Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (267623 => 267624)
--- trunk/Source/_javascript_Core/ChangeLog 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-09-26 19:52:14 UTC (rev 267624)
@@ -1,3 +1,24 @@
+2020-09-26 Yusuke Suzuki <[email protected]>
+
+ Unreviewed, follow-up after r267373 to resolve post-commit review comments
+ https://bugs.webkit.org/show_bug.cgi?id=216667
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ * dfg/DFGOperations.cpp:
+ * dfg/DFGOperations.h:
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
+ (JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
+ * runtime/HashMapImpl.h:
+ (JSC::jsMapHash):
+
2020-09-25 Ross Kirsling <[email protected]>
%TypedArray%.{from, of} no longer perform AllocateTypedArray
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (267623 => 267624)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2020-09-26 19:52:14 UTC (rev 267624)
@@ -1381,8 +1381,8 @@
break;
}
- SpeculatedType typeMaybeNormalized = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
- if (!(forNode(node->child1()).m_type & typeMaybeNormalized)) {
+ SpeculatedType typesNeedingNormalization = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
+ if (!(forNode(node->child1()).m_type & typesNeedingNormalization)) {
m_state.setShouldTryConstantFolding(true);
forNode(node) = forNode(node->child1());
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (267623 => 267624)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2020-09-26 19:52:14 UTC (rev 267624)
@@ -909,8 +909,8 @@
}
case NormalizeMapKey: {
- SpeculatedType typeMaybeNormalized = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
- if (m_state.forNode(node->child1()).m_type & typeMaybeNormalized)
+ SpeculatedType typesNeedingNormalization = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
+ if (m_state.forNode(node->child1()).m_type & typesNeedingNormalization)
break;
node->convertToIdentity();
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (267623 => 267624)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2020-09-26 19:52:14 UTC (rev 267624)
@@ -3212,12 +3212,12 @@
return putDynamicVar(globalObject, vm, scope, value, impl, getPutInfoBits, isStrictMode);
}
-EncodedJSValue JIT_OPERATION operationNormalizeMapKey(VM* vmPointer, EncodedJSValue input)
+EncodedJSValue JIT_OPERATION operationNormalizeMapKeyHeapBigInt(VM* vmPointer, JSBigInt* input)
{
VM& vm = *vmPointer;
CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
- return JSValue::encode(normalizeMapKey(JSValue::decode(input)));
+ return JSValue::encode(normalizeMapKey(input));
}
UCPUStrictInt32 JIT_OPERATION operationMapHash(JSGlobalObject* globalObject, EncodedJSValue input)
@@ -3229,6 +3229,15 @@
return toUCPUStrictInt32(jsMapHash(globalObject, vm, JSValue::decode(input)));
}
+UCPUStrictInt32 JIT_OPERATION operationMapHashHeapBigInt(VM* vmPointer, JSBigInt* input)
+{
+ VM& vm = *vmPointer;
+ CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+ JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+
+ return toUCPUStrictInt32(jsMapHash(input));
+}
+
JSCell* JIT_OPERATION operationJSMapFindBucket(JSGlobalObject* globalObject, JSCell* map, EncodedJSValue key, int32_t hash)
{
VM& vm = globalObject->vm();
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.h (267623 => 267624)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.h 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.h 2020-09-26 19:52:14 UTC (rev 267624)
@@ -34,6 +34,7 @@
namespace JSC {
class DateInstance;
+class JSBigInt;
namespace DFG {
@@ -243,8 +244,9 @@
char* JIT_OPERATION operationInt52ToStringWithValidRadix(JSGlobalObject*, int64_t, int32_t);
