nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dfg-convert-this-dom-window...

22 lines
1.7 KiB
Plaintext
Raw Permalink Normal View History

Source/JavaScriptCore: DFG ConvertThis optimizations do not honor the distinction between the global object and the global this object https://bugs.webkit.org/show_bug.cgi?id=75058 <rdar://problem/10616612> <rdar://problem/10617500> Reviewed by Oliver Hunt. Added a call to toThisObject() in the DFG when planting a direct reference to the global this object. Instead of adding a separate toThisObject() method on JSCell which does not take ExecState*, I reascribed a new contract: if you're calling toThisObject() on JSObject or one of its subtypes, then the ExecState* is optional. * dfg/DFGAssemblyHelpers.h: (JSC::DFG::AssemblyHelpers::globalThisObjectFor): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * runtime/JSObject.h: LayoutTests: DFG ConvertThis optimizations do not honor the distinction between the global object and the global this object https://bugs.webkit.org/show_bug.cgi?id=75058 <rdar://problem/10616612> Reviewed by Oliver Hunt. * fast/js/dfg-convert-this-dom-window-expected.txt: Added. * fast/js/dfg-convert-this-dom-window.html: Added. * fast/js/script-tests/dfg-convert-this-dom-window.js: Added. (myObject.call): (myFunction): (myFunctionWithCall): (myFunctionWithCall.call): Canonical link: https://commits.webkit.org/91796@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@103482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2011-12-22 02:23:42 +00:00
This tests that we can correctly call Function.prototype.call in the DFG, but more precisely, that we give the correct this object in case it is undefined
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
REGRESSION(149636, merged in 153145): ToThis conversion doesn't work in the DFG https://bugs.webkit.org/show_bug.cgi?id=120781 Reviewed by Mark Hahnenberg. Roll this back in with a build fix. - Use some method table hacks to detect if the CheckStructure optimization is valid for to_this. - Introduce a FinalObjectUse and use it for ToThis->Identity conversion. This looks like it might be perf-neutral on the major benchmarks, but it introduces some horrible performance cliffs. For example if you add methods to the Array prototype, you'll get horrible performance cliffs. As in virtual calls to C++ every time you call a JS function even if it's inlined. LongSpider/3d-cube appears to hit this. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGRepatch.cpp: (JSC::DFG::emitPutTransitionStub): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateFinalObject): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::isCell): Canonical link: https://commits.webkit.org/138810@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@155201 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-09-06 19:01:21 +00:00
PASS myObject.call() is [myObject, "myObject.call"] on all iterations including after DFG tier-up.
PASS myFunction('arg1') is [this, "myFunction", "arg1"] on all iterations including after DFG tier-up.
PASS myFunction.call(myObject, 'arg1') is [myObject, "myFunction", "arg1"] on all iterations including after DFG tier-up.
PASS myFunction.call() is [this, "myFunction", undefined] on all iterations including after DFG tier-up.
PASS myFunction.call(null) is [this, "myFunction", undefined] on all iterations including after DFG tier-up.
PASS myFunction.call(undefined) is [this, "myFunction", undefined] on all iterations including after DFG tier-up.
PASS myFunction.aliasedCall(myObject, 'arg1') is [myObject, "myFunction", "arg1"] on all iterations including after DFG tier-up.
PASS myFunction.aliasedCall() is [this, "myFunction", undefined] on all iterations including after DFG tier-up.
PASS myFunction.aliasedCall(null) is [this, "myFunction", undefined] on all iterations including after DFG tier-up.
PASS myFunction.aliasedCall(undefined) is [this, "myFunction", undefined] on all iterations including after DFG tier-up.
PASS myFunctionWithCall.call(myObject, 'arg1') is [myFunctionWithCall, "myFunctionWithCall.call", myObject] on all iterations including after DFG tier-up.
PASS myFunctionWithCall.aliasedCall(myObject, 'arg1') is [myObject, "myFunctionWithCall", "arg1"] on all iterations including after DFG tier-up.
Source/JavaScriptCore: DFG ConvertThis optimizations do not honor the distinction between the global object and the global this object https://bugs.webkit.org/show_bug.cgi?id=75058 <rdar://problem/10616612> <rdar://problem/10617500> Reviewed by Oliver Hunt. Added a call to toThisObject() in the DFG when planting a direct reference to the global this object. Instead of adding a separate toThisObject() method on JSCell which does not take ExecState*, I reascribed a new contract: if you're calling toThisObject() on JSObject or one of its subtypes, then the ExecState* is optional. * dfg/DFGAssemblyHelpers.h: (JSC::DFG::AssemblyHelpers::globalThisObjectFor): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * runtime/JSObject.h: LayoutTests: DFG ConvertThis optimizations do not honor the distinction between the global object and the global this object https://bugs.webkit.org/show_bug.cgi?id=75058 <rdar://problem/10616612> Reviewed by Oliver Hunt. * fast/js/dfg-convert-this-dom-window-expected.txt: Added. * fast/js/dfg-convert-this-dom-window.html: Added. * fast/js/script-tests/dfg-convert-this-dom-window.js: Added. (myObject.call): (myFunction): (myFunctionWithCall): (myFunctionWithCall.call): Canonical link: https://commits.webkit.org/91796@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@103482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2011-12-22 02:23:42 +00:00
PASS successfullyParsed is true
TEST COMPLETE