<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[279610] branches/safari-612.1.22.3-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/279610">279610</a></dd>
<dt>Author</dt> <dd>rubent_22@apple.com</dd>
<dt>Date</dt> <dd>2021-07-06 12:43:11 -0700 (Tue, 06 Jul 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Cherry-pick <a href="http://trac.webkit.org/projects/webkit/changeset/279449">r279449</a>. rdar://problem/80212082

    Turn off data ICs by default
    https://bugs.webkit.org/show_bug.cgi?id=227334
    <rdar://problem/79802812>

    Reviewed by Yusuke Suzuki.

    JSTests:

    * microbenchmarks/deltablue-varargs.js:
    * microbenchmarks/richards-try-catch.js:

    Source/JavaScriptCore:

    There are GC crashes that are caused by access data IC sharing. This
    patch is both turning off data IC sharing by default, and turning off data
    ICs by default.

    We should re-enable this once we figure out the issue:
    https://bugs.webkit.org/show_bug.cgi?id=227551

    Some of our testing modes are still running with data ICs on, so the code doesn't
    bit rot. And a select few tests are running with data IC sharing on, for
    similar reasons, even though we know it has issues. If those tests start
    crashing, we'll just disable sharing completely until the issue is resolved.

    * bytecode/PolymorphicAccess.cpp:
    (JSC::PolymorphicAccess::regenerate):
    * runtime/OptionsList.h:

    Tools:

    * Scripts/run-jsc-stress-tests:

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279449 268f45cc-cd09-0410-ab3c-d52691b4dbfc</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari6121223branchJSTestsChangeLog">branches/safari-612.1.22.3-branch/JSTests/ChangeLog</a></li>
<li><a href="#branchessafari6121223branchJSTestsmicrobenchmarksdeltabluevarargsjs">branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/deltablue-varargs.js</a></li>
<li><a href="#branchessafari6121223branchJSTestsmicrobenchmarksrichardstrycatchjs">branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/richards-try-catch.js</a></li>
<li><a href="#branchessafari6121223branchSourceJavaScriptCoreChangeLog">branches/safari-612.1.22.3-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari6121223branchSourceJavaScriptCorebytecodePolymorphicAccesscpp">branches/safari-612.1.22.3-branch/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#branchessafari6121223branchSourceJavaScriptCoreruntimeOptionsListh">branches/safari-612.1.22.3-branch/Source/JavaScriptCore/runtime/OptionsList.h</a></li>
<li><a href="#branchessafari6121223branchToolsChangeLog">branches/safari-612.1.22.3-branch/Tools/ChangeLog</a></li>
<li><a href="#branchessafari6121223branchToolsScriptsrunjscstresstests">branches/safari-612.1.22.3-branch/Tools/Scripts/run-jsc-stress-tests</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari6121223branchJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/JSTests/ChangeLog (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/JSTests/ChangeLog      2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/JSTests/ChangeLog 2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -1,3 +1,53 @@
</span><ins>+2021-07-06  Ruben Turcios  <rubent_22@apple.com>
+
+        Cherry-pick r279449. rdar://problem/80212082
+
+    Turn off data ICs by default
+    https://bugs.webkit.org/show_bug.cgi?id=227334
+    <rdar://problem/79802812>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * microbenchmarks/deltablue-varargs.js:
+    * microbenchmarks/richards-try-catch.js:
+    
+    Source/JavaScriptCore:
+    
+    There are GC crashes that are caused by access data IC sharing. This
+    patch is both turning off data IC sharing by default, and turning off data
+    ICs by default.
+    
+    We should re-enable this once we figure out the issue:
+    https://bugs.webkit.org/show_bug.cgi?id=227551
+    
+    Some of our testing modes are still running with data ICs on, so the code doesn't
+    bit rot. And a select few tests are running with data IC sharing on, for
+    similar reasons, even though we know it has issues. If those tests start
+    crashing, we'll just disable sharing completely until the issue is resolved.
+    
+    * bytecode/PolymorphicAccess.cpp:
+    (JSC::PolymorphicAccess::regenerate):
+    * runtime/OptionsList.h:
+    
+    Tools:
+    
+    * Scripts/run-jsc-stress-tests:
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279449 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-06-30  Saam Barati  <sbarati@apple.com>
+
+            Turn off data ICs by default
+            https://bugs.webkit.org/show_bug.cgi?id=227334
+            <rdar://problem/79802812>
+
+            Reviewed by Yusuke Suzuki.
+
+            * microbenchmarks/deltablue-varargs.js:
+            * microbenchmarks/richards-try-catch.js:
+
</ins><span class="cx"> 2021-06-25  Guillaume Emont  <guijemont@igalia.com>
</span><span class="cx"> 
</span><span class="cx">         Unskip stress/call-apply-exponential-bytecode-size.js on most platforms
</span></span></pre></div>
<a id="branchessafari6121223branchJSTestsmicrobenchmarksdeltabluevarargsjs"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/deltablue-varargs.js (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/deltablue-varargs.js   2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/deltablue-varargs.js      2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -1,4 +1,6 @@
</span><span class="cx"> //@ skip if $model == "Apple Watch Series 3" # added by mark-jsc-stress-test.py
</span><ins>+//@ requireOptions("--useDataIC=true", "--useDataICSharing=true")
+
</ins><span class="cx"> // Copyright 2008 the V8 project authors. All rights reserved.
</span><span class="cx"> // Copyright 1996 John Maloney and Mario Wolczko.
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6121223branchJSTestsmicrobenchmarksrichardstrycatchjs"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/richards-try-catch.js (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/richards-try-catch.js  2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/JSTests/microbenchmarks/richards-try-catch.js     2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -1,4 +1,6 @@
</span><span class="cx"> //@ skip if $model == "Apple Watch Series 3" # added by mark-jsc-stress-test.py
</span><ins>+//@ requireOptions("--useDataIC=true", "--useDataICSharing=true")
+
</ins><span class="cx"> // Copyright 2006-2008 the V8 project authors. All rights reserved.
</span><span class="cx"> // Redistribution and use in source and binary forms, with or without
</span><span class="cx"> // modification, are permitted provided that the following conditions are
</span></span></pre></div>
<a id="branchessafari6121223branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/Source/JavaScriptCore/ChangeLog (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/Source/JavaScriptCore/ChangeLog        2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/Source/JavaScriptCore/ChangeLog   2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -1,5 +1,68 @@
</span><span class="cx"> 2021-07-06  Ruben Turcios  <rubent_22@apple.com>
</span><span class="cx"> 
</span><ins>+        Cherry-pick r279449. rdar://problem/80212082
+
+    Turn off data ICs by default
+    https://bugs.webkit.org/show_bug.cgi?id=227334
+    <rdar://problem/79802812>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * microbenchmarks/deltablue-varargs.js:
+    * microbenchmarks/richards-try-catch.js:
+    
+    Source/JavaScriptCore:
+    
+    There are GC crashes that are caused by access data IC sharing. This
+    patch is both turning off data IC sharing by default, and turning off data
+    ICs by default.
+    
+    We should re-enable this once we figure out the issue:
+    https://bugs.webkit.org/show_bug.cgi?id=227551
+    
+    Some of our testing modes are still running with data ICs on, so the code doesn't
+    bit rot. And a select few tests are running with data IC sharing on, for
+    similar reasons, even though we know it has issues. If those tests start
+    crashing, we'll just disable sharing completely until the issue is resolved.
+    
+    * bytecode/PolymorphicAccess.cpp:
+    (JSC::PolymorphicAccess::regenerate):
+    * runtime/OptionsList.h:
+    
+    Tools:
+    
+    * Scripts/run-jsc-stress-tests:
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279449 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-06-30  Saam Barati  <sbarati@apple.com>
+
+            Turn off data ICs by default
+            https://bugs.webkit.org/show_bug.cgi?id=227334
+            <rdar://problem/79802812>
+
+            Reviewed by Yusuke Suzuki.
+
+            There are GC crashes that are caused by access data IC sharing. This
+            patch is both turning off data IC sharing by default, and turning off data
