REGRESSION: 2x regression on Dromaeo DOM query tests
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 16 Dec 2013 05:56:25 +0000 (05:56 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 16 Dec 2013 05:56:25 +0000 (05:56 +0000)
commit77665861ac0742dd7fc4de962338166ee2c6494d
treef38a449b73ae65792a59ee2c8268991fdf0d70ac
parent9c88328c83749f667d67e7a85eee1146d41f83ce
REGRESSION: 2x regression on Dromaeo DOM query tests
https://bugs.webkit.org/show_bug.cgi?id=125377

Reviewed by Filip Pizlo.

PerformanceTests:

Added a micro-benchmark for updating a named property on document.

* Bindings/update-name-getter.html: Added.
* Skipped:

Source/JavaScriptCore:

The bug was caused by JSC not JIT'ing property access on "document" due to its type info having
HasImpureGetOwnPropertySlot flag.

Fixed the bug by new type info flag NewImpurePropertyFiresWatchpoints, which allows the baseline
JIT to generate byte code for access properties on an object with named properties (a.k.a.
custom name getter) in DOM. When a new named property appears on the object, VM is notified via
VM::addImpureProperty and fires StructureStubClearingWatchpoint added during the repatch.

* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFromLLInt): Take the slow path if we have any object with impure
properties in the prototype chain.
(JSC::GetByIdStatus::computeForChain): Ditto.

* jit/Repatch.cpp:
(JSC::repatchByIdSelfAccess): Throw away the byte code when a new impure property is added on any
object in the prototype chain via StructureStubClearingWatchpoint.
(JSC::generateProtoChainAccessStub): Ditto.
(JSC::tryCacheGetByID):
(JSC::tryBuildGetByIDList):
(JSC::tryRepatchIn): Ditto.

* runtime/JSTypeInfo.h: Added NewImpurePropertyFiresWatchpoints.
(JSC::TypeInfo::newImpurePropertyFiresWatchpoints): Added.

* runtime/Operations.h:
(JSC::normalizePrototypeChainForChainAccess): Don't exit early if VM will be notified of new
impure property even if the object had impure properties.

* runtime/Structure.h:
(JSC::Structure::takesSlowPathInDFGForImpureProperty): Added. Wraps hasImpureGetOwnPropertySlot and
asserts that newImpurePropertyFiresWatchpoints is true whenever hasImpureGetOwnPropertySlot is true.

* runtime/VM.cpp:
(JSC::VM::registerWatchpointForImpureProperty): Added.
(JSC::VM::addImpureProperty): Added. HTMLDocument calls it to notify JSC of a new impure property.

* runtime/VM.h:

Source/WebCore:

The bug was caused by JSC not JIT'ing property accesses on document because of its having
custom named getter (named properties).  This resulted in resolution of methods on document
such as getElementById to happen inside the interpreter.

Fixed the bug by using the new JSC type info flag which tells JSC to JIT property access on
document, and then notifying JSC whenever a new named property appeared on document.

Tests: js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html
       js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html
       js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html
       js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html
       js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html
       js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html

* bindings/js/JSDOMBinding.cpp:
(WebCore::addImpureProperty): Wraps VM::addImpureProperty.
* bindings/js/JSDOMBinding.h:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader): Added the support for NewImpurePropertyFiresWatchpoints.
* bindings/scripts/IDLAttributes.txt: Ditto.
* html/HTMLDocument.cpp:
(WebCore::HTMLDocument::addDocumentNamedItem): Calls addImpureProperty.
* html/HTMLDocument.idl: Added NewImpurePropertyFiresWatchpoints.

LayoutTests:

Added more regression tests for throwing away byte code when a new named property appears.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-expected: Rebaselined.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.html: Fixed the test to use dfgShouldBe.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added.
* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added.
* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added.
* js/dom/script-tests/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.js: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@160628 268f45cc-cd09-0410-ab3c-d52691b4dbfc
38 files changed:
LayoutTests/ChangeLog
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html [new file with mode: 0644]
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-expected.txt
LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.html
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html [new file with mode: 0644]
LayoutTests/js/dom/script-tests/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.js [deleted file]
PerformanceTests/Bindings/update-name-getter.html [new file with mode: 0644]
PerformanceTests/ChangeLog
PerformanceTests/Skipped
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
Source/JavaScriptCore/jit/Repatch.cpp
Source/JavaScriptCore/runtime/JSTypeInfo.h
Source/JavaScriptCore/runtime/Operations.h
Source/JavaScriptCore/runtime/Structure.h
Source/JavaScriptCore/runtime/VM.cpp
Source/JavaScriptCore/runtime/VM.h
Source/WebCore/ChangeLog
Source/WebCore/bindings/js/JSDOMBinding.cpp
Source/WebCore/bindings/js/JSDOMBinding.h
Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
Source/WebCore/bindings/scripts/IDLAttributes.txt
Source/WebCore/html/HTMLDocument.cpp
Source/WebCore/html/HTMLDocument.idl