Changeset 180703 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

Timestamp:

Feb 26, 2015, 2:44:45 PM (10 years ago)

Author:

[email protected]

Message:

Various array access corner cases should take OSR exit feedback
​https://bugs.webkit.org/show_bug.cgi?id=142056

Reviewed by Geoffrey Garen.
Source/JavaScriptCore:

Two major changes here:

• Don't keep converting GetById into GetArrayLength if we exited due to any kind of array type check.

• Use a generic form of GetByVal/PutByVal if we exited due to any kind of exotic checks, like the Arguments safety checks. We use the "ExoticObjectMode" for out-of-bounds on arguments for now, since it's a convenient way of forcing out-of-bounds to be handled by the Generic array mode.

• bytecode/ExitKind.cpp:

(JSC::exitKindToString):

• bytecode/ExitKind.h:
• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
(JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):

• tests/stress/array-length-array-storage-plain-object.js: Added.

(foo):

• tests/stress/array-length-plain-object.js: Added.

(foo):

LayoutTests:

• js/regress/arguments-out-of-bounds-expected.txt: Added.
• js/regress/arguments-out-of-bounds.html: Added.
• js/regress/exit-length-on-plain-object-expected.txt: Added.
• js/regress/exit-length-on-plain-object.html: Added.
• js/regress/script-tests/arguments-out-of-bounds.js: Added.

(foo):
(bar):

• js/regress/script-tests/exit-length-on-plain-object.js: Added.

(foo):

• js/regress/script-tests/string-out-of-bounds.js: Added.

(bar):

• js/regress/string-out-of-bounds-expected.txt: Added.
• js/regress/string-out-of-bounds.html: Added.

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -146 +146 @@
     
     if (!isInt32Speculation(index))
+        return ArrayMode(Array::Generic);
+    
+    // If we had exited because of an exotic object behavior, then don't try to specialize.
+    if (graph.hasExitSite(node->origin.semantic, ExoticObjectMode))
         return ArrayMode(Array::Generic);