Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (259644 => 259645)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-07 17:39:24 UTC (rev 259645)
@@ -1,5 +1,50 @@
2020-04-07 Yusuke Suzuki <[email protected]>
+ [JSC] JSWrapperObject should use JSInternalFieldObjectImpl
+ https://bugs.webkit.org/show_bug.cgi?id=210019
+
+ Reviewed by Mark Lam.
+
+ JSWrapperObject's mechanism can be basically implemented by using JSInternalFieldObjectImpl.
+ We should leverage JSInternalFieldObjectImpl to implement JSWrapperObject since it can pave
+ the way to implementing Object-Allocation-Sinking and faster access to value etc. in DFG without
+ duplicating code.
+
+ We also noticed that we are storing classInfo to JSWrapperObject when allocating StringObject in
+ DFG and FTL while JSWrapperObject is no longer inheriting JSDestructibleObject! But it turned out
+ that this is safe since the subsequent JSWrapperObject::internalValue setting can overwrite it.
+ We remove this wrong store.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileNewStringObject):
+ * dfg/DFGSpeculativeJIT.h:
+ (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject): Deleted.
+ * ftl/FTLAbstractHeapRepository.cpp:
+ (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+ * ftl/FTLAbstractHeapRepository.h:
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
+ (JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.
+ * runtime/BigIntObject.h:
+ * runtime/BooleanObject.h:
+ * runtime/JSDestructibleObject.h:
+ (JSC::JSDestructibleObject::classInfo const):
+ (JSC::JSDestructibleObject::classInfoOffset): Deleted.
+ * runtime/JSWrapperObject.cpp:
+ (JSC::JSWrapperObject::visitChildren):
+ * runtime/JSWrapperObject.h:
+ (JSC::JSWrapperObject::internalValueOffset):
+ (JSC::JSWrapperObject::internalValue const):
+ (JSC::JSWrapperObject::setInternalValue):
+ (JSC::JSWrapperObject::createStructure): Deleted.
+ * runtime/NumberObject.h:
+ * runtime/StringObject.h:
+ * runtime/SymbolObject.h:
+
+2020-04-07 Yusuke Suzuki <[email protected]>
+
[JSC] Inlined IC should get right JSGlobalObject
https://bugs.webkit.org/show_bug.cgi?id=210092
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (259644 => 259645)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2020-04-07 17:39:24 UTC (rev 259645)
@@ -9861,9 +9861,6 @@
resultGPR, TrustedImmPtr(node->structure()), butterfly, scratch1GPR, scratch2GPR,
slowPath);
- m_jit.storePtr(
- TrustedImmPtr(StringObject::info()),
- JITCompiler::Address(resultGPR, JSDestructibleObject::classInfoOffset()));
#if USE(JSVALUE64)
m_jit.store64(
operandGPR, JITCompiler::Address(resultGPR, JSWrapperObject::internalValueOffset()));
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (259644 => 259645)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -1525,13 +1525,6 @@
m_jit.emitAllocateVariableSizedJSObject<ClassType>(vm(), resultGPR, structure, allocationSize, scratchGPR1, scratchGPR2, slowPath);
}
- template<typename ClassType>
- void emitAllocateDestructibleObject(GPRReg resultGPR, RegisteredStructure structure,
- GPRReg scratchGPR1, GPRReg scratchGPR2, MacroAssembler::JumpList& slowPath)
- {
- m_jit.emitAllocateDestructibleObject<ClassType>(vm(), resultGPR, structure.get(), scratchGPR1, scratchGPR2, slowPath);
- }
-
void emitAllocateRawObject(GPRReg resultGPR, RegisteredStructure, GPRReg storageGPR, unsigned numElements, unsigned vectorLength);
void emitGetLength(InlineCallFrame*, GPRReg lengthGPR, bool includeThis = false);
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp (259644 => 259645)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp 2020-04-07 17:39:24 UTC (rev 259645)
@@ -71,6 +71,7 @@
#undef NUMBERED_ABSTRACT_HEAP_INITIALIZATION
, JSString_value(JSRopeString_fiber0)
+ , JSWrapperObject_internalValue(const_cast<AbstractHeap&>(JSInternalFieldObjectImpl_internalFields[static_cast<unsigned>(JSWrapperObject::Field::WrappedValue)]))
, absolute(&root, "absolute")
{
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h (259644 => 259645)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -97,7 +97,6 @@
macro(JSCell_typeInfoFlags, JSCell::typeInfoFlagsOffset()) \
macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
macro(JSCell_usefulBytes, JSCell::indexingTypeAndMiscOffset()) \
- macro(JSDestructibleObject_classInfo, JSDestructibleObject::classInfoOffset()) \
macro(JSFunction_executableOrRareData, JSFunction::offsetOfExecutableOrRareData()) \
macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
macro(JSGlobalObject_regExpGlobalData_cachedResult_lastRegExp, JSGlobalObject::regExpGlobalDataOffset() + RegExpGlobalData::offsetOfCachedResult() + RegExpCachedResult::offsetOfLastRegExp()) \
@@ -119,7 +118,6 @@
macro(JSRopeString_fiber2, JSRopeString::offsetOfFiber2()) \
macro(JSScope_next, JSScope::offsetOfNext()) \
macro(JSSymbolTableObject_symbolTable, JSSymbolTableObject::offsetOfSymbolTable()) \
- macro(JSWrapperObject_internalValue, JSWrapperObject::internalValueOffset()) \
macro(RegExpObject_regExpAndLastIndexIsNotWritableFlag, RegExpObject::offsetOfRegExpAndLastIndexIsNotWritableFlag()) \
macro(RegExpObject_lastIndex, RegExpObject::offsetOfLastIndex()) \
