Changeset 231990 in webkit for trunk/Source/JavaScriptCore/bytecode/ArrayProfile.h

Timestamp:

May 18, 2018, 4:16:09 PM (7 years ago)

Author:

[email protected]

Message:

op_in should mark if it sees out of bounds accesses
​https://bugs.webkit.org/show_bug.cgi?id=185792

Reviewed by Filip Pizlo.

JSTests:

• stress/has-indexed-property-array-storage-ftl.js:

(test2):

• stress/has-indexed-property-slow-put-array-storage-ftl.js:

(test2):

Source/JavaScriptCore:

This would used to cause us to OSR loop since we would always speculate
we were in bounds in HasIndexedProperty.

• bytecode/ArrayProfile.cpp:

(JSC::ArrayProfile::observeIndexedRead):

• bytecode/ArrayProfile.h:
• runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::opIn):

File:

• trunk/Source/JavaScriptCore/bytecode/ArrayProfile.h (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecode/ArrayProfile.h

@@ -215 +215 @@
         m_lastSeenStructureID = structure->id();
     }
-    
+
     void computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock*);
     void computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock*, Structure* lastSeenStructure);
     
     void observeArrayMode(ArrayModes mode) { m_observedArrayModes |= mode; }
+    void observeIndexedRead(VM&, JSCell*, unsigned index);
+
     ArrayModes observedArrayModes(const ConcurrentJSLocker&) const { return m_observedArrayModes; }
     bool mayInterceptIndexedAccesses(const ConcurrentJSLocker&) const { return m_mayInterceptIndexedAccesses; }