Diff
Modified: trunk/JSTests/ChangeLog (281683 => 281684)
--- trunk/JSTests/ChangeLog 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/JSTests/ChangeLog 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1,3 +1,33 @@
+2021-08-26 Yusuke Suzuki <[email protected]>
+
+ [JSC] op_put_private_name should use modern IC and remove ByValInfo
+ https://bugs.webkit.org/show_bug.cgi?id=229544
+
+ Reviewed by Saam Barati.
+
+ Move class-fields-private benchmarks into microbenchmarks.
+ Added several microbenchmarks and stress tests.
+
+ * microbenchmarks/class-private-field-polymorphic.js: Added.
+ (shouldBe):
+ (test.A.prototype.put):
+ * microbenchmarks/get-private-name.js: Renamed from JSTests/microbenchmarks/class-fields-private/get-private-name.js.
+ * microbenchmarks/monomorphic-get-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/monomorphic-get-private-field.js.
+ * microbenchmarks/polymorphic-get-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/polymorphic-get-private-field.js.
+ * microbenchmarks/polymorphic-put-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/polymorphic-put-private-field.js.
+ * microbenchmarks/put-by-val-polymorphic-properties.js: Added.
+ (shouldBe):
+ (test):
+ * microbenchmarks/put-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/put-private-field.js.
+ * stress/class-private-field-megamorphic.js: Added.
+ (shouldBe):
+ * stress/class-private-field-polymorphic.js: Added.
+ (shouldBe):
+ (test.A.prototype.put):
+ * stress/put-by-val-polymorphic-properties.js: Added.
+ (shouldBe):
+ (test):
+
2021-08-26 Saam Barati <[email protected]>
r281485 was not sufficient in where it called disablePeepholeOptimization
Added: trunk/JSTests/microbenchmarks/class-private-field-polymorphic.js (0 => 281684)
--- trunk/JSTests/microbenchmarks/class-private-field-polymorphic.js (rev 0)
+++ trunk/JSTests/microbenchmarks/class-private-field-polymorphic.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,36 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(i)
+{
+ class A {
+ #field = 0;
+ put(i)
+ {
+ this.#field = i;
+ }
+ get()
+ {
+ return this.#field;
+ }
+ }
+ noInline(A.prototype.get);
+ noInline(A.prototype.put);
+ return new A;
+}
+
+let test0 = test(0);
+let test1 = test(1);
+let test2 = test(2);
+let test3 = test(3);
+let test4 = test(4);
+
+for (var i = 0; i < 1e5; ++i) {
+ test0.put(i + 0);
+ test1.put(i + 1);
+ test2.put(i + 2);
+ test3.put(i + 3);
+ test4.put(i + 4);
+}
Copied: trunk/JSTests/microbenchmarks/get-private-name.js (from rev 281679, trunk/JSTests/microbenchmarks/class-fields-private/get-private-name.js) (0 => 281684)
--- trunk/JSTests/microbenchmarks/get-private-name.js (rev 0)
+++ trunk/JSTests/microbenchmarks/get-private-name.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,27 @@
+function assert(b, m = "Assertion failed") {
+ if (!b)
+ throw new Error(m);
+}
+
+function test1() {
+ function factory(i) {
+ return new class {
+ #x = i;
+ get() { return this.#x; }
+ };
+ }
+
+ function foo(o, i) {
+ return o.get();
+ }
+ noInline(foo);
+
+ let a = factory(42);
+ let b = factory(43);
+ let start = Date.now();
+ for (let i = 0; i < 10000000; ++i) {
+ assert(foo(a, "a") === 42);
+ assert(foo(b, "b") === 43);
+ }
+}
+test1();
Copied: trunk/JSTests/microbenchmarks/monomorphic-get-private-field.js (from rev 281679, trunk/JSTests/microbenchmarks/class-fields-private/monomorphic-get-private-field.js) (0 => 281684)
--- trunk/JSTests/microbenchmarks/monomorphic-get-private-field.js (rev 0)
+++ trunk/JSTests/microbenchmarks/monomorphic-get-private-field.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,18 @@
+class C {
+ #field;
+
+ constructor(i) {
+ this.#field = i;
+ }
+
+ getField() {
+ return this.#field;
+ }
+}
+noInline(C.prototype.getField);
+
+let c = new C("test");
+for (let i = 0; i < 5000000; i++) {
+ if (c.getField() !== "test")
+ throw new Error("unexpected field value");
+}
Copied: trunk/JSTests/microbenchmarks/polymorphic-get-private-field.js (from rev 281679, trunk/JSTests/microbenchmarks/class-fields-private/polymorphic-get-private-field.js) (0 => 281684)
--- trunk/JSTests/microbenchmarks/polymorphic-get-private-field.js (rev 0)
+++ trunk/JSTests/microbenchmarks/polymorphic-get-private-field.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,32 @@
+class C {
+ #field;
+
+ setField(value) {
+ this.#field = value;
+ }
+
+ getField() {
+ return this.#field;
+ }
+}
+noInline(C.prototype.getField);
+
+let c1 = new C();
+c1.foo = 0;
+c1.setField("a");
+
+let c2 = new C();
+c2.bar = 0;
+c2.setField("b");
+
+let c3 = new C();
+c3.baz = 0;
+c3.setField("c");
+
+let arr = [c1, c2, c3];
+let values = ["a", "b", "c"];
+for (let i = 0; i < 5000000; i++) {
+ if (arr[i % arr.length].getField() !== values[i % values.length])
+ throw new Error("unexpected field value");
+}
+
Copied: trunk/JSTests/microbenchmarks/polymorphic-put-private-field.js (from rev 281679, trunk/JSTests/microbenchmarks/class-fields-private/polymorphic-put-private-field.js) (0 => 281684)
--- trunk/JSTests/microbenchmarks/polymorphic-put-private-field.js (rev 0)
+++ trunk/JSTests/microbenchmarks/polymorphic-put-private-field.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,24 @@
+class C {
+ #field;
+
+ setField(value) {
+ this.#field = value;
+ }
+}
+noInline(C.prototype.setField);
+
+let c1 = new C();
+c1.foo = 0;
+
+let c2 = new C();
+c2.bar = 0;
+
+let c3 = new C();
+c3.baz = 0;
+
+let arr = [c1, c2, c3];
+
+for (let i = 0; i < 5000000; i++) {
+ arr[i % arr.length].setField(i);
+}
+
Added: trunk/JSTests/microbenchmarks/put-by-val-polymorphic-properties.js (0 => 281684)
--- trunk/JSTests/microbenchmarks/put-by-val-polymorphic-properties.js (rev 0)
+++ trunk/JSTests/microbenchmarks/put-by-val-polymorphic-properties.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,20 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(object, name, value)
+{
+ object[name] = value;
+}
+noInline(test);
+
+var array = [ 0, 1, 2 ];
+array.hello = 42;
+array.world = 44;
+
+for (var i = 0; i < 1e6; ++i) {
+ test(array, "hello", i);
+ test(array, "world", i);
+ test(array, 0, i);
+}
Copied: trunk/JSTests/microbenchmarks/put-private-field.js (from rev 281679, trunk/JSTests/microbenchmarks/class-fields-private/put-private-field.js) (0 => 281684)
--- trunk/JSTests/microbenchmarks/put-private-field.js (rev 0)
+++ trunk/JSTests/microbenchmarks/put-private-field.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,14 @@
+class C {
+ #field;
+
+ setField(value) {
+ this.#field = value;
+ }
+}
+noInline(C.prototype.setField);
+
+let c = new C();
+for (let i = 0; i < 5000000; i++) {
+ c.setField(i);
+}
+
Added: trunk/JSTests/stress/class-private-field-megamorphic.js (0 => 281684)
--- trunk/JSTests/stress/class-private-field-megamorphic.js (rev 0)
+++ trunk/JSTests/stress/class-private-field-megamorphic.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,26 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(i)
+{
+ class A {
+ #field = 0;
+ get()
+ {
+ return this.#field;
+ }
+ put(i)
+ {
+ this.#field = i;
+ }
+ }
+
+ let instance = new A;
+ instance.put(i);
+ return instance.get();
+}
+
+for (var i = 0; i < 1e5; ++i)
+ shouldBe(test(i), i);
Added: trunk/JSTests/stress/class-private-field-polymorphic.js (0 => 281684)
--- trunk/JSTests/stress/class-private-field-polymorphic.js (rev 0)
+++ trunk/JSTests/stress/class-private-field-polymorphic.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,41 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(i)
+{
+ class A {
+ #field = 0;
+ put(i)
+ {
+ this.#field = i;
+ }
+ get()
+ {
+ return this.#field;
+ }
+ }
+ noInline(A.prototype.get);
+ noInline(A.prototype.put);
+ return new A;
+}
+
+let test0 = test(0);
+let test1 = test(1);
+let test2 = test(2);
+let test3 = test(3);
+let test4 = test(4);
+
+for (var i = 0; i < 1e5; ++i) {
+ test0.put(i + 0);
+ shouldBe(test0.get(), i + 0);
+ test1.put(i + 1);
+ shouldBe(test1.get(), i + 1);
+ test2.put(i + 2);
+ shouldBe(test2.get(), i + 2);
+ test3.put(i + 3);
+ shouldBe(test3.get(), i + 3);
+ test4.put(i + 4);
+ shouldBe(test4.get(), i + 4);
+}
Added: trunk/JSTests/stress/put-by-val-polymorphic-properties.js (0 => 281684)
--- trunk/JSTests/stress/put-by-val-polymorphic-properties.js (rev 0)
+++ trunk/JSTests/stress/put-by-val-polymorphic-properties.js 2021-08-27 04:26:35 UTC (rev 281684)
@@ -0,0 +1,23 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(object, name, value)
+{
+ object[name] = value;
+}
+noInline(test);
+
+var array = [ 0, 1, 2 ];
+array.hello = 42;
+array.world = 44;
+
+for (var i = 0; i < 1e6; ++i) {
+ test(array, "hello", i);
+ shouldBe(array.hello, i);
+ test(array, "world", i);
+ shouldBe(array.world, i);
+ test(array, 0, i);
+ shouldBe(array[0], i);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (281683 => 281684)
--- trunk/Source/_javascript_Core/ChangeLog 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1,3 +1,75 @@
+2021-08-26 Yusuke Suzuki <[email protected]>
+
+ [JSC] op_put_private_name should use modern IC and remove ByValInfo
+ https://bugs.webkit.org/show_bug.cgi?id=229544
+
+ Reviewed by Saam Barati.
+
+ This patch makes op_put_private_name use new PutByVal IC. This allows op_put_private_name to support
+ polymorphic properties, and we can finally remove Baseline's adhoc IC and ByValInfo completely.
+
+ Added microbenchmark showed 3x improvement due to polymorphic PutPrivateName IC.
+
+ ToT Patched
+
+ class-private-field-polymorphic 9.3666+-0.0332 ^ 3.1199+-0.0182 ^ definitely 3.0022x faster
+
+
+ * _javascript_Core.xcodeproj/project.pbxproj:
+ * Sources.txt:
+ * bytecode/ByValInfo.cpp: Removed.
+ * bytecode/ByValInfo.h: Removed.
