[DFG] Introduce {Set,Map,WeakMap}Fields
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 27 Nov 2017 01:46:59 +0000 (01:46 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 27 Nov 2017 01:46:59 +0000 (01:46 +0000)
commitade7566bab9cf03a31799ad4fb83b72e102abec9
treebced220afc835983596ea1b5793c24e429b3b981
parent80282df1b3852a12ab3579b0c3f70ee7da45bcbd
[DFG] Introduce {Set,Map,WeakMap}Fields
https://bugs.webkit.org/show_bug.cgi?id=179925

Reviewed by Saam Barati.

JSTests:

* stress/map-set-clobber-map-get.js: Added.
(shouldBe):
(test):
* stress/map-set-does-not-clobber-set-has.js: Added.
(shouldBe):
* stress/map-set-does-not-clobber-weak-map-get.js: Added.
(shouldBe):
(test):
* stress/set-add-clobber-set-has.js: Added.
(shouldBe):
* stress/set-add-does-not-clobber-map-get.js: Added.
(shouldBe):

Source/JavaScriptCore:

SetAdd and MapSet uses `write(MiscFields)`, but it is not correct. It accidentally
writes readonly MiscFields which is used by various nodes and make optimization
conservative.

We introduce JSSetFields, JSMapFields, and JSWeakMapFields to precisely model clobberizing of Map, Set, and WeakMap.

* dfg/DFGAbstractHeap.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGNode.h:
(JSC::DFG::Node::hasBucketOwnerType):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225151 268f45cc-cd09-0410-ab3c-d52691b4dbfc
13 files changed:
JSTests/ChangeLog
JSTests/stress/map-set-clobber-map-get.js [new file with mode: 0644]
JSTests/stress/map-set-does-not-clobber-set-has.js [new file with mode: 0644]
JSTests/stress/map-set-does-not-clobber-weak-map-get.js [new file with mode: 0644]
JSTests/stress/set-add-clobber-set-has.js [new file with mode: 0644]
JSTests/stress/set-add-does-not-clobber-map-get.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractHeap.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGHeapLocation.cpp
Source/JavaScriptCore/dfg/DFGHeapLocation.h
Source/JavaScriptCore/dfg/DFGNode.h