<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[169188] branches/ftlopt</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/169188">169188</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-05-21 21:11:15 -0700 (Wed, 21 May 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>[ftlopt] DFG::clobberize should be blind to the effects of GC
https://bugs.webkit.org/show_bug.cgi?id=133166
Source/JavaScriptCore:
Reviewed by Goeffrey Garen.
Move the computation of where GCs happen to DFG::doesGC().
Large (>5x) speed-up on programs that do loop-invariant string concatenations.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGAbstractHeap.h:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
(JSC::DFG::clobberizeForAllocation): Deleted.
* dfg/DFGDoesGC.cpp: Added.
(JSC::DFG::doesGC):
* dfg/DFGDoesGC.h: Added.
* dfg/DFGStoreBarrierElisionPhase.cpp:
(JSC::DFG::StoreBarrierElisionPhase::handleNode):
(JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Deleted.
LayoutTests:
Reviewed by Geoffrey Garen.
* js/regress/hoist-make-rope-expected.txt: Added.
* js/regress/hoist-make-rope.html: Added.
* js/regress/script-tests/hoist-make-rope.js: Added.
(foo):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchesftloptLayoutTestsChangeLog">branches/ftlopt/LayoutTests/ChangeLog</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreCMakeListstxt">branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreChangeLog">branches/ftlopt/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGAbstractHeaph">branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractHeap.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGClobberizeh">branches/ftlopt/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGStoreBarrierElisionPhasecpp">branches/ftlopt/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#branchesftloptLayoutTestsjsregresshoistmakeropeexpectedtxt">branches/ftlopt/LayoutTests/js/regress/hoist-make-rope-expected.txt</a></li>
<li><a href="#branchesftloptLayoutTestsjsregresshoistmakeropehtml">branches/ftlopt/LayoutTests/js/regress/hoist-make-rope.html</a></li>
<li><a href="#branchesftloptLayoutTestsjsregressscripttestshoistmakeropejs">branches/ftlopt/LayoutTests/js/regress/script-tests/hoist-make-rope.js</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGDoesGCcpp">branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGDoesGCh">branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchesftloptLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/LayoutTests/ChangeLog (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/ChangeLog 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/LayoutTests/ChangeLog 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2014-05-21 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] DFG::clobberize should be blind to the effects of GC
+ https://bugs.webkit.org/show_bug.cgi?id=133166
+
+ Reviewed by Geoffrey Garen.
+
+ * js/regress/hoist-make-rope-expected.txt: Added.
+ * js/regress/hoist-make-rope.html: Added.
+ * js/regress/script-tests/hoist-make-rope.js: Added.
+ (foo):
+
</ins><span class="cx"> 2014-05-19 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> [ftlopt] DFG bytecode parser should turn GetById with nothing but a Getter stub as stuff+handleCall, and handleCall should be allowed to inline if it wants to
</span></span></pre></div>
<a id="branchesftloptLayoutTestsjsregresshoistmakeropeexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/hoist-make-rope-expected.txt (0 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/hoist-make-rope-expected.txt (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/hoist-make-rope-expected.txt 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/hoist-make-rope
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregresshoistmakeropehtml"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/hoist-make-rope.html (0 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/hoist-make-rope.html (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/hoist-make-rope.html 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/hoist-make-rope.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregressscripttestshoistmakeropejs"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/script-tests/hoist-make-rope.js (0 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/script-tests/hoist-make-rope.js (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/script-tests/hoist-make-rope.js 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+function foo(a, b) {
+ var result;
+ for (var i = 0; i < 10000; ++i)
+ result = a + b;
+ return result;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 500; ++i) {
+ var result = foo("hello ", "world!");
+ if (result != "hello world!")
+ throw "Error: bad result: " + result;
+}
</ins></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -137,6 +137,7 @@
</span><span class="cx"> dfg/DFGDesiredWeakReferences.cpp
</span><span class="cx"> dfg/DFGDesiredWriteBarriers.cpp
</span><span class="cx"> dfg/DFGDisassembler.cpp
</span><ins>+ dfg/DFGDoesGC.cpp
</ins><span class="cx"> dfg/DFGDominators.cpp
</span><span class="cx"> dfg/DFGDriver.cpp
</span><span class="cx"> dfg/DFGEdge.cpp
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/ChangeLog (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/ChangeLog 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/ChangeLog 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -1,5 +1,30 @@
</span><span class="cx"> 2014-05-21 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><ins>+ [ftlopt] DFG::clobberize should be blind to the effects of GC
+ https://bugs.webkit.org/show_bug.cgi?id=133166
+
+ Reviewed by Goeffrey Garen.