char* JIT_OPERATION operationDoubleToStringWithValidRadix(JSGlobalObject*, double, int32_t);
-EncodedJSValue JIT_OPERATION operationNormalizeMapKey(VM*, EncodedJSValue input) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNormalizeMapKeyHeapBigInt(VM*, JSBigInt*) WTF_INTERNAL;
UCPUStrictInt32 JIT_OPERATION operationMapHash(JSGlobalObject*, EncodedJSValue input);
+UCPUStrictInt32 JIT_OPERATION operationMapHashHeapBigInt(VM*, JSBigInt*);
JSCell* JIT_OPERATION operationJSMapFindBucket(JSGlobalObject*, JSCell*, EncodedJSValue, int32_t);
JSCell* JIT_OPERATION operationJSSetFindBucket(JSGlobalObject*, JSCell*, EncodedJSValue, int32_t);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (267623 => 267624)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2020-09-26 19:52:14 UTC (rev 267624)
@@ -12582,7 +12582,7 @@
passThroughCases.link(&m_jit);
m_jit.moveValueRegs(keyRegs, resultRegs);
- addSlowPathGenerator(slowPathCall(slowPath, this, operationNormalizeMapKey, resultRegs, &vm(), keyRegs));
+ addSlowPathGenerator(slowPathCall(slowPath, this, operationNormalizeMapKeyHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultRegs, &vm(), keyRegs.payloadGPR()));
doneCases.link(&m_jit);
jsValueResult(resultRegs, node);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (267623 => 267624)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2020-09-26 19:52:14 UTC (rev 267624)
@@ -4472,8 +4472,7 @@
flushRegisters();
GPRFlushedCallResult result(this);
GPRReg resultGPR = result.gpr();
- callOperation(operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputGPR);
- m_jit.exceptionCheck();
+ callOperation(operationMapHashHeapBigInt, resultGPR, &vm(), inputGPR);
strictInt32Result(resultGPR, node);
break;
}
@@ -4502,7 +4501,7 @@
auto isHeapBigInt = m_jit.branchIfHeapBigInt(inputGPR);
m_jit.move(inputGPR, resultGPR);
m_jit.wangsInt64Hash(resultGPR, tempGPR);
- addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputGPR));
+ addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHashHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultGPR, &vm(), inputGPR));
done.append(m_jit.jump());
isString.link(&m_jit);
}
@@ -4556,7 +4555,7 @@
straightHash.link(&m_jit);
m_jit.move(inputGPR, resultGPR);
m_jit.wangsInt64Hash(resultGPR, tempGPR);
- addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputGPR));
+ addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHashHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultGPR, &vm(), inputGPR));
done.append(m_jit.jump());
slowPath.link(&m_jit);
@@ -4648,7 +4647,7 @@
done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR));
loopAround.append(m_jit.branchIfNotCell(JSValueRegs(bucketGPR)));
- auto isBucketString = m_jit.branchIfString(bucketGPR);
+ auto bucketIsString = m_jit.branchIfString(bucketGPR);
loopAround.append(m_jit.branchIfNotHeapBigInt(bucketGPR));
// bucket is HeapBigInt.
@@ -4656,7 +4655,7 @@
loopAround.append(m_jit.jump());
// bucket is String.
- isBucketString.link(&m_jit);
+ bucketIsString.link(&m_jit);
loopAround.append(m_jit.branchIfNotString(keyGPR));
slowPathCases.append(m_jit.jump());
break;
@@ -4682,7 +4681,7 @@
// first is a cell here.
loopAround.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR)));
// Both are cells here.
- auto isBucketString = m_jit.branchIfString(bucketGPR);
+ auto bucketIsString = m_jit.branchIfString(bucketGPR);
// bucket is not String.
loopAround.append(m_jit.branchIfNotHeapBigInt(bucketGPR));
// bucket is HeapBigInt.
@@ -4689,7 +4688,7 @@
slowPathCases.append(m_jit.branchIfHeapBigInt(keyGPR));
loopAround.append(m_jit.jump());
// bucket is String.
