Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (211907 => 211908)
--- trunk/Source/_javascript_Core/ChangeLog 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1,3 +1,57 @@
+2017-02-08 Keith Miller <[email protected]>
+
+ [JSC] op_in should have ArrayProfile
+ https://bugs.webkit.org/show_bug.cgi?id=164581
+
+ Reviewed by Filip Pizlo.
+
+ This patch adds an ArrayProfile to the op_in bytecode. In the
+ DFG, if we see that we the key is an int32 we will convert the In
+ DFG node to a HasIndexedProperty node instead.
+
+ This patch also flips the two arguments of op_in and the In node
+ to reflect the other property lookup bytecodes.
+
+ * bytecode/BytecodeList.json:
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::dumpBytecode):
+ (JSC::CodeBlock::finishCreation):
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::emitIn):
+ * bytecompiler/BytecodeGenerator.h:
+ (JSC::BytecodeGenerator::emitIn): Deleted.
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::InNode::emitBytecode):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ (JSC::DFG::FixupPhase::convertToHasIndexedProperty):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::hasArrayMode):
+ (JSC::DFG::Node::hasInternalMethodType):
+ (JSC::DFG::Node::internalMethodType):
+ (JSC::DFG::Node::setInternalMethodType):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileIn):
+ * dfg/DFGSpeculativeJIT.h:
+ (JSC::DFG::SpeculativeJIT::callOperation):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+ (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
+ * jit/JITOperations.cpp:
+ * jit/JITOperations.h:
+ * llint/LowLevelInterpreter.asm:
+ * parser/Nodes.h:
+ * runtime/CommonSlowPaths.cpp:
+ (JSC::SLOW_PATH_DECL):
+ * runtime/CommonSlowPaths.h:
+ (JSC::CommonSlowPaths::opIn):
+
2017-02-08 Saam Barati <[email protected]>
Air IRC might spill a terminal that produces a value after the terminal
Modified: trunk/Source/_javascript_Core/bytecode/BytecodeList.json (211907 => 211908)
--- trunk/Source/_javascript_Core/bytecode/BytecodeList.json 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/bytecode/BytecodeList.json 2017-02-09 00:02:20 UTC (rev 211908)
@@ -62,7 +62,7 @@
{ "name" : "op_is_object_or_null", "length" : 3 },
{ "name" : "op_is_function", "length" : 3 },
{ "name" : "op_is_cell_with_type", "length" : 4 },
- { "name" : "op_in", "length" : 4 },
+ { "name" : "op_in", "length" : 5 },
{ "name" : "op_get_array_length", "length" : 9 },
{ "name" : "op_get_by_id", "length" : 9 },
{ "name" : "op_get_by_id_proto_load", "length" : 9 },
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1105,6 +1105,7 @@
}
case op_in: {
printBinaryOp(out, exec, location, it, "in");
+ dumpArrayProfiling(out, it, hasPrintedProfiling);
break;
}
case op_try_get_by_id: {
@@ -2095,12 +2096,9 @@
linkValueProfile(i, opLength);
break;
}
- case op_put_by_val: {
- int arrayProfileIndex = pc[opLength - 1].u.operand;
- m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
- instructions[i + opLength - 1] = &m_arrayProfiles[arrayProfileIndex];
- break;
- }
+
+ case op_in:
+ case op_put_by_val:
case op_put_by_val_direct: {
int arrayProfileIndex = pc[opLength - 1].u.operand;
m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -2571,6 +2571,17 @@
return dst;
}
+RegisterID* BytecodeGenerator::emitIn(RegisterID* dst, RegisterID* property, RegisterID* base)
+{
+ UnlinkedArrayProfile arrayProfile = newArrayProfile();
+ emitOpcode(op_in);
+ instructions().append(dst->index());
+ instructions().append(base->index());
+ instructions().append(property->index());
+ instructions().append(arrayProfile);
+ return dst;
+}
+
RegisterID* BytecodeGenerator::emitTryGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
{
ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties are not supported with tryGetById.");