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::getICStatusMap):
+ (JSC::CodeBlock::stronglyVisitStrongReferences):
+ (JSC::CodeBlock::findByValInfo): Deleted.
+ (JSC::CodeBlock::addByValInfo): Deleted.
+ * bytecode/CodeBlock.h:
+ * bytecode/ICStatusMap.h:
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileGetPrivateName):
+ (JSC::DFG::SpeculativeJIT::compilePutPrivateName):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGStoreBarrierInsertionPhase.cpp:
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
+ * jit/JIT.cpp:
+ (JSC::JIT::privateCompileSlowCases):
+ (JSC::JIT::link):
+ (JSC::JIT::privateCompileExceptionHandlers):
+ * jit/JIT.h:
+ (JSC::ByValCompilationInfo::ByValCompilationInfo): Deleted.
+ * jit/JITInlines.h:
+ (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): Deleted.
+ (JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase): Deleted.
+ * jit/JITOperations.cpp:
+ (JSC::putPrivateNameOptimize):
+ (JSC::putPrivateName):
+ (JSC::JSC_DEFINE_JIT_OPERATION):
+ * jit/JITOperations.h:
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emit_op_put_private_name):
+ (JSC::JIT::emitSlow_op_put_private_name):
+ (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
+ (JSC::JIT::emitPutByValWithCachedId): Deleted.
+ (JSC::JIT::emitPutPrivateNameWithCachedId): Deleted.
+ (JSC::JIT::emitByValIdentifierCheck): Deleted.
+ (JSC::JIT::privateCompilePutPrivateNameWithCachedId): Deleted.
+ * jit/JITPropertyAccess32_64.cpp:
+ (JSC::JIT::emit_op_put_private_name):
+ (JSC::JIT::emitSlow_op_put_private_name):
+ * jit/Repatch.cpp:
+ (JSC::appropriateGenericPutByFunction):
+ (JSC::appropriateOptimizingPutByFunction):
+ (JSC::resetPutBy):
+
2021-08-26 Saam Barati <[email protected]>
r281485 was not sufficient in where it called disablePeepholeOptimization
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (281683 => 281684)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2021-08-27 04:26:35 UTC (rev 281684)
@@ -444,7 +444,6 @@
0F7DF13C1E2971130095951B /* JSDestructibleObjectHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF13A1E29710E0095951B /* JSDestructibleObjectHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F7DF1461E2BEF6A0095951B /* BlockDirectoryInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF1451E2BEF680095951B /* BlockDirectoryInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F7F988C1D9596C800F4F12E /* DFGStoreBarrierClusteringPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7F988A1D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.h */; };
- 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; };
0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F8364B7164B0C110053329A /* DFGBranchDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */; };
0F86A26F1D6F7B3300CB0C92 /* GCTypeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F86A26E1D6F7B3100CB0C92 /* GCTypeMap.h */; };
@@ -2828,7 +2827,6 @@
0F7DF1451E2BEF680095951B /* BlockDirectoryInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BlockDirectoryInlines.h; sourceTree = "<group>"; };
0F7F98891D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStoreBarrierClusteringPhase.cpp; path = dfg/DFGStoreBarrierClusteringPhase.cpp; sourceTree = "<group>"; };
0F7F988A1D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStoreBarrierClusteringPhase.h; path = dfg/DFGStoreBarrierClusteringPhase.h; sourceTree = "<group>"; };
- 0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = "<group>"; };
0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; };
0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBranchDirection.h; path = dfg/DFGBranchDirection.h; sourceTree = "<group>"; };
@@ -5135,7 +5133,6 @@
E355D38E2244686C008F1AD6 /* GlobalExecutable.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = GlobalExecutable.cpp; sourceTree = "<group>"; };
E356987122841183008CDCCB /* PackedCellPtr.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PackedCellPtr.h; sourceTree = "<group>"; };
E35A0B9C220AD87A00AC4474 /* ExecutableBaseInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableBaseInlines.h; sourceTree = "<group>"; };
- E35BA2C0241A0E8C00B67086 /* ByValInfo.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = ByValInfo.cpp; sourceTree = "<group>"; };
E35CA14F1DBC3A5600F83516 /* DOMJITAbstractHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMJITAbstractHeap.cpp; sourceTree = "<group>"; };
E35CA1501DBC3A5600F83516 /* DOMJITAbstractHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITAbstractHeap.h; sourceTree = "<group>"; };
E35CA1511DBC3A5600F83516 /* DOMJITHeapRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMJITHeapRange.cpp; sourceTree = "<group>"; };
@@ -8554,8 +8551,6 @@
E3D2642A1D38C042000BE174 /* BytecodeRewriter.h */,
53D35498240D88AD008950DD /* BytecodeUseDef.cpp */,
0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */,
- E35BA2C0241A0E8C00B67086 /* ByValInfo.cpp */,
- 0F8023E91613832300A0BA45 /* ByValInfo.h */,
0F64B2771A7957B2006E4E66 /* CallEdge.cpp */,
0F64B2781A7957B2006E4E66 /* CallEdge.h */,
0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */,
@@ -9473,7 +9468,6 @@
E328DAEB1D38D005001A2529 /* BytecodeRewriter.h in Headers */,
6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */,
0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */,
- 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */,
FE8DE54B23AC1DAD005C9142 /* CacheableIdentifier.h in Headers */,
FE8DE54D23AC1E86005C9142 /* CacheableIdentifierInlines.h in Headers */,
144CA3502224180100817789 /* CachedBytecode.h in Headers */,
Modified: trunk/Source/_javascript_Core/Sources.txt (281683 => 281684)
--- trunk/Source/_javascript_Core/Sources.txt 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/Sources.txt 2021-08-27 04:26:35 UTC (rev 281684)
@@ -197,7 +197,6 @@
bytecode/ArithProfile.cpp
bytecode/ArrayAllocationProfile.cpp
bytecode/ArrayProfile.cpp
-bytecode/ByValInfo.cpp
bytecode/BytecodeBasicBlock.cpp
bytecode/BytecodeDumper.cpp
bytecode/BytecodeGeneratorification.cpp
Deleted: trunk/Source/_javascript_Core/bytecode/ByValInfo.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/bytecode/ByValInfo.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/bytecode/ByValInfo.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ByValInfo.h"
-
-#include "CacheableIdentifierInlines.h"
-
-namespace JSC {
-
-#if ENABLE(JIT)
-
-template<typename Visitor>
-void ByValInfo::visitAggregateImpl(Visitor& visitor)
-{
- cachedId.visitAggregate(visitor);
-}
-
-DEFINE_VISIT_AGGREGATE(ByValInfo);
-
-#endif // ENABLE(JIT)
-
-} // namespace JSC
Deleted: trunk/Source/_javascript_Core/bytecode/ByValInfo.h (281683 => 281684)
--- trunk/Source/_javascript_Core/bytecode/ByValInfo.h 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/bytecode/ByValInfo.h 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1,300 +0,0 @@
-/*
- * Copyright (C) 2012-2021 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "CacheableIdentifier.h"
-#include "ClassInfo.h"
-#include "CodeLocation.h"
-#include "IndexingType.h"
-#include "JITStubRoutine.h"
-#include "Structure.h"
-
-namespace JSC {
-
-class Symbol;
-
-#if ENABLE(JIT)
-
-class ArrayProfile;
-class StructureStubInfo;
-
-enum JITArrayMode : uint8_t {
- JITInt32,
- JITDouble,
- JITContiguous,
- JITArrayStorage,
- JITDirectArguments,
- JITScopedArguments,
- JITInt8Array,
- JITInt16Array,
- JITInt32Array,
- JITUint8Array,
- JITUint8ClampedArray,
- JITUint16Array,
- JITUint32Array,
- JITFloat32Array,
- JITFloat64Array,
- JITBigInt64Array,
- JITBigUint64Array,
-};
-
-inline bool isOptimizableIndexingType(IndexingType indexingType)
-{
- switch (indexingType) {
- case ALL_INT32_INDEXING_TYPES:
- case ALL_DOUBLE_INDEXING_TYPES:
- case ALL_CONTIGUOUS_INDEXING_TYPES:
- case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES:
- return true;
- default:
- return false;
- }
-}
-
-inline bool hasOptimizableIndexingForJSType(JSType type)
-{
- switch (type) {
- case DirectArgumentsType:
- case ScopedArgumentsType:
- return true;
- default:
- return false;
- }
-}
-
-inline bool hasOptimizableIndexingForClassInfo(const ClassInfo* classInfo)
-{
- return isTypedView(classInfo->typedArrayStorageType);
-}
-
-inline bool hasOptimizableIndexing(Structure* structure)
-{
- return isOptimizableIndexingType(structure->indexingType())
- || hasOptimizableIndexingForJSType(structure->typeInfo().type())
- || hasOptimizableIndexingForClassInfo(structure->classInfo());
-}
-
-inline JITArrayMode jitArrayModeForIndexingType(IndexingType indexingType)
-{
- switch (indexingType) {
- case ALL_INT32_INDEXING_TYPES:
- return JITInt32;
- case ALL_DOUBLE_INDEXING_TYPES:
- return JITDouble;
- case ALL_CONTIGUOUS_INDEXING_TYPES:
- return JITContiguous;
- case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES:
- return JITArrayStorage;
- default:
- CRASH();
- return JITContiguous;
- }
-}
-
-inline JITArrayMode jitArrayModeForJSType(JSType type)
-{
- switch (type) {
- case DirectArgumentsType:
- return JITDirectArguments;
- case ScopedArgumentsType:
- return JITScopedArguments;
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return JITContiguous;
- }
-}
-
-inline JITArrayMode jitArrayModeForClassInfo(const ClassInfo* classInfo)
-{
- switch (classInfo->typedArrayStorageType) {
- case TypeInt8:
- return JITInt8Array;
- case TypeInt16:
- return JITInt16Array;
- case TypeInt32:
- return JITInt32Array;
- case TypeUint8:
- return JITUint8Array;
- case TypeUint8Clamped:
- return JITUint8ClampedArray;
- case TypeUint16:
- return JITUint16Array;
- case TypeUint32:
- return JITUint32Array;
- case TypeFloat32:
- return JITFloat32Array;
- case TypeFloat64:
- return JITFloat64Array;
- case TypeBigInt64:
- return JITBigInt64Array;
- case TypeBigUint64:
- return JITBigUint64Array;
- default:
- CRASH();
- return JITContiguous;
- }
-}
-
-inline bool jitArrayModePermitsPut(JITArrayMode mode)
-{
- switch (mode) {
- case JITDirectArguments:
- case JITScopedArguments:
- // FIXME: Optimize BigInt64Array / BigUint64Array in IC
- // https://bugs.webkit.org/show_bug.cgi?id=221183
- case JITBigInt64Array:
- case JITBigUint64Array:
- // We could support put_by_val on these at some point, but it's just not that profitable
- // at the moment.
- return false;
- default:
- return true;
- }
-}
-
-inline bool jitArrayModePermitsPutDirect(JITArrayMode mode)
-{
- // We don't allow typed array putDirect here since putDirect has
- // defineOwnProperty({configurable: true, writable:true, enumerable:true})
- // semantics. Typed array indexed properties are non-configurable by
- // default, so we can't simply store to a typed array for putDirect.
