[JSC] Record CoW status in ArrayProfile correctly
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 27 Jul 2018 22:27:10 +0000 (22:27 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 27 Jul 2018 22:27:10 +0000 (22:27 +0000)
commit86c03a34c80e687ba93e7e3a6c805e849e5652d4
treeea351ffdeaa34c39e4e7390cee37b43cb0016eba
parent1b008695c2ccafddda7dc6d16317fc5f4c670448
[JSC] Record CoW status in ArrayProfile correctly
https://bugs.webkit.org/show_bug.cgi?id=187949

Reviewed by Saam Barati.

JSTests:

* stress/array-profile-should-record-copy-on-write.js: Added.
(shouldBe):
(test1):
(test2):
(test3):

Source/JavaScriptCore:

In this patch, we simplify asArrayModes: just shifting the value with IndexingMode.
This is important since our OSR exit compiler records m_observedArrayModes by calculating
ArrayModes with shifting. Since ArrayModes for CoW arrays are incorrectly calculated,
our OSR exit compiler records incorrect results in ArrayProfile. And it leads to
Array::Generic DFG nodes.

* bytecode/ArrayProfile.h:
(JSC::asArrayModes):
(JSC::ArrayProfile::ArrayProfile):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileExit):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* runtime/IndexingType.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234331 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/array-profile-should-record-copy-on-write.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/ArrayProfile.h
Source/JavaScriptCore/dfg/DFGOSRExit.cpp
Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
Source/JavaScriptCore/runtime/IndexingType.h