-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[JSC] AccessCase should not hold CallLinkInfo*
https://bugs.webkit.org/show_bug.cgi?id=268221 rdar://121733122 Reviewed by Justin Michaud. AccessCase holds CallLinkInfo*. But when the underlying JITStubRoutine gets destroyed, this becomes invalid. Previously, it does not matter since we always destroy CodeBlock first (synchronously), and then we clean up JITStubRoutine. So there were strict ordering. But now CodeBlock destruction can get delayed. But fundamentally speaking, having CallLinkInfo* in AccessCase is not right. This is compiled code's data structure and AccessCase should be just a data for IC feedback. In this patch we decouple CallLinkInfo* from AccessCase. CallLinkInfo's lifetime should be correctly managed by visitWeak, so, we add visitWeak iteration in MarkingGCAwareJITStubRoutine. Then we can remove CallLinkInfo from AccessCase. * JSTests/stress/decouple-calllinkinfo-from-access-case.js: Added. (F7): (f25): (f33): (C20.prototype.valueOf): (C20): (f27): * Source/JavaScriptCore/bytecode/AccessCase.cpp: (JSC::AccessCase::forEachDependentCell const): (JSC::AccessCase::doesCalls const): (JSC::AccessCase::visitWeak const): (JSC::AccessCase::collectDependentCells const): * Source/JavaScriptCore/bytecode/AccessCase.h: * Source/JavaScriptCore/bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * Source/JavaScriptCore/bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::dumpImpl const): * Source/JavaScriptCore/bytecode/GetterSetterAccessCase.h: * Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp: (JSC::InlineCacheCompiler::generateWithGuard): (JSC::InlineCacheCompiler::generate): (JSC::InlineCacheCompiler::generateImpl): (JSC::InlineCacheCompiler::emitProxyObjectAccess): (JSC::InlineCacheCompiler::regenerate): (JSC::InlineCacheHandler::callLinkInfoAt): (JSC::InlineCacheHandler::visitWeak const): * Source/JavaScriptCore/bytecode/InlineCacheCompiler.h: * Source/JavaScriptCore/bytecode/ProxyObjectAccessCase.cpp: (JSC::ProxyObjectAccessCase::dumpImpl const): * Source/JavaScriptCore/bytecode/ProxyObjectAccessCase.h: * Source/JavaScriptCore/bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeForStubInfo): * Source/JavaScriptCore/bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::callLinkInfoAt): * Source/JavaScriptCore/bytecode/StructureStubInfo.h: * Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp: (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine): (JSC::MarkingGCAwareJITStubRoutine::visitWeakImpl): (JSC::MarkingGCAwareJITStubRoutine::callLinkInfoAtImpl): (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler): (JSC::createICJITStubRoutine): * Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h: * Source/JavaScriptCore/jit/JITStubRoutine.cpp: (JSC::JITStubRoutine::callLinkInfoAt): * Source/JavaScriptCore/jit/JITStubRoutine.h: (JSC::JITStubRoutine::callLinkInfoAtImpl): Originally-landed-as: 272448.633@safari-7618-branch (f25738c). rdar://128077399 Canonical link: https://commits.webkit.org/278779@main
- Loading branch information
1 parent
6ad266d
commit b251507
Showing
17 changed files
with
210 additions
and
204 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| // runDefault("--validateOptions=true", "--thresholdForJITSoon=10", "--thresholdForJITAfterWarmUp=10", "--thresholdForOptimizeAfterWarmUp=100", "--thresholdForOptimizeAfterLongWarmUp=100", "--thresholdForOptimizeSoon=100", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--thresholdForFTLOptimizeSoon=1000", "--validateBCE=true") | ||
|
|
||
| const ProxyConstructor = Proxy; | ||
| const getPrototypeOf = Object.getPrototypeOf; | ||
| const ReflectGet = Reflect.get; | ||
| const ReflectSet = Reflect.set; | ||
| const ReflectHas = Reflect.has; | ||
| const setPrototypeOf = Object.setPrototypeOf; | ||
|
|
||
| function probe(id, value) { | ||
| let originalPrototype, newPrototype; | ||
| let handler = { | ||
| get(target, key, receiver) { | ||
| if (key === '__proto__' && receiver === value) return originalPrototype; | ||
| if (receiver === newPrototype) return ReflectGet(target, key); | ||
| return ReflectGet(target, key, receiver); | ||
| }, | ||
| set(target, key, value, receiver) { | ||
| if (receiver === newPrototype) return ReflectSet(target, key, value); | ||
| return ReflectSet(target, key, value, receiver); | ||
| }, | ||
| has(target, key) { | ||
| return ReflectHas(target, key); | ||
| }, | ||
| }; | ||
|
|
||
| try { | ||
| originalPrototype = getPrototypeOf(value); | ||
| newPrototype = new ProxyConstructor(originalPrototype, handler); | ||
| setPrototypeOf(value, newPrototype); | ||
| } catch (e) {} | ||
| } | ||
|
|
||
| probe("v1", "2003629588"); | ||
| let v4 = 9150; | ||
| v4--; | ||
| probe("v6", 51828); | ||
| function F7(a9, a10, a11) { | ||
| if (!new.target) { throw 'must be called with new'; } | ||
| const v12 = this?.constructor; | ||
| try { new v12(this, "object", 447824390); } catch (e) {} | ||
| a11 % a11; | ||
| this.b = a9; | ||
| this.g = a10; | ||
| } | ||
| const v15 = new F7("2003629588", "object", 447824390); | ||
| const v16 = new F7(v15, v4, v4); | ||
| const v17 = new F7("2003629588", 51828, 51828); | ||
| probe("v17", v17); | ||
| const v18 = v17?.constructor; | ||
| probe("v18", v18); | ||
| let v19; | ||
| try { v19 = new v18("r", v17, "r"); } catch (e) {} | ||
| probe("v19", v19); | ||
| const v20 = [v17,v17]; | ||
| probe("v20", v20); | ||
| const v21 = [F7,v15,v20,v15,v4]; | ||
| const v22 = [v4,"object",51828]; | ||
| probe("v22", v22); | ||
| let v23; | ||
| try { v23 = v22.reduce(v15); } catch (e) {} | ||
| const v24 = [2,-354747782,-16,10251,-1485280459,5,6,536870888,-47153,-193790246]; | ||
| probe("v24", v24); | ||
| function f25(a26, a27) { | ||
| const o28 = { | ||
| [a27]: a26, | ||
| "d": v21, | ||
| }; | ||
| return o28; | ||
| } | ||
| f25(v16, v22); | ||
| f25(v23, v16); | ||
| f25(v15, v22); | ||
| v24[4]; | ||
| function f33(a34, a35, a36, a37) { | ||
| probe("v36", a36); | ||
| ~a35; | ||
| v22.length = 1; | ||
| a36?.[v21]; | ||
| } | ||
| v24.flatMap(f33); | ||
| gc(); | ||
| class C20 { | ||
| valueOf(a22, a23) { | ||
| return ("n")[1204] - this; | ||
| } | ||
| } | ||
| const v26 = new C20(); | ||
| function f27(a28, a29) { | ||
| new BigInt64Array(3603); | ||
| return v26 * v26; | ||
| } | ||
| try { | ||
| v26[Symbol.toPrimitive] = f27; | ||
| v26.valueOf(); | ||
| } catch { } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.