+
+ Move the computation of where GCs happen to DFG::doesGC().
+
+ Large (>5x) speed-up on programs that do loop-invariant string concatenations.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * dfg/DFGAbstractHeap.h:
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ (JSC::DFG::clobberizeForAllocation): Deleted.
+ * dfg/DFGDoesGC.cpp: Added.
+ (JSC::DFG::doesGC):
+ * dfg/DFGDoesGC.h: Added.
+ * dfg/DFGStoreBarrierElisionPhase.cpp:
+ (JSC::DFG::StoreBarrierElisionPhase::handleNode):
+ (JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Deleted.
+
+2014-05-21 Filip Pizlo <fpizlo@apple.com>
+
</ins><span class="cx"> Merge trunk r169184 to ftlopt.
</span><span class="cx">
</span><span class="cx"> 2014-05-21 Filip Pizlo <fpizlo@apple.com>
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -388,6 +388,7 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDesiredWeakReferences.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDesiredWriteBarriers.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDisassembler.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGDoesGC.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGDominators.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDriver.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGEdge.cpp" />
</span><span class="lines">@@ -943,6 +944,7 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDesiredWeakReferences.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDesiredWriteBarriers.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDisassembler.h" />
</span><ins>+ <ClInclude Include="..\dfg\DFGDoesGC.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGDominators.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDoubleFormatState.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDriver.h" />
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -289,6 +289,8 @@
</span><span class="cx"> 0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */; };
</span><span class="cx"> 0F572D4F16879FDD00E57FBD /* ThunkGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F5780A218FE1E98001E72D9 /* PureNaN.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5780A118FE1E98001E72D9 /* PureNaN.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0F5A1273192D9FDF008764A3 /* DFGDoesGC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */; };
+ 0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0F5A52D017ADD717008ECB2D /* CopyToken.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A52CF17ADD717008ECB2D /* CopyToken.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F5A6283188C98D40072C9DF /* FTLValueRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */; };
</span><span class="cx"> 0F5A6284188C98D40072C9DF /* FTLValueRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A6282188C98D40072C9DF /* FTLValueRange.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -2096,6 +2098,8 @@
</span><span class="cx"> 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutionCounter.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerator.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F5780A118FE1E98001E72D9 /* PureNaN.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PureNaN.h; sourceTree = "<group>"; };
</span><ins>+ 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDoesGC.cpp; path = dfg/DFGDoesGC.cpp; sourceTree = "<group>"; };
+ 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDoesGC.h; path = dfg/DFGDoesGC.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0F5A52CF17ADD717008ECB2D /* CopyToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyToken.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLValueRange.cpp; path = ftl/FTLValueRange.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F5A6282188C98D40072C9DF /* FTLValueRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLValueRange.h; path = ftl/FTLValueRange.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -4674,6 +4678,8 @@
</span><span class="cx"> C2981FDB17BAFF4400A3BC98 /* DFGDesiredWriteBarriers.h */,
</span><span class="cx"> 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */,
</span><span class="cx"> 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */,
</span><ins>+ 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */,
+ 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */,
</ins><span class="cx"> 0FD81ACF154FB4EB00983E72 /* DFGDominators.cpp */,
</span><span class="cx"> 0FD81AD0154FB4EB00983E72 /* DFGDominators.h */,
</span><span class="cx"> 0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */,
</span><span class="lines">@@ -4694,6 +4700,8 @@
