Regression(r191815): 5.3% regression on Dromaeo JS Library Benchmark
authorkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 11 Nov 2015 21:34:57 +0000 (21:34 +0000)
committerkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 11 Nov 2015 21:34:57 +0000 (21:34 +0000)
commita93ceb5fe24d0fc3e30b4e4912b65f4f0df932df
treea2c1fbd3efafca428135ec4dc3ccd8c1061bd31a
parent35959a9efd4fb0002a518dc8ef8f2d5cca7ac98f
Regression(r191815): 5.3% regression on Dromaeo JS Library Benchmark
https://bugs.webkit.org/show_bug.cgi?id=150945

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch fixes a performance regression introduced by r191815. Before adding Symbol.toStringTag
we would cache the value of Object.prototype.toString() in the rareData of the structure.
In order to cache the result of Object.prototype.toString() we now need to ensure that the
value stored in Symbol.toStringTag is a known constant. Thus, in order to ensure the stored Symbol.toStringTag
value remains constant adaptive inferred value watchpoints have been re-factored to be generalizable and
a new version that clears the toString value cache when fired has been added.

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp.
(JSC::AdaptiveInferredPropertyValueWatchpointBase::AdaptiveInferredPropertyValueWatchpointBase):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::install):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::fireInternal):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::fireInternal):
* bytecode/AdaptiveInferredPropertyValueWatchpointBase.h: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h.
(JSC::AdaptiveInferredPropertyValueWatchpointBase::key):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::StructureWatchpoint):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::PropertyWatchpoint):
* dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::handleFire):
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::install): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::fireInternal): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::fireInternal): Deleted.
* dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::key): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::StructureWatchpoint): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::PropertyWatchpoint): Deleted.
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncToString):
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::setObjectToStringValue):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::StructureRareData):
(JSC::StructureRareData::setObjectToStringValue):
(JSC::StructureRareData::clearObjectToStringValue):
(JSC::ObjectToStringAdaptiveStructureWatchpoint::ObjectToStringAdaptiveStructureWatchpoint):
(JSC::ObjectToStringAdaptiveStructureWatchpoint::install):
(JSC::ObjectToStringAdaptiveStructureWatchpoint::fireInternal):
(JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::ObjectToStringAdaptiveInferredPropertyValueWatchpoint):
(JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::handleFire):
* runtime/StructureRareData.h:
* runtime/StructureRareDataInlines.h:
(JSC::StructureRareData::setObjectToStringValue): Deleted.
* tests/stress/symbol-tostringtag-watchpoints.js: Added.
(Base):

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp.
(JSC::AdaptiveInferredPropertyValueWatchpointBase::AdaptiveInferredPropertyValueWatchpointBase):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::install):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::fireInternal):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::fireInternal):
* bytecode/AdaptiveInferredPropertyValueWatchpointBase.h: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h.
(JSC::AdaptiveInferredPropertyValueWatchpointBase::key):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::StructureWatchpoint):
(JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::PropertyWatchpoint):
* dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::handleFire):
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::install): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::fireInternal): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::fireInternal): Deleted.
* dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::key): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::StructureWatchpoint): Deleted.
(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::PropertyWatchpoint): Deleted.
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncToString):
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::setObjectToStringValue):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::StructureRareData):
(JSC::StructureRareData::setObjectToStringValue):
(JSC::StructureRareData::clearObjectToStringValue):
(JSC::ObjectToStringAdaptiveStructureWatchpoint::ObjectToStringAdaptiveStructureWatchpoint):
(JSC::ObjectToStringAdaptiveStructureWatchpoint::install):
(JSC::ObjectToStringAdaptiveStructureWatchpoint::fireInternal):
(JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::ObjectToStringAdaptiveInferredPropertyValueWatchpoint):
(JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::handleFire):
* runtime/StructureRareData.h:
* runtime/StructureRareDataInlines.h:
(JSC::StructureRareData::setObjectToStringValue): Deleted.
* tests/stress/symbol-tostringtag-watchpoints.js: Added.
(Base):

LayoutTests:

Added a preformance regression test that checks the speed of Symbol.toStringTag.
The change to cross-origin-replace-history-object-child-expected.txt is a
result of the toString value being cached.

* http/tests/history/cross-origin-replace-history-object-child-expected.txt:
* js/regress/script-tests/symbol-tostringtag.js: Added.
(buildChain):
(body):
* js/regress/symbol-tostringtag-expected.txt: Added.
* js/regress/symbol-tostringtag.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@192321 268f45cc-cd09-0410-ab3c-d52691b4dbfc
19 files changed:
LayoutTests/ChangeLog
LayoutTests/http/tests/history/cross-origin-replace-history-object-child-expected.txt
LayoutTests/js/regress/script-tests/symbol-tostringtag.js [new file with mode: 0644]
LayoutTests/js/regress/symbol-tostringtag-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/symbol-tostringtag.html [new file with mode: 0644]
Source/JavaScriptCore/CMakeLists.txt
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
Source/JavaScriptCore/bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp [new file with mode: 0644]
Source/JavaScriptCore/bytecode/AdaptiveInferredPropertyValueWatchpointBase.h [new file with mode: 0644]
Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp
Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h
Source/JavaScriptCore/runtime/ObjectPrototype.cpp
Source/JavaScriptCore/runtime/Structure.h
Source/JavaScriptCore/runtime/StructureInlines.h
Source/JavaScriptCore/runtime/StructureRareData.cpp
Source/JavaScriptCore/runtime/StructureRareData.h
Source/JavaScriptCore/runtime/StructureRareDataInlines.h
Source/JavaScriptCore/tests/stress/symbol-tostringtag-watchpoints.js [new file with mode: 0644]