+            ICs by default.
+
+            We should re-enable this once we figure out the issue:
+            https://bugs.webkit.org/show_bug.cgi?id=227551
+
+            Some of our testing modes are still running with data ICs on, so the code doesn't
+            bit rot. And a select few tests are running with data IC sharing on, for
+            similar reasons, even though we know it has issues. If those tests start
+            crashing, we'll just disable sharing completely until the issue is resolved.
+
+            * bytecode/PolymorphicAccess.cpp:
+            (JSC::PolymorphicAccess::regenerate):
+            * runtime/OptionsList.h:
+
+2021-07-06  Ruben Turcios  <rubent_22@apple.com>
+
</ins><span class="cx">         Cherry-pick r279560. rdar://problem/80212160
</span><span class="cx"> 
</span><span class="cx">     ActiveScratchBufferScope should take the buffer as argument
</span></span></pre></div>
<a id="branchessafari6121223branchSourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp   2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp      2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -522,7 +522,7 @@
</span><span class="cx"> 
</span><span class="cx">     bool doesCalls = false;
</span><span class="cx">     bool doesJSGetterSetterCalls = false;
</span><del>-    bool canBeShared = true;
</del><ins>+    bool canBeShared = Options::useDataICSharing();
</ins><span class="cx">     Vector<JSCell*> cellsToMark;
</span><span class="cx">     FixedVector<RefPtr<AccessCase>> keys(cases.size());
</span><span class="cx">     unsigned index = 0;
</span></span></pre></div>
<a id="branchessafari6121223branchSourceJavaScriptCoreruntimeOptionsListh"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/Source/JavaScriptCore/runtime/OptionsList.h (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/Source/JavaScriptCore/runtime/OptionsList.h    2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/Source/JavaScriptCore/runtime/OptionsList.h       2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -546,8 +546,9 @@
</span><span class="cx">     v(Bool, useSharedArrayBuffer, false, Normal, nullptr) \
</span><span class="cx">     v(Bool, useTopLevelAwait, true, Normal, "allow the await keyword at the top level of a module.") \
</span><span class="cx">     v(Bool, verboseExecutablePoolAllocation, false, Normal, nullptr) \
</span><del>-    v(Bool, useDataIC, isARM64(), Normal, nullptr) \
</del><ins>+    v(Bool, useDataIC, false, Normal, nullptr) \
</ins><span class="cx">     v(Bool, useDataICInOptimizingJIT, false, Normal, nullptr) \
</span><ins>+    v(Bool, useDataICSharing, false, Normal, nullptr) \
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> enum OptionEquivalence {
</span></span></pre></div>
<a id="branchessafari6121223branchToolsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/Tools/ChangeLog (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/Tools/ChangeLog        2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/Tools/ChangeLog   2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -1,3 +1,52 @@
</span><ins>+2021-07-06  Ruben Turcios  <rubent_22@apple.com>
+
+        Cherry-pick r279449. rdar://problem/80212082
+
+    Turn off data ICs by default
+    https://bugs.webkit.org/show_bug.cgi?id=227334
+    <rdar://problem/79802812>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * microbenchmarks/deltablue-varargs.js:
+    * microbenchmarks/richards-try-catch.js:
+    
+    Source/JavaScriptCore:
+    
+    There are GC crashes that are caused by access data IC sharing. This
+    patch is both turning off data IC sharing by default, and turning off data
+    ICs by default.
+    
+    We should re-enable this once we figure out the issue:
+    https://bugs.webkit.org/show_bug.cgi?id=227551
+    
+    Some of our testing modes are still running with data ICs on, so the code doesn't
+    bit rot. And a select few tests are running with data IC sharing on, for
+    similar reasons, even though we know it has issues. If those tests start
+    crashing, we'll just disable sharing completely until the issue is resolved.
+    
+    * bytecode/PolymorphicAccess.cpp:
+    (JSC::PolymorphicAccess::regenerate):
+    * runtime/OptionsList.h:
+    
+    Tools:
+    
+    * Scripts/run-jsc-stress-tests:
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279449 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-06-30  Saam Barati  <sbarati@apple.com>
+
+            Turn off data ICs by default
+            https://bugs.webkit.org/show_bug.cgi?id=227334
+            <rdar://problem/79802812>
+
+            Reviewed by Yusuke Suzuki.
+
+            * Scripts/run-jsc-stress-tests:
+
</ins><span class="cx"> 2021-06-29  Alan Coon  <alancoon@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r279361. rdar://problem/79923766
</span></span></pre></div>
<a id="branchessafari6121223branchToolsScriptsrunjscstresstests"></a>
<div class="modfile"><h4>Modified: branches/safari-612.1.22.3-branch/Tools/Scripts/run-jsc-stress-tests (279609 => 279610)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612.1.22.3-branch/Tools/Scripts/run-jsc-stress-tests     2021-07-06 19:37:30 UTC (rev 279609)
+++ branches/safari-612.1.22.3-branch/Tools/Scripts/run-jsc-stress-tests        2021-07-06 19:43:11 UTC (rev 279610)
</span><span class="lines">@@ -788,7 +788,7 @@
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> def runFTLNoCJIT(*optionalTestSpecificOptions)
</span><del>-    run("misc-ftl-no-cjit", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
</del><ins>+    run("misc-ftl-no-cjit", "--useDataIC=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
</ins><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> def runFTLNoCJITB3O0(*optionalTestSpecificOptions)
</span><span class="lines">@@ -796,7 +796,7 @@
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> def runFTLNoCJITValidate(*optionalTestSpecificOptions)
</span><del>-    run("ftl-no-cjit-validate-sampling-profiler", "--validateGraph=true", "--validateBCE=true", "--useSamplingProfiler=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
</del><ins>+    run("ftl-no-cjit-validate-sampling-profiler", "--validateGraph=true", "--validateBCE=true", "--useSamplingProfiler=true", "--airForceIRCAllocator=true", "--useDataIC=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
</ins><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> def runFTLNoCJITNoPutStackValidate(*optionalTestSpecificOptions)
</span><span class="lines">@@ -820,7 +820,7 @@
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> def runFTLEager(*optionalTestSpecificOptions)
</span><del>-    run("ftl-eager", "--airForceBriggsAllocator=true", "--useRandomizingExecutableIslandAllocation=true", "--forcePolyProto=true", *(FTL_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + optionalTestSpecificOptions))
</del><ins>+    run("ftl-eager", "--airForceBriggsAllocator=true", "--useRandomizingExecutableIslandAllocation=true", "--forcePolyProto=true", "--useDataIC=true", *(FTL_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + optionalTestSpecificOptions))
</ins><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> def runFTLEagerWatchdog(*optionalTestSpecificOptions)
</span></span></pre>
</div>
</div>

</body>
</html>