nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dfg-constant-fold-mispredic...

10 lines
261 B
Plaintext
Raw Permalink Normal View History

Source/JavaScriptCore: DFG may get stuck in an infinite fix point if it constant folds a mispredicted node https://bugs.webkit.org/show_bug.cgi?id=90829 <rdar://problem/11823843> Reviewed by Oliver Hunt. If a node is shown to have been mispredicted during CFA, then don't allow constant folding to make the graph even more degenerate. Instead, pull back on constant folding and allow the normal OSR machinery to fix our profiling so that a future recompilation doesn't see the same mistake. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::execute): * dfg/DFGAbstractState.h: (JSC::DFG::AbstractState::trySetConstant): (AbstractState): * dfg/DFGPhase.h: (JSC::DFG::Phase::name): (Phase): (JSC::DFG::runAndLog): (DFG): (JSC::DFG::runPhase): LayoutTests: DFG may get stuck in an infinite fix point if it constant folds a mispredicted node https://bugs.webkit.org/show_bug.cgi?id=90829 Reviewed by Oliver Hunt. * fast/js/dfg-constant-fold-misprediction-expected.txt: Added. * fast/js/dfg-constant-fold-misprediction.html: Added. * fast/js/script-tests/dfg-constant-fold-misprediction.js: Added. (foo): Canonical link: https://commits.webkit.org/108659@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122167 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-07-09 23:28:53 +00:00
This tests that a constant folding on a node that has obviously mispredicted type doesn't send the compiler into an infinite loop.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
REGRESSION(149636, merged in 153145): ToThis conversion doesn't work in the DFG https://bugs.webkit.org/show_bug.cgi?id=120781 Reviewed by Mark Hahnenberg. Roll this back in with a build fix. - Use some method table hacks to detect if the CheckStructure optimization is valid for to_this. - Introduce a FinalObjectUse and use it for ToThis->Identity conversion. This looks like it might be perf-neutral on the major benchmarks, but it introduces some horrible performance cliffs. For example if you add methods to the Array prototype, you'll get horrible performance cliffs. As in virtual calls to C++ every time you call a JS function even if it's inlined. LongSpider/3d-cube appears to hit this. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGRepatch.cpp: (JSC::DFG::emitPutTransitionStub): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateFinalObject): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::isCell): Canonical link: https://commits.webkit.org/138810@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@155201 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-09-06 19:01:21 +00:00
Passed some tests silently.
Source/JavaScriptCore: DFG may get stuck in an infinite fix point if it constant folds a mispredicted node https://bugs.webkit.org/show_bug.cgi?id=90829 <rdar://problem/11823843> Reviewed by Oliver Hunt. If a node is shown to have been mispredicted during CFA, then don't allow constant folding to make the graph even more degenerate. Instead, pull back on constant folding and allow the normal OSR machinery to fix our profiling so that a future recompilation doesn't see the same mistake. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::execute): * dfg/DFGAbstractState.h: (JSC::DFG::AbstractState::trySetConstant): (AbstractState): * dfg/DFGPhase.h: (JSC::DFG::Phase::name): (Phase): (JSC::DFG::runAndLog): (DFG): (JSC::DFG::runPhase): LayoutTests: DFG may get stuck in an infinite fix point if it constant folds a mispredicted node https://bugs.webkit.org/show_bug.cgi?id=90829 Reviewed by Oliver Hunt. * fast/js/dfg-constant-fold-misprediction-expected.txt: Added. * fast/js/dfg-constant-fold-misprediction.html: Added. * fast/js/script-tests/dfg-constant-fold-misprediction.js: Added. (foo): Canonical link: https://commits.webkit.org/108659@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122167 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-07-09 23:28:53 +00:00
TEST COMPLETE