Diff
Modified: trunk/JSTests/ChangeLog (228726 => 228727)
--- trunk/JSTests/ChangeLog 2018-02-20 04:00:16 UTC (rev 228726)
+++ trunk/JSTests/ChangeLog 2018-02-20 04:33:33 UTC (rev 228727)
@@ -1,5 +1,16 @@
2018-02-14 Yusuke Suzuki <utatane....@gmail.com>
+ [FTL] Support ArrayPop for ArrayStorage
+ https://bugs.webkit.org/show_bug.cgi?id=182783
+
+ Reviewed by Saam Barati.
+
+ * stress/array-pop-array-storage.js: Added.
+ (shouldBe):
+ (test):
+
+2018-02-14 Yusuke Suzuki <utatane....@gmail.com>
+
[FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=182731
Added: trunk/JSTests/stress/array-pop-array-storage.js (0 => 228727)
--- trunk/JSTests/stress/array-pop-array-storage.js (rev 0)
+++ trunk/JSTests/stress/array-pop-array-storage.js 2018-02-20 04:33:33 UTC (rev 228727)
@@ -0,0 +1,65 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(array) {
+ return [array.pop(), array.pop(), array.pop(), array.pop()];
+}
+
+noInline(test);
+
+for (var i = 0; i < 1e4; ++i) {
+ var array = ["foo", "bar", "baz"];
+ ensureArrayStorage(array);
+ var result = test(array);
+ shouldBe(result[0], "baz");
+ shouldBe(result[1], "bar");
+ shouldBe(result[2], "foo");
+ shouldBe(result[3], undefined);
+ shouldBe(array.length, 0);
+}
+
+for (var i = 0; i < 1e4; ++i) {
+ var array = ["foo", "bar", , "baz"];
+ ensureArrayStorage(array);
+ var result = test(array);
+ shouldBe(result[0], "baz");
+ shouldBe(result[1], undefined);
+ shouldBe(result[2], "bar");
+ shouldBe(result[3], "foo");
+ shouldBe(array.length, 0);
+}
+
+for (var i = 0; i < 1e4; ++i) {
+ var array = ["foo", "bar", , "baz", , , "OK"];
+ ensureArrayStorage(array);
+ shouldBe(array.length, 7);
+ var result = test(array);
+ shouldBe(result[0], "OK");
+ shouldBe(result[1], undefined);
+ shouldBe(result[2], undefined);
+ shouldBe(result[3], "baz");
+ shouldBe(array.length, 3);
+ shouldBe(array[0], "foo");
+ shouldBe(array[1], "bar");
+ shouldBe(array[2], undefined);
+ shouldBe(array[3], undefined);
+}
+
+for (var i = 0; i < 1e4; ++i) {
+ var array = ["foo", "bar", "baz"];
+ ensureArrayStorage(array);
+ array.length = 0xffffffff - 1;
+ shouldBe(array.length, 0xffffffff - 1);
+ var result = test(array);
+ shouldBe(result[0], undefined);
+ shouldBe(result[1], undefined);
+ shouldBe(result[2], undefined);
+ shouldBe(result[3], undefined);
+ shouldBe(array.length, 0xffffffff - 5);
+ shouldBe(array[0], "foo");
+ shouldBe(array[1], "bar");
+ shouldBe(array[2], "baz");
+ shouldBe(array[3], undefined);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (228726 => 228727)
--- trunk/Source/_javascript_Core/ChangeLog 2018-02-20 04:00:16 UTC (rev 228726)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-02-20 04:33:33 UTC (rev 228727)
@@ -1,5 +1,20 @@
2018-02-14 Yusuke Suzuki <utatane....@gmail.com>
+ [FTL] Support ArrayPop for ArrayStorage
+ https://bugs.webkit.org/show_bug.cgi?id=182783
+
+ Reviewed by Saam Barati.
+
+ This patch adds ArrayPop(ArrayStorage) support to FTL. We port the implementation in DFG to FTL.