</span><span class="cx"> 0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */,
</span><span class="cx"> A7D89CE817A0B8CC00773AD8 /* DFGFlushFormat.cpp */,
</span><span class="cx"> A7D89CE917A0B8CC00773AD8 /* DFGFlushFormat.h */,
</span><ins>+ 2A88067619107D5500CB0BBB /* DFGFunctionWhitelist.cpp */,
+ 2A88067719107D5500CB0BBB /* DFGFunctionWhitelist.h */,
</ins><span class="cx"> 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
</span><span class="cx"> 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
</span><span class="cx"> 86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
</span><span class="lines">@@ -4834,8 +4842,6 @@
</span><span class="cx"> 0FC97F3C18202119002C9B26 /* DFGWatchpointCollectionPhase.h */,
</span><span class="cx"> 0FDB2CE5174830A2007B3C1B /* DFGWorklist.cpp */,
</span><span class="cx"> 0FDB2CE6174830A2007B3C1B /* DFGWorklist.h */,
</span><del>- 2A88067619107D5500CB0BBB /* DFGFunctionWhitelist.cpp */,
- 2A88067719107D5500CB0BBB /* DFGFunctionWhitelist.h */,
</del><span class="cx"> );
</span><span class="cx"> name = dfg;
</span><span class="cx"> sourceTree = "<group>";
</span><span class="lines">@@ -5960,6 +5966,7 @@
</span><span class="cx"> 0F2B66F217B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h in Headers */,
</span><span class="cx"> 0F2B66F317B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h in Headers */,
</span><span class="cx"> 0F2B66F417B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h in Headers */,
</span><ins>+ 0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */,
</ins><span class="cx"> 0F2B66F517B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h in Headers */,
</span><span class="cx"> 0F2B66F617B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h in Headers */,
</span><span class="cx"> BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
</span><span class="lines">@@ -7049,6 +7056,7 @@
</span><span class="cx"> 0F235BE117178E1C00690C7F /* FTLThunks.cpp in Sources */,
</span><span class="cx"> 0F6B1CC51862C47800845D97 /* FTLUnwindInfo.cpp in Sources */,
</span><span class="cx"> 0F235BE317178E1C00690C7F /* FTLValueFormat.cpp in Sources */,
</span><ins>+ 0F5A1273192D9FDF008764A3 /* DFGDoesGC.cpp in Sources */,
</ins><span class="cx"> A53CE08718BC1A5600BEDF76 /* JSConsole.cpp in Sources */,
</span><span class="cx"> 0F5A6283188C98D40072C9DF /* FTLValueRange.cpp in Sources */,
</span><span class="cx"> 147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */,
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGAbstractHeaph"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractHeap.h (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractHeap.h 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractHeap.h 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -70,8 +70,7 @@
</span><span class="cx"> macro(ArrayStorageProperties) \
</span><span class="cx"> macro(Variables) \
</span><span class="cx"> macro(TypedArrayProperties) \
</span><del>- macro(GCState) \
- macro(BarrierState) \
</del><ins>+ macro(HeapObjectCount) /* Used to reflect the fact that some allocations reveal object identity */\
</ins><span class="cx"> macro(RegExpState) \
</span><span class="cx"> macro(InternalState) \
</span><span class="cx"> macro(Absolute) \
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGClobberize.h (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -35,15 +35,6 @@
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><span class="cx"> template<typename ReadFunctor, typename WriteFunctor>
</span><del>-void clobberizeForAllocation(ReadFunctor& read, WriteFunctor& write)
-{
- read(GCState);
- read(BarrierState);
- write(GCState);
- write(BarrierState);
-}
-
-template<typename ReadFunctor, typename WriteFunctor>
</del><span class="cx"> void clobberize(Graph& graph, Node* node, ReadFunctor& read, WriteFunctor& write)
</span><span class="cx"> {
</span><span class="cx"> // Some notes:
</span><span class="lines">@@ -131,6 +122,7 @@
</span><span class="cx"> case DoubleRep:
</span><span class="cx"> case ValueRep:
</span><span class="cx"> case Int52Rep:
</span><ins>+ case MakeRope:
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case MovHint:
</span><span class="lines">@@ -156,6 +148,8 @@
</span><span class="cx"> case Breakpoint:
</span><span class="cx"> case ProfileWillCall:
</span><span class="cx"> case ProfileDidCall:
</span><ins>+ case StoreBarrier:
+ case StoreBarrierWithNullCheck:
</ins><span class="cx"> write(SideState);
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="lines">@@ -172,7 +166,8 @@
</span><span class="cx">
</span><span class="cx"> case CreateActivation:
</span><span class="cx"> case CreateArguments:
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> write(SideState);
</span><span class="cx"> write(Watchpoint_fire);
</span><span class="cx"> return;
</span><span class="lines">@@ -184,7 +179,8 @@
</span><span class="cx"> case ToThis:
</span><span class="cx"> case CreateThis:
</span><span class="cx"> read(MiscFields);
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case VarInjectionWatchpoint:
</span><span class="lines">@@ -451,13 +447,11 @@
</span><span class="cx">
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> read(JSObject_butterfly);
</span><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><span class="lines">@@ -472,7 +466,6 @@
</span><span class="cx"> write(JSCell_structureID);
</span><span class="cx"> write(JSCell_indexingType);
</span><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="lines">@@ -505,10 +498,8 @@
</span><span class="cx"> write(AbstractHeap(NamedProperties, node->multiPutByOffsetData().identifierNumber));
</span><span class="cx"> if (node->multiPutByOffsetData().writesStructures())
</span><span class="cx"> write(JSCell_structureID);
</span><del>- if (node->multiPutByOffsetData().reallocatesStorage()) {
</del><ins>+ if (node->multiPutByOffsetData().reallocatesStorage())
</ins><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
- }
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case PutByOffset:
</span><span class="lines">@@ -574,15 +565,16 @@
</span><span class="cx"> case NewArrayBuffer:
</span><span class="cx"> case NewRegexp:
</span><span class="cx"> case NewStringObject:
</span><del>- case MakeRope:
</del><span class="cx"> case NewFunctionNoCheck:
</span><span class="cx"> case NewFunction:
</span><span class="cx"> case NewFunctionExpression:
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case NewTypedArray:
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> switch (node->child1().useKind()) {
</span><span class="cx"> case Int32Use:
</span><span class="cx"> return;
</span><span class="lines">@@ -660,7 +652,8 @@
</span><span class="cx">
</span><span class="cx"> case ThrowReferenceError:
</span><span class="cx"> write(SideState);
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case CountExecution:
</span><span class="lines">@@ -668,12 +661,6 @@
</span><span class="cx"> read(InternalState);
</span><span class="cx"> write(InternalState);
</span><span class="cx"> return;
</span><del>-
- case StoreBarrier:
- case StoreBarrierWithNullCheck:
- read(BarrierState);
- write(BarrierState);
- return;
</del><span class="cx">
</span><span class="cx"> case LastNodeType:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="addfile"><h4>Added: branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (0 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (rev 0)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -0,0 +1,228 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGDoesGC.h"
+
+#include "DFGGraph.h"
+#include "DFGNode.h"
+#include "Operations.h"
+
+namespace JSC { namespace DFG {
+
+bool doesGC(Graph& graph, Node* node)
+{
+ if (graph.clobbersWorld(node))
+ return true;
+
+ // Now consider nodes that don't clobber the world but that still may GC. This includes all
+ // nodes. By convention we put world-clobbering nodes in the block of "false" cases but we can
+ // put them anywhere.
+ switch (node->op()) {
+ case JSConstant:
+ case DoubleConstant:
+ case Int52Constant:
+ case WeakJSConstant:
+ case Identity:
+ case GetCallee:
+ case GetLocal:
+ case SetLocal:
+ case MovHint:
+ case ZombieHint:
+ case GetArgument:
+ case Phantom:
+ case HardPhantom:
+ case Upsilon:
+ case Phi:
+ case Flush:
+ case PhantomLocal:
+ case GetLocalUnlinked:
+ case SetArgument:
+ case BitAnd:
+ case BitOr:
+ case BitXor:
+ case BitLShift:
+ case BitRShift:
+ case BitURShift:
+ case ValueToInt32:
+ case UInt32ToNumber:
+ case DoubleAsInt32:
+ case ArithAdd:
+ case ArithSub:
+ case ArithNegate:
+ case ArithMul:
+ case ArithIMul:
+ case ArithDiv:
+ case ArithMod:
+ case ArithAbs:
+ case ArithMin:
+ case ArithMax:
+ case ArithSqrt:
+ case ArithFRound:
+ case ArithSin:
+ case ArithCos:
+ case ValueAdd:
+ case GetById:
+ case GetByIdFlush:
+ case PutById:
+ case PutByIdFlush:
+ case PutByIdDirect:
+ case CheckStructure:
+ case CheckExecutable:
+ case GetButterfly:
+ case CheckArray:
+ case GetScope:
+ case GetMyScope:
+ case SkipTopScope:
+ case SkipScope:
+ case GetClosureRegisters:
+ case GetClosureVar:
+ case PutClosureVar:
+ case GetGlobalVar:
+ case PutGlobalVar:
+ case VariableWatchpoint:
+ case VarInjectionWatchpoint:
+ case CheckFunction:
+ case AllocationProfileWatchpoint:
+ case RegExpExec:
+ case RegExpTest:
+ case CompareLess:
+ case CompareLessEq:
+ case CompareGreater:
+ case CompareGreaterEq:
+ case CompareEq:
+ case CompareEqConstant:
+ case CompareStrictEq:
+ case Call:
+ case Construct:
+ case Breakpoint:
+ case ProfileWillCall:
+ case ProfileDidCall:
+ case CheckHasInstance:
+ case InstanceOf:
+ case IsUndefined:
+ case IsBoolean:
+ case IsNumber:
+ case IsString:
+ case IsObject:
+ case IsFunction:
+ case TypeOf:
+ case LogicalNot:
+ case ToPrimitive:
+ case ToString:
+ case In:
+ case TearOffActivation:
+ case PhantomArguments:
+ case TearOffArguments:
+ case GetMyArgumentsLength:
+ case GetMyArgumentByVal:
+ case GetMyArgumentsLengthSafe:
+ case GetMyArgumentByValSafe:
+ case CheckArgumentsNotCreated:
+ case Jump:
+ case Branch:
+ case Switch:
+ case Return:
+ case Throw:
+ case CountExecution:
+ case ForceOSRExit:
+ case CheckWatchdogTimer:
+ case StringFromCharCode:
+ case Unreachable:
+ case ExtractOSREntryLocal:
+ case CheckTierUpInLoop:
+ case CheckTierUpAtReturn:
+ case CheckTierUpAndOSREnter:
+ case LoopHint:
+ case StoreBarrier:
+ case StoreBarrierWithNullCheck:
+ case InvalidationPoint:
+ case NotifyWrite:
+ case FunctionReentryWatchpoint:
+ case TypedArrayWatchpoint:
+ case CheckInBounds:
+ case ConstantStoragePointer:
+ case Check:
+ case MultiGetByOffset:
+ case ValueRep:
+ case DoubleRep:
+ case Int52Rep:
+ case GetGetter:
+ case GetSetter:
+ case GetByVal:
+ case GetIndexedPropertyStorage:
+ case GetArrayLength:
+ case ArrayPush:
+ case ArrayPop:
+ case StringCharAt:
+ case StringCharCodeAt:
+ case GetTypedArrayByteOffset:
+ case PutByValDirect:
+ case PutByVal:
+ case PutByValAlias:
+ case StructureTransitionWatchpoint:
+ case PutStructure:
+ case PhantomPutStructure:
+ case GetByOffset:
+ case GetGetterSetterByOffset:
+ case PutByOffset:
+ return false;
+
+ case CreateActivation:
+ case CreateArguments:
+ case ToThis:
+ case CreateThis:
+ case AllocatePropertyStorage:
+ case ReallocatePropertyStorage:
+ case Arrayify:
+ case ArrayifyToStructure:
+ case NewObject:
+ case NewArray:
+ case NewArrayWithSize:
+ case NewArrayBuffer:
+ case NewRegexp:
+ case NewStringObject:
+ case MakeRope:
+ case NewFunctionNoCheck:
+ case NewFunction:
+ case NewFunctionExpression:
+ case NewTypedArray:
+ case ThrowReferenceError:
+ return true;
+
+ case MultiPutByOffset:
+ return node->multiPutByOffsetData().reallocatesStorage();
+
+ case LastNodeType:
+ RELEASE_ASSERT_NOT_REACHED();
+ return true;
+ }
+
+ RELEASE_ASSERT_NOT_REACHED();
+ return true;
+}
+
+} } // namespace JSC::DFG
+
</ins></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGDoesGCh"></a>
<div class="addfile"><h4>Added: branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.h (0 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.h (rev 0)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGDoesGC.h 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGDoesGC_h
+#define DFGDoesGC_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+struct Node;
+
+bool doesGC(Graph&, Node*);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGDoesGC_h
+
</ins></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGStoreBarrierElisionPhasecpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp (169187 => 169188)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp 2014-05-22 03:52:34 UTC (rev 169187)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp 2014-05-22 04:11:15 UTC (rev 169188)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx">
</span><span class="cx"> #include "DFGBasicBlock.h"
</span><span class="cx"> #include "DFGClobberize.h"
</span><ins>+#include "DFGDoesGC.h"
</ins><span class="cx"> #include "DFGGraph.h"
</span><span class="cx"> #include "DFGPhase.h"
</span><span class="cx"> #include "JSCInlines.h"
</span><span class="lines">@@ -58,11 +59,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- bool couldCauseGC(Node* node)
- {
- return writesOverlap(m_graph, node, GCState);
- }
-
</del><span class="cx"> bool allocatesFreshObject(Node* node)
</span><span class="cx"> {
</span><span class="cx"> switch (node->op()) {
</span><span class="lines">@@ -104,7 +100,7 @@
</span><span class="cx">
</span><span class="cx"> void handleNode(HashSet<Node*>& dontNeedBarriers, Node* node)
</span><span class="cx"> {
</span><del>- if (couldCauseGC(node))
</del><ins>+ if (doesGC(m_graph, node))
</ins><span class="cx"> dontNeedBarriers.clear();
</span><span class="cx">
</span><span class="cx"> if (allocatesFreshObject(node))
</span></span></pre>
</div>
</div>
</body>
</html>