Changeset 284726 in webkit for trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

Timestamp:

Oct 22, 2021, 4:31:08 PM (4 years ago)

Author:

Justin Michaud

Message:

Fix nits from 232019
​https://bugs.webkit.org/show_bug.cgi?id=232180

Reviewed by Saam Barati.

We only need one write barrier, since we only need to guarantee that we read the status of the write barrier before we read from the structure cache.
If we are delayed in watching the watchpoint, it does not change any of the interleavings.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

File:

• trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -840 +840 @@
                         // Having a bad time clears the structureCache, and so it should invalidate this structure.
                         bool isHavingABadTime = globalObject->isHavingABadTime();
-                        WTF::loadLoadFence();
-                        if (!isHavingABadTime)
-                            m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
                         // Normally, we would always install a watchpoint. In this case, however, if we haveABadTime, we
                         // still want to optimize. There is no watchpoint for that case though, so we need to make sure this load
                         // does not get hoisted above the check.
                         WTF::loadLoadFence();
-                        structure = globalObject->vm().structureCache
-                            .emptyObjectStructureConcurrently(globalObject, base.getObject(), JSFinalObject::defaultInlineCapacity());
+                        if (!isHavingABadTime)
+                            m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
+                        structure = globalObject->vm().structureCache.emptyObjectStructureConcurrently(globalObject, base.getObject(), JSFinalObject::defaultInlineCapacity());
                     }