Title: [172120] trunk
Revision
172120
Author
commit-qu...@webkit.org
Date
2014-08-05 19:30:22 -0700 (Tue, 05 Aug 2014)

Log Message

Unreviewed, rolling out r172099.
https://bugs.webkit.org/show_bug.cgi?id=135635

Needs a do-over. (Requested by kling on #webkit).

Reverted changeset:

"The JIT should cache property lookup misses."
https://bugs.webkit.org/show_bug.cgi?id=135578
http://trac.webkit.org/changeset/172099

Modified Paths

Removed Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (172119 => 172120)


--- trunk/LayoutTests/ChangeLog	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/LayoutTests/ChangeLog	2014-08-06 02:30:22 UTC (rev 172120)
@@ -1,3 +1,16 @@
+2014-08-05  Commit Queue  <commit-qu...@webkit.org>
+
+        Unreviewed, rolling out r172099.
+        https://bugs.webkit.org/show_bug.cgi?id=135635
+
+        Needs a do-over. (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "The JIT should cache property lookup misses."
+        https://bugs.webkit.org/show_bug.cgi?id=135578
+        http://trac.webkit.org/changeset/172099
+
 2014-08-05  Nikos Andronikos  <nikos.andronikos-web...@cisra.canon.com.au>
 
         [CG] strokeRect does not honor lineJoin

Deleted: trunk/LayoutTests/js/regress/script-tests/undefined-property-access.js (172119 => 172120)


--- trunk/LayoutTests/js/regress/script-tests/undefined-property-access.js	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/LayoutTests/js/regress/script-tests/undefined-property-access.js	2014-08-06 02:30:22 UTC (rev 172120)
@@ -1,9 +0,0 @@
-someGlobal = 0;
-
-function foo() {
-    var myObject = {};
-    for (var i = 0; i < 10000000; ++i) {
-        someGlobal = myObject.undefinedProperty;
-    }
-}
-foo();

Deleted: trunk/LayoutTests/js/regress/undefined-property-access-expected.txt (172119 => 172120)


--- trunk/LayoutTests/js/regress/undefined-property-access-expected.txt	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/LayoutTests/js/regress/undefined-property-access-expected.txt	2014-08-06 02:30:22 UTC (rev 172120)
@@ -1,10 +0,0 @@
-JSRegress/undefined-property-access
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-

Deleted: trunk/LayoutTests/js/regress/undefined-property-access.html (172119 => 172120)


--- trunk/LayoutTests/js/regress/undefined-property-access.html	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/LayoutTests/js/regress/undefined-property-access.html	2014-08-06 02:30:22 UTC (rev 172120)
@@ -1,12 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src=""
-</head>
-<body>
-<script src=""
-<script src=""
-<script src=""
-<script src=""
-</body>
-</html>

Modified: trunk/Source/_javascript_Core/ChangeLog (172119 => 172120)


--- trunk/Source/_javascript_Core/ChangeLog	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/Source/_javascript_Core/ChangeLog	2014-08-06 02:30:22 UTC (rev 172120)
@@ -1,3 +1,16 @@
+2014-08-05  Commit Queue  <commit-qu...@webkit.org>
+
+        Unreviewed, rolling out r172099.
+        https://bugs.webkit.org/show_bug.cgi?id=135635
+
+        Needs a do-over. (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "The JIT should cache property lookup misses."
+        https://bugs.webkit.org/show_bug.cgi?id=135578
+        http://trac.webkit.org/changeset/172099
+
 2014-08-05  Przemyslaw Kuczynski  <p.kuczyn...@samsung.com>
 
         Fix resource leak of unclosed file descriptor.

