<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[166945] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/166945">166945</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-04-08 12:39:55 -0700 (Tue, 08 Apr 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Repatch should support setters and plant calls to them directly
https://bugs.webkit.org/show_bug.cgi?id=130750
Source/JavaScriptCore:
Reviewed by Geoffrey Garen.
All of the infrastructure was in place so this just enables setter optimization.
This is a 12x speed-up on setter microbenchmarks. This is a 1% speed-up on Octane.
* bytecode/PolymorphicPutByIdList.cpp:
(JSC::PutByIdAccess::visitWeak):
* bytecode/PolymorphicPutByIdList.h:
(JSC::PutByIdAccess::setter):
(JSC::PutByIdAccess::customSetter): Deleted.
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeForStubInfo):
* jit/Repatch.cpp:
(JSC::toString):
(JSC::kindFor):
(JSC::customFor):
(JSC::generateByIdStub):
(JSC::tryCachePutByID):
(JSC::tryBuildPutByIdList):
* runtime/JSObject.cpp:
(JSC::JSObject::put):
* runtime/Lookup.h:
(JSC::putEntry):
* runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::setCacheableSetter):
(JSC::PutPropertySlot::isCacheableSetter):
(JSC::PutPropertySlot::isCacheableCustom):
(JSC::PutPropertySlot::setCacheableCustomProperty): Deleted.
(JSC::PutPropertySlot::isCacheableCustomProperty): Deleted.
* tests/stress/setter.js: Added.
(foo):
LayoutTests:
Reviewed by Geoffrey Garen.
* js/regress/script-tests/setter.js: Added.
* js/regress/setter-expected.txt: Added.
* js/regress/setter.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicPutByIdListcpp">trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicPutByIdListh">trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitRepatchcpp">trunk/Source/JavaScriptCore/jit/Repatch.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeLookuph">trunk/Source/JavaScriptCore/runtime/Lookup.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePutPropertySloth">trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressscripttestssetterjs">trunk/LayoutTests/js/regress/script-tests/setter.js</a></li>
<li><a href="#trunkLayoutTestsjsregresssetterexpectedtxt">trunk/LayoutTests/js/regress/setter-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresssetterhtml">trunk/LayoutTests/js/regress/setter.html</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresssetterjs">trunk/Source/JavaScriptCore/tests/stress/setter.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/LayoutTests/ChangeLog 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2014-04-07 Filip Pizlo <fpizlo@apple.com>
+
+ Repatch should support setters and plant calls to them directly
+ https://bugs.webkit.org/show_bug.cgi?id=130750
+
+ Reviewed by Geoffrey Garen.
+
+ * js/regress/script-tests/setter.js: Added.
+ * js/regress/setter-expected.txt: Added.
+ * js/regress/setter.html: Added.
+
</ins><span class="cx"> 2014-04-08 Morten Stenshorne <mstensho@opera.com>
</span><span class="cx">
</span><span class="cx"> [New Multicolumn] Child top margin sometimes ignored for column balancing
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestssetterjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/setter.js (0 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/setter.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/setter.js 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+(function() {
+ var o = {_f:42};
+ o.__defineSetter__("f", function(value) { this._f = value; });
+ var n = 2000000;
+ for (var i = 0; i < n; ++i)
+ o.f = i;
+ if (o._f != n - 1)
+ throw "Error: bad result: " + o._f;
+})();
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresssetterexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/setter-expected.txt (0 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/setter-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/setter-expected.txt 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/setter
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresssetterhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/setter.html (0 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/setter.html (rev 0)
+++ trunk/LayoutTests/js/regress/setter.html 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/setter.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -1,5 +1,43 @@
</span><span class="cx"> 2014-04-07 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><ins>+ Repatch should support setters and plant calls to them directly
+ https://bugs.webkit.org/show_bug.cgi?id=130750
+
+ Reviewed by Geoffrey Garen.
+
+ All of the infrastructure was in place so this just enables setter optimization.
+
+ This is a 12x speed-up on setter microbenchmarks. This is a 1% speed-up on Octane.