- //
- // We could model putDirect on ScopedArguments and DirectArguments, but we
- // haven't found any performance incentive to do it yet.
- switch (mode) {
- case JITInt32:
- case JITDouble:
- case JITContiguous:
- case JITArrayStorage:
- return true;
- default:
- return false;
- }
-}
-
-inline TypedArrayType typedArrayTypeForJITArrayMode(JITArrayMode mode)
-{
- switch (mode) {
- case JITInt8Array:
- return TypeInt8;
- case JITInt16Array:
- return TypeInt16;
- case JITInt32Array:
- return TypeInt32;
- case JITUint8Array:
- return TypeUint8;
- case JITUint8ClampedArray:
- return TypeUint8Clamped;
- case JITUint16Array:
- return TypeUint16;
- case JITUint32Array:
- return TypeUint32;
- case JITFloat32Array:
- return TypeFloat32;
- case JITFloat64Array:
- return TypeFloat64;
- case JITBigInt64Array:
- return TypeBigInt64;
- case JITBigUint64Array:
- return TypeBigUint64;
- default:
- CRASH();
- return NotTypedArray;
- }
-}
-
-inline JITArrayMode jitArrayModeForStructure(Structure* structure)
-{
- if (isOptimizableIndexingType(structure->indexingType()))
- return jitArrayModeForIndexingType(structure->indexingType());
-
- if (hasOptimizableIndexingForJSType(structure->typeInfo().type()))
- return jitArrayModeForJSType(structure->typeInfo().type());
-
- ASSERT(hasOptimizableIndexingForClassInfo(structure->classInfo()));
- return jitArrayModeForClassInfo(structure->classInfo());
-}
-
-struct ByValInfo {
- ByValInfo(BytecodeIndex bytecodeIndex)
- : bytecodeIndex(bytecodeIndex)
- {
- }
-
- void setUp(CodeLocationLabel<ExceptionHandlerPtrTag> exceptionHandler, JITArrayMode arrayMode, ArrayProfile* arrayProfile, CodeLocationLabel<JSInternalPtrTag> doneTarget, CodeLocationLabel<JSInternalPtrTag> badTypeNextHotPathTarget, CodeLocationLabel<JSInternalPtrTag> slowPathTarget)
- {
- this->exceptionHandler = exceptionHandler;
- this->doneTarget = doneTarget;
- this->badTypeNextHotPathTarget = badTypeNextHotPathTarget;
- this->slowPathTarget = slowPathTarget;
- this->arrayProfile = arrayProfile;
- this->slowPathCount = 0;
- this->stubInfo = nullptr;
- this->arrayMode = arrayMode;
- this->tookSlowPath = false;
- this->seen = false;
- }
-
- DECLARE_VISIT_AGGREGATE;
-
- static ptrdiff_t offsetOfSlowOperation() { return OBJECT_OFFSETOF(ByValInfo, m_slowOperation); }
- static ptrdiff_t offsetOfNotIndexJumpTarget() { return OBJECT_OFFSETOF(ByValInfo, m_notIndexJumpTarget); }
- static ptrdiff_t offsetOfBadTypeJumpTarget() { return OBJECT_OFFSETOF(ByValInfo, m_badTypeJumpTarget); }
-
- FunctionPtr<OperationPtrTag> m_slowOperation;
-
- union {
- CodeLocationLabel<JITStubRoutinePtrTag> m_notIndexJumpTarget;
- CodeLocationJump<JSInternalPtrTag> m_notIndexJump;
- };
- union {
- CodeLocationLabel<JITStubRoutinePtrTag> m_badTypeJumpTarget;
- CodeLocationJump<JSInternalPtrTag> m_badTypeJump;
- };
-
- CodeLocationLabel<ExceptionHandlerPtrTag> exceptionHandler;
- CodeLocationLabel<JSInternalPtrTag> doneTarget;
- CodeLocationLabel<JSInternalPtrTag> badTypeNextHotPathTarget;
- CodeLocationLabel<JSInternalPtrTag> slowPathTarget;
- ArrayProfile* arrayProfile;
- BytecodeIndex bytecodeIndex;
- unsigned slowPathCount;
- RefPtr<JITStubRoutine> stubRoutine;
- CacheableIdentifier cachedId; // Once we set cachedId, we must not change the value. JIT code relies on that configured cachedId is marked and retained by CodeBlock through ByValInfo.
- StructureStubInfo* stubInfo;
- JITArrayMode arrayMode; // The array mode that was baked into the inline JIT code.
- bool tookSlowPath : 1;
- bool seen : 1;
-};
-
-inline BytecodeIndex getByValInfoBytecodeIndex(ByValInfo* info)
-{
- return info->bytecodeIndex;
-}
-
-#endif // ENABLE(JIT)
-
-} // namespace JSC
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -32,7 +32,6 @@
#include "ArithProfile.h"
#include "BasicBlockLocation.h"
-#include "ByValInfo.h"
#include "BytecodeDumper.h"
#include "BytecodeLivenessAnalysisInlines.h"
#include "BytecodeOperandsForCheckpoint.h"
@@ -1626,8 +1625,6 @@
result.add(stubInfo->codeOrigin, ICStatus()).iterator->value.stubInfo = stubInfo;
for (CallLinkInfo* callLinkInfo : jitData->m_callLinkInfos)
result.add(callLinkInfo->codeOrigin(), ICStatus()).iterator->value.callLinkInfo = callLinkInfo;
- for (ByValInfo* byValInfo : jitData->m_byValInfos)
- result.add(CodeOrigin(byValInfo->bytecodeIndex), ICStatus()).iterator->value.byValInfo = byValInfo;
}
#if ENABLE(DFG_JIT)
if (JITCode::isOptimizingJIT(jitType())) {
@@ -1699,24 +1696,6 @@
return nullptr;
}
-ByValInfo* CodeBlock::findByValInfo(CodeOrigin codeOrigin)
-{
- ConcurrentJSLocker locker(m_lock);
- if (auto* jitData = m_jitData.get()) {
- for (ByValInfo* byValInfo : jitData->m_byValInfos) {
- if (byValInfo->bytecodeIndex == codeOrigin.bytecodeIndex())
- return byValInfo;
- }
- }
- return nullptr;
-}
-
-ByValInfo* CodeBlock::addByValInfo(BytecodeIndex bytecodeIndex)
-{
- ConcurrentJSLocker locker(m_lock);
- return ensureJITData(locker).m_byValInfos.add(bytecodeIndex);
-}
-
CallLinkInfo* CodeBlock::addCallLinkInfo(CodeOrigin codeOrigin)
{
ConcurrentJSLocker locker(m_lock);
@@ -1828,8 +1807,6 @@
#if ENABLE(JIT)
if (auto* jitData = m_jitData.get()) {
- for (ByValInfo* byValInfo : jitData->m_byValInfos)
- byValInfo->visitAggregate(visitor);
for (StructureStubInfo* stubInfo : jitData->m_stubInfos)
stubInfo->visitAggregate(visitor);
}
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.h (281683 => 281684)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.h 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.h 2021-08-27 04:26:35 UTC (rev 281684)
@@ -97,7 +97,6 @@
class PCToCodeOriginMap;
class RegisterAtOffsetList;
class StructureStubInfo;
-struct ByValInfo;
DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(CodeBlockRareData);
@@ -275,7 +274,6 @@
Bag<JITMulIC> m_mulICs;
Bag<JITNegIC> m_negICs;
Bag<JITSubIC> m_subICs;
- Bag<ByValInfo> m_byValInfos;
Bag<CallLinkInfo> m_callLinkInfos;
SentinelLinkedList<CallLinkInfo, PackedRawSentinelNode<CallLinkInfo>> m_incomingCalls;
SentinelLinkedList<PolymorphicCallNode, PackedRawSentinelNode<PolymorphicCallNode>> m_incomingPolymorphicCalls;
@@ -316,11 +314,7 @@
// O(n) operation. Use getICStatusMap() unless you really only intend to get one stub info.
StructureStubInfo* findStubInfo(CodeOrigin);
- // O(n) operation. Use getICStatusMap() unless you really only intend to get one by-val-info.
- ByValInfo* findByValInfo(CodeOrigin);
- ByValInfo* addByValInfo(BytecodeIndex);
-
CallLinkInfo* addCallLinkInfo(CodeOrigin);
// This is a slow function call used primarily for compiling OSR exits in the case
Modified: trunk/Source/_javascript_Core/bytecode/ICStatusMap.h (281683 => 281684)
--- trunk/Source/_javascript_Core/bytecode/ICStatusMap.h 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/bytecode/ICStatusMap.h 2021-08-27 04:26:35 UTC (rev 281684)
@@ -39,12 +39,10 @@
class PutByStatus;
class DeleteByStatus;
class StructureStubInfo;
-struct ByValInfo;
struct ICStatus {
StructureStubInfo* stubInfo { nullptr };
CallLinkInfo* callLinkInfo { nullptr };
- ByValInfo* byValInfo { nullptr };
CallLinkStatus* callStatus { nullptr };
GetByStatus* getStatus { nullptr };
InByStatus* inStatus { nullptr };
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -6453,12 +6453,11 @@
Node* value = get(bytecode.m_value);
bool compiledAsPutPrivateNameById = false;
+ PutByStatus status = PutByStatus::computeFor(m_inlineStackTop->m_profiledBlock, m_inlineStackTop->m_baselineMap, m_icContextStack, currentCodeOrigin());
+
if (!m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIdent)
&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType)
&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadConstantValue)) {
-
- PutByStatus status = PutByStatus::computeFor(m_inlineStackTop->m_profiledBlock, m_inlineStackTop->m_baselineMap, m_icContextStack, currentCodeOrigin());
-
if (CacheableIdentifier identifier = status.singleIdentifier()) {
UniquedStringImpl* uid = identifier.uid();
unsigned identifierNumber = m_graph.identifiers().ensure(uid);
@@ -6473,11 +6472,37 @@
handlePutPrivateNameById(base, identifier, identifierNumber, value, status, bytecode.m_putKind);
compiledAsPutPrivateNameById = true;
+ } else if (status.takesSlowPath()) {
+ // Even though status is taking a slow path, it is possible that this node still has constant identifier and using PutById is always better in that case.
