WebKit Bugzilla
Attachment 369794 Details for
Bug 197855
: Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-197855-20190514004747.patch (text/plain), 32.69 KB, created by
Tadeu Zagallo
on 2019-05-13 15:47:49 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Tadeu Zagallo
Created:
2019-05-13 15:47:49 PDT
Size:
32.69 KB
patch
obsolete
>Subversion Revision: 244956 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index 7d960395584de6aa830c033c9f0c21d4162c62f6..8f88edcf7f05695bde3ab4773f4130f1dd505ac2 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,25 @@ >+2019-05-13 Tadeu Zagallo <tzagallo@apple.com> >+ >+ Remove MaximalFlushInsertionPhase >+ https://bugs.webkit.org/show_bug.cgi?id=197855 >+ <rdar://problem/50236506> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ Maximal flush assumes that it's safe to extend the liveness of locals, >+ but since SetArgumentMaybe was introduced r244324, this assumption is no >+ longer valid. >+ >+ * JavaScriptCore.xcodeproj/project.pbxproj: >+ * Sources.txt: >+ * dfg/DFGMaximalFlushInsertionPhase.cpp: Removed. >+ * dfg/DFGMaximalFlushInsertionPhase.h: Removed. >+ * dfg/DFGPlan.cpp: >+ (JSC::DFG::Plan::compileInThreadImpl): >+ * runtime/Options.cpp: >+ (JSC::recomputeDependentOptions): >+ * runtime/Options.h: >+ > 2019-05-04 Tadeu Zagallo <tzagallo@apple.com> > > TypedArrays should not store properties that are canonical numeric indices >diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj >index e7dc887b9aaf815bb3b80a7d42e8a07f894fdd03..93f4486aff8c4184dfc39a65813b5c747e121064 100644 >--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj >+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj >@@ -1194,7 +1194,6 @@ > 79DFCBDB1D88C59600527D03 /* HasOwnPropertyCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 79DFCBDA1D88C59600527D03 /* HasOwnPropertyCache.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 79EE0C001B4AFB85000385C9 /* VariableEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 79EE0BFE1B4AFB85000385C9 /* VariableEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 79EFD4841EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 79EFD4821EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; }; >- 79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */; }; > 79FC8A081E32E9F000D88F0E /* DFGRegisteredStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = 79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 7A9774A8206B82E4008D03D0 /* JSWeakValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A9774A7206B82C9008D03D0 /* JSWeakValue.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 7BC547D31B6959A100959B58 /* WasmFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 7BC547D21B69599B00959B58 /* WasmFormat.h */; settings = {ATTRIBUTES = (Private, ); }; }; >@@ -3871,8 +3870,6 @@ > 79EE0BFE1B4AFB85000385C9 /* VariableEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VariableEnvironment.h; sourceTree = "<group>"; }; > 79EFD4811EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCodeBlockHeapCellType.cpp; path = js/JSWebAssemblyCodeBlockHeapCellType.cpp; sourceTree = "<group>"; }; > 79EFD4821EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyCodeBlockHeapCellType.h; path = js/JSWebAssemblyCodeBlockHeapCellType.h; sourceTree = "<group>"; }; >- 79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMaximalFlushInsertionPhase.cpp; path = dfg/DFGMaximalFlushInsertionPhase.cpp; sourceTree = "<group>"; }; >- 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMaximalFlushInsertionPhase.h; path = dfg/DFGMaximalFlushInsertionPhase.h; sourceTree = "<group>"; }; > 79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisteredStructure.h; path = dfg/DFGRegisteredStructure.h; sourceTree = "<group>"; }; > 