- isBucketString.link(&m_jit);
+ bucketIsString.link(&m_jit);
loopAround.append(m_jit.branchIfNotString(keyGPR));
slowPathCases.append(m_jit.jump());
break;
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (267623 => 267624)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-09-26 19:52:14 UTC (rev 267624)
@@ -11297,7 +11297,7 @@
case HeapBigIntUse: {
LValue key = lowHeapBigInt(m_node->child1());
- setInt32(m_out.castToInt32(vmCall(Int64, operationMapHash, weakPointer(globalObject), key)));
+ setInt32(m_out.castToInt32(vmCall(Int64, operationMapHashHeapBigInt, m_vmValue, key)));
return;
}
@@ -11305,7 +11305,7 @@
LBasicBlock isString = m_out.newBlock();
LBasicBlock notString = m_out.newBlock();
LBasicBlock isHeapBigIntCase = m_out.newBlock();
- LBasicBlock notStringHeapBigIntCase = m_out.newBlock();
+ LBasicBlock notStringNorHeapBigIntCase = m_out.newBlock();
LBasicBlock continuation = m_out.newBlock();
LValue value = lowCell(m_node->child1());
@@ -11318,13 +11318,13 @@
m_out.jump(continuation);
m_out.appendTo(notString, isHeapBigIntCase);
- m_out.branch(isHeapBigInt(value, (provenType(m_node->child1()) & ~SpecString)), unsure(isHeapBigIntCase), unsure(notStringHeapBigIntCase));
+ m_out.branch(isHeapBigInt(value, (provenType(m_node->child1()) & ~SpecString)), unsure(isHeapBigIntCase), unsure(notStringNorHeapBigIntCase));
- m_out.appendTo(isHeapBigIntCase, notStringHeapBigIntCase);
- ValueFromBlock heapBigIntResult = m_out.anchor(m_out.castToInt32(vmCall(Int64, operationMapHash, weakPointer(globalObject), value)));
+ m_out.appendTo(isHeapBigIntCase, notStringNorHeapBigIntCase);
+ ValueFromBlock heapBigIntResult = m_out.anchor(m_out.castToInt32(vmCall(Int64, operationMapHashHeapBigInt, m_vmValue, value)));
m_out.jump(continuation);
- m_out.appendTo(notStringHeapBigIntCase, continuation);
+ m_out.appendTo(notStringNorHeapBigIntCase, continuation);
ValueFromBlock notStringResult = m_out.anchor(wangsInt64Hash(value));
m_out.jump(continuation);
@@ -11410,7 +11410,7 @@
m_out.branch(isNotHeapBigInt(key, (provenType(m_node->child1()) & SpecCellCheck)), unsure(continuation), unsure(isHeapBigIntCase));
m_out.appendTo(isHeapBigIntCase, notCellCase);
- ValueFromBlock bigIntResult = m_out.anchor(vmCall(Int64, operationNormalizeMapKey, m_vmValue, key));
+ ValueFromBlock bigIntResult = m_out.anchor(vmCall(Int64, operationNormalizeMapKeyHeapBigInt, m_vmValue, key));
m_out.jump(continuation);
m_out.appendTo(notCellCase, isNumberCase);
Modified: trunk/Source/_javascript_Core/runtime/HashMapImpl.h (267623 => 267624)
--- trunk/Source/_javascript_Core/runtime/HashMapImpl.h 2020-09-26 16:34:32 UTC (rev 267623)
+++ trunk/Source/_javascript_Core/runtime/HashMapImpl.h 2020-09-26 19:52:14 UTC (rev 267624)
@@ -279,6 +279,11 @@
return static_cast<unsigned>(key);
}
+ALWAYS_INLINE uint32_t jsMapHash(JSBigInt* bigInt)
+{
+ return bigInt->hash();
+}
+
ALWAYS_INLINE uint32_t jsMapHash(JSGlobalObject* globalObject, VM& vm, JSValue value)
{
ASSERT_WITH_MESSAGE(normalizeMapKey(value) == value, "We expect normalized values flowing into this function.");
@@ -291,7 +296,7 @@
}
if (value.isHeapBigInt())
- return value.asHeapBigInt()->hash();
+ return jsMapHash(value.asHeapBigInt());
return wangsInt64Hash(JSValue::encode(value));
}