+ UniquedStringImpl* uid = nullptr;
+ JSCell* propertyCell = nullptr;
+ if (auto* symbol = property->dynamicCastConstant<Symbol*>(*m_vm)) {
+ uid = &symbol->uid();
+ propertyCell = symbol;
+ FrozenValue* frozen = m_graph.freezeStrong(symbol);
+ addToGraph(CheckIsConstant, OpInfo(frozen), property);
+ } else if (auto* string = property->dynamicCastConstant<JSString*>(*m_vm)) {
+ if (auto* impl = string->tryGetValueImpl(); impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
+ uid = bitwise_cast<UniquedStringImpl*>(impl);
+ propertyCell = string;
+ m_graph.freezeStrong(string);
+ addToGraph(CheckIdent, OpInfo(uid), property);
+ }
+ }
+
+ if (uid) {
+ unsigned identifierNumber = m_graph.identifiers().ensure(uid);
+ handlePutPrivateNameById(base, CacheableIdentifier::createFromCell(propertyCell), identifierNumber, value, status, bytecode.m_putKind);
+ compiledAsPutPrivateNameById = true;
+ }
}
}
- if (!compiledAsPutPrivateNameById)
- addToGraph(PutPrivateName, OpInfo(), OpInfo(bytecode.m_putKind), base, property, value);
+ if (!compiledAsPutPrivateNameById) {
+ Node* putPrivateName = addToGraph(PutPrivateName, OpInfo(), OpInfo(bytecode.m_putKind), base, property, value);
+ if (status.observedStructureStubInfoSlowPath())
+ m_graph.m_slowPutByVal.add(putPrivateName);
+ }
NEXT_OPCODE(op_put_private_name);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1952,8 +1952,16 @@
break;
}
- case CheckPrivateBrand:
+ case CheckPrivateBrand: {
+ fixEdge<SymbolUse>(node->child2());
+ break;
+ }
+
case PutPrivateName: {
+ if (!m_graph.m_slowPutByVal.contains(node)) {
+ if (node->child1()->shouldSpeculateCell())
+ fixEdge<CellUse>(node->child1());
+ }
fixEdge<SymbolUse>(node->child2());
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -3746,9 +3746,6 @@
void SpeculativeJIT::compileGetPrivateName(Node* node)
{
- if (node->hasCacheableIdentifier())
- return compileGetPrivateNameById(node);
-
switch (m_graph.child(node, 0).useKind()) {
case CellUse: {
SpeculateCellOperand base(this, m_graph.child(node, 0));
@@ -3941,22 +3938,78 @@
void SpeculativeJIT::compilePutPrivateName(Node* node)
{
- ASSERT(node->child1().useKind() == UntypedUse);
- JSValueOperand base(this, node->child1());
- SpeculateCellOperand propertyValue(this, node->child2());
- JSValueOperand value(this, node->child3());
+ Edge& child1 = node->child1();
+ Edge& child2 = node->child2();
+ Edge& child3 = node->child3();
+ if (m_graph.m_slowPutByVal.contains(node) || (child1.useKind() != CellUse && child1.useKind() != KnownCellUse)) {
+ ASSERT(child1.useKind() == UntypedUse);
+ JSValueOperand base(this, child1);
+ SpeculateCellOperand propertyValue(this, child2);
+ JSValueOperand value(this, child3);
- JSValueRegs valueRegs = value.jsValueRegs();
- JSValueRegs baseRegs = base.jsValueRegs();
+ JSValueRegs valueRegs = value.jsValueRegs();
+ JSValueRegs baseRegs = base.jsValueRegs();
+ GPRReg propertyGPR = propertyValue.gpr();
+
+ speculateSymbol(child2, propertyGPR);
+
+ flushRegisters();
+ auto operation = node->privateFieldPutKind().isDefine() ? operationPutByValDefinePrivateFieldGeneric : operationPutByValSetPrivateFieldGeneric;
+ callOperation(operation, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, CCallHelpers::CellValue(propertyGPR), valueRegs, TrustedImmPtr(nullptr), TrustedImmPtr(nullptr));
+ m_jit.exceptionCheck();
+
+ noResult(node);
+ return;
+ }
+
+ SpeculateCellOperand base(this, child1);
+ SpeculateCellOperand propertyValue(this, child2);
+ JSValueOperand value(this, child3);
+
+ GPRReg baseGPR = base.gpr();
GPRReg propertyGPR = propertyValue.gpr();
+ JSValueRegs valueRegs = value.jsValueRegs();
- speculateSymbol(node->child2(), propertyGPR);
+ GPRTemporary stubInfo;
+ GPRReg stubInfoGPR = InvalidGPRReg;
+ if (JITCode::useDataIC(JITType::DFGJIT)) {
+ stubInfo = GPRTemporary(this);
+ stubInfoGPR = stubInfo.gpr();
+ }
- flushRegisters();
- callOperation(operationPutPrivateNameGeneric, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, CCallHelpers::CellValue(propertyGPR), valueRegs, TrustedImmPtr(nullptr), TrustedImm32(node->privateFieldPutKind().value()));
- m_jit.exceptionCheck();
+ speculateSymbol(child2, propertyGPR);
+ CodeOrigin codeOrigin = node->origin.semantic;
+ CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size());
+ RegisterSet usedRegisters = this->usedRegisters();
+
+ JITPutByValGenerator gen(
+ m_jit.codeBlock(), JITType::DFGJIT, codeOrigin, callSite, AccessType::PutByVal, usedRegisters,
+ JSValueRegs::payloadOnly(baseGPR), JSValueRegs::payloadOnly(propertyGPR), valueRegs, InvalidGPRReg, stubInfoGPR);
+ gen.stubInfo()->propertyIsSymbol = true;
+
+ gen.generateFastPath(m_jit);
+
+ JITCompiler::JumpList slowCases;
+ if (!JITCode::useDataIC(JITType::DFGJIT))
+ slowCases.append(gen.slowPathJump());
+
+ std::unique_ptr<SlowPathGenerator> slowPath;
+ auto operation = node->privateFieldPutKind().isDefine() ? operationPutByValDefinePrivateFieldOptimize : operationPutByValSetPrivateFieldOptimize;
+ if (JITCode::useDataIC(JITType::DFGJIT)) {
+ slowPath = slowPathICCall(
+ slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operation,
+ NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, stubInfoGPR, nullptr);
+ } else {
+ slowPath = slowPathCall(
+ slowCases, this, operation,
+ NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, gen.stubInfo(), nullptr);
+ }
+
+ m_jit.addPutByVal(gen, slowPath.get());
+ addSlowPathGenerator(WTFMove(slowPath));
+
noResult(node);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -2592,12 +2592,16 @@
break;
}
- case GetPrivateName:
- case GetPrivateNameById: {
+ case GetPrivateName: {
compileGetPrivateName(node);
break;
}
+ case GetPrivateNameById: {
+ compileGetPrivateNameById(node);
+ break;
+ }
+
case GetByVal: {
JSValueRegsTemporary jsValueResult;
GPRTemporary oneRegResult;
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -3108,12 +3108,16 @@
break;
}
- case GetPrivateName:
- case GetPrivateNameById: {
+ case GetPrivateName: {
compileGetPrivateName(node);
break;
}
+ case GetPrivateNameById: {
+ compileGetPrivateNameById(node);
+ break;
+ }
+
case GetByVal: {
JSValueRegsTemporary result;
compileGetByVal(node, scopedLambda<std::tuple<JSValueRegs, DataFormat>(DataFormat preferredFormat)>([&] (DataFormat preferredFormat) {
Modified: trunk/Source/_javascript_Core/dfg/DFGStoreBarrierInsertionPhase.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/dfg/DFGStoreBarrierInsertionPhase.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/dfg/DFGStoreBarrierInsertionPhase.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -275,6 +275,12 @@
break;
}
+ case PutPrivateName: {
+ if (!m_graph.m_slowPutByVal.contains(m_node) && (m_node->child1().useKind() == CellUse || m_node->child1().useKind() == KnownCellUse))
+ considerBarrier(m_node->child1(), m_node->child3());
+ break;
+ }
+
case PutPrivateNameById: {
// We emit IC code when we have a non-null cacheableIdentifier and we need to introduce a
// barrier for it. On PutPrivateName, we perform store barrier during slow path execution.
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -4262,15 +4262,100 @@
void compilePutPrivateName()
{
- DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse, m_node->child1().useKind());
JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+ Edge& child1 = m_node->child1();
+ Edge& child2 = m_node->child2();
+ Edge& child3 = m_node->child3();
+ if (m_graph.m_slowPutByVal.contains(m_node) || (child1.useKind() != CellUse && child1.useKind() != KnownCellUse)) {
+ DFG_ASSERT(m_graph, m_node, child1.useKind() == UntypedUse, child1.useKind());
- LValue base = lowJSValue(m_node->child1());
- LValue property = lowSymbol(m_node->child2());
- LValue value = lowJSValue(m_node->child3());
+ LValue base = lowJSValue(child1);
+ LValue property = lowSymbol(child2);
+ LValue value = lowJSValue(child3);
- vmCall(Void, operationPutPrivateNameGeneric,
- weakPointer(globalObject), base, property, value, m_out.constIntPtr(0), m_out.constInt32(m_node->privateFieldPutKind().value()));
+ auto operation = m_node->privateFieldPutKind().isDefine() ? operationPutByValDefinePrivateFieldGeneric : operationPutByValSetPrivateFieldGeneric;
+ vmCall(Void, operation, weakPointer(globalObject), base, property, value, m_out.constIntPtr(0), m_out.constIntPtr(0));
+ return;
+ }
+
+ Node* node = m_node;
+
+ LValue base = lowCell(child1);
+ LValue property = lowSymbol(child2);
+ LValue value = lowJSValue(child3);
+
+ PatchpointValue* patchpoint = m_out.patchpoint(Void);
+ patchpoint->appendSomeRegister(base);
+ patchpoint->appendSomeRegister(property);
+ patchpoint->appendSomeRegister(value);
+ patchpoint->append(m_notCellMask, ValueRep::lateReg(GPRInfo::notCellMaskRegister));
+ patchpoint->append(m_numberTag, ValueRep::lateReg(GPRInfo::numberTagRegister));
+ patchpoint->clobber(RegisterSet::macroScratchRegisters());
+ patchpoint->numGPScratchRegisters = JITCode::useDataIC(JITType::FTLJIT) ? 1 : 0;
+
+ RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+
+ State* state = &m_ftlState;
+ CodeOrigin nodeSemanticOrigin = node->origin.semantic;
+ auto operation = node->privateFieldPutKind().isDefine() ? operationPutByValDefinePrivateFieldOptimize : operationPutByValSetPrivateFieldOptimize;
+ patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+ AllowMacroScratchRegisterUsage allowScratch(jit);
+
+ CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(nodeSemanticOrigin);
+
+ // This is the direct exit target for operation calls.
+ Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+ // This is the exit for call IC's created by the IC for getters. We don't have
+ // to do anything weird other than call this, since it will associate the exit with
+ // the callsite index.
+ exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+
+ GPRReg baseGPR = params[0].gpr();
+ GPRReg propertyGPR = params[1].gpr();
+ GPRReg valueGPR = params[2].gpr();
+ GPRReg stubInfoGPR = JITCode::useDataIC(JITType::FTLJIT) ? params.gpScratch(0) : InvalidGPRReg;
+
+ auto generator = Box<JITPutByValGenerator>::create(
+ jit.codeBlock(), JITType::FTLJIT, nodeSemanticOrigin, callSiteIndex, AccessType::PutByVal,
+ params.unavailableRegisters(), JSValueRegs(baseGPR), JSValueRegs(propertyGPR), JSValueRegs(valueGPR), InvalidGPRReg, stubInfoGPR);
+
+ generator->stubInfo()->propertyIsSymbol = true;
+
+ generator->generateFastPath(jit);
+ CCallHelpers::Label done = jit.label();
+
+ params.addLatePath([=] (CCallHelpers& jit) {
+ AllowMacroScratchRegisterUsage allowScratch(jit);
+
+ if (!JITCode::useDataIC(JITType::FTLJIT))
+ generator->slowPathJump().link(&jit);
+ CCallHelpers::Label slowPathBegin = jit.label();
+ CCallHelpers::Call slowPathCall;
+ if (JITCode::useDataIC(JITType::FTLJIT)) {
+ jit.move(CCallHelpers::TrustedImmPtr(generator->stubInfo()), stubInfoGPR);
+ generator->stubInfo()->m_slowOperation = operation;
+ slowPathCall = callOperation(
+ *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
+ exceptions.get(), CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), InvalidGPRReg,
+ jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
+ baseGPR, propertyGPR, valueGPR, stubInfoGPR, CCallHelpers::TrustedImmPtr(nullptr)).call();
+ } else {
+ slowPathCall = callOperation(
+ *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
+ exceptions.get(), operation, InvalidGPRReg,
+ jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
+ baseGPR, propertyGPR, valueGPR, CCallHelpers::TrustedImmPtr(generator->stubInfo()), CCallHelpers::TrustedImmPtr(nullptr)).call();
+ }
+ jit.jump().linkTo(done, &jit);
+
+ generator->reportSlowPathCall(slowPathBegin, slowPathCall);
+
+ jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+ generator->finalize(linkBuffer, linkBuffer);
+ });
+ });
+ });
}
void compileAtomicsReadModifyWrite()
Modified: trunk/Source/_javascript_Core/jit/JIT.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JIT.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JIT.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -517,7 +517,6 @@
m_delByValIndex = 0;
m_instanceOfIndex = 0;
m_privateBrandAccessIndex = 0;
- m_byValInstructionIndex = 0;
m_callLinkInfoIndex = 0;
unsigned bytecodeCountHavingSlowCase = 0;
@@ -919,45 +918,6 @@
finalizeInlineCaches(m_instanceOfs, patchBuffer);
finalizeInlineCaches(m_privateBrandAccesses, patchBuffer);
- if (m_byValCompilationInfo.size()) {
-#if ENABLE(EXTRA_CTI_THUNKS)
- CodeLocationLabel exceptionHandler(vm().getCTIStub(handleExceptionGenerator).retaggedCode<ExceptionHandlerPtrTag>());
-#else
- CodeLocationLabel<ExceptionHandlerPtrTag> exceptionHandler = patchBuffer.locationOf<ExceptionHandlerPtrTag>(m_exceptionHandler);
-#endif
-
- for (const auto& byValCompilationInfo : m_byValCompilationInfo) {
- PatchableJump patchableNotIndexJump = byValCompilationInfo.notIndexJump;
- CodeLocationJump<JSInternalPtrTag> notIndexJump;
- if (Jump(patchableNotIndexJump).isSet())
- notIndexJump = CodeLocationJump<JSInternalPtrTag>(patchBuffer.locationOf<JSInternalPtrTag>(patchableNotIndexJump));
-
- PatchableJump patchableBadTypeJump = byValCompilationInfo.badTypeJump;
- CodeLocationJump<JSInternalPtrTag> badTypeJump;
- if (Jump(patchableBadTypeJump).isSet())
- badTypeJump = CodeLocationJump<JSInternalPtrTag>(patchBuffer.locationOf<JSInternalPtrTag>(byValCompilationInfo.badTypeJump));
-
- auto doneTarget = CodeLocationLabel<JSInternalPtrTag>(patchBuffer.locationOf<JSInternalPtrTag>(byValCompilationInfo.doneTarget));
- auto nextHotPathTarget = CodeLocationLabel<JSInternalPtrTag>(patchBuffer.locationOf<JSInternalPtrTag>(byValCompilationInfo.nextHotPathTarget));
- auto slowPathTarget = CodeLocationLabel<JSInternalPtrTag>(patchBuffer.locationOf<JSInternalPtrTag>(byValCompilationInfo.slowPathTarget));
-
- byValCompilationInfo.byValInfo->setUp(
- exceptionHandler,
- byValCompilationInfo.arrayMode,
- byValCompilationInfo.arrayProfile,
- doneTarget,
- nextHotPathTarget,
- slowPathTarget);
- if (JITCode::useDataIC(JITType::BaselineJIT)) {
- byValCompilationInfo.byValInfo->m_notIndexJumpTarget = slowPathTarget.retagged<JITStubRoutinePtrTag>();
- byValCompilationInfo.byValInfo->m_badTypeJumpTarget = slowPathTarget.retagged<JITStubRoutinePtrTag>();
- } else {
- byValCompilationInfo.byValInfo->m_notIndexJump = notIndexJump;
- byValCompilationInfo.byValInfo->m_badTypeJump = badTypeJump;
- }
- }
- }
-
for (auto& compilationInfo : m_callCompilationInfo) {
CallLinkInfo& info = *compilationInfo.callLinkInfo;
info.setCodeLocations(
@@ -1060,7 +1020,7 @@
jumpToExceptionHandler(vm());
}
- if (!m_exceptionChecks.empty() || m_byValCompilationInfo.size()) {
+ if (!m_exceptionChecks.empty()) {
m_exceptionHandler = label();
m_exceptionChecks.link(this);
Modified: trunk/Source/_javascript_Core/jit/JIT.h (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JIT.h 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JIT.h 2021-08-27 04:26:35 UTC (rev 281684)
@@ -37,7 +37,6 @@
#define ASSERT_JIT_OFFSET(actual, expected) ASSERT_WITH_MESSAGE(actual == expected, "JIT Offset \"%s\" should be %d, not %d.\n", #expected, static_cast<int>(expected), static_cast<int>(actual));
-#include "ByValInfo.h"
#include "CodeBlock.h"
#include "CommonSlowPaths.h"
#include "JITDisassembler.h"
@@ -149,42 +148,6 @@
}
};
- struct ByValCompilationInfo {
- ByValCompilationInfo() { }
-
- ByValCompilationInfo(ByValInfo* byValInfo, BytecodeIndex bytecodeIndex, MacroAssembler::PatchableJump notIndexJump, MacroAssembler::PatchableJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, MacroAssembler::Label doneTarget, MacroAssembler::Label nextHotPathTarget)
- : byValInfo(byValInfo)
- , bytecodeIndex(bytecodeIndex)
- , notIndexJump(notIndexJump)
- , badTypeJump(badTypeJump)
- , arrayMode(arrayMode)
- , arrayProfile(arrayProfile)
- , doneTarget(doneTarget)
- , nextHotPathTarget(nextHotPathTarget)
- {
- }
-
- ByValCompilationInfo(ByValInfo* byValInfo, BytecodeIndex bytecodeIndex, MacroAssembler::PatchableJump notIndexJump, MacroAssembler::Label doneTarget, MacroAssembler::Label nextHotPathTarget)
- : byValInfo(byValInfo)
- , bytecodeIndex(bytecodeIndex)
- , notIndexJump(notIndexJump)
- , doneTarget(doneTarget)
- , nextHotPathTarget(nextHotPathTarget)
- {
- }
-
- ByValInfo* byValInfo;
- BytecodeIndex bytecodeIndex;
- MacroAssembler::PatchableJump notIndexJump;
- MacroAssembler::PatchableJump badTypeJump;
- JITArrayMode arrayMode;
- ArrayProfile* arrayProfile;
- MacroAssembler::Label doneTarget;
- MacroAssembler::Label nextHotPathTarget;
- MacroAssembler::Label slowPathTarget;
- MacroAssembler::Call returnAddress;
- };
-
struct CallCompilationInfo {
MacroAssembler::Label slowPathStart;
MacroAssembler::Label doneLocation;
@@ -224,13 +187,6 @@
{
return JIT(vm, codeBlock, bytecodeOffset).privateCompile(effort);
}
-
- static void compilePutPrivateNameWithCachedId(VM& vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, CacheableIdentifier propertyName)
- {
- JIT jit(vm, codeBlock);
- jit.m_bytecodeIndex = byValInfo->bytecodeIndex;
- jit.privateCompilePutPrivateNameWithCachedId(byValInfo, returnAddress, propertyName);
- }
static unsigned frameRegisterCountFor(CodeBlock*);
static int stackPointerOffsetFor(CodeBlock*);
@@ -244,8 +200,6 @@
void privateCompileSlowCases();
void link();
CompilationResult privateCompile(JITCompilationEffort);
-
- void privateCompilePutPrivateNameWithCachedId(ByValInfo*, ReturnAddressPtr, CacheableIdentifier);
// Add a call out from JIT code, without an exception check.
Call appendCall(const FunctionPtr<CFunctionPtrTag> function)
@@ -353,8 +307,6 @@
void emitArrayProfilingSiteWithCell(RegisterID cellGPR, ArrayProfile*, RegisterID scratchGPR);
void emitArrayProfilingSiteWithCell(RegisterID cellGPR, RegisterID arrayProfileGPR, RegisterID scratchGPR);
- void emitArrayProfileStoreToHoleSpecialCase(ArrayProfile*);
- void emitArrayProfileOutOfBoundsSpecialCase(ArrayProfile*);
template<typename Op>
ECMAMode ecmaMode(Op);
@@ -363,14 +315,6 @@
template<typename Op>
PrivateFieldPutKind privateFieldPutKind(Op);
- // Identifier check helper for GetByVal and PutByVal.