7A9774A6206B828C008D03D0 /* JSWeakValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakValue.cpp; sourceTree = "<group>"; }; > 7A9774A7206B82C9008D03D0 /* JSWeakValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakValue.h; sourceTree = "<group>"; }; >@@ -7595,8 +7592,6 @@ > A7D89CED17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h */, > A767B5B317A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp */, > A767B5B417A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h */, >- 79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */, >- 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */, > 0F5874EB194FEB1200AAB2C1 /* DFGMayExit.cpp */, > 0F5874EC194FEB1200AAB2C1 /* DFGMayExit.h */, > 0F1725FE1B48719A00AC3A55 /* DFGMinifiedGraph.cpp */, >@@ -8969,7 +8964,6 @@ > 79C4B15E1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h in Headers */, > A7D89CFC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h in Headers */, > A767B5B617A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h in Headers */, >- 79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */, > 0F5874EE194FEB1200AAB2C1 /* DFGMayExit.h in Headers */, > 0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */, > 0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */, >diff --git a/Source/JavaScriptCore/Sources.txt b/Source/JavaScriptCore/Sources.txt >index f5534441390d1a608aae0dc28ffbef31868329b4..9460eb4b3f4ec827db6b59f8521aab217cc4375b 100644 >--- a/Source/JavaScriptCore/Sources.txt >+++ b/Source/JavaScriptCore/Sources.txt >@@ -361,7 +361,6 @@ dfg/DFGLazyJSValue.cpp > dfg/DFGLazyNode.cpp > dfg/DFGLivenessAnalysisPhase.cpp > dfg/DFGLoopPreHeaderCreationPhase.cpp >-dfg/DFGMaximalFlushInsertionPhase.cpp > dfg/DFGMayExit.cpp > dfg/DFGMinifiedGraph.cpp > dfg/DFGMinifiedNode.cpp >diff --git a/Source/JavaScriptCore/dfg/DFGMaximalFlushInsertionPhase.cpp b/Source/JavaScriptCore/dfg/DFGMaximalFlushInsertionPhase.cpp >deleted file mode 100644 >index 394a8e6565c03efbe1967a1beab353b24a77a5f8..0000000000000000000000000000000000000000 >--- a/Source/JavaScriptCore/dfg/DFGMaximalFlushInsertionPhase.cpp >+++ /dev/null >@@ -1,165 +0,0 @@ >-/* >- * Copyright (C) 2015 Apple Inc. All rights reserved. >- * >- * Redistribution and use in source and binary forms, with or without >- * modification, are permitted provided that the following conditions >- * are met: >- * 1. Redistributions of source code must retain the above copyright >- * notice, this list of conditions and the following disclaimer. >- * 2. Redistributions in binary form must reproduce the above copyright >- * notice, this list of conditions and the following disclaimer in the >- * documentation and/or other materials provided with the distribution. >- * >- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY >- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR >- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, >- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, >- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR >- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY >- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE >- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >- */ >- >-#include "config.h" >-#include "DFGMaximalFlushInsertionPhase.h" >- >-#if ENABLE(DFG_JIT) >- >-#include "DFGBasicBlockInlines.h" >-#include "DFGGraph.h" >-#include "DFGInsertionSet.h" >-#include "DFGPhase.h" >-#include "JSCInlines.h" >- >-namespace JSC { namespace DFG { >- >-class MaximalFlushInsertionPhase : public Phase { >-public: >- MaximalFlushInsertionPhase(Graph& graph) >- : Phase(graph, "maximal flush insertion phase") >- { >- } >- >- bool run() >- { >- DFG_ASSERT(m_graph, nullptr, m_graph.m_form == LoadStore); >- >- InsertionSet