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h (211907 => 211908)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h 2017-02-09 00:02:20 UTC (rev 211908)
@@ -628,7 +628,7 @@
RegisterID* emitInstanceOf(RegisterID* dst, RegisterID* value, RegisterID* basePrototype);
RegisterID* emitInstanceOfCustom(RegisterID* dst, RegisterID* value, RegisterID* constructor, RegisterID* hasInstanceValue);
RegisterID* emitTypeOf(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_typeof, dst, src); }
- RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
+ RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base);
RegisterID* emitTryGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
Modified: trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -2042,6 +2042,17 @@
return dstReg.get();
}
+// ------------------------------ InNode ----------------------------
+
+RegisterID* InNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+ RefPtr<RegisterID> key = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+ RefPtr<RegisterID> base = generator.emitNode(m_expr2);
+ generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+ return generator.emitIn(generator.finalDestination(dst, key.get()), key.get(), base.get());
+}
+
+
// ------------------------------ LogicalOpNode ----------------------------
RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -5481,8 +5481,9 @@
}
case op_in: {
+ ArrayMode arrayMode = getArrayMode(currentInstruction[OPCODE_LENGTH(op_in) - 1].u.arrayProfile);
set(VirtualRegister(currentInstruction[1].u.operand),
- addToGraph(In, get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand))));
+ addToGraph(In, OpInfo(arrayMode.asWord()), get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand))));
NEXT_OPCODE(op_in);
}
@@ -5511,7 +5512,7 @@
Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
- Node* hasIterableProperty = addToGraph(HasIndexedProperty, OpInfo(arrayMode.asWord()), base, property);
+ Node* hasIterableProperty = addToGraph(HasIndexedProperty, OpInfo(arrayMode.asWord()), OpInfo(static_cast<uint32_t>(PropertySlot::InternalMethodType::GetOwnProperty)), base, property);
set(VirtualRegister(currentInstruction[1].u.operand), hasIterableProperty);
NEXT_OPCODE(op_has_indexed_property);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1363,10 +1363,12 @@
break;
case In: {
- // FIXME: We should at some point have array profiling on op_in, in which
- // case we would be able to turn this into a kind of GetByVal.
-
- fixEdge<CellUse>(node->child2());
+ if (node->child2()->shouldSpeculateInt32()) {
+ convertToHasIndexedProperty(node);
+ break;
+ }
+
+ fixEdge<CellUse>(node->child1());
break;
}
@@ -2652,7 +2654,7 @@
else
truncateConstantToInt32(node->child2());
}
-
+
bool attemptToMakeIntegerAdd(Node* node)
{
AddSpeculationMode mode = m_graph.addSpeculationMode(node, FixupPass);
@@ -2743,7 +2745,25 @@
m_indexInBlock, SpecInt32Only, GetArrayLength, origin,
OpInfo(arrayMode.asWord()), Edge(child, KnownCellUse), Edge(storage));
}
-
+
+ void convertToHasIndexedProperty(Node* node)
+ {
+ node->setOp(HasIndexedProperty);
+ node->clearFlags(NodeMustGenerate);
+ node->setArrayMode(
+ node->arrayMode().refine(
+ m_graph, node,
+ node->child1()->prediction(),
+ node->child2()->prediction(),
+ SpecNone));
+ node->setInternalMethodType(PropertySlot::InternalMethodType::HasProperty);
+
+ blessArrayOperation(node->child1(), node->child2(), node->child3());
+
+ fixEdge<CellUse>(node->child1());
+ fixEdge<Int32Use>(node->child2());
+ }
+
bool attemptToMakeCallDOM(Node* node)
{
if (m_graph.hasExitSite(node->origin.semantic, BadType))
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1788,6 +1788,7 @@
switch (op()) {
case GetIndexedPropertyStorage:
case GetArrayLength:
