[JSC] Bracket compound assignment should resolve property key at most once #25526
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rkirsling
added
the
JavaScriptCore
|
EWS run on previous version of this PR (hash cff3852) |
Constellation
requested changes
Mar 6, 2024
There was a problem hiding this comment.
I think this has a problem that it always makes the result as string while it can be a number. And we are observing perf regressions in some of JetStream2 tests. We should not do atom string generation if the input is a number, so probably some special bytecode and Baseline / DFG / FTL handling is necessary.
webkit-ews-buildbot
added
the
merging-blocked
rkirsling
removed
the
merging-blocked
rkirsling
force-pushed
the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
from
cff3852
to
93f81c9
Compare
|
EWS run on previous version of this PR (hash 93f81c9) |
webkit-ews-buildbot
added
the
merging-blocked
rkirsling
removed
the
merging-blocked
rkirsling
force-pushed
the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
from
93f81c9
to
fefe1af
Compare
|
EWS run on previous version of this PR (hash fefe1af) |
webkit-ews-buildbot
added
the
merging-blocked
rkirsling
removed
the
merging-blocked
rkirsling
force-pushed
the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
from
fefe1af
to
47e17cb
Compare
|
EWS run on previous version of this PR (hash 47e17cb) |
rkirsling
force-pushed
the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
from
47e17cb
to
3ab3620
Compare
|
EWS run on previous version of this PR (hash 3ab3620) |
rkirsling
force-pushed
the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
from
3ab3620
to
a1b832b
Compare
|
EWS run on current version of this PR (hash a1b832b) |
webkit-ews-buildbot
added
the
merging-blocked
rkirsling
removed
the
merging-blocked
|
Just a reminder that this is ready for review. |
… once https://bugs.webkit.org/show_bug.cgi?id=270563 Reviewed by Yusuke Suzuki. Just as we did for `obj[prop]++` (275531@main), we need to make sure `obj[prop] += 1;` doesn't double-evaluate `prop`. The existing solution, however, is not of reasonable performance when `prop` is a Number value -- it is, of course, unacceptable for `arr[i]++` to be slow. To this end, this patch also introduces OpToPropertyKeyOrNumber, which will return numbers unchanged, just as it does with strings and symbols. * JSTests/test262/expectations.yaml: Mark 22 test cases as passing. * Source/JavaScriptCore/bytecode/BytecodeList.rb: * Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp: * Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp: * Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h: * Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp: (JSC::PostfixNode::emitBracket): (JSC::PrefixNode::emitBracket): (JSC::ReadModifyBracketNode::emitBytecode): (JSC::ShortCircuitReadModifyBracketNode::emitBytecode): (JSC::ObjectPatternNode::bindValue const): * Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h: * Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp: * Source/JavaScriptCore/dfg/DFGClobberize.h: * Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp: * Source/JavaScriptCore/dfg/DFGDoesGC.cpp: * Source/JavaScriptCore/dfg/DFGFixupPhase.cpp: * Source/JavaScriptCore/dfg/DFGNode.h: * Source/JavaScriptCore/dfg/DFGNodeType.h: * Source/JavaScriptCore/dfg/DFGOperations.cpp: * Source/JavaScriptCore/dfg/DFGOperations.h: * Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp: * Source/JavaScriptCore/dfg/DFGSafeToExecute.h: * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp: * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h: * Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: * Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp: * Source/JavaScriptCore/ftl/FTLCapabilities.cpp: * Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp: * Source/JavaScriptCore/jit/JIT.cpp: * Source/JavaScriptCore/jit/JIT.h: * Source/JavaScriptCore/jit/JITOpcodes.cpp: * Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm: * Source/JavaScriptCore/llint/LowLevelInterpreter64.asm: * Source/JavaScriptCore/runtime/CommonSlowPaths.cpp: * Source/JavaScriptCore/runtime/CommonSlowPaths.h: Canonical link: https://commits.webkit.org/275944@main
webkit-commit-queue
force-pushed
the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
from
a1b832b
to
c9e7ab3
Compare
|
Committed 275944@main (c9e7ab3): https://commits.webkit.org/275944@main Reviewed commits have been landed. Closing PR #25526 and removing active labels. |
webkit-commit-queue
removed
the
merge-queue
rkirsling
deleted the
eng/JSC-Bracket-compound-assignment-should-resolve-property-key-at-most-once
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
c9e7ab3
a1b832b