+
+ * ftl/FTLAbstractHeapRepository.h:
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
+
+2018-02-14 Yusuke Suzuki <utatane....@gmail.com>
+
[FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=182731
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h (228726 => 228727)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2018-02-20 04:00:16 UTC (rev 228726)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2018-02-20 04:33:33 UTC (rev 228727)
@@ -45,6 +45,7 @@
#define FOR_EACH_ABSTRACT_FIELD(macro) \
macro(ArrayBuffer_data, ArrayBuffer::offsetOfData()) \
+ macro(ArrayStorage_numValuesInVector, ArrayStorage::numValuesInVectorOffset()) \
macro(Butterfly_arrayBuffer, Butterfly::offsetOfArrayBuffer()) \
macro(Butterfly_publicLength, Butterfly::offsetOfPublicLength()) \
macro(Butterfly_vectorLength, Butterfly::offsetOfVectorLength()) \
Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (228726 => 228727)
--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2018-02-20 04:00:16 UTC (rev 228726)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2018-02-20 04:33:33 UTC (rev 228727)
@@ -318,6 +318,7 @@
case CallDOMGetter:
case ArraySlice:
case ArrayIndexOf:
+ case ArrayPop:
case ParseInt:
case AtomicsAdd:
case AtomicsAnd:
@@ -437,7 +438,6 @@
case PutByValWithThis:
break;
case ArrayPush:
- case ArrayPop:
switch (node->arrayMode().type()) {
case Array::Int32:
case Array::Contiguous:
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (228726 => 228727)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2018-02-20 04:00:16 UTC (rev 228726)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2018-02-20 04:33:33 UTC (rev 228727)
@@ -4748,6 +4748,49 @@
return;
}
+ case Array::ArrayStorage: {
+ LBasicBlock vectorLengthCheckCase = m_out.newBlock();
+ LBasicBlock popCheckCase = m_out.newBlock();
+ LBasicBlock fastCase = m_out.newBlock();
+ LBasicBlock slowCase = m_out.newBlock();
+ LBasicBlock continuation = m_out.newBlock();
+
+ LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
+
+ Vector<ValueFromBlock, 3> results;
+ results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
+ m_out.branch(
+ m_out.isZero32(prevLength), rarely(continuation), usually(vectorLengthCheckCase));
+
+ LBasicBlock lastNext = m_out.appendTo(vectorLengthCheckCase, popCheckCase);
+ LValue newLength = m_out.sub(prevLength, m_out.int32One);
+ m_out.branch(
+ m_out.aboveOrEqual(newLength, m_out.load32(storage, m_heaps.Butterfly_vectorLength)), rarely(slowCase), usually(popCheckCase));
+
+ m_out.appendTo(popCheckCase, fastCase);
+ TypedPointer pointer = m_out.baseIndex(m_heaps.ArrayStorage_vector, storage, m_out.zeroExtPtr(newLength));
+ LValue result = m_out.load64(pointer);
+ m_out.branch(m_out.notZero64(result), usually(fastCase), rarely(slowCase));
+
+ m_out.appendTo(fastCase, slowCase);
+ m_out.store32(newLength, storage, m_heaps.Butterfly_publicLength);
+ m_out.store64(m_out.int64Zero, pointer);
+ m_out.store32(
+ m_out.sub(m_out.load32(storage, m_heaps.ArrayStorage_numValuesInVector), m_out.int32One),
+ storage, m_heaps.ArrayStorage_numValuesInVector);
+ results.append(m_out.anchor(result));
+ m_out.jump(continuation);
+
+ m_out.appendTo(slowCase, continuation);
+ results.append(m_out.anchor(vmCall(
+ Int64, m_out.operation(operationArrayPop), m_callFrame, base)));
+ m_out.jump(continuation);
+
+ m_out.appendTo(continuation, lastNext);
+ setJSValue(m_out.phi(Int64, results));
+ return;
+ }
+
default:
DFG_CRASH(m_graph, m_node, "Bad array type");
return;
