haikuwebkit/PerformanceTests/Bindings/update-name-getter.html

21 lines
513 B
HTML
Raw Permalink Normal View History

REGRESSION: 2x regression on Dromaeo DOM query tests https://bugs.webkit.org/show_bug.cgi?id=125377 Reviewed by Filip Pizlo. PerformanceTests: Added a micro-benchmark for updating a named property on document. * Bindings/update-name-getter.html: Added. * Skipped: Source/JavaScriptCore: The bug was caused by JSC not JIT'ing property access on "document" due to its type info having HasImpureGetOwnPropertySlot flag. Fixed the bug by new type info flag NewImpurePropertyFiresWatchpoints, which allows the baseline JIT to generate byte code for access properties on an object with named properties (a.k.a. custom name getter) in DOM. When a new named property appears on the object, VM is notified via VM::addImpureProperty and fires StructureStubClearingWatchpoint added during the repatch. * bytecode/GetByIdStatus.cpp: (JSC::GetByIdStatus::computeFromLLInt): Take the slow path if we have any object with impure properties in the prototype chain. (JSC::GetByIdStatus::computeForChain): Ditto. * jit/Repatch.cpp: (JSC::repatchByIdSelfAccess): Throw away the byte code when a new impure property is added on any object in the prototype chain via StructureStubClearingWatchpoint. (JSC::generateProtoChainAccessStub): Ditto. (JSC::tryCacheGetByID): (JSC::tryBuildGetByIDList): (JSC::tryRepatchIn): Ditto. * runtime/JSTypeInfo.h: Added NewImpurePropertyFiresWatchpoints. (JSC::TypeInfo::newImpurePropertyFiresWatchpoints): Added. * runtime/Operations.h: (JSC::normalizePrototypeChainForChainAccess): Don't exit early if VM will be notified of new impure property even if the object had impure properties. * runtime/Structure.h: (JSC::Structure::takesSlowPathInDFGForImpureProperty): Added. Wraps hasImpureGetOwnPropertySlot and asserts that newImpurePropertyFiresWatchpoints is true whenever hasImpureGetOwnPropertySlot is true. * runtime/VM.cpp: (JSC::VM::registerWatchpointForImpureProperty): Added. (JSC::VM::addImpureProperty): Added. HTMLDocument calls it to notify JSC of a new impure property. * runtime/VM.h: Source/WebCore: The bug was caused by JSC not JIT'ing property accesses on document because of its having custom named getter (named properties). This resulted in resolution of methods on document such as getElementById to happen inside the interpreter. Fixed the bug by using the new JSC type info flag which tells JSC to JIT property access on document, and then notifying JSC whenever a new named property appeared on document. Tests: js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html * bindings/js/JSDOMBinding.cpp: (WebCore::addImpureProperty): Wraps VM::addImpureProperty. * bindings/js/JSDOMBinding.h: * bindings/scripts/CodeGeneratorJS.pm: (GenerateHeader): Added the support for NewImpurePropertyFiresWatchpoints. * bindings/scripts/IDLAttributes.txt: Ditto. * html/HTMLDocument.cpp: (WebCore::HTMLDocument::addDocumentNamedItem): Calls addImpureProperty. * html/HTMLDocument.idl: Added NewImpurePropertyFiresWatchpoints. LayoutTests: Added more regression tests for throwing away byte code when a new named property appears. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-expected: Rebaselined. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.html: Fixed the test to use dfgShouldBe. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added. * js/dom/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2-expected.txt: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-2.html: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3-expected.txt: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-3.html: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4-expected.txt: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-4.html: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-expected.txt: Added. * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html: Added. * js/dom/script-tests/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps.js: Removed. Canonical link: https://commits.webkit.org/143790@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@160628 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-12-16 05:56:25 +00:00
<!DOCTYPE html>
<html>
<body>
<img id="foo" name="bar">
<script src="../resources/runner.js"></script>
<script>
var imageElement = document.querySelector("img");
imageElement.id = "foo";
PerfTestRunner.measureRunsPerSecond({
description: "This benchmark covers 'getElementById' in Dromaeo/dom-query.html, and other DOM methods that return a Node object.",
run: function() {
for (var i = 0; i < 100000; i++)
imageElement.id = i % 2 ? "foo1" : "foo0";
}});
</script>
</body>
</html>