+
+ * bytecode/PolymorphicPutByIdList.cpp:
+ (JSC::PutByIdAccess::visitWeak):
+ * bytecode/PolymorphicPutByIdList.h:
+ (JSC::PutByIdAccess::setter):
+ (JSC::PutByIdAccess::customSetter): Deleted.
+ * bytecode/PutByIdStatus.cpp:
+ (JSC::PutByIdStatus::computeForStubInfo):
+ * jit/Repatch.cpp:
+ (JSC::toString):
+ (JSC::kindFor):
+ (JSC::customFor):
+ (JSC::generateByIdStub):
+ (JSC::tryCachePutByID):
+ (JSC::tryBuildPutByIdList):
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::put):
+ * runtime/Lookup.h:
+ (JSC::putEntry):
+ * runtime/PutPropertySlot.h:
+ (JSC::PutPropertySlot::setCacheableSetter):
+ (JSC::PutPropertySlot::isCacheableSetter):
+ (JSC::PutPropertySlot::isCacheableCustom):
+ (JSC::PutPropertySlot::setCacheableCustomProperty): Deleted.
+ (JSC::PutPropertySlot::isCacheableCustomProperty): Deleted.
+ * tests/stress/setter.js: Added.
+ (foo):
+
+2014-04-07 Filip Pizlo <fpizlo@apple.com>
+
</ins><span class="cx"> Setters are just getters that take an extra argument and don't return a value
</span><span class="cx"> https://bugs.webkit.org/show_bug.cgi?id=131336
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicPutByIdListcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -77,6 +77,7 @@
</span><span class="cx"> if (!Heap::isMarked(m_chain.get()))
</span><span class="cx"> return false;
</span><span class="cx"> break;
</span><ins>+ case Setter:
</ins><span class="cx"> case CustomSetter:
</span><span class="cx"> if (!Heap::isMarked(m_oldStructure.get()))
</span><span class="cx"> return false;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicPutByIdListh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -47,6 +47,7 @@
</span><span class="cx"> Invalid,
</span><span class="cx"> Transition,
</span><span class="cx"> Replace,
</span><ins>+ Setter,
</ins><span class="cx"> CustomSetter
</span><span class="cx"> };
</span><span class="cx">
</span><span class="lines">@@ -88,17 +89,19 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx">
</span><del>- static PutByIdAccess customSetter(
</del><ins>+ static PutByIdAccess setter(
</ins><span class="cx"> VM& vm,
</span><span class="cx"> JSCell* owner,
</span><ins>+ AccessType accessType,
</ins><span class="cx"> Structure* structure,
</span><span class="cx"> StructureChain* chain,
</span><span class="cx"> PutPropertySlot::PutValueFunc customSetter,
</span><span class="cx"> PassRefPtr<JITStubRoutine> stubRoutine)
</span><span class="cx"> {
</span><ins>+ RELEASE_ASSERT(accessType == Setter || accessType == CustomSetter);
</ins><span class="cx"> PutByIdAccess result;
</span><span class="cx"> result.m_oldStructure.set(vm, owner, structure);
</span><del>- result.m_type = CustomSetter;
</del><ins>+ result.m_type = accessType;
</ins><span class="cx"> if (chain)
</span><span class="cx"> result.m_chain.set(vm, owner, chain);
</span><span class="cx"> result.m_customSetter = customSetter;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -205,6 +205,7 @@
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+ case PutByIdAccess::Setter:
</ins><span class="cx"> case PutByIdAccess::CustomSetter:
</span><span class="cx"> return PutByIdStatus(MakesCalls);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitRepatchcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/Repatch.cpp (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/Repatch.cpp 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/jit/Repatch.cpp 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -230,6 +230,25 @@
</span><span class="cx"> CallCustomSetter
</span><span class="cx"> };
</span><span class="cx">
</span><ins>+static const char* toString(ByIdStubKind kind)
+{
+ switch (kind) {
+ case GetValue:
+ return "GetValue";
+ case CallGetter:
