[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.15.1-1414-gc69ee75
ggaren at apple.com
ggaren at apple.com
Thu Oct 29 20:48:12 UTC 2009
The following commit has been merged in the webkit-1.1 branch:
commit 9dc3ab7a79a54e06983aadb81a7c1a531c5fd3db
Author: ggaren at apple.com <ggaren at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Mon Oct 19 22:59:41 2009 +0000
Tightened up some put_by_id_transition code generation.
https://bugs.webkit.org/show_bug.cgi?id=30539
Patch by Geoffrey Garen <ggaren at apple.com> on 2009-10-19
Reviewed by Oliver Hunt.
* jit/JIT.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::testPrototype):
(JSC::JIT::privateCompilePutByIdTransition): No need to do object type
checks or read Structures and prototypes from objects: they're all known
constants at compile time.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@49820 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index a07ee22..8d6c2df 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,5 +1,19 @@
2009-10-19 Geoffrey Garen <ggaren at apple.com>
+ Reviewed by Oliver Hunt.
+
+ Tightened up some put_by_id_transition code generation.
+ https://bugs.webkit.org/show_bug.cgi?id=30539
+
+ * jit/JIT.h:
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::testPrototype):
+ (JSC::JIT::privateCompilePutByIdTransition): No need to do object type
+ checks or read Structures and prototypes from objects: they're all known
+ constants at compile time.
+
+2009-10-19 Geoffrey Garen <ggaren at apple.com>
+
Reviewed by Sam Weinig.
Added a private API for getting a global context from a context, for
diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index 23e8883..9406d1f 100644
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -386,6 +386,8 @@ namespace JSC {
Address addressFor(unsigned index, RegisterID base = callFrameRegister);
+ void testPrototype(Structure*, JumpList& failureCases);
+
#if USE(JSVALUE32_64)
Address tagFor(unsigned index, RegisterID base = callFrameRegister);
Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 9edfd01..4241111 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -521,22 +521,26 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
load32(Address(temp, offset + 4), resultTag);
}
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+ if (structure->m_prototype.isNull())
+ return;
+
+ failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
{
// It is assumed that regT0 contains the basePayload and regT1 contains the baseTag. The value can be found on the stack.
JumpList failureCases;
failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-
- loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
- failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(oldStructure)));
+ failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+ testPrototype(oldStructure, failureCases);
// Verify that nothing in the prototype chain has a setter for this property.
- for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
- loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
- loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
- failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(it->get())));
- }
+ for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+ testPrototype(it->get(), failureCases);
// Reallocate property storage if needed.
Call callTarget;
@@ -1347,35 +1351,27 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
}
}
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+ if (structure->m_prototype.isNull())
+ return;
+
+ move(ImmPtr(&asCell(structure->m_prototype)->m_structure), regT2);
+ move(ImmPtr(asCell(structure->m_prototype)->m_structure), regT3);
+ failureCases.append(branchPtr(NotEqual, Address(regT2), regT3));
+}
+
void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
{
JumpList failureCases;
// Check eax is an object of the right Structure.
failureCases.append(emitJumpIfNotJSCell(regT0));
failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
- JumpList successCases;
+ testPrototype(oldStructure, failureCases);
- // ecx = baseObject
- loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
- // proto(ecx) = baseObject->structure()->prototype()
- failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
-
- loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-
// ecx = baseObject->m_structure
- for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
- // null check the prototype
- successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
-
- // Check the structure id
- failureCases.append(branchPtr(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(it->get())));
-
- loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
- failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
- loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
- }
-
- successCases.link(this);
+ for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+ testPrototype(it->get(), failureCases);
Call callTarget;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list