+ case In:
case PutByValDirect:
case PutByVal:
case PutByValAlias:
@@ -2421,6 +2422,23 @@
return m_opInfo.as<const DOMJIT::Signature*>();
}
+ bool hasInternalMethodType() const
+ {
+ return op() == HasIndexedProperty;
+ }
+
+ PropertySlot::InternalMethodType internalMethodType() const
+ {
+ ASSERT(hasInternalMethodType());
+ return static_cast<PropertySlot::InternalMethodType>(m_opInfo2.as<uint32_t>());
+ }
+
+ void setInternalMethodType(PropertySlot::InternalMethodType type)
+ {
+ ASSERT(hasInternalMethodType());
+ m_opInfo2 = static_cast<uint32_t>(type);
+ }
+
Node* replacement() const
{
return m_misc.replacement;
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1037,10 +1037,10 @@
void SpeculativeJIT::compileIn(Node* node)
{
- SpeculateCellOperand base(this, node->child2());
+ SpeculateCellOperand base(this, node->child1());
GPRReg baseGPR = base.gpr();
- if (JSString* string = node->child1()->dynamicCastConstant<JSString*>(*m_jit.vm())) {
+ if (JSString* string = node->child2()->dynamicCastConstant<JSString*>(*m_jit.vm())) {
if (string->tryGetValueImpl() && string->tryGetValueImpl()->isAtomic()) {
StructureStubInfo* stubInfo = m_jit.codeBlock()->addStubInfo(AccessType::In);
@@ -1047,7 +1047,7 @@
GPRTemporary result(this);
GPRReg resultGPR = result.gpr();
- use(node->child1());
+ use(node->child2());
MacroAssembler::PatchableJump jump = m_jit.patchableJump();
MacroAssembler::Label done = m_jit.label();
@@ -1079,7 +1079,7 @@
}
}
- JSValueOperand key(this, node->child1());
+ JSValueOperand key(this, node->child2());
JSValueRegs regs = key.jsValueRegs();
GPRFlushedCallResult result(this);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1539,6 +1539,11 @@
m_jit.setupArgumentsWithExecState(arg1, arg2);
return appendCallSetResult(operation, result);
}
+ JITCompiler::Call callOperation(J_JITOperation_ECZZ operation, GPRReg result, GPRReg arg1, GPRReg arg2, int32_t constant)
+ {
+ m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImm32(constant));
+ return appendCallSetResult(operation, result);
+ }
JITCompiler::Call callOperation(J_JITOperation_ESsiCI operation, GPRReg result, StructureStubInfo* stubInfo, GPRReg arg1, const UniquedStringImpl* uid)
{
m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
@@ -2074,6 +2079,11 @@
m_jit.setupArgumentsWithExecState(arg1, arg2);
return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
}
+ JITCompiler::Call callOperation(J_JITOperation_ECZZ operation, JSValueRegs result, GPRReg arg1, GPRReg arg2, int32_t constant)
+ {
+ m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImm32(constant));
+ return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+ }
JITCompiler::Call callOperation(J_JITOperation_EJscC operation, JSValueRegs result, GPRReg arg1, JSCell* cell)
{
m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), cell));
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -5280,7 +5280,7 @@
moveTrueTo(resultPayloadGPR);
MacroAssembler::Jump done = m_jit.jump();
- addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, JSValueRegs(resultTagGPR, resultPayloadGPR), baseGPR, indexGPR));
+ addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, JSValueRegs(resultTagGPR, resultPayloadGPR), baseGPR, indexGPR, static_cast<int32_t>(node->internalMethodType())));
done.link(&m_jit);
booleanResult(resultPayloadGPR, node);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -5476,7 +5476,7 @@
}
}
- addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, resultGPR, baseGPR, indexGPR));
+ addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, resultGPR, baseGPR, indexGPR, static_cast<int32_t>(node->internalMethodType())));
jsValueResult(resultGPR, node, DataFormatJSBoolean);
break;
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -8039,12 +8039,12 @@