insertionSet(m_graph); >- for (BasicBlock* block : m_graph.blocksInNaturalOrder()) { >- treatRegularBlock(block, insertionSet); >- insertionSet.execute(block); >- } >- >- for (BasicBlock* entrypoint : m_graph.m_roots) { >- treatRootBlock(entrypoint, insertionSet); >- insertionSet.execute(entrypoint); >- } >- >- return true; >- } >- >- void treatRegularBlock(BasicBlock* block, InsertionSet& insertionSet) >- { >- Operands<VariableAccessData*> currentBlockAccessData(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr); >- // Insert a Flush before every SetLocal to properly pattern the graph such that >- // any range between SetLocal and Flush has access to the local on the stack. >- { >- for (unsigned i = 0; i < block->size(); i++) { >- Node* node = block->at(i); >- bool isPrimordialSetArgument = false; >- if (node->op() == SetArgumentDefinitely && node->local().isArgument()) { >- auto iter = m_graph.m_rootToArguments.find(block); >- if (iter != m_graph.m_rootToArguments.end()) >- isPrimordialSetArgument = node == iter->value[node->local().toArgument()]; >- } >- >- if (node->op() == SetLocal || (node->op() == SetArgumentDefinitely && !isPrimordialSetArgument) || node->op() == SetArgumentMaybe) { >- VirtualRegister operand = node->local(); >- VariableAccessData* flushAccessData = currentBlockAccessData.operand(operand); >- if (!flushAccessData) >- flushAccessData = newVariableAccessData(operand); >- >- insertionSet.insertNode(i, SpecNone, >- Flush, node->origin, OpInfo(flushAccessData)); >- } >- >- if (node->accessesStack(m_graph)) >- currentBlockAccessData.operand(node->local()) = node->variableAccessData(); >- } >- } >- >- // Flush everything at the end of the block. >- { >- NodeOrigin origin = block->at(block->size() - 1)->origin; >- auto insertFlushAtEnd = [&] (VirtualRegister operand) { >- VariableAccessData* accessData = currentBlockAccessData.operand(operand); >- if (!accessData) >- accessData = newVariableAccessData(operand); >- >- currentBlockAccessData.operand(operand) = accessData; >- >- insertionSet.insertNode(block->size(), SpecNone, >- Flush, origin, OpInfo(accessData)); >- }; >- >- for (unsigned i = 0; i < block->variablesAtTail.numberOfLocals(); i++) >- insertFlushAtEnd(virtualRegisterForLocal(i)); >- for (unsigned i = 0; i < block->variablesAtTail.numberOfArguments(); i++) >- insertFlushAtEnd(virtualRegisterForArgument(i)); >- } >- } >- >- void treatRootBlock(BasicBlock* block, InsertionSet& insertionSet) >- { >- Operands<VariableAccessData*> initialAccessData(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr); >- Operands<Node*> initialAccessNodes(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr); >- for (auto* node : *block) { >- if (!node->accessesStack(m_graph)) >- continue; >- >- VirtualRegister operand = node->local(); >- if (initialAccessData.operand(operand)) >- continue; >- >- DFG_ASSERT(m_graph, node, node->op() != SetLocal); // We should have inserted a Flush before this! >- initialAccessData.operand(operand) = node->variableAccessData(); >- initialAccessNodes.operand(operand) = node; >- } >- >- // We want every Flush to be able to reach backwards to >- // a SetLocal. Doing this in the root block achieves this goal. >- NodeOrigin origin = block->at(0)->origin; >- Node* undefined = insertionSet.insertConstant(0, origin, jsUndefined()); >- >- for (unsigned i = 0; i < block->variablesAtTail.numberOfLocals(); i++) { >- VirtualRegister operand = virtualRegisterForLocal(i); >- DFG_ASSERT(m_graph, nullptr, initialAccessNodes.operand(operand)->op() == Flush); // We should have inserted a Flush before any SetLocal/SetArgumentDefinitely/SetArgumentMaybe for the local that we are analyzing now. >- VariableAccessData* accessData = initialAccessData.operand(operand); >- DFG_ASSERT(m_graph, nullptr, accessData); >- insertionSet.insertNode(0, SpecNone, >- SetLocal, origin, OpInfo(accessData), Edge(undefined)); >- accessData->mergeShouldNeverUnbox(true); // We don't know if we can exit here. >- } >- } >- >- >- VariableAccessData* newVariableAccessData(VirtualRegister operand) >- { >- ASSERT(!operand.isConstant()); >- >- m_graph.m_variableAccessData.append(VariableAccessData(operand)); >- return &m_graph.m_variableAccessData.last(); >- } >-}; >- >-bool performMaximalFlushInsertion(Graph& graph) >-{ >- return runPhase<MaximalFlushInsertionPhase>(graph); >-} >- >-} } // namespace JSC::DFG >- >-#endif // ENABLE(DFG_JIT) >diff --git a/Source/JavaScriptCore/dfg/DFGMaximalFlushInsertionPhase.h b/Source/JavaScriptCore/dfg/DFGMaximalFlushInsertionPhase.h >deleted file mode 100644 >index af310e9f3b2d84f5a0bd2922cc690d4027552be4..0000000000000000000000000000000000000000 >--- a/Source/JavaScriptCore/dfg/DFGMaximalFlushInsertionPhase.h >+++ /dev/null >@@ -1,54 +0,0 @@ >-/* >- * Copyright (C) 2015 Apple Inc. All rights reserved. >- * >- * Redistribution and use in source and binary forms, with or without >- * modification, are permitted provided that the following conditions >- * are met: >- * 1. Redistributions of source code must retain the above copyright >- * notice, this list of conditions and the following disclaimer. >- * 2. Redistributions in binary form must reproduce the above copyright >- * notice, this list of conditions and the following disclaimer in the >- * documentation and/or other materials provided with the distribution. >- * >- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY >- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR >- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, >- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, >- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR >- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY >- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE >- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >- */ >- >-#pragma once >- >-#if ENABLE(DFG_JIT) >- >-namespace JSC { namespace DFG { >- >-class Graph; >- >-// This phase ensures we keep all locals/arguments flushed. >-// What this means is: any node inbetween a SetLocal and a Flush should >-// be able to observe that particular local on the stack. This phase patterns >-// the graph by inserting a Flush before each SetLocal such that the Flush >-// we inserted can do a backwards search through all paths in the CFG and >-// reach a SetLocal. >-// .... >-// SetLocal(locX) >-// < >-// | >-// ... We ensure that locX is available on the stack to any nodes in this region that may ask for locX. >-// | >-// > >-// Flush(locX) >-// SetLocal(locX) >- >-bool performMaximalFlushInsertion(Graph&); >- >-} } // namespace JSC::DFG >- >-#endif // ENABLE(DFG_JIT) >diff --git a/Source/JavaScriptCore/dfg/DFGPlan.cpp b/Source/JavaScriptCore/dfg/DFGPlan.cpp >index 5758a6e82e17c77722a5b8ca395439b130f5cd90..ba30de3c9e3816b921804ebb5d7cbf339854bc33 100644 >--- a/Source/JavaScriptCore/dfg/DFGPlan.cpp >+++ b/Source/JavaScriptCore/dfg/DFGPlan.cpp >@@ -51,7 +51,6 @@ > #include "DFGLiveCatchVariablePreservationPhase.h" > #include "DFGLivenessAnalysisPhase.h" > #include "DFGLoopPreHeaderCreationPhase.h" >-#include "DFGMaximalFlushInsertionPhase.h" > #include "DFGMovHintRemovalPhase.h" > #include "DFGOSRAvailabilityAnalysisPhase.h" > #include "DFGOSREntrypointCreationPhase.h" >@@ -283,9 +282,6 @@ Plan::CompilationPath Plan::compileInThreadImpl() > > RUN_PHASE(performLiveCatchVariablePreservationPhase); > >- if (Options::useMaximalFlushInsertionPhase()) >- RUN_PHASE(performMaximalFlushInsertion); >- > RUN_PHASE(performCPSRethreading); > RUN_PHASE(performUnification); > RUN_PHASE(performPredictionInjection); >diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp >index c65c6dbd3592000b617fbdcf83592ff1b5c7015a..61296bcadbf435bdc02dbe7539154765de4f6a65 100644 >--- a/Source/JavaScriptCore/runtime/Options.cpp >+++ b/Source/JavaScriptCore/runtime/Options.cpp >@@ -468,10 +468,6 @@ static void recomputeDependentOptions() > Options::maximumEvalCacheableSourceLength() = 150000; > Options::useConcurrentJIT() = false; > } >- if (Options::useMaximalFlushInsertionPhase()) { >- Options::useOSREntryToDFG() = false; >- Options::useOSREntryToFTL() = false; >- } > > #if ENABLE(SEPARATED_WX_HEAP) > // Override globally for now. Longer term we'll just make the default >diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h >index aa37c00791b95423b168647bea1f741e9b9d6369..0b2bb4e9e73d206d14a7a99293b92f712dc24b5a 100644 >--- a/Source/JavaScriptCore/runtime/Options.h >+++ b/Source/JavaScriptCore/runtime/Options.h >@@ -318,8 +318,6 @@ constexpr bool enableWebAssemblyStreamingApi = false; > \ > v(unsigned, maximumVarargsForInlining, 100, Normal, nullptr) \ > \ >- v(bool, useMaximalFlushInsertionPhase, false, Normal, "Setting to true allows the DFG's MaximalFlushInsertionPhase to run.") \ >- \ > v(unsigned, maximumBinaryStringSwitchCaseLength, 50, Normal, nullptr) \ > v(unsigned, maximumBinaryStringSwitchTotalLength, 2000, Normal, nullptr) \ > \ >@@ -546,7 +544,6 @@ enum OptionEquivalence { > v(enableArchitectureSpecificOptimizations, useArchitectureSpecificOptimizations, SameOption) \ > v(enablePolyvariantCallInlining, usePolyvariantCallInlining, SameOption) \ > v(enablePolyvariantByIdInlining, usePolyvariantByIdInlining, SameOption) \ >- v(enableMaximalFlushInsertionPhase, useMaximalFlushInsertionPhase, SameOption) \ > v(objectsAreImmortal, useImmortalObjects, SameOption) \ > v(showObjectStatistics, dumpObjectStatistics, SameOption) \ > v(disableGC, useGC, InvertedOption) \ >diff --git a/Tools/ChangeLog b/Tools/ChangeLog >index 806e0b1b8cae70cb16c736727c8602b758e4da26..d0cd1983e16727383dfc0b05a7aa8cff22895c07 100644 >--- a/Tools/ChangeLog >+++ b/Tools/ChangeLog >@@ -1,3 +1,13 @@ >+2019-05-13 Tadeu Zagallo <tzagallo@apple.com> >+ >+ Remove MaximalFlushInsertionPhase >+ https://bugs.webkit.org/show_bug.cgi?id=197855 >+ <rdar://problem/50236506> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * Scripts/run-jsc-stress-tests: >+ > 2019-05-04 Alex Christensen <achristensen@webkit.org> > > Revert r244953 and r244954 because they broke internal builds. >diff --git a/Tools/Scripts/run-jsc-stress-tests b/Tools/Scripts/run-jsc-stress-tests >index a7be368588a5df26ddefe2a555412659e9fbeeec..6587c97d5c19af1c1d9bbf24a1c2ead17ab53b89 100755 >--- a/Tools/Scripts/run-jsc-stress-tests >+++ b/Tools/Scripts/run-jsc-stress-tests >@@ -772,10 +772,6 @@ def runNoCJIT(*optionalTestSpecificOptions) > run("no-cjit", *(NO_CJIT_OPTIONS + optionalTestSpecificOptions)) > end > >-def runDFGMaximalFlushPhase(*optionalTestSpecificOptions) >- run("dfg-maximal-flush-validate-no-cjit", "--forceCodeBlockToJettisonDueToOldAge=true", "--validateGraph=true", "--useMaximalFlushInsertionPhase=true", *(NO_CJIT_OPTIONS + optionalTestSpecificOptions)) >-end >- > def runShadowChicken(*optionalTestSpecificOptions) > run("shadow-chicken", "--useDFGJIT=false", "--alwaysUseShadowChicken=true", *optionalTestSpecificOptions) > end >@@ -793,7 +789,6 @@ def defaultRun > runDFGEager > if $mode != "basic" > runDFGEagerNoCJITValidate >- runDFGMaximalFlushPhase > end > > return if !$isFTLPlatform >@@ -825,7 +820,6 @@ def defaultNoNoLLIntRun > runDFGEager > if $mode != "basic" > runDFGEagerNoCJITValidate >- runDFGMaximalFlushPhase > end > > return if !