- void emitByValIdentifierCheck(RegisterID cell, RegisterID scratch, CacheableIdentifier, JumpList& slowCases);
-
- JITPutByIdGenerator emitPutPrivateNameWithCachedId(OpPutPrivateName, CacheableIdentifier, JumpList& doneCases, JumpList& slowCases);
-
- template<typename Op>
- JITPutByIdGenerator emitPutByValWithCachedId(Op, PutKind, CacheableIdentifier, JumpList& doneCases, JumpList& slowCases);
-
enum FinalObjectMode { MayBeFinal, KnownNotFinal };
void emitGetVirtualRegister(VirtualRegister src, JSValueRegs dst);
@@ -1012,7 +956,6 @@
Vector<JITDelByValGenerator> m_delByVals;
Vector<JITInstanceOfGenerator> m_instanceOfs;
Vector<JITPrivateBrandAccessGenerator> m_privateBrandAccesses;
- Vector<ByValCompilationInfo> m_byValCompilationInfo;
Vector<CallCompilationInfo> m_callCompilationInfo;
Vector<JumpTable> m_jmpTable;
@@ -1040,7 +983,6 @@
unsigned m_delByIdIndex { UINT_MAX };
unsigned m_instanceOfIndex { UINT_MAX };
unsigned m_privateBrandAccessIndex { UINT_MAX };
- unsigned m_byValInstructionIndex { UINT_MAX };
unsigned m_callLinkInfoIndex { UINT_MAX };
unsigned m_bytecodeCountHavingSlowCase { 0 };
Modified: trunk/Source/_javascript_Core/jit/JITInlines.h (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JITInlines.h 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JITInlines.h 2021-08-27 04:26:35 UTC (rev 281684)
@@ -360,16 +360,6 @@
}
}
-inline void JIT::emitArrayProfileStoreToHoleSpecialCase(ArrayProfile* arrayProfile)
-{
- store8(TrustedImm32(1), arrayProfile->addressOfMayStoreToHole());
-}
-
-inline void JIT::emitArrayProfileOutOfBoundsSpecialCase(ArrayProfile* arrayProfile)
-{
- store8(TrustedImm32(1), arrayProfile->addressOfOutOfBounds());
-}
-
ALWAYS_INLINE int32_t JIT::getOperandConstantInt(VirtualRegister src)
{
return getConstantOperand(src).asInt32();
Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JITOperations.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1315,19 +1315,12 @@
RETURN_IF_EXCEPTION(scope, void());
}
-JSC_DEFINE_JIT_OPERATION(operationPutPrivateNameOptimize, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo, PrivateFieldPutKind putKind))
+template<bool define>
+static ALWAYS_INLINE void putPrivateNameOptimize(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue subscript, JSValue value, StructureStubInfo* stubInfo)
{
VM& vm = globalObject->vm();
- CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
- JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
auto scope = DECLARE_THROW_SCOPE(vm);
- CodeBlock* codeBlock = callFrame->codeBlock();
-
- JSValue baseValue = JSValue::decode(encodedBaseValue);
- JSValue subscript = JSValue::decode(encodedSubscript);
- JSValue value = JSValue::decode(encodedValue);
-
auto baseObject = baseValue.toObject(globalObject);
RETURN_IF_EXCEPTION(scope, void());
@@ -1334,93 +1327,108 @@
auto propertyName = subscript.toPropertyKey(globalObject);
EXCEPTION_ASSERT(!scope.exception());
- OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
+ // Private fields can only be accessed within class lexical scope
+ // and class methods are always in strict mode
+ AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+ Structure* structure = CommonSlowPaths::originalStructureBeforePut(vm, baseValue);
+ constexpr bool isStrictMode = true;
+ PutPropertySlot slot(baseObject, isStrictMode);
+ if constexpr (define)
+ baseObject->definePrivateField(globalObject, propertyName, value, slot);
+ else
+ baseObject->setPrivateField(globalObject, propertyName, value, slot);
+ RETURN_IF_EXCEPTION(scope, void());
+ if (accessType != static_cast<AccessType>(stubInfo->accessType))
+ return;
+
if (baseValue.isObject() && CacheableIdentifier::isCacheableIdentifierCell(subscript)) {
- ASSERT(subscript.isSymbol());
- ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
- ASSERT(!byValInfo->stubRoutine);
- if (byValInfo->seen) {
- if (byValInfo->cachedId.uid() == propertyName) {
- JIT::compilePutPrivateNameWithCachedId(vm, codeBlock, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), byValInfo->cachedId);
- optimizationResult = OptimizationResult::Optimized;
- } else {
- // Seem like a generic property access site.
- optimizationResult = OptimizationResult::GiveUp;
- }
- } else {
- {
- ConcurrentJSLocker locker(codeBlock->m_lock);
- byValInfo->seen = true;
- byValInfo->cachedId = CacheableIdentifier::createFromCell(subscript.asCell());
- optimizationResult = OptimizationResult::SeenOnce;
- }
- vm.heap.writeBarrier(codeBlock, subscript.asCell());
- }
+ CacheableIdentifier identifier = CacheableIdentifier::createFromCell(subscript.asCell());
+ if (stubInfo->considerCachingBy(vm, codeBlock, structure, identifier))
+ repatchPutBy(globalObject, codeBlock, baseValue, structure, identifier, slot, *stubInfo, PutByKind::ByVal, define ? PutKind::DirectPrivateFieldDefine : PutKind::DirectPrivateFieldSet);
}
+}
- if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
- // If we take slow path more than 10 times without patching then make sure we
- // never make that mistake again. This gives 10 iterations worth of opportunity
- // for us to observe that the put_private_name may be polymorphic.
- // We count up slowPathCount even if the result is GiveUp.
- if (++byValInfo->slowPathCount >= 10)
- optimizationResult = OptimizationResult::GiveUp;
- }
+template<bool define>
+static ALWAYS_INLINE void putPrivateName(JSGlobalObject* globalObject, JSValue baseValue, JSValue subscript, JSValue value)
+{
+ VM& vm = globalObject->vm();
+ auto scope = DECLARE_THROW_SCOPE(vm);
- if (optimizationResult == OptimizationResult::GiveUp) {
- // Don't ever try to optimize.
- byValInfo->tookSlowPath = true;
- if (codeBlock->useDataIC())
- byValInfo->m_slowOperation = operationPutPrivateNameGeneric;
- else
- ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), operationPutPrivateNameGeneric);
- }
+ auto baseObject = baseValue.toObject(globalObject);
+ RETURN_IF_EXCEPTION(scope, void());
+ auto propertyName = subscript.toPropertyKey(globalObject);
+ EXCEPTION_ASSERT(!scope.exception());
+
scope.release();
-
+
// Private fields can only be accessed within class lexical scope
// and class methods are always in strict mode
- const bool isStrictMode = true;
+ constexpr bool isStrictMode = true;
PutPropertySlot slot(baseObject, isStrictMode);
- if (putKind.isDefine())
+ if constexpr (define)
baseObject->definePrivateField(globalObject, propertyName, value, slot);
else
baseObject->setPrivateField(globalObject, propertyName, value, slot);
}
-// We need to match the signature of operationPutPrivateNameOptimize
-JSC_DEFINE_JIT_OPERATION(operationPutPrivateNameGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo, PrivateFieldPutKind privateFieldPutKind))
+JSC_DEFINE_JIT_OPERATION(operationPutByValDefinePrivateFieldOptimize, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, StructureStubInfo* stubInfo, ArrayProfile*))
{
VM& vm = globalObject->vm();
CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
- auto scope = DECLARE_THROW_SCOPE(vm);
+ CodeBlock* codeBlock = callFrame->codeBlock();
+ JSValue baseValue = JSValue::decode(encodedBaseValue);
+ JSValue subscript = JSValue::decode(encodedSubscript);
+ JSValue value = JSValue::decode(encodedValue);
+ putPrivateNameOptimize<true>(globalObject, codeBlock, baseValue, subscript, value, stubInfo);
+}
+JSC_DEFINE_JIT_OPERATION(operationPutByValSetPrivateFieldOptimize, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, StructureStubInfo* stubInfo, ArrayProfile*))
+{
+ VM& vm = globalObject->vm();
+ CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+ JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+
+ CodeBlock* codeBlock = callFrame->codeBlock();
JSValue baseValue = JSValue::decode(encodedBaseValue);
JSValue subscript = JSValue::decode(encodedSubscript);
JSValue value = JSValue::decode(encodedValue);
+ putPrivateNameOptimize<false>(globalObject, codeBlock, baseValue, subscript, value, stubInfo);
+}
- auto baseObject = baseValue.toObject(globalObject);
- RETURN_IF_EXCEPTION(scope, void());
+JSC_DEFINE_JIT_OPERATION(operationPutByValDefinePrivateFieldGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, StructureStubInfo* stubInfo, ArrayProfile*))
+{
+ VM& vm = globalObject->vm();
+ CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+ JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
- auto propertyName = subscript.toPropertyKey(globalObject);
- EXCEPTION_ASSERT(!scope.exception());
+ JSValue baseValue = JSValue::decode(encodedBaseValue);
+ JSValue subscript = JSValue::decode(encodedSubscript);
+ JSValue value = JSValue::decode(encodedValue);
- scope.release();
+ if (stubInfo)
+ stubInfo->tookSlowPath = true;
- // Private fields can only be accessed within class lexical scope
- // and class methods are always in strict mode
- const bool isStrictMode = true;
- PutPropertySlot slot(baseObject, isStrictMode);
- if (privateFieldPutKind.isDefine())
- baseObject->definePrivateField(globalObject, propertyName, value, slot);
- else
- baseObject->setPrivateField(globalObject, propertyName, value, slot);
+ putPrivateName<true>(globalObject, baseValue, subscript, value);
+}
- if (byValInfo)
- byValInfo->tookSlowPath = true;
+JSC_DEFINE_JIT_OPERATION(operationPutByValSetPrivateFieldGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, StructureStubInfo* stubInfo, ArrayProfile*))
+{
+ VM& vm = globalObject->vm();
+ CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+ JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+
+ JSValue baseValue = JSValue::decode(encodedBaseValue);
+ JSValue subscript = JSValue::decode(encodedSubscript);
+ JSValue value = JSValue::decode(encodedValue);
+
+ if (stubInfo)
+ stubInfo->tookSlowPath = true;
+
+ putPrivateName<false>(globalObject, baseValue, subscript, value);
}
JSC_DEFINE_JIT_OPERATION(operationCallEval, EncodedJSValue, (JSGlobalObject* globalObject, CallFrame* calleeFrame, ECMAMode ecmaMode))
Modified: trunk/Source/_javascript_Core/jit/JITOperations.h (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JITOperations.h 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JITOperations.h 2021-08-27 04:26:35 UTC (rev 281684)
@@ -64,7 +64,6 @@
class VM;
class WatchpointSet;
-struct ByValInfo;
struct ECMAMode;
struct InlineCallFrame;
struct Instruction;
@@ -80,7 +79,6 @@
Ap: ArrayProfile*
Arp: BinaryArithProfile*
B: Butterfly*
- By: ByValInfo*
C: JSCell*
Cb: CodeBlock*
Cli: CallLinkInfo*
@@ -201,9 +199,6 @@
JSC_DECLARE_JIT_OPERATION(operationSetPrivateBrandGeneric, void, (JSGlobalObject*, StructureStubInfo*, EncodedJSValue, EncodedJSValue));
JSC_DECLARE_JIT_OPERATION(operationCheckPrivateBrandGeneric, void, (JSGlobalObject*, StructureStubInfo*, EncodedJSValue, EncodedJSValue));
-JSC_DECLARE_JIT_OPERATION(operationPutPrivateNameOptimize, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*, PrivateFieldPutKind));
-JSC_DECLARE_JIT_OPERATION(operationPutPrivateNameGeneric, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*, PrivateFieldPutKind));
-
JSC_DECLARE_JIT_OPERATION(operationPutByValNonStrictOptimize, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
JSC_DECLARE_JIT_OPERATION(operationPutByValStrictOptimize, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
JSC_DECLARE_JIT_OPERATION(operationDirectPutByValNonStrictOptimize, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
@@ -212,6 +207,10 @@
JSC_DECLARE_JIT_OPERATION(operationPutByValStrictGeneric, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
JSC_DECLARE_JIT_OPERATION(operationDirectPutByValStrictGeneric, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
JSC_DECLARE_JIT_OPERATION(operationDirectPutByValNonStrictGeneric, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
+JSC_DECLARE_JIT_OPERATION(operationPutByValDefinePrivateFieldOptimize, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
+JSC_DECLARE_JIT_OPERATION(operationPutByValDefinePrivateFieldGeneric, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
+JSC_DECLARE_JIT_OPERATION(operationPutByValSetPrivateFieldOptimize, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
+JSC_DECLARE_JIT_OPERATION(operationPutByValSetPrivateFieldGeneric, void, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, StructureStubInfo*, ArrayProfile*));
JSC_DECLARE_JIT_OPERATION(operationCallEval, EncodedJSValue, (JSGlobalObject*, CallFrame*, ECMAMode));
JSC_DECLARE_JIT_OPERATION(operationLinkCall, SlowPathReturnType, (CallFrame*, JSGlobalObject*, CallLinkInfo*));
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -467,49 +467,6 @@
emitWriteBarrier(base, ShouldFilterBase);
}
-template<typename Op>
-JITPutByIdGenerator JIT::emitPutByValWithCachedId(Op bytecode, PutKind putKind, CacheableIdentifier propertyName, JumpList& doneCases, JumpList& slowCases)
-{
- // base: regT0
- // property: regT1
- // scratch: regT2
-
- VirtualRegister base = bytecode.m_base;
- VirtualRegister value = bytecode.m_value;
-
- slowCases.append(branchIfNotCell(regT1));
- emitByValIdentifierCheck(regT1, regT1, propertyName, slowCases);
-
- // Write barrier breaks the registers. So after issuing the write barrier,
- // reload the registers.