void compileIn()
{
- DFG_ASSERT(m_graph, m_node, m_node->child2().useKind() == CellUse);
+ DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == CellUse);
Node* node = m_node;
- Edge base = node->child2();
+ Edge base = node->child1();
LValue cell = lowCell(base);
- if (JSString* string = node->child1()->dynamicCastConstant<JSString*>(vm())) {
+ if (JSString* string = node->child2()->dynamicCastConstant<JSString*>(vm())) {
if (string->tryGetValueImpl() && string->tryGetValueImpl()->isAtomic()) {
UniquedStringImpl* str = bitwise_cast<UniquedStringImpl*>(string->tryGetValueImpl());
B3::PatchpointValue* patchpoint = m_out.patchpoint(Int64);
@@ -8116,7 +8116,7 @@
}
}
- setJSValue(vmCall(Int64, m_out.operation(operationGenericIn), m_callFrame, cell, lowJSValue(m_node->child1())));
+ setJSValue(vmCall(Int64, m_out.operation(operationGenericIn), m_callFrame, cell, lowJSValue(m_node->child2())));
}
void compileHasOwnProperty()
@@ -8351,6 +8351,7 @@
LValue base = lowCell(m_node->child1());
LValue index = lowInt32(m_node->child2());
LValue storage = lowStorage(m_node->child3());
+ LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties;
@@ -8376,7 +8377,7 @@
m_out.appendTo(slowCase, continuation);
ValueFromBlock slowResult = m_out.anchor(m_out.equal(
m_out.constInt64(JSValue::encode(jsBoolean(true))),
- vmCall(Int64, m_out.operation(operationHasIndexedProperty), m_callFrame, base, index)));
+ vmCall(Int64, m_out.operation(operationHasIndexedProperty), m_callFrame, base, index, internalMethodType)));
m_out.jump(continuation);
m_out.appendTo(continuation, lastNext);
@@ -8387,6 +8388,7 @@
LValue base = lowCell(m_node->child1());
LValue index = lowInt32(m_node->child2());
LValue storage = lowStorage(m_node->child3());
+ LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
@@ -8411,7 +8413,7 @@
m_out.appendTo(slowCase, continuation);
ValueFromBlock slowResult = m_out.anchor(m_out.equal(
m_out.constInt64(JSValue::encode(jsBoolean(true))),
- vmCall(Int64, m_out.operation(operationHasIndexedProperty), m_callFrame, base, index)));
+ vmCall(Int64, m_out.operation(operationHasIndexedProperty), m_callFrame, base, index, internalMethodType)));
m_out.jump(continuation);
m_out.appendTo(continuation, lastNext);
Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/jit/JITOperations.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -321,7 +321,7 @@
VM* vm = &exec->vm();
NativeCallFrameTracer tracer(vm, exec);
- return JSValue::encode(jsBoolean(CommonSlowPaths::opIn(exec, JSValue::decode(key), base)));
+ return JSValue::encode(jsBoolean(CommonSlowPaths::opIn(exec, base, JSValue::decode(key))));
}
void JIT_OPERATION operationPutByIdStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
@@ -2254,12 +2254,12 @@
return JSValue::encode(jsBoolean(base->hasPropertyGeneric(exec, asString(propertyName)->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
}
-EncodedJSValue JIT_OPERATION operationHasIndexedProperty(ExecState* exec, JSCell* baseCell, int32_t subscript)
+EncodedJSValue JIT_OPERATION operationHasIndexedProperty(ExecState* exec, JSCell* baseCell, int32_t subscript, int32_t internalMethodType)
{
VM& vm = exec->vm();
NativeCallFrameTracer tracer(&vm, exec);
JSObject* object = baseCell->toObject(exec, exec->lexicalGlobalObject());
- return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, subscript, PropertySlot::InternalMethodType::GetOwnProperty)));
+ return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, subscript, static_cast<PropertySlot::InternalMethodType>(internalMethodType))));
}
JSCell* JIT_OPERATION operationGetPropertyEnumerator(ExecState* exec, JSCell* cell)
Modified: trunk/Source/_javascript_Core/jit/JITOperations.h (211907 => 211908)
