Diff
Modified: trunk/JSTests/ChangeLog (223918 => 223919)
--- trunk/JSTests/ChangeLog 2017-10-24 20:47:11 UTC (rev 223918)
+++ trunk/JSTests/ChangeLog 2017-10-24 20:48:03 UTC (rev 223919)
@@ -1,3 +1,14 @@
+2017-10-24 Yusuke Suzuki <[email protected]>
+
+ [FTL] Support NewStringObject
+ https://bugs.webkit.org/show_bug.cgi?id=178737
+
+ Reviewed by Saam Barati.
+
+ * stress/new-string-object.js: Added.
+ (shouldBe):
+ (test):
+
2017-10-15 Yusuke Suzuki <[email protected]>
[JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
Added: trunk/JSTests/stress/new-string-object.js (0 => 223919)
--- trunk/JSTests/stress/new-string-object.js (rev 0)
+++ trunk/JSTests/stress/new-string-object.js 2017-10-24 20:48:03 UTC (rev 223919)
@@ -0,0 +1,16 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(string)
+{
+ return new String(string);
+}
+noInline(test);
+
+for (var i = 0; i < 1e4; ++i) {
+ var object = test("Cocoa");
+ shouldBe(object instanceof String, true);
+ shouldBe(object.valueOf(), "Cocoa");
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (223918 => 223919)
--- trunk/Source/_javascript_Core/ChangeLog 2017-10-24 20:47:11 UTC (rev 223918)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-10-24 20:48:03 UTC (rev 223919)
@@ -1,3 +1,20 @@
+2017-10-24 Yusuke Suzuki <[email protected]>
+
+ [FTL] Support NewStringObject
+ https://bugs.webkit.org/show_bug.cgi?id=178737
+
+ Reviewed by Saam Barati.
+
+ FTL should support NewStringObject and encourage use of NewStringObject in DFG pipeline.
+ After this change, we can convert `CallObjectConstructor(String)` to `NewStringObject(String)`.
+
+ * ftl/FTLAbstractHeapRepository.h:
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+ (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
+
2017-10-24 Guillaume Emont <[email protected]>
[mips] fix offsets of branches that have to go over a jump
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h (223918 => 223919)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2017-10-24 20:47:11 UTC (rev 223918)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2017-10-24 20:48:03 UTC (rev 223919)
@@ -66,6 +66,7 @@
macro(JSCell_typeInfoFlags, JSCell::typeInfoFlagsOffset()) \
macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
macro(JSCell_usefulBytes, JSCell::indexingTypeAndMiscOffset()) \
+ macro(JSDestructibleObject_classInfo, JSDestructibleObject::classInfoOffset()) \
macro(JSFunction_executable, JSFunction::offsetOfExecutable()) \
macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
macro(JSFunction_rareData, JSFunction::offsetOfRareData()) \
Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (223918 => 223919)
--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2017-10-24 20:47:11 UTC (rev 223918)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2017-10-24 20:48:03 UTC (rev 223919)
@@ -72,6 +72,7 @@
case GetButterfly:
case GetButterflyWithoutCaging:
case NewObject:
+ case NewStringObject:
case NewArray:
case NewArrayWithSpread:
case Spread:
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (223918 => 223919)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2017-10-24 20:47:11 UTC (rev 223918)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2017-10-24 20:48:03 UTC (rev 223919)
@@ -800,6 +800,9 @@
case NewObject:
compileNewObject();
break;
+ case NewStringObject:
+ compileNewStringObject();
+ break;
case NewArray:
compileNewArray();
break;
@@ -4903,6 +4906,39 @@
setJSValue(allocateObject(m_node->structure()));
mutatorFence();
}
+
+ void compileNewStringObject()
+ {
+ RegisteredStructure structure = m_node->structure();
+ LValue string = lowString(m_node->child1());
+
+ LBasicBlock slowCase = m_out.newBlock();
+ LBasicBlock continuation = m_out.newBlock();
+
+ LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowCase);
+
+ LValue fastResultValue = allocateObject<StringObject>(structure, m_out.intPtrZero, slowCase);
+ m_out.storePtr(m_out.constIntPtr(StringObject::info()), fastResultValue, m_heaps.JSDestructibleObject_classInfo);
+ m_out.store64(string, fastResultValue, m_heaps.JSWrapperObject_internalValue);
+ mutatorFence();
+ ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+ m_out.jump(continuation);
+
+ m_out.appendTo(slowCase, continuation);
+ VM& vm = this->vm();
+ LValue slowResultValue = lazySlowPath(
+ [=, &vm] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+ return createLazyCallGenerator(vm,
+ operationNewStringObject, locations[0].directGPR(), locations[1].directGPR(),
+ CCallHelpers::TrustedImmPtr(structure.get()));
+ },
+ string);
+ ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+ m_out.jump(continuation);
+
+ m_out.appendTo(continuation, lastNext);
+ setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
+ }
void compileNewArray()
{
