<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"

"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />

<title>[160628] trunk</title>

</head>

<body>

<style type="text/css"><!--

#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }

#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }

#msg dt:after { content:':';}

#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }

#msg dl a { font-weight: bold}

#msg dl a:link    { color:#fc3; }

#msg dl a:active  { color:#ff0; }

#msg dl a:visited { color:#cc6; }

h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }

#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }

#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }

#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }

#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }

#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }

#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }

#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }

#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }

#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }

#logmsg pre { background: #eee; padding: 1em; }

#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}

#logmsg dl { margin: 0; }

#logmsg dt { font-weight: bold; }

#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }

#logmsg dd:before { content:'\00bb';}

#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }

#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }

#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }

#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }

#logmsg table th.Corner { text-align: left; }

#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }

#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }

#patch { width: 100%; }

#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}

#patch .propset h4, #patch .binary h4 {margin:0;}

#patch pre {padding:0;line-height:1.2em;margin:0;}

#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}

#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}

#patch span {display:block;padding:0 10px;}

#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}

#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}

#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}

#patch .lines, .info {color:#888;background:#fff;}

--></style>

<div id="msg">

<dl class="meta">

<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/160628">160628</a></dd>

<dt>Author</dt> <dd>rniwa@webkit.org</dd>

<dt>Date</dt> <dd>2013-12-15 21:56:25 -0800 (Sun, 15 Dec 2013)</dd>

</dl>

<h3>Log Message</h3>

<pre>REGRESSION: 2x regression on Dromaeo DOM query tests

https://bugs.webkit.org/show_bug.cgi?id=125377

Reviewed by Filip Pizlo.

PerformanceTests:

Added a micro-benchmark for updating a named property on document.

* Bindings/update-name-getter.html: Added.

* Skipped:

Source/JavaScriptCore:

The bug was caused by JSC not JIT'ing property access on &quot;document&quot; due to its type info having

HasImpureGetOwnPropertySlot flag.

Fixed the bug by new type info flag NewImpurePropertyFiresWatchpoints, which allows the baseline

JIT to generate byte code for access properties on an object with named properties (a.k.a.

custom name getter) in DOM. When a new named property appears on the object, VM is notified via

VM::addImpureProperty and fires StructureStubClearingWatchpoint added during the repatch.

* bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFromLLInt): Take the slow path if we have any object with impure

properties in the prototype chain.

(JSC::GetByIdStatus::computeForChain): Ditto.

* jit/Repatch.cpp:

(JSC::repatchByIdSelfAccess): Throw away the byte code when a new impure property is added on any

object in the prototype chain via StructureStubClearingWatchpoint.

(JSC::generateProtoChainAccessStub): Ditto.

(JSC::tryCacheGetByID):

(JSC::tryBuildGetByIDList):

(JSC::tryRepatchIn): Ditto.

* runtime/JSTypeInfo.h: Added NewImpurePropertyFiresWatchpoints.

(JSC::TypeInfo::newImpurePropertyFiresWatchpoints): Added.

* runtime/Operations.h:

(JSC::normalizePrototypeChainForChainAccess): Don't exit early if VM will be notified of new

impure property even if the object had impure properties.

* runtime/Structure.h:

(JSC::Structure::takesSlowPathInDFGForImpureProperty): Added. Wraps hasImpureGetOwnPropertySlot and

asserts that newImpurePropertyFiresWatchpoints is true whenever hasImpureGetOwnPropertySlot is true.

* runtime/VM.cpp:

(JSC::VM::registerWatchpointForImpureProperty): Added.

(JSC::VM::addImpureProperty): Added. HTMLDocument calls it to notify JSC of a new impure property.

* runtime/VM.h:

Source/WebCore:

The bug was caused by JSC not JIT'ing property accesses on document because of its having

custom named getter (named properties).  This resulted in resolution of methods on document

such as getElementById to happen inside the interpreter.

Fixed the bug by using the new JSC type info flag which tells JSC to JIT property access on

document, and then notifying JSC whenever a new named property appeared on document.

Tests: js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html

       js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html

       js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html

       js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html

       js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html

       js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html

* bindings/js/JSDOMBinding.cpp:

(WebCore::addImpureProperty): Wraps VM::addImpureProperty.