Modified: trunk/Source/_javascript_Core/jit/Repatch.cpp (172119 => 172120)


--- trunk/Source/_javascript_Core/jit/Repatch.cpp	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/Source/_javascript_Core/jit/Repatch.cpp	2014-08-06 02:30:22 UTC (rev 172120)
@@ -52,8 +52,6 @@
 
 namespace JSC {
 
-static void patchJumpToGetByIdStub(CodeBlock*, StructureStubInfo&, JITStubRoutine*);
-
 // Beware: in this code, it is not safe to assume anything about the following registers
 // that would ordinarily have well-known values:
 // - tagTypeNumberRegister
@@ -228,7 +226,6 @@
 
 enum ByIdStubKind {
     GetValue,
-    GetUndefined,
     CallGetter,
     CallCustomGetter,
     CallSetter,
@@ -240,8 +237,6 @@
     switch (kind) {
     case GetValue:
         return "GetValue";
-    case GetUndefined:
-        return "GetUndefined";
     case CallGetter:
         return "CallGetter";
     case CallCustomGetter:
@@ -260,8 +255,6 @@
 {
     if (slot.isCacheableValue())
         return GetValue;
-    if (slot.isUnset())
-        return GetUndefined;
     if (slot.isCacheableCustom())
         return CallCustomGetter;
     RELEASE_ASSERT(slot.isCacheableGetter());
@@ -306,7 +299,7 @@
         static_cast<GPRReg>(stubInfo.patch.valueGPR));
     GPRReg scratchGPR = TempRegisterSet(stubInfo.patch.usedRegisters).getFreeGPR();
     bool needToRestoreScratch = scratchGPR == InvalidGPRReg;
-    RELEASE_ASSERT(!needToRestoreScratch || (kind == GetValue || kind == GetUndefined));
+    RELEASE_ASSERT(!needToRestoreScratch || kind == GetValue);
     
     CCallHelpers stubJit(&exec->vm(), exec->codeBlock());
     if (needToRestoreScratch) {
@@ -364,28 +357,24 @@
         }
     }
     
-    GPRReg baseForAccessGPR = InvalidGPRReg;
-    if (kind != GetUndefined) {
-        if (chain) {
-            // We could have clobbered scratchGPR earlier, so we have to reload from baseGPR to get the target.
-            if (loadTargetFromProxy)
-                stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSProxy::targetOffset()), baseForGetGPR);
-            stubJit.move(MacroAssembler::TrustedImmPtr(protoObject), scratchGPR);
-            baseForAccessGPR = scratchGPR;
-        } else {
-            // For proxy objects, we need to do all the Structure checks before moving the baseGPR into
-            // baseForGetGPR because if we fail any of the checks then we would have the wrong value in baseGPR
-            // on the slow path.
-            if (loadTargetFromProxy)
-                stubJit.move(scratchGPR, baseForGetGPR);
-            baseForAccessGPR = baseForGetGPR;
-        }
+    GPRReg baseForAccessGPR;
+    if (chain) {
+        // We could have clobbered scratchGPR earlier, so we have to reload from baseGPR to get the target.
+        if (loadTargetFromProxy)
+            stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSProxy::targetOffset()), baseForGetGPR);
+        stubJit.move(MacroAssembler::TrustedImmPtr(protoObject), scratchGPR);
+        baseForAccessGPR = scratchGPR;
+    } else {
+        // For proxy objects, we need to do all the Structure checks before moving the baseGPR into 
+        // baseForGetGPR because if we fail any of the checks then we would have the wrong value in baseGPR
+        // on the slow path.
+        if (loadTargetFromProxy)
+            stubJit.move(scratchGPR, baseForGetGPR);
+        baseForAccessGPR = baseForGetGPR;
     }
 
     GPRReg loadedValueGPR = InvalidGPRReg;
-    if (kind == GetUndefined)
-        stubJit.moveTrustedValue(jsUndefined(), valueRegs);
-    else if (kind != CallCustomGetter && kind != CallCustomSetter) {
+    if (kind != CallCustomGetter && kind != CallCustomSetter) {
         if (kind == GetValue)
             loadedValueGPR = valueRegs.payloadGPR();
         else
@@ -419,7 +408,7 @@
     std::unique_ptr<CallLinkInfo> callLinkInfo;
 