- emitGetVirtualRegisters(base, regT0, value, regT1);
-
- JITPutByIdGenerator gen(
- m_codeBlock, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(), propertyName,
- JSValueRegs(regT0), JSValueRegs(regT1), regT3, regT2, ecmaMode(bytecode), putKind);
- gen.generateFastPath(*this);
- // IC can write new Structure without write-barrier if a base is cell.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
- doneCases.append(jump());
-
- Label coldPathBegin = label();
- gen.slowPathJump().link(this);
-
- Call call;
- if (JITCode::useDataIC(JITType::BaselineJIT)) {
- gen.stubInfo()->m_slowOperation = gen.slowPathFunction();
- move(TrustedImmPtr(gen.stubInfo()), GPRInfo::nonArgGPR0);
- callOperation<decltype(gen.slowPathFunction())>(Address(GPRInfo::nonArgGPR0, StructureStubInfo::offsetOfSlowOperation()), TrustedImmPtr(m_codeBlock->globalObject()), GPRInfo::nonArgGPR0, regT1, regT0, propertyName.rawBits());
- } else
- call = callOperation(gen.slowPathFunction(), TrustedImmPtr(m_codeBlock->globalObject()), gen.stubInfo(), regT1, regT0, propertyName.rawBits());
- gen.reportSlowPathCall(coldPathBegin, call);
- doneCases.append(jump());
-
- return gen;
-}
-
void JIT::emitSlow_op_put_by_val(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
{
bool isDirect = currentInstruction->opcodeID() == op_put_by_val_direct;
@@ -611,76 +568,72 @@
auto bytecode = currentInstruction->as<OpPutPrivateName>();
VirtualRegister base = bytecode.m_base;
VirtualRegister property = bytecode.m_property;
- ByValInfo* byValInfo = m_codeBlock->addByValInfo(m_bytecodeIndex);
+ VirtualRegister value = bytecode.m_value;
emitGetVirtualRegister(base, regT0);
emitGetVirtualRegister(property, regT1);
+ emitGetVirtualRegister(value, regT2);
emitJumpSlowCaseIfNotJSCell(regT0, base);
- PatchableJump fastPathJmp;
- if (JITCode::useDataIC(JITType::BaselineJIT))
- farJump(AbsoluteAddress(&byValInfo->m_notIndexJumpTarget), JITStubRoutinePtrTag);
- else {
- fastPathJmp = patchableJump();
- addSlowCase(fastPathJmp);
- }
-
- Label done = label();
-
- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeIndex, fastPathJmp, done, done));
+ JITPutByValGenerator gen(
+ m_codeBlock, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::PutByVal, RegisterSet::stubUnavailableRegisters(),
+ JSValueRegs(regT0), JSValueRegs(regT1), JSValueRegs(regT2), InvalidGPRReg, regT4);
+ gen.generateFastPath(*this);
+ if (!JITCode::useDataIC(JITType::BaselineJIT))
+ addSlowCase(gen.slowPathJump());
+ else
+ addSlowCase();
+ m_putByVals.append(gen);
+
+ // IC can write new Structure without write-barrier if a base is cell.
+ // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
+ // https://bugs.webkit.org/show_bug.cgi?id=209395
+ emitWriteBarrier(base, ShouldFilterBase);
}
void JIT::emitSlow_op_put_private_name(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
{
auto bytecode = currentInstruction->as<OpPutPrivateName>();
- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
PrivateFieldPutKind putKind = bytecode.m_putKind;
+ JITPutByValGenerator& gen = m_putByVals[m_putByValIndex++];
+
linkAllSlowCases(iter);
- Label slowPath = label();
+ Label coldPathBegin = label();
+
+ auto operation = putKind.isDefine() ? operationPutByValDefinePrivateFieldOptimize : operationPutByValSetPrivateFieldOptimize;
#if !ENABLE(EXTRA_CTI_THUNKS)
+ // They are configured in the fast path and not clobbered.
constexpr GPRReg baseGPR = regT0;
constexpr GPRReg propertyGPR = regT1;
constexpr GPRReg valueGPR = regT2;
-
- emitGetVirtualRegister(bytecode.m_base, baseGPR);
- emitGetVirtualRegister(bytecode.m_property, propertyGPR);
- emitGetVirtualRegister(bytecode.m_value, valueGPR);
- Call call = callOperation(operationPutPrivateNameOptimize, TrustedImmPtr(m_codeBlock->globalObject()), baseGPR, propertyGPR, valueGPR, byValInfo, TrustedImm32(putKind.value()));
+ Call call = callOperation(operation, TrustedImmPtr(m_codeBlock->globalObject()), baseGPR, propertyGPR, valueGPR, gen.stubInfo(), TrustedImmPtr(nullptr));
#else
VM& vm = this->vm();
uint32_t bytecodeOffset = m_bytecodeIndex.offset();
ASSERT(BytecodeIndex(bytecodeOffset) == m_bytecodeIndex);
- constexpr GPRReg bytecodeOffsetGPR = argumentGPR0;
+ // constexpr GPRReg baseGPR = regT0;
+ // constexpr GPRReg propertyGPR = regT1;
+ // constexpr GPRReg valueGPR = regT2;
+ constexpr GPRReg stubInfoGPR = regT3;
+ constexpr GPRReg bytecodeOffsetGPR = regT4;
+
move(TrustedImm32(bytecodeOffset), bytecodeOffsetGPR);
-
- constexpr GPRReg baseGPR = argumentGPR1;
- constexpr GPRReg propertyGPR = argumentGPR2;
- constexpr GPRReg valueGPR = argumentGPR3;
- constexpr GPRReg byValInfoGPR = argumentGPR4;
- constexpr GPRReg putKindGPR = argumentGPR5;
-
- emitGetVirtualRegister(bytecode.m_base, baseGPR);
- emitGetVirtualRegister(bytecode.m_property, propertyGPR);
- emitGetVirtualRegister(bytecode.m_value, valueGPR);
- move(TrustedImmPtr(byValInfo), byValInfoGPR);
- move(TrustedImm32(putKind.value()), putKindGPR);
+ move(TrustedImmPtr(gen.stubInfo()), stubInfoGPR);
emitNakedNearCall(vm.getCTIStub(slow_op_put_private_name_prepareCallGenerator).retaggedCode<NoPtrTag>());
Call call;
if (JITCode::useDataIC(JITType::BaselineJIT))
- byValInfo->m_slowOperation = operationPutPrivateNameOptimize;
+ gen.stubInfo()->m_slowOperation = operation;
else
- call = appendCall(operationPutPrivateNameOptimize);
+ call = appendCall(operation);
emitNakedNearCall(vm.getCTIStub(checkExceptionGenerator).retaggedCode<NoPtrTag>());
#endif // ENABLE(EXTRA_CTI_THUNKS)
- m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
- m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
- m_byValInstructionIndex++;
+ gen.reportSlowPathCall(coldPathBegin, call);
}
#if ENABLE(EXTRA_CTI_THUNKS)
@@ -695,24 +648,24 @@
if (!JITCode::useDataIC(JITType::BaselineJIT))
jit.tagReturnAddress();
- constexpr GPRReg bytecodeOffsetGPR = argumentGPR0;
+ constexpr GPRReg baseGPR = regT0;
+ constexpr GPRReg propertyGPR = regT1;
+ constexpr GPRReg valueGPR = regT2;
+ constexpr GPRReg stubInfoGPR = regT3;
+ constexpr GPRReg bytecodeOffsetGPR = regT4;
+
jit.store32(bytecodeOffsetGPR, tagFor(CallFrameSlot::argumentCountIncludingThis));
- constexpr GPRReg globalObjectGPR = argumentGPR0;
- constexpr GPRReg baseGPR = argumentGPR1;
- constexpr GPRReg propertyGPR = argumentGPR2;
- constexpr GPRReg valueGPR = argumentGPR3;
- constexpr GPRReg byValInfoGPR = argumentGPR4;
- constexpr GPRReg putKindGPR = argumentGPR5;
+ constexpr GPRReg globalObjectGPR = regT4;
jit.loadPtr(addressFor(CallFrameSlot::codeBlock), globalObjectGPR);
jit.loadPtr(Address(globalObjectGPR, CodeBlock::offsetOfGlobalObject()), globalObjectGPR);
- jit.setupArguments<decltype(operationPutPrivateNameOptimize)>(globalObjectGPR, baseGPR, propertyGPR, valueGPR, byValInfoGPR, putKindGPR);
+ jit.setupArguments<decltype(operationPutByValDefinePrivateFieldOptimize)>(globalObjectGPR, baseGPR, propertyGPR, valueGPR, stubInfoGPR, TrustedImmPtr(nullptr));
jit.prepareCallOperation(vm);
if (JITCode::useDataIC(JITType::BaselineJIT))
- jit.farJump(Address(argumentGPR4, ByValInfo::offsetOfSlowOperation()), OperationPtrTag);
+ jit.farJump(Address(argumentGPR4, StructureStubInfo::offsetOfSlowOperation()), OperationPtrTag);
else
jit.ret();
@@ -3060,62 +3013,8 @@
valueNotCell.link(this);
}
-template <typename Op>
-JITPutByIdGenerator JIT::emitPutByValWithCachedId(Op bytecode, PutKind putKind, CacheableIdentifier propertyName, JumpList& doneCases, JumpList& slowCases)
-{
- // base: tag(regT1), payload(regT0)
- // property: tag(regT3), payload(regT2)
-
- VirtualRegister base = bytecode.m_base;
- VirtualRegister value = bytecode.m_value;
-
- slowCases.append(branchIfNotCell(regT3));
- emitByValIdentifierCheck(regT2, regT2, propertyName, slowCases);
-
- // Write barrier breaks the registers. So after issuing the write barrier,
- // reload the registers.
- //
- // IC can write new Structure without write-barrier if a base is cell.
- // We are emitting write-barrier before writing here but this is OK since 32bit JSC does not have concurrent GC.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
- emitLoadPayload(base, regT0);
- emitLoad(value, regT3, regT2);
-
- JITPutByIdGenerator gen(
- m_codeBlock, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(), propertyName,
- JSValueRegs::payloadOnly(regT0), JSValueRegs(regT3, regT2), InvalidGPRReg, regT1, ecmaMode(bytecode), putKind);
- gen.generateFastPath(*this);
- doneCases.append(jump());
-
- Label coldPathBegin = label();
- gen.slowPathJump().link(this);
-
- // JITPutByIdGenerator only preserve the value and the base's payload, we have to reload the tag.