* bindings/js/JSDOMBinding.h:

* bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader): Added the support for NewImpurePropertyFiresWatchpoints.

* bindings/scripts/IDLAttributes.txt: Ditto.

* html/HTMLDocument.cpp:

(WebCore::HTMLDocument::addDocumentNamedItem): Calls addImpureProperty.

* html/HTMLDocument.idl: Added NewImpurePropertyFiresWatchpoints.

LayoutTests:

Added more regression tests for throwing away byte code when a new named property appears.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-expected: Rebaselined.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.html: Fixed the test to use dfgShouldBe.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added.

* js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added.

* js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added.

* js/dom/script-tests/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.js: Removed.</pre>

<h3>Modified Paths</h3>

<ul>

<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottrapsexpectedtxt">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottrapshtml">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.html</a></li>

<li><a href="#trunkPerformanceTestsChangeLog">trunk/PerformanceTests/ChangeLog</a></li>

<li><a href="#trunkPerformanceTestsSkipped">trunk/PerformanceTests/Skipped</a></li>

<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorejitRepatchcpp">trunk/Source/JavaScriptCore/jit/Repatch.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeOperationsh">trunk/Source/JavaScriptCore/runtime/Operations.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>

<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMBindingcpp">trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMBindingh">trunk/Source/WebCore/bindings/js/JSDOMBinding.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptsIDLAttributestxt">trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt</a></li>

<li><a href="#trunkSourceWebCorehtmlHTMLDocumentcpp">trunk/Source/WebCore/html/HTMLDocument.cpp</a></li>

<li><a href="#trunkSourceWebCorehtmlHTMLDocumentidl">trunk/Source/WebCore/html/HTMLDocument.idl</a></li>

</ul>

<h3>Added Paths</h3>

<ul>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps2expectedtxt">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps2html">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps3expectedtxt">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps3html">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps4expectedtxt">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps4html">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps5expectedtxt">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps5html">trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps2expectedtxt">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps2html">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps3expectedtxt">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps3html">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps4expectedtxt">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps4html">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps5expectedtxt">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomprototypechaincachingwithimpuregetownpropertyslottraps5html">trunk/LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html</a></li>

<li><a href="#trunkPerformanceTestsBindingsupdatenamegetterhtml">trunk/PerformanceTests/Bindings/update-name-getter.html</a></li>

</ul>

<h3>Removed Paths</h3>

<ul>

<li><a href="#trunkLayoutTestsjsdomscripttestsdfgprototypechaincachingwithimpuregetownpropertyslottrapsjs">trunk/LayoutTests/js/dom/script-tests/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.js</a></li>

</ul>

</div>

<div id="patch">

<h3>Diff</h3>

<a id="trunkLayoutTestsChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (160627 => 160628)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/ChangeLog        2013-12-16 04:58:10 UTC (rev 160627)

+++ trunk/LayoutTests/ChangeLog        2013-12-16 05:56:25 UTC (rev 160628)

</span><span class="lines">@@ -1,3 +1,32 @@

</span><ins>+2013-12-15  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;

+

+        REGRESSION: 2x regression on Dromaeo DOM query tests

+        https://bugs.webkit.org/show_bug.cgi?id=125377

+

+        Reviewed by Filip Pizlo.

+

+        Added more regression tests for throwing away byte code when a new named property appears.

+        

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-expected: Rebaselined.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.html: Fixed the test to use dfgShouldBe.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added.

+        * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added.

+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added.

+        * js/dom/script-tests/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.js: Removed.

+

</ins><span class="cx"> 2013-12-15  Rob Buis  &lt;rob.buis@samsung.com&gt;

</span><span class="cx"> 

</span><span class="cx">         [CSS Shapes] shape-outside animation does not handle 'auto' well

</span></span></pre></div>

<a id="trunkLayoutTestsjsdomdfgprototypechaincachingwithimpuregetownpropertyslottraps2expectedtxt"></a>

<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt (0 => 160628)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt                                (rev 0)

+++ trunk/LayoutTests/js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt        2013-12-16 05:56:25 UTC (rev 160628)

</span><span class="lines">@@ -0,0 +1,11 @@