+ return "CallGetter";
+ case CallCustomGetter:
+ return "CallCustomGetter";
+ case CallSetter:
+ return "CallSetter";
+ case CallCustomSetter:
+ return "CallCustomSetter";
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ return nullptr;
+ }
+}
+
</ins><span class="cx"> static ByIdStubKind kindFor(const PropertySlot& slot)
</span><span class="cx"> {
</span><span class="cx"> if (slot.isCacheableValue())
</span><span class="lines">@@ -250,13 +269,15 @@
</span><span class="cx"> static ByIdStubKind kindFor(const PutPropertySlot& slot)
</span><span class="cx"> {
</span><span class="cx"> RELEASE_ASSERT(!slot.isCacheablePut());
</span><del>- RELEASE_ASSERT(slot.isCacheableCustomProperty());
</del><ins>+ if (slot.isCacheableSetter())
+ return CallSetter;
+ RELEASE_ASSERT(slot.isCacheableCustom());
</ins><span class="cx"> return CallCustomSetter;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static FunctionPtr customFor(const PutPropertySlot& slot)
</span><span class="cx"> {
</span><del>- if (!slot.isCacheableCustomProperty())
</del><ins>+ if (!slot.isCacheableCustom())
</ins><span class="cx"> return FunctionPtr();
</span><span class="cx"> return FunctionPtr(slot.customSetter());
</span><span class="cx"> }
</span><span class="lines">@@ -531,8 +552,9 @@
</span><span class="cx">
</span><span class="cx"> MacroAssemblerCodeRef code = FINALIZE_CODE_FOR(
</span><span class="cx"> exec->codeBlock(), patchBuffer,
</span><del>- ("Get access stub for %s, return point %p",
- toCString(*exec->codeBlock()).data(), successLabel.executableAddress()));
</del><ins>+ ("%s access stub for %s, return point %p",
+ toString(kind), toCString(*exec->codeBlock()).data(),
+ successLabel.executableAddress()));
</ins><span class="cx">
</span><span class="cx"> if (kind == CallGetter || kind == CallSetter)
</span><span class="cx"> stubRoutine = adoptRef(new AccessorCallJITStubRoutine(code, *vm, std::move(callLinkInfo)));
</span><span class="lines">@@ -1111,7 +1133,7 @@
</span><span class="cx"> Structure* structure = baseCell->structure();
</span><span class="cx"> Structure* oldStructure = structure->previousID();
</span><span class="cx">
</span><del>- if (!slot.isCacheablePut() && !slot.isCacheableCustomProperty())
</del><ins>+ if (!slot.isCacheablePut() && !slot.isCacheableCustom() && !slot.isCacheableSetter())
</ins><span class="cx"> return false;
</span><span class="cx"> if (!structure->propertyAccessesAreCacheable())
</span><span class="cx"> return false;
</span><span class="lines">@@ -1166,7 +1188,8 @@
</span><span class="cx"> stubInfo.initPutByIdReplace(*vm, codeBlock->ownerExecutable(), structure);
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><del>- if (slot.isCacheableCustomProperty() && stubInfo.patch.spillMode == DontSpill) {
</del><ins>+ if ((slot.isCacheableCustom() || slot.isCacheableSetter())
+ && stubInfo.patch.spillMode == DontSpill) {
</ins><span class="cx"> RefPtr<JITStubRoutine> stubRoutine;
</span><span class="cx">
</span><span class="cx"> StructureChain* prototypeChain = 0;
</span><span class="lines">@@ -1189,7 +1212,10 @@
</span><span class="cx"> stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToSlowCase),
</span><span class="cx"> stubRoutine);
</span><span class="cx">
</span><del>- list->addAccess(PutByIdAccess::customSetter(*vm, codeBlock->ownerExecutable(), structure, prototypeChain, slot.customSetter(), stubRoutine));
</del><ins>+ list->addAccess(PutByIdAccess::setter(
+ *vm, codeBlock->ownerExecutable(),
+ slot.isCacheableSetter() ? PutByIdAccess::Setter : PutByIdAccess::CustomSetter,
+ structure, prototypeChain, slot.customSetter(), stubRoutine));
</ins><span class="cx">
</span><span class="cx"> RepatchBuffer repatchBuffer(codeBlock);