--- trunk/Source/_javascript_Core/jit/JITOperations.h 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/jit/JITOperations.h 2017-02-09 00:02:20 UTC (rev 211908)
@@ -131,6 +131,7 @@
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECI)(ExecState*, JSCell*, UniquedStringImpl*);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECJ)(ExecState*, JSCell*, EncodedJSValue);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECZ)(ExecState*, JSCell*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECZZ)(ExecState*, JSCell*, int32_t, int32_t);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EDA)(ExecState*, double, JSArray*);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EE)(ExecState*, ExecState*);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EGReoJ)(ExecState*, JSGlobalObject*, RegExpObject*, EncodedJSValue);
@@ -435,7 +436,7 @@
int32_t JIT_OPERATION operationInstanceOfCustom(ExecState*, EncodedJSValue encodedValue, JSObject* constructor, EncodedJSValue encodedHasInstance) WTF_INTERNAL;
EncodedJSValue JIT_OPERATION operationHasGenericProperty(ExecState*, EncodedJSValue, JSCell*);
-EncodedJSValue JIT_OPERATION operationHasIndexedProperty(ExecState*, JSCell*, int32_t);
+EncodedJSValue JIT_OPERATION operationHasIndexedProperty(ExecState*, JSCell*, int32_t, int32_t);
JSCell* JIT_OPERATION operationGetPropertyEnumerator(ExecState*, JSCell*);
EncodedJSValue JIT_OPERATION operationNextEnumeratorPname(ExecState*, JSCell*, int32_t);
JSCell* JIT_OPERATION operationToIndexString(ExecState*, int32_t);
Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter.asm (211907 => 211908)
--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter.asm 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter.asm 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1391,7 +1391,7 @@
_llint_op_in:
traceExecution()
callOpcodeSlowPath(_slow_path_in)
- dispatch(4)
+ dispatch(5)
_llint_op_try_get_by_id:
Modified: trunk/Source/_javascript_Core/parser/Nodes.h (211907 => 211908)
--- trunk/Source/_javascript_Core/parser/Nodes.h 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/parser/Nodes.h 2017-02-09 00:02:20 UTC (rev 211908)
@@ -1152,6 +1152,9 @@
class InNode : public ThrowableBinaryOpNode {
public:
InNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+
+ private:
+ RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
};
class EqualNode : public BinaryOpNode {
Modified: trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp (211907 => 211908)
--- trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp 2017-02-09 00:02:20 UTC (rev 211908)
@@ -40,6 +40,7 @@
#include "ExceptionFuzz.h"
#include "GetterSetter.h"
#include "HostCallReturnValue.h"
+#include "ICStats.h"
#include "Interpreter.h"
#include "IteratorOperations.h"
#include "JIT.h"
@@ -620,7 +621,7 @@
SLOW_PATH_DECL(slow_path_in)
{
BEGIN();
- RETURN(jsBoolean(CommonSlowPaths::opIn(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+ RETURN(jsBoolean(CommonSlowPaths::opIn(exec, OP_C(2).jsValue(), OP_C(3).jsValue(), pc[4].u.arrayProfile)));
}
SLOW_PATH_DECL(slow_path_del_by_val)
Modified: trunk/Source/_javascript_Core/runtime/CommonSlowPaths.h (211907 => 211908)
--- trunk/Source/_javascript_Core/runtime/CommonSlowPaths.h 2017-02-08 23:51:04 UTC (rev 211907)
+++ trunk/Source/_javascript_Core/runtime/CommonSlowPaths.h 2017-02-09 00:02:20 UTC (rev 211908)
@@ -71,7 +71,7 @@
return paddedStackSpace;
}
-inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)
+inline bool opIn(ExecState* exec, JSValue baseVal, JSValue propName, ArrayProfile* arrayProfile = nullptr)
{
VM& vm = exec->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
@@ -81,6 +81,8 @@
}
JSObject* baseObj = asObject(baseVal);
+ if (arrayProfile)
+ arrayProfile->observeStructure(baseObj->structure(vm));
uint32_t i;
if (propName.getUInt32(i)) {