     MacroAssembler::Jump success, fail;
-    if (kind != GetValue && kind != GetUndefined) {
+    if (kind != GetValue) {
         // Need to make sure that whenever this call is made in the future, we remember the
         // place that we made it from. It just so happens to be the place that we are at
         // right now!
@@ -740,46 +729,15 @@
     // FIXME: Cache property access for immediates.
     if (!baseValue.isCell())
         return GiveUpOnCache;
-
-    if (!slot.isCacheable() && !slot.isUnset())
-        return GiveUpOnCache;
-
     JSCell* baseCell = baseValue.asCell();
     Structure* structure = baseCell->structure();
+    if (!slot.isCacheable())
+        return GiveUpOnCache;
 
     InlineCacheAction action = "" baseCell);
     if (action != AttemptToCache)
         return action;
 
-    if (slot.isUnset()) {
-        // Property lookup miss - let's try to cache that.
-        size_t count = normalizePrototypeChain(exec, baseCell);
-        if (count == InvalidPrototypeChain)
-            return GiveUpOnCache;
-        StructureChain* prototypeChain = structure->prototypeChain(exec);
-        PolymorphicGetByIdList* list = PolymorphicGetByIdList::from(stubInfo);
-        if (list->isFull()) {
-            // We need this extra check because of recursion.
-            return GiveUpOnCache;
-        }
-
-        RefPtr<JITStubRoutine> stubRoutine;
-        generateByIdStub(
-            exec, GetUndefined, propertyName, FunctionPtr(), stubInfo, prototypeChain, count, invalidOffset,
-            structure, false, nullptr,
-            stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone),
-            CodeLocationLabel(list->currentSlowPathTarget(stubInfo)), stubRoutine);
-
-        list->addAccess(GetByIdAccess(
-            *vm, codeBlock->ownerExecutable(),
-            GetByIdAccess::SimpleInline,
-            stubRoutine, structure, prototypeChain, count));
-
-        patchJumpToGetByIdStub(codeBlock, stubInfo, stubRoutine.get());
-
-        return list->isFull() ? GiveUpOnCache : RetryCacheLater;
-    }
-
     // Optimize self access.
     if (slot.slotBase() == baseValue
         && slot.isCacheableValue()
@@ -802,7 +760,7 @@
         repatchCall(exec->codeBlock(), stubInfo.callReturnLocation, operationGetById);
 }
 
-void patchJumpToGetByIdStub(CodeBlock* codeBlock, StructureStubInfo& stubInfo, JITStubRoutine* stubRoutine)
+static void patchJumpToGetByIdStub(CodeBlock* codeBlock, StructureStubInfo& stubInfo, JITStubRoutine* stubRoutine)
 {
     RELEASE_ASSERT(stubInfo.accessType == access_get_by_id_list);
     RepatchBuffer repatchBuffer(codeBlock);

Modified: trunk/Source/_javascript_Core/runtime/PropertySlot.h (172119 => 172120)


--- trunk/Source/_javascript_Core/runtime/PropertySlot.h	2014-08-06 02:19:40 UTC (rev 172119)
+++ trunk/Source/_javascript_Core/runtime/PropertySlot.h	2014-08-06 02:30:22 UTC (rev 172120)
@@ -78,7 +78,6 @@
     JSValue getValue(ExecState*, unsigned propertyName) const;
 
     bool isCacheable() const { return m_cacheability == CachingAllowed && m_offset != invalidOffset; }
-    bool isUnset() const { return m_propertyType == TypeUnset; }
     bool isValue() const { return m_propertyType == TypeValue; }
     bool isAccessor() const { return m_propertyType == TypeGetter; }
     bool isCustom() const { return m_propertyType == TypeCustom; }
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to