</span><span class="cx"> repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.deltaCallToJump), CodeLocationLabel(stubRoutine->code().code()));
</span><span class="lines">@@ -1222,7 +1248,7 @@
</span><span class="cx"> Structure* oldStructure = structure->previousID();
</span><span class="cx">
</span><span class="cx">
</span><del>- if (!slot.isCacheablePut() && !slot.isCacheableCustomProperty())
</del><ins>+ if (!slot.isCacheablePut() && !slot.isCacheableCustom() && !slot.isCacheableSetter())
</ins><span class="cx"> return false;
</span><span class="cx">
</span><span class="cx"> if (!structure->propertyAccessesAreCacheable())
</span><span class="lines">@@ -1295,7 +1321,8 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (slot.isCacheableCustomProperty() && stubInfo.patch.spillMode == DontSpill) {
</del><ins>+ if ((slot.isCacheableCustom() || slot.isCacheableSetter())
+ && stubInfo.patch.spillMode == DontSpill) {
</ins><span class="cx"> RefPtr<JITStubRoutine> stubRoutine;
</span><span class="cx"> StructureChain* prototypeChain = 0;
</span><span class="cx"> PropertyOffset offset = slot.cachedOffset();
</span><span class="lines">@@ -1317,7 +1344,10 @@
</span><span class="cx"> CodeLocationLabel(list->currentSlowPathTarget()),
</span><span class="cx"> stubRoutine);
</span><span class="cx">
</span><del>- list->addAccess(PutByIdAccess::customSetter(*vm, codeBlock->ownerExecutable(), structure, prototypeChain, slot.customSetter(), stubRoutine));
</del><ins>+ list->addAccess(PutByIdAccess::setter(
+ *vm, codeBlock->ownerExecutable(),
+ slot.isCacheableSetter() ? PutByIdAccess::Setter : PutByIdAccess::CustomSetter,
+ structure, prototypeChain, slot.customSetter(), stubRoutine));
</ins><span class="cx">
</span><span class="cx"> RepatchBuffer repatchBuffer(codeBlock);
</span><span class="cx"> repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.deltaCallToJump), CodeLocationLabel(stubRoutine->code().code()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -384,6 +384,8 @@
</span><span class="cx"> JSValue gs = obj->getDirect(offset);
</span><span class="cx"> if (gs.isGetterSetter()) {
</span><span class="cx"> callSetter(exec, cell, gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode);
</span><ins>+ if (!thisObject->structure()->isDictionary())
+ slot.setCacheableSetter(obj, offset);
</ins><span class="cx"> return;
</span><span class="cx"> } else
</span><span class="cx"> ASSERT(!(attributes & Accessor));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeLookuph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.h (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.h 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/runtime/Lookup.h 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -270,7 +270,7 @@
</span><span class="cx"> thisObject->putDirect(exec->vm(), propertyName, value);
</span><span class="cx"> } else if (!(entry->attributes() & ReadOnly)) {
</span><span class="cx"> entry->propertyPutter()(exec, base, JSValue::encode(slot.thisValue()), JSValue::encode(value));
</span><del>- slot.setCacheableCustomProperty(base, entry->propertyPutter());
</del><ins>+ slot.setCustomProperty(base, entry->propertyPutter());
</ins><span class="cx"> } else if (slot.isStrictMode())
</span><span class="cx"> throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePutPropertySloth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h (166944 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h 2014-04-08 19:26:17 UTC (rev 166944)
+++ trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">
</span><span class="cx"> class PutPropertySlot {
</span><span class="cx"> public:
</span><del>- enum Type { Uncachable, ExistingProperty, NewProperty, CustomProperty, CacheableCustomProperty };
