Bug 951497 - Add type constraints for definite property analysis. r=jandem, a=abillings
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 02 Jan 2014 11:53:38 -0500
changeset 167813 fcd21692c90661aa828de377e35521d30ff431e2
parent 167812 54ba69e5c5f9333ee389d5343a37d66a0215ac5a
child 167814 db102e35eec3bce0c994483073ee53a25ae59aba
push id428
push userbbajaj@mozilla.com
push dateTue, 28 Jan 2014 00:16:25 +0000
treeherdermozilla-release@cd72a7ff3a75 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, abillings
bugs951497
milestone27.0
Bug 951497 - Add type constraints for definite property analysis. r=jandem, a=abillings
js/src/jit/IonAnalysis.cpp
js/src/jsinfer.cpp
js/src/jsinfer.h
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -2109,16 +2109,18 @@ jit::AnalyzeNewScriptProperties(JSContex
                        &inspector, &info, /* baselineFrame = */ nullptr);
 
     if (!builder.build()) {
         if (builder.abortReason() == AbortReason_Alloc)
             return false;
         return true;
     }
 
+    types::FinishDefinitePropertiesAnalysis(cx, constraints);
+
     if (!SplitCriticalEdges(graph))
         return false;
 
     if (!RenumberBlocks(graph))
         return false;
 
     if (!BuildDominatorTree(graph))
         return false;
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -881,20 +881,18 @@ CheckFrozenTypeSet(JSContext *cx, Tempor
 
     if (!actual->isSubset(frozen))
         return false;
 
     if (!frozen->isSubset(actual)) {
         TypeSet::TypeList list;
         frozen->enumerateTypes(&list);
 
-        for (size_t i = 0; i < list.length(); i++) {
-            // Note: On OOM this will preserve the type set's contents.
+        for (size_t i = 0; i < list.length(); i++)
             actual->addType(cx, list[i]);
-        }
     }
 
     return true;
 }
 
 namespace {
 
 /*
@@ -988,16 +986,51 @@ types::FinishCompilation(JSContext *cx, 
         types.constrainedOutputs->back().invalidate();
         script->resetUseCount();
         return false;
     }
 
     return true;
 }
 
+static void
+CheckDefinitePropertiesTypeSet(JSContext *cx, TemporaryTypeSet *frozen, StackTypeSet *actual)
+{
+    // The definite properties analysis happens on the main thread, so no new
+    // types can have been added to actual. The analysis may have updated the
+    // contents of |frozen| though with new speculative types, and these need
+    // to be reflected in |actual| for AddClearDefiniteFunctionUsesInScript
+    // to work.
+    JS_ASSERT(actual->isSubset(frozen));
+
+    if (!frozen->isSubset(actual)) {
+        TypeSet::TypeList list;
+        frozen->enumerateTypes(&list);
+
+        for (size_t i = 0; i < list.length(); i++)
+            actual->addType(cx, list[i]);
+    }
+}
+
+void
+types::FinishDefinitePropertiesAnalysis(JSContext *cx, CompilerConstraintList *constraints)
+{
+    for (size_t i = 0; i < constraints->numFrozenScripts(); i++) {
+        const CompilerConstraintList::FrozenScript &entry = constraints->frozenScript(i);
+        JS_ASSERT(entry.script->types);
+
+        CheckDefinitePropertiesTypeSet(cx, entry.thisTypes, types::TypeScript::ThisTypes(entry.script));
+        unsigned nargs = entry.script->function() ? entry.script->function()->nargs() : 0;
+        for (size_t i = 0; i < nargs; i++)
+            CheckDefinitePropertiesTypeSet(cx, &entry.argTypes[i], types::TypeScript::ArgTypes(entry.script, i));
+        for (size_t i = 0; i < entry.script->nTypeSets(); i++)
+            CheckDefinitePropertiesTypeSet(cx, &entry.bytecodeTypes[i], &entry.script->types->typeArray()[i]);
+    }
+}
+
 namespace {
 
 // Constraint which triggers recompilation of a script if any type is added to a type set. */
 class ConstraintDataFreeze
 {
   public:
     ConstraintDataFreeze() {}
 
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -1219,16 +1219,21 @@ class RecompileInfo;
 
 // Allocate a CompilerOutput for a finished compilation and generate the type
 // constraints for the compilation. Returns whether the type constraints
 // still hold.
 bool
 FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode executionMode,
                   CompilerConstraintList *constraints, RecompileInfo *precompileInfo);
 
+// Update the actual types in any scripts queried by constraints with any
+// speculative types added during the definite properties analysis.
+void
+FinishDefinitePropertiesAnalysis(JSContext *cx, CompilerConstraintList *constraints);
+
 struct ArrayTableKey;
 typedef HashMap<ArrayTableKey,ReadBarriered<TypeObject>,ArrayTableKey,SystemAllocPolicy> ArrayTypeTable;
 
 struct ObjectTableKey;
 struct ObjectTableEntry;
 typedef HashMap<ObjectTableKey,ObjectTableEntry,ObjectTableKey,SystemAllocPolicy> ObjectTypeTable;
 
 struct AllocationSiteKey;