Sane chain and string watchpoints should be set in FixupPhase or the backend rather than WatchpointCollectionPhase
https://bugs.webkit.org/show_bug.cgi?id=144665
Reviewed by Michael Saboff.
This is a step towards getting rid of WatchpointCollectionPhase. It's also a step towards
extending SaneChain to all indexing shapes.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode): Set the watchpoints here so that we don't need a case in WatchpointCollectionPhase.
(JSC::DFG::FixupPhase::checkArray): Clarify the need for checking the structure. We often forget why we do this instead of always using CheckArray.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnString): Set the watchpoints here so that we don't need a case in WatchpointCollectionPhase.
* dfg/DFGWatchpointCollectionPhase.cpp:
(JSC::DFG::WatchpointCollectionPhase::handle): Remove some code.
(JSC::DFG::WatchpointCollectionPhase::handleStringGetByVal): Deleted.
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileStringCharAt): Set the watchpoints here so that we don't need a case in WatchpointCollectionPhase.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@183897 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 8be0089..7ab1b16 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -28,6 +28,7 @@
#if ENABLE(DFG_JIT)
+#include "ArrayPrototype.h"
#include "DFGGraph.h"
#include "DFGInsertionSet.h"
#include "DFGPhase.h"
@@ -517,10 +518,17 @@
switch (arrayMode.type()) {
case Array::Double:
if (arrayMode.arrayClass() == Array::OriginalArray
- && arrayMode.speculation() == Array::InBounds
- && m_graph.globalObjectFor(node->origin.semantic)->arrayPrototypeChainIsSane()
- && !(node->flags() & NodeBytecodeUsesAsOther))
- node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
+ && arrayMode.speculation() == Array::InBounds) {
+ JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+ if (globalObject->arrayPrototypeChainIsSane()
+ && !(node->flags() & NodeBytecodeUsesAsOther)) {
+ m_graph.watchpoints().addLazily(
+ globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
+ m_graph.watchpoints().addLazily(
+ globalObject->objectPrototype()->structure()->transitionWatchpointSet());
+ node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
+ }
+ }
break;
case Array::String:
@@ -1542,10 +1550,12 @@
m_insertionSet.insertNode(
m_indexInBlock, SpecNone, Check, origin, Edge(array, StringUse));
} else {
+ // Note that we only need to be using a structure check if we opt for SaneChain, since
+ // that needs to protect against JSArray's __proto__ being changed.
Structure* structure = arrayMode.originalArrayStructure(m_graph, origin.semantic);
Edge indexEdge = index ? Edge(index, Int32Use) : Edge();
-
+
if (arrayMode.doesConversion()) {
if (structure) {
m_insertionSet.insertNode(