</del><ins>+ enum Type { Uncachable, ExistingProperty, NewProperty, SetterProperty, CustomProperty };
</ins><span class="cx"> enum Context { UnknownContext, PutById, PutByIdEval };
</span><span class="cx"> typedef void (*PutValueFunc)(ExecState*, JSObject* base, EncodedJSValue thisObject, EncodedJSValue value);
</span><span class="cx">
</span><span class="lines">@@ -72,13 +72,14 @@
</span><span class="cx"> m_base = base;
</span><span class="cx"> m_putFunction = function;
</span><span class="cx"> }
</span><del>-
- void setCacheableCustomProperty(JSObject* base, PutValueFunc function)
</del><ins>+
+ void setCacheableSetter(JSObject* base, PropertyOffset offset)
</ins><span class="cx"> {
</span><del>- m_type = CacheableCustomProperty;
</del><ins>+ m_type = SetterProperty;
</ins><span class="cx"> m_base = base;
</span><del>- m_putFunction = function;
</del><ins>+ m_offset = offset;
</ins><span class="cx"> }
</span><ins>+
</ins><span class="cx"> PutValueFunc customSetter() const { return m_putFunction; }
</span><span class="cx">
</span><span class="cx"> Context context() const { return static_cast<Context>(m_context); }
</span><span class="lines">@@ -89,7 +90,8 @@
</span><span class="cx">
</span><span class="cx"> bool isStrictMode() const { return m_isStrictMode; }
</span><span class="cx"> bool isCacheablePut() const { return m_type == NewProperty || m_type == ExistingProperty; }
</span><del>- bool isCacheableCustomProperty() const { return m_type == CacheableCustomProperty; }
</del><ins>+ bool isCacheableSetter() const { return m_type == SetterProperty; }
+ bool isCacheableCustom() const { return m_type == CustomProperty; }
</ins><span class="cx">
</span><span class="cx"> PropertyOffset cachedOffset() const
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresssetterjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/setter.js (0 => 166945)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/setter.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/setter.js 2014-04-08 19:39:55 UTC (rev 166945)
</span><span class="lines">@@ -0,0 +1,47 @@
</span><ins>+function foo(o, v1) {
+ o.f = v1;
+ o.k = v1 * 33;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100; ++i) {
+ var o = {g_: 5};
+ o.__defineSetter__("f", function(value) { this.g_ += 42 * value; });
+ o.__defineSetter__("g", function(value) { this.g_ += 43 * value; });
+ o.__defineSetter__("h", function(value) { this.g_ += 44 * value; });
+ o.__defineSetter__("i", function(value) { this.g_ += 45 * value; });
+ o.__defineSetter__("j", function(value) { this.g_ += 46 * value; });
+ o.__defineSetter__("k", function(value) { this.g_ += 47 * value; });
+ foo(o, 29);
+ if (o.g_ != 5 + 42 * 29 + 29 * 47 * 33)
+ throw "Error: bad result: " + o.g_;
+}
+
+// Test the case where those fields aren't setters anymore.
+var o = {g_: 5};
+o.f = 1;
+o.g = 2;
+o.h = 3;
+o.i = 4;
+o.j = 5;
+o.k = 6;
+foo(o, 29);
+if (o.g_ != 5)
+ throw "Error: bad value of g_: " + o.g_;
+if (o.f != 29)
+ throw "Error: bad value of f: " + o.f;
+if (o.k != 29 * 33)
+ throw "Error: bad value of k: " + o.k;
+
+// Test the case where they are setters but they're not the same setters.
+var o = {g_: 5};
+o.__defineSetter__("f", function(value) { this.g_ += 52 * value; });
+o.__defineSetter__("g", function(value) { this.g_ += 53 * value; });
+o.__defineSetter__("h", function(value) { this.g_ += 54 * value; });
+o.__defineSetter__("i", function(value) { this.g_ += 55 * value; });
+o.__defineSetter__("j", function(value) { this.g_ += 56 * value; });
+o.__defineSetter__("k", function(value) { this.g_ += 57 * value; });
+foo(o, 29);
+if (o.g_ != 5 + 52 * 29 + 29 * 57 * 33)
+ throw "Error: bad result at end: " + o.g_;
</ins></span></pre>
</div>
</div>
</body>
</html>