$isFTLPlatform >@@ -870,7 +864,6 @@ end > > def defaultSpotCheck > defaultSpotCheckNoMaximalFlush >- runDFGMaximalFlushPhase > end > > # This is expected to not do eager runs because eager runs can have a lot of recompilations >@@ -903,7 +896,6 @@ def defaultNoSamplingProfilerRun > runNoCJITCollectContinuously if shouldCollectContinuously? > runDFGEager > runDFGEagerNoCJITValidate >- runDFGMaximalFlushPhase > > return if !$isFTLPlatform > >diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog >index c2316a6960e6628407f9cdb7dc3efee2b59cc899..003584738ba137c8d3d7b9c54a688dfa0a47016d 100644 >--- a/JSTests/ChangeLog >+++ b/JSTests/ChangeLog >@@ -1,3 +1,29 @@ >+2019-05-13 Tadeu Zagallo <tzagallo@apple.com> >+ >+ Remove MaximalFlushInsertionPhase >+ https://bugs.webkit.org/show_bug.cgi?id=197855 >+ <rdar://problem/50236506> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * stress/arith-ceil-on-various-types.js: >+ (checkCompileCountForUselessNegativeZero): >+ * stress/arith-floor-on-various-types.js: >+ (checkCompileCountForUselessNegativeZero): >+ * stress/arith-negate-on-various-types.js: >+ (checkCompileCountForUselessNegativeZero): >+ * stress/arith-round-on-various-types.js: >+ (checkCompileCountForUselessNegativeZero): >+ * stress/arith-trunc-on-various-types.js: >+ (checkCompileCountForUselessNegativeZero): >+ * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: >+ * stress/has-indexed-property-should-accept-non-int32.js: >+ * stress/has-indexed-property-with-worsening-array-mode.js: >+ * stress/known-int32-cant-be-used-across-bytecode-boundary.js: >+ * stress/read-dead-bytecode-locals-in-must-handle-values1.js: >+ * stress/read-dead-bytecode-locals-in-must-handle-values2.js: >+ * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: >+ > 2019-05-04 Tadeu Zagallo <tzagallo@apple.com> > > TypedArrays should not store properties that are canonical numeric indices >diff --git a/JSTests/stress/arith-ceil-on-various-types.js b/JSTests/stress/arith-ceil-on-various-types.js >index 29c2e4a682653aeb2c128e20a9c0f5ccea3b7811..ea96a4f831dea480e75d74f20ebfe7d085f958e3 100644 >--- a/JSTests/stress/arith-ceil-on-various-types.js >+++ b/JSTests/stress/arith-ceil-on-various-types.js >@@ -140,11 +140,8 @@ testSingleTypeCall(); > > function checkCompileCountForUselessNegativeZero(testFunction) > { >- if (jscOptions().useMaximalFlushInsertionPhase) { >- // If we forced a flush after the operation, the negative zero becomes >- // observable and we may be overly optimistic. >- return numberOfDFGCompiles(testFunction) <= 2; >- } >+ // FIXME: If we re-enable maximal flush, this should return <= 2 when the option is set >+ // https://bugs.webkit.org/show_bug.cgi?id=197852 > return numberOfDFGCompiles(testFunction) <= 1; > } > >diff --git a/JSTests/stress/arith-floor-on-various-types.js b/JSTests/stress/arith-floor-on-various-types.js >index ff740cc37795ef5497cdd4f39cd71d9534fd2290..79513ec2904cf5ff3a61304e4b1b3e1c2809b345 100644 >--- a/JSTests/stress/arith-floor-on-various-types.js >+++ b/JSTests/stress/arith-floor-on-various-types.js >@@ -140,11 +140,8 @@ testSingleTypeCall(); > > function checkCompileCountForUselessNegativeZero(testFunction) > { >- if (jscOptions().useMaximalFlushInsertionPhase) { >- // If we forced a flush after the operation, the negative zero becomes >- // observable and we may be overly optimistic. >- return numberOfDFGCompiles(testFunction) <= 2; >- } >+ // FIXME: If we re-enable maximal flush, this should return <= 2 when the option is set >+ // https://bugs.webkit.org/show_bug.cgi?id=197852 > return numberOfDFGCompiles(testFunction) <= 1; > } > >diff --git a/JSTests/stress/arith-negate-on-various-types.js b/JSTests/stress/arith-negate-on-various-types.js >index 7d3f19209ffed4da701bbf9c60b17997929fa1d3..705092395f5cda703be8b2d07dabee64c8093624 100644 >--- a/JSTests/stress/arith-negate-on-various-types.js >+++ b/JSTests/stress/arith-negate-on-various-types.js >@@ -120,11 +120,8 @@ testSingleTypeCall(); > > function checkCompileCountForUselessNegativeZero(testFunction) > { >- if (jscOptions().useMaximalFlushInsertionPhase) { >- // If we forced a flush after the operation, the negative zero becomes >- // observable and we may be overly optimistic. >- return numberOfDFGCompiles(testFunction) <= 2; >- } >+ // FIXME: If we re-enable maximal flush, this should return <= 2 when the option is set >+ // https://bugs.webkit.org/show_bug.cgi?id=197852 > return numberOfDFGCompiles(testFunction) <= 1; > } > >diff --git a/JSTests/stress/arith-round-on-various-types.js b/JSTests/stress/arith-round-on-various-types.js >index eb893393e1ac3f5a5005f4d82ec4f10624ca991d..af64cb2210425c2a7992eb5fc34584ee40d4d33c 100644 >--- a/JSTests/stress/arith-round-on-various-types.js >+++ b/JSTests/stress/arith-round-on-various-types.js >@@ -140,11 +140,8 @@ testSingleTypeCall(); > > function checkCompileCountForUselessNegativeZero(testFunction) > { >- if (jscOptions().useMaximalFlushInsertionPhase) { >- // If we forced a flush after the operation, the negative zero becomes >- // observable and we may be overly optimistic. >- return numberOfDFGCompiles(testFunction) <= 2; >- } >+ // FIXME: If we re-enable maximal flush, this should return <= 2 when the option is set >+ // https://bugs.webkit.org/show_bug.cgi?id=197852 > return numberOfDFGCompiles(testFunction) <= 1; > } > >diff --git a/JSTests/stress/arith-trunc-on-various-types.js b/JSTests/stress/arith-trunc-on-various-types.js >index 8469846ff926ebe8ff55b46865ac26980851841f..28981dc7c02abeda5babc6f47d909053dea8cf14 100644 >--- a/JSTests/stress/arith-trunc-on-various-types.js >+++ b/JSTests/stress/arith-trunc-on-various-types.js >@@ -140,11 +140,8 @@ testSingleTypeCall(); > > function checkCompileCountForUselessNegativeZero(testFunction) > { >- if (jscOptions().useMaximalFlushInsertionPhase) { >- // If we forced a flush after the operation, the negative zero becomes >- // observable and we may be overly optimistic. >- return numberOfDFGCompiles(testFunction) <= 2; >- } >+ // FIXME: If we re-enable maximal flush, this should return <= 2 when the option is set >+ // https://bugs.webkit.org/show_bug.cgi?id=197852 > return numberOfDFGCompiles(testFunction) <= 1; > } > >diff --git a/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js b/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js >index 61ffa55fc299b6a21ebb1b21546908c45e464cef..c85ed2e05d2bd6396096cd6b96ac6906a3a3de2c 100644 >--- a/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js >+++ b/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js >@@ -1,4 +1,6 @@ >-//@ runDefault("--collectContinuously=true", "--collectContinuouslyPeriodMS=0.15", "--useMaximalFlushInsertionPhase=true", "--useLLInt=false", "--useFTLJIT=false", "--jitPolicyScale=0") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 >+//@ runDefault("--collectContinuously=true", "--collectContinuouslyPeriodMS=0.15", "--useLLInt=false", "--useFTLJIT=false", "--jitPolicyScale=0") > > // This test exercises DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(). > >diff --git a/JSTests/stress/has-indexed-property-should-accept-non-int32.js b/JSTests/stress/has-indexed-property-should-accept-non-int32.js >index 5e5486b2d10e42efee4cbd34f925343e4371f6a6..0c819b7f8bbc842e6fdd70ab8d858c7a45095f98 100644 >--- a/JSTests/stress/has-indexed-property-should-accept-non-int32.js >+++ b/JSTests/stress/has-indexed-property-should-accept-non-int32.js >@@ -1,4 +1,6 @@ >-//@ runDefault("--useRandomizingFuzzerAgent=1", "--jitPolicyScale=0", "--useMaximalFlushInsertionPhase=1", "--useConcurrentJIT=0") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 >+//@ runDefault("--useRandomizingFuzzerAgent=1", "--jitPolicyScale=0", "--useConcurrentJIT=0") > function foo(obj) { > for (var x in obj) { > if (0 > 0) { >diff --git a/JSTests/stress/has-indexed-property-with-worsening-array-mode.js b/JSTests/stress/has-indexed-property-with-worsening-array-mode.js >index f942410a35488c86ec3238fdf816c3d14f81dc72..ce8dcf05cec6b050b1ebb5949601e6e1b1c62442 100644 >--- a/JSTests/stress/has-indexed-property-with-worsening-array-mode.js >+++ b/JSTests/stress/has-indexed-property-with-worsening-array-mode.js >@@ -1,4 +1,6 @@ >-//@ requireOptions("--watchdog=1000", "--watchdog-exception-ok", "--useMaximalFlushInsertionPhase=1") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 >+//@ requireOptions("--watchdog=1000", "--watchdog-exception-ok") > // This test only seems to reproduce the issue when it runs in an infinite loop. So we use the watchdog to time it out. > for (let x in [0]) { > break >diff --git a/JSTests/stress/known-int32-cant-be-used-across-bytecode-boundary.js b/JSTests/stress/known-int32-cant-be-used-across-bytecode-boundary.js >index fc0c4ab77c7c643a43af288fc7836aa6ccaf75d5..6c5b872c48bc70e40e19bd1764670b3ca72b6bf6 100644 >--- a/JSTests/stress/known-int32-cant-be-used-across-bytecode-boundary.js >+++ b/JSTests/stress/known-int32-cant-be-used-across-bytecode-boundary.js >@@ -1,4 +1,5 @@ >-//@ runDefault("--useConcurrentJIT=0", "--useMaximalFlushInsertionPhase=1") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 > > function foo() { > var x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13; >diff --git a/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values1.js b/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values1.js >index 9e2ae386da5dd1e66ec01e91d5483834fc73fee7..5f55248ab85a097d137835de9d81e9b57293d173 100644 >--- a/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values1.js >+++ b/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values1.js >@@ -1,4 +1,6 @@ >-//@ runDefault("--useMaximalFlushInsertionPhase=1", "--useConcurrentJIT=0") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 >+//@ runDefault("--useConcurrentJIT=0") > function bar(x) { > if (x) { > return; >diff --git a/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values2.js b/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values2.js >index feb3cfa157daeb570c8a16638e6528d277638ec1..2016e9c00ed282245d6c34f4e5bfc27bf9af5909 100644 >--- a/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values2.js >+++ b/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values2.js >@@ -1,4 +1,6 @@ >-//@ runDefault("--useMaximalFlushInsertionPhase=1", "--useConcurrentJIT=0") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 >+//@ runDefault("--useConcurrentJIT=0") > function bar(c) { > if (c > 1) { > bar(parseInt(c * 2)) >diff --git a/JSTests/stress/to-index-string-should-not-assume-incoming-value-is-uint32.js b/JSTests/stress/to-index-string-should-not-assume-incoming-value-is-uint32.js >index 5c8b25a0e2fcbfb9c5e66620f3eefba688053e0e..c095b4f1a77a751d3a71d159a923ed0ebf66be94 100644 >--- a/JSTests/stress/to-index-string-should-not-assume-incoming-value-is-uint32.js >+++ b/JSTests/stress/to-index-string-should-not-assume-incoming-value-is-uint32.js >@@ -1,4 +1,6 @@ >-//@ runDefault("--useMaximalFlushInsertionPhase=1", "--useRandomizingFuzzerAgent=1") >+// FIXME: If we re-enable maximal flush, this test should use it >+// https://bugs.webkit.org/show_bug.cgi?id=197852 >+//@ runDefault("--useRandomizingFuzzerAgent=1") > > function foo() { > for (var x in ['a', 'b']) {
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=369794">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 197855
:
369794
|
369802
|
369823
|
369898