Title: [225834] trunk
- Revision
- 225834
- Author
- sbar...@apple.com
- Date
- 2017-12-12 19:04:22 -0800 (Tue, 12 Dec 2017)
Log Message
We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
https://bugs.webkit.org/show_bug.cgi?id=180725
<rdar://problem/35970511>
Reviewed by Michael Saboff.
JSTests:
* stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
(f1):
(f2):
(let.o2.valueOf):
Source/_javascript_Core:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGPreciseLocalClobberize.h:
(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (225833 => 225834)
--- trunk/JSTests/ChangeLog 2017-12-13 02:52:43 UTC (rev 225833)
+++ trunk/JSTests/ChangeLog 2017-12-13 03:04:22 UTC (rev 225834)
@@ -1,3 +1,16 @@
+2017-12-12 Saam Barati <sbar...@apple.com>
+
+ We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
+ https://bugs.webkit.org/show_bug.cgi?id=180725
+ <rdar://problem/35970511>
+
+ Reviewed by Michael Saboff.
+
+ * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
+ (f1):
+ (f2):
+ (let.o2.valueOf):
+
2017-12-12 Yusuke Suzuki <utatane....@gmail.com>
[JSC] Implement optimized WeakMap and WeakSet
Added: trunk/JSTests/stress/model-effects-properly-of-spread-over-phantom-create-rest.js (0 => 225834)
--- trunk/JSTests/stress/model-effects-properly-of-spread-over-phantom-create-rest.js (rev 0)
+++ trunk/JSTests/stress/model-effects-properly-of-spread-over-phantom-create-rest.js 2017-12-13 03:04:22 UTC (rev 225834)
@@ -0,0 +1,25 @@
+"use strict";
+function f1(o) {
+ let result = [];
+ for (let key of Object.getOwnPropertyNames(o)) {
+ result.push(key)
+ }
+ return result;
+}
+function f2(a1, a2, ...args) {
+ let r = f1(a1);
+ let index = r[a2 % r.length];
+ a1[index](...args)
+}
+let theObj = {};
+let o2 = {
+ valueOf: function (a, b) {
+ a === 42
+ b === theObj
+ try {} catch (e) {}
+ }
+};
+for (let i = 0; i < 1e5; ++i) {
+ for (let j = 0; j < 100; j++) {}
+ f2(o2, 897989, 42, theObj);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (225833 => 225834)
--- trunk/Source/_javascript_Core/ChangeLog 2017-12-13 02:52:43 UTC (rev 225833)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-12-13 03:04:22 UTC (rev 225834)
@@ -1,3 +1,16 @@
+2017-12-12 Saam Barati <sbar...@apple.com>
+
+ We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
+ https://bugs.webkit.org/show_bug.cgi?id=180725
+ <rdar://problem/35970511>
+
+ Reviewed by Michael Saboff.
+
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGPreciseLocalClobberize.h:
+ (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+
2017-12-12 Yusuke Suzuki <utatane....@gmail.com>
[JSC] Implement optimized WeakMap and WeakSet
Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (225833 => 225834)
--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2017-12-13 02:52:43 UTC (rev 225833)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2017-12-13 03:04:22 UTC (rev 225834)
@@ -1312,6 +1312,9 @@
}
case Spread: {
+ if (node->child1()->op() == PhantomCreateRest)
+ read(Stack);
+
if (node->child1().useKind() == ArrayUse) {
// FIXME: We can probably CSE these together, but we need to construct the right rules
// to prove that nobody writes to child1() in between two Spreads: https://bugs.webkit.org/show_bug.cgi?id=164531
Modified: trunk/Source/_javascript_Core/dfg/DFGPreciseLocalClobberize.h (225833 => 225834)
--- trunk/Source/_javascript_Core/dfg/DFGPreciseLocalClobberize.h 2017-12-13 02:52:43 UTC (rev 225833)
+++ trunk/Source/_javascript_Core/dfg/DFGPreciseLocalClobberize.h 2017-12-13 03:04:22 UTC (rev 225834)
@@ -120,8 +120,8 @@
m_read(VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
};
- auto readPhantomSpreadNode = [&] (Node* spread) {
- ASSERT(spread->op() == PhantomSpread);
+ auto readSpreadOfPhantomCreateRest = [&] (Node* spread) {
+ ASSERT(spread->op() == Spread || spread->op() == PhantomSpread);
ASSERT(spread->child1()->op() == PhantomCreateRest);
InlineCallFrame* inlineCallFrame = spread->child1()->origin.semantic.inlineCallFrame;
unsigned numberOfArgumentsToSkip = spread->child1()->numberOfArgumentsToSkip();
@@ -135,7 +135,7 @@
if (bitVector->get(i)) {
Node* child = m_graph.varArgChild(arrayWithSpread, i).node();
if (child->op() == PhantomSpread)
- readPhantomSpreadNode(child);
+ readSpreadOfPhantomCreateRest(child);
}
}
};
@@ -181,7 +181,7 @@
if (m_node->argumentsChild()->op() == PhantomNewArrayWithSpread)
readNewArrayWithSpreadNode(m_node->argumentsChild().node());
else
- readPhantomSpreadNode(m_node->argumentsChild().node());
+ readSpreadOfPhantomCreateRest(m_node->argumentsChild().node());
} else {
InlineCallFrame* inlineCallFrame;
if (m_node->hasArgumentsChild() && m_node->argumentsChild())
@@ -203,6 +203,11 @@
break;
}
+ case Spread:
+ if (m_node->child1()->op() == PhantomCreateRest)
+ readSpreadOfPhantomCreateRest(m_node);
+ break;
+
case NewArrayWithSpread: {
readNewArrayWithSpreadNode(m_node);
break;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
