git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (from parent 1: dd8bec6)
DFG optimizes out strict mode arguments tear off
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 17 Aug 2013 05:36:32 +0000 (05:36 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 17 Aug 2013 05:36:32 +0000 (05:36 +0000)
https://bugs.webkit.org/show_bug.cgi?id=119504

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg and Oliver Hunt.

Don't do the optimization for strict mode.

* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
(JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations):

LayoutTests:

Reviewed by Mark Hahnenberg and Oliver Hunt.

* fast/js/dfg-arguments-strict-mode-expected.txt: Added.
* fast/js/dfg-arguments-strict-mode.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-arguments-strict-mode.js: Added.
(f):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@154217 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/js/dfg-arguments-strict-mode.html [new file with mode: 0644] patch | blob
LayoutTests/fast/js/jsc-test-list patch | blob | history
LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js [new file with mode: 0644] patch | blob
Source/JavaScriptCore/ChangeLog patch | blob | history
Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index cc04a3e..aed2417 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2013-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG optimizes out strict mode arguments tear off
+        https://bugs.webkit.org/show_bug.cgi?id=119504
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+
+        * fast/js/dfg-arguments-strict-mode-expected.txt: Added.
+        * fast/js/dfg-arguments-strict-mode.html: Added.
+        * fast/js/jsc-test-list:
+        * fast/js/script-tests/dfg-arguments-strict-mode.js: Added.
+        (f):
+
 2013-08-16  Ryosuke Niwa  <rniwa@webkit.org>
 
         <https://webkit.org/b/119915> REGRESSION(r154144): ASSERTION FAILED: m_history->provisionalItem() == m_requestedHistoryItem.get()
diff --git a/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt b/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt
new file mode 100644 (file)
index 0000000..5c91f7a
--- /dev/null
+++ b/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt
@@ -0,0 +1,10 @@
+Tests what happens when you use arguments in strict mode and present the DFG with a tempting optimization opportunity.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS f(1) is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/dfg-arguments-strict-mode.html b/LayoutTests/fast/js/dfg-arguments-strict-mode.html
new file mode 100644 (file)
index 0000000..153264d
--- /dev/null
+++ b/LayoutTests/fast/js/dfg-arguments-strict-mode.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/dfg-arguments-strict-mode.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/jsc-test-list b/LayoutTests/fast/js/jsc-test-list
index 4744813..8c2bbe1 100644 (file)
--- a/LayoutTests/fast/js/jsc-test-list
+++ b/LayoutTests/fast/js/jsc-test-list
@@ -86,6 +86,7 @@ fast/js/dfg-arguments-osr-exit
 fast/js/dfg-arguments-osr-exit-multiple-blocks
 fast/js/dfg-arguments-osr-exit-multiple-blocks-before-exit
 fast/js/dfg-arguments-out-of-bounds
+fast/js/dfg-arguments-strict-mode
 fast/js/dfg-arguments-unexpected-escape
 fast/js/dfg-arith-add-overflow-check-elimination-predicted-but-not-proven-int
 fast/js/dfg-arith-add-overflow-check-elimination-tower-of-large-numbers
diff --git a/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js b/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js
new file mode 100644 (file)
index 0000000..c16ba63
--- /dev/null
+++ b/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js
@@ -0,0 +1,17 @@
+description(
+"Tests what happens when you use arguments in strict mode and present the DFG with a tempting optimization opportunity."
+);
+
+function f(a) {
+    "use strict";
+    a = 5;
+    return arguments[0];
+}
+
+noInline(f);
+
+while (!dfgCompiled({f:f}))
+    f(1);
+
+shouldBe("f(1)", "1");
+
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 40afa9d..9808144 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2013-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG optimizes out strict mode arguments tear off
+        https://bugs.webkit.org/show_bug.cgi?id=119504
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+        
+        Don't do the optimization for strict mode.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations):
+
 2013-08-16  Benjamin Poulain  <benjamin@webkit.org>
 
         [JSC] x86: improve code generation for xxxTest32
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index 1972c97..8022b52 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -122,12 +122,9 @@ public:
         bool changed = false;
         
         // Record which arguments are known to escape no matter what.
-        for (unsigned i = codeBlock()->inlineCallFrames().size(); i--;) {
-            InlineCallFrame* inlineCallFrame = &codeBlock()->inlineCallFrames()[i];
-            if (m_graph.m_executablesWhoseArgumentsEscaped.contains(
-                    m_graph.executableFor(inlineCallFrame)))
-                m_createsArguments.add(inlineCallFrame);
-        }
+        for (unsigned i = codeBlock()->inlineCallFrames().size(); i--;)
+            pruneObviousArgumentCreations(&codeBlock()->inlineCallFrames()[i]);
+        pruneObviousArgumentCreations(0); // the machine call frame.
         
         // Create data for variable access datas that we will want to analyze.
         for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
@@ -694,6 +691,14 @@ private:
             NullableHashTraits<VariableAccessData*> > m_argumentsAliasing;
     HashSet<VariableAccessData*> m_isLive;
 
+    void pruneObviousArgumentCreations(InlineCallFrame* inlineCallFrame)
+    {
+        ScriptExecutable* executable = m_graph.executableFor(inlineCallFrame);
+        if (m_graph.m_executablesWhoseArgumentsEscaped.contains(executable)
+            || executable->isStrictMode())
+            m_createsArguments.add(inlineCallFrame);
+    }
+    
     void observeBadArgumentsUse(Node* node)
     {
         if (!node)
Mirror of the WebKit open source project from svn.webkit.org.