macro(ShadowChicken_Packet_callee, OBJECT_OFFSETOF(ShadowChicken::Packet, callee)) \
@@ -214,6 +212,7 @@
#undef NUMBERED_ABSTRACT_HEAP_DECLARATION
AbstractHeap& JSString_value;
+ AbstractHeap& JSWrapperObject_internalValue;
AbsoluteAbstractHeap absolute;
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (259644 => 259645)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-04-07 17:39:24 UTC (rev 259645)
@@ -6398,6 +6398,8 @@
void compileNewStringObject()
{
+ // FIXME: We should handle this as JSInternalFieldObject allocation.
+ // https://bugs.webkit.org/show_bug.cgi?id=209453
RegisteredStructure structure = m_node->structure();
LValue string = lowString(m_node->child1());
@@ -6407,7 +6409,6 @@
LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowCase);
LValue fastResultValue = allocateObject<StringObject>(structure, m_out.intPtrZero, slowCase);
- m_out.storePtr(m_out.constIntPtr(StringObject::info()), fastResultValue, m_heaps.JSDestructibleObject_classInfo);
m_out.store64(string, fastResultValue, m_heaps.JSWrapperObject_internalValue);
mutatorFence();
ValueFromBlock fastResult = m_out.anchor(fastResultValue);
@@ -7405,6 +7406,8 @@
JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
switch (m_node->child1().useKind()) {
case StringObjectUse: {
+ // FIXME: We should convert this to GetInternalField(0).
+ // https://bugs.webkit.org/show_bug.cgi?id=209453
LValue cell = lowCell(m_node->child1());
speculateStringObjectForCell(m_node->child1(), cell);
setJSValue(m_out.loadPtr(cell, m_heaps.JSWrapperObject_internalValue));
Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.h (259644 => 259645)
--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -1871,14 +1871,6 @@
}
void emitConvertValueToBoolean(VM&, JSValueRegs, GPRReg result, GPRReg scratchIfShouldCheckMasqueradesAsUndefined, FPRReg, FPRReg, bool shouldCheckMasqueradesAsUndefined, JSGlobalObject*, bool negateResult = false);
- template<typename ClassType>
- void emitAllocateDestructibleObject(VM& vm, GPRReg resultGPR, Structure* structure, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
- {
- auto butterfly = TrustedImmPtr(nullptr);
- emitAllocateJSObject<ClassType>(vm, resultGPR, TrustedImmPtr(structure), butterfly, scratchGPR1, scratchGPR2, slowPath);
- storePtr(TrustedImmPtr(structure->classInfo()), Address(resultGPR, JSDestructibleObject::classInfoOffset()));
- }
-
void emitInitializeInlineStorage(GPRReg baseGPR, unsigned inlineCapacity)
{
for (unsigned i = 0; i < inlineCapacity; ++i)
Modified: trunk/Source/_javascript_Core/runtime/BigIntObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/BigIntObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/BigIntObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -60,5 +60,6 @@
JS_EXPORT_PRIVATE void finishCreation(VM&, JSBigInt*);
JS_EXPORT_PRIVATE BigIntObject(VM&, Structure*);
};
+static_assert(sizeof(BigIntObject) == sizeof(JSWrapperObject));
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/BooleanObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/BooleanObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/BooleanObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -52,5 +52,6 @@
return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
}
};
+static_assert(sizeof(BooleanObject) == sizeof(JSWrapperObject));
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/JSDestructibleObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/JSDestructibleObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/JSDestructibleObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -38,8 +38,6 @@
static constexpr bool needsDestruction = true;
const ClassInfo* classInfo() const { return m_classInfo; }
-
- static ptrdiff_t classInfoOffset() { return OBJECT_OFFSETOF(JSDestructibleObject, m_classInfo); }
protected:
JSDestructibleObject(VM& vm, Structure* structure, Butterfly* butterfly = 0)
Modified: trunk/Source/_javascript_Core/runtime/JSWrapperObject.cpp (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/JSWrapperObject.cpp 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/JSWrapperObject.cpp 2020-04-07 17:39:24 UTC (rev 259645)
@@ -23,6 +23,7 @@
#include "JSWrapperObject.h"
#include "JSCInlines.h"
+#include "JSInternalFieldObjectImplInlines.h"
namespace JSC {
@@ -30,10 +31,9 @@
void JSWrapperObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
{
- JSWrapperObject* thisObject = jsCast<JSWrapperObject*>(cell);
+ auto* thisObject = jsCast<JSWrapperObject*>(cell);
ASSERT_GC_OBJECT_INHERITS(thisObject, info());
- JSObject::visitChildren(thisObject, visitor);
- visitor.append(thisObject->m_internalValue);
+ Base::visitChildren(thisObject, visitor);
}
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/JSWrapperObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/JSWrapperObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/JSWrapperObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -21,15 +21,15 @@
#pragma once
-#include "JSObject.h"
+#include "JSInternalFieldObjectImpl.h"
namespace JSC {
// This class is used as a base for classes such as String,
// Number, Boolean and Symbol which are wrappers for primitive types.
