Throwing an exception in the DFG/FTL should not cause a jettison
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 Sep 2017 05:41:08 +0000 (05:41 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 Sep 2017 05:41:08 +0000 (05:41 +0000)
commita954415cfaa0e32f5b7962091abf7a9d3b77d3ef
tree01d8ba23851e5e4ba190c5594bfbc57cc108297f
parent58566b5af4b6f7a07318e8853cc4ee173ed3d6c0
Throwing an exception in the DFG/FTL should not cause a jettison
https://bugs.webkit.org/show_bug.cgi?id=176060
<rdar://problem/34143348>

Reviewed by Keith Miller.

Throwing an exception is not something that should be a jettison-able
OSR exit. We used to count Throw/ThrowStaticError towards our OSR exit
counts which could cause a CodeBlock to jettison and recompile. This
was dumb. Throwing an exception is not a reason to jettison and
recompile in the way that a speculation failure is. This patch
treats Throw/ThrowStaticError as true terminals in DFG IR.

* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
* dfg/DFGNode.h:
(JSC::DFG::Node::isTerminal):
(JSC::DFG::Node::isPseudoTerminal):
(JSC::DFG::Node::errorType):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileThrow):
(JSC::DFG::SpeculativeJIT::compileThrowStaticError):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileThrow):
(JSC::FTL::DFG::LowerDFGToB3::compileThrowStaticError):
* jit/JITOperations.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221472 268f45cc-cd09-0410-ab3c-d52691b4dbfc
18 files changed:
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/BytecodeUseDef.h
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp
Source/JavaScriptCore/dfg/DFGNode.h
Source/JavaScriptCore/dfg/DFGNodeType.h
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Source/JavaScriptCore/jit/JITOperations.h