-class JSWrapperObject : public JSNonFinalObject {
+class JSWrapperObject : public JSInternalFieldObjectImpl<1> {
public:
- using Base = JSNonFinalObject;
+ using Base = JSInternalFieldObjectImpl<1>;
template<typename, SubspaceAccess>
static void subspaceFor(VM&)
@@ -43,15 +43,15 @@
return sizeof(JSWrapperObject);
}
+ enum class Field : uint32_t {
+ WrappedValue = 0,
+ };
+ static_assert(numberOfInternalFields == 1);
+
JSValue internalValue() const;
void setInternalValue(VM&, JSValue);
- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
- {
- return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
- }
-
- static ptrdiff_t internalValueOffset() { return OBJECT_OFFSETOF(JSWrapperObject, m_internalValue); }
+ static ptrdiff_t internalValueOffset() { return offsetOfInternalField(static_cast<unsigned>(Field::WrappedValue)); }
static ptrdiff_t internalValueCellOffset()
{
#if USE(JSVALUE64)
@@ -65,9 +65,6 @@
explicit JSWrapperObject(VM&, Structure*);
JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
-
-private:
- WriteBarrier<Unknown> m_internalValue;
};
inline JSWrapperObject::JSWrapperObject(VM& vm, Structure* structure)
@@ -77,7 +74,7 @@
inline JSValue JSWrapperObject::internalValue() const
{
- return m_internalValue.get();
+ return internalField(static_cast<unsigned>(Field::WrappedValue)).get();
}
inline void JSWrapperObject::setInternalValue(VM& vm, JSValue value)
@@ -84,7 +81,7 @@
{
ASSERT(value);
ASSERT(!value.isObject());
- m_internalValue.set(vm, this, value);
+ internalField(static_cast<unsigned>(Field::WrappedValue)).set(vm, this, value);
}
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/NumberObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/NumberObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/NumberObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -52,6 +52,7 @@
return Structure::create(vm, globalObject, prototype, TypeInfo(NumberObjectType, StructureFlags), info());
}
};
+static_assert(sizeof(NumberObject) == sizeof(JSWrapperObject));
JS_EXPORT_PRIVATE NumberObject* constructNumber(JSGlobalObject*, JSValue);
Modified: trunk/Source/_javascript_Core/runtime/StringObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/StringObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/StringObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -76,6 +76,7 @@
JS_EXPORT_PRIVATE void finishCreation(VM&, JSString*);
JS_EXPORT_PRIVATE StringObject(VM&, Structure*);
};
+static_assert(sizeof(StringObject) == sizeof(JSWrapperObject));
JS_EXPORT_PRIVATE StringObject* constructString(VM&, JSGlobalObject*, JSValue);
Modified: trunk/Source/_javascript_Core/runtime/SymbolObject.h (259644 => 259645)
--- trunk/Source/_javascript_Core/runtime/SymbolObject.h 2020-04-07 17:26:40 UTC (rev 259644)
+++ trunk/Source/_javascript_Core/runtime/SymbolObject.h 2020-04-07 17:39:24 UTC (rev 259645)
@@ -68,5 +68,6 @@
JS_EXPORT_PRIVATE void finishCreation(VM&, Symbol*);
JS_EXPORT_PRIVATE SymbolObject(VM&, Structure*);
};
+static_assert(sizeof(SymbolObject) == sizeof(JSWrapperObject));
} // namespace JSC