- emitLoadTag(base, regT1);
-
- Call call;
- if (JITCode::useDataIC(JITType::BaselineJIT)) {
- gen.stubInfo()->m_slowOperation = gen.slowPathFunction();
- move(TrustedImmPtr(gen.stubInfo()), GPRInfo::nonArgGPR0);
- callOperation<decltype(gen.slowPathFunction())>(Address(GPRInfo::nonArgGPR0, StructureStubInfo::offsetOfSlowOperation()), m_codeBlock->globalObject(), GPRInfo::nonArgGPR0, JSValueRegs(regT3, regT2), JSValueRegs(regT1, regT0), propertyName.rawBits());
- } else
- call = callOperation(gen.slowPathFunction(), m_codeBlock->globalObject(), gen.stubInfo(), JSValueRegs(regT3, regT2), JSValueRegs(regT1, regT0), propertyName.rawBits());
- gen.reportSlowPathCall(coldPathBegin, call);
- doneCases.append(jump());
-
- return gen;
-}
-
#endif // USE(JSVALUE64)
-JITPutByIdGenerator JIT::emitPutPrivateNameWithCachedId(OpPutPrivateName bytecode, CacheableIdentifier propertyName, JumpList& doneCases, JumpList& slowCases)
-{
- auto putKind = bytecode.m_putKind.isDefine() ? PutKind::DirectPrivateFieldDefine : PutKind::DirectPrivateFieldSet;
- return emitPutByValWithCachedId(bytecode, putKind, propertyName, doneCases, slowCases);
-}
-
void JIT::emitWriteBarrier(VirtualRegister owner, WriteBarrierMode mode)
{
ASSERT(mode == UnconditionalWriteBarrier || mode == ShouldFilterBase);
@@ -3129,58 +3028,6 @@
ownerIsRememberedOrInEden.link(this);
}
-void JIT::emitByValIdentifierCheck(RegisterID cell, RegisterID scratch, CacheableIdentifier propertyName, JumpList& slowCases)
-{
- if (propertyName.isSymbolCell())
- slowCases.append(branchPtr(NotEqual, cell, TrustedImmPtr(propertyName.cell())));
- else {
- slowCases.append(branchIfNotString(cell));
- loadPtr(Address(cell, JSString::offsetOfValue()), scratch);
- slowCases.append(branchPtr(NotEqual, scratch, TrustedImmPtr(propertyName.uid())));
- }
-}
-
-void JIT::privateCompilePutPrivateNameWithCachedId(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, CacheableIdentifier propertyName)
-{
- const Instruction* currentInstruction = m_codeBlock->instructions().at(byValInfo->bytecodeIndex).ptr();
- auto bytecode = currentInstruction->as<OpPutPrivateName>();
-
- JumpList doneCases;
- JumpList slowCases;
-
- JITPutByIdGenerator gen = emitPutPrivateNameWithCachedId(bytecode, propertyName, doneCases, slowCases);
-
- ConcurrentJSLocker locker(m_codeBlock->m_lock);
- LinkBuffer patchBuffer(*this, m_codeBlock, LinkBuffer::Profile::InlineCache);
- patchBuffer.link(slowCases, byValInfo->slowPathTarget);
- patchBuffer.link(doneCases, byValInfo->doneTarget);
- if (!m_exceptionChecks.empty())
- patchBuffer.link(m_exceptionChecks, byValInfo->exceptionHandler);
-
- for (const auto& callSite : m_nearCalls) {
- if (callSite.callee)
- patchBuffer.link(callSite.from, callSite.callee);
- }
- for (const auto& callSite : m_farCalls) {
- if (callSite.callee)
- patchBuffer.link(callSite.from, callSite.callee);
- }
- gen.finalize(patchBuffer, patchBuffer);
-
- byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
- m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
- "Baseline put_private_name with cached property name '%s' stub for %s, return point %p", propertyName.uid()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
- byValInfo->stubInfo = gen.stubInfo();
-
- if (JITCode::useDataIC(JITType::BaselineJIT)) {
- byValInfo->m_notIndexJumpTarget = CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code());
- byValInfo->m_slowOperation = operationPutPrivateNameGeneric;
- } else {
- MacroAssembler::repatchJump(byValInfo->m_notIndexJump, CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code()));
- MacroAssembler::repatchCall(CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationPutPrivateNameGeneric));
- }
-}
-
} // namespace JSC
#endif // ENABLE(JIT)
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -340,44 +340,46 @@
auto bytecode = currentInstruction->as<OpPutPrivateName>();
VirtualRegister base = bytecode.m_base;
VirtualRegister property = bytecode.m_property;
- ByValInfo* byValInfo = m_codeBlock->addByValInfo(m_bytecodeIndex);
+ VirtualRegister value = bytecode.m_value;
emitLoad2(base, regT1, regT0, property, regT3, regT2);
+ emitLoad(value, regT5, regT4);
emitJumpSlowCaseIfNotJSCell(base, regT1);
- PatchableJump fastPathJmp = patchableJump();
- addSlowCase(fastPathJmp);
- Label done = label();
-
- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeIndex, fastPathJmp, done, done));
+ JITPutByValGenerator gen(
+ m_codeBlock, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::PutByVal, RegisterSet::stubUnavailableRegisters(),
+ JSValueRegs(regT1, regT0), JSValueRegs(regT3, regT2), JSValueRegs(regT5, regT4), InvalidGPRReg, InvalidGPRReg);
+ gen.stubInfo()->propertyIsSymbol = true;
+ gen.generateFastPath(*this);
+ addSlowCase(gen.slowPathJump());
+ m_putByVals.append(gen);
+
+ // IC can write new Structure without write-barrier if a base is cell.
+ // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
+ // https://bugs.webkit.org/show_bug.cgi?id=209395
+ emitWriteBarrier(base, ShouldFilterBase);
}
void JIT::emitSlow_op_put_private_name(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
{
auto bytecode = currentInstruction->as<OpPutPrivateName>();
- VirtualRegister base = bytecode.m_base;
- VirtualRegister property = bytecode.m_property;
- VirtualRegister value = bytecode.m_value;
-
- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
PrivateFieldPutKind putKind = bytecode.m_putKind;
+ JITPutByValGenerator& gen = m_putByVals[m_putByValIndex++];
+
linkAllSlowCases(iter);
- Label slowPath = label();
+ Label coldPathBegin = label();
+
JSValueRegs baseRegs(regT1, regT0);
JSValueRegs propertyRegs(regT3, regT2);
JSValueRegs valueRegs(regT5, regT4);
- emitLoad(base, baseRegs.tagGPR(), baseRegs.payloadGPR());
- emitLoad(property, propertyRegs.tagGPR(), propertyRegs.payloadGPR());
- emitLoad(value, valueRegs.tagGPR(), valueRegs.payloadGPR());
- Call call = callOperation(operationPutPrivateNameOptimize, TrustedImmPtr(m_codeBlock->globalObject()), baseRegs, propertyRegs, valueRegs, byValInfo, TrustedImm32(putKind.value()));
+ auto operation = putKind.isDefine() ? operationPutByValDefinePrivateFieldOptimize : operationPutByValSetPrivateFieldOptimize;
+ Call call = callOperation(operation, TrustedImmPtr(m_codeBlock->globalObject()), baseRegs, propertyRegs, valueRegs, gen.stubInfo(), TrustedImmPtr(nullptr));
- m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
- m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
- m_byValInstructionIndex++;
+ gen.reportSlowPathCall(coldPathBegin, call);
}
void JIT::emit_op_set_private_brand(const Instruction* currentInstruction)
Modified: trunk/Source/_javascript_Core/jit/Repatch.cpp (281683 => 281684)
--- trunk/Source/_javascript_Core/jit/Repatch.cpp 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Source/_javascript_Core/jit/Repatch.cpp 2021-08-27 04:26:35 UTC (rev 281684)
@@ -600,9 +600,12 @@
if (slot.isStrictMode())
return operationDirectPutByValStrictGeneric;
return operationDirectPutByValNonStrictGeneric;
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
+ case PutKind::DirectPrivateFieldDefine:
+ ASSERT(slot.isStrictMode());
+ return operationPutByValDefinePrivateFieldGeneric;
+ case PutKind::DirectPrivateFieldSet:
+ ASSERT(slot.isStrictMode());
+ return operationPutByValSetPrivateFieldGeneric;
}
break;
}
@@ -633,7 +636,7 @@
return operationPutByIdSetPrivateFieldStrictOptimize;
}
break;
- case PutByKind::ByVal: {
+ case PutByKind::ByVal:
switch (putKind) {
case PutKind::NotDirect:
if (slot.isStrictMode())
@@ -643,13 +646,15 @@
if (slot.isStrictMode())
return operationDirectPutByValStrictOptimize;
return operationDirectPutByValNonStrictOptimize;
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
+ case PutKind::DirectPrivateFieldDefine:
+ ASSERT(slot.isStrictMode());
+ return operationPutByValDefinePrivateFieldOptimize;
+ case PutKind::DirectPrivateFieldSet:
+ ASSERT(slot.isStrictMode());
+ return operationPutByValSetPrivateFieldOptimize;
}
break;
}
- }
// Make win port compiler happy
RELEASE_ASSERT_NOT_REACHED();
return nullptr;
@@ -1922,6 +1927,10 @@
optimizedFunction = operationPutByValNonStrictOptimize;
else if (unoptimizedFunction == operationDirectPutByValStrictGeneric || unoptimizedFunction == operationDirectPutByValStrictOptimize)
optimizedFunction = operationDirectPutByValStrictOptimize;
+ else if (unoptimizedFunction == operationPutByValDefinePrivateFieldGeneric || unoptimizedFunction == operationPutByValDefinePrivateFieldOptimize)
+ optimizedFunction = operationPutByValDefinePrivateFieldOptimize;
+ else if (unoptimizedFunction == operationPutByValSetPrivateFieldGeneric || unoptimizedFunction == operationPutByValSetPrivateFieldOptimize)
+ optimizedFunction = operationPutByValSetPrivateFieldOptimize;
else {
ASSERT(unoptimizedFunction == operationDirectPutByValNonStrictGeneric || unoptimizedFunction == operationDirectPutByValNonStrictOptimize);
optimizedFunction = operationDirectPutByValNonStrictOptimize;
Modified: trunk/Tools/ChangeLog (281683 => 281684)
--- trunk/Tools/ChangeLog 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Tools/ChangeLog 2021-08-27 04:26:35 UTC (rev 281684)
@@ -1,3 +1,12 @@
+2021-08-26 Yusuke Suzuki <[email protected]>
+
+ [JSC] op_put_private_name should use modern IC and remove ByValInfo
+ https://bugs.webkit.org/show_bug.cgi?id=229544
+
+ Reviewed by Saam Barati.
+
+ * Scripts/run-jsc-benchmarks:
+
2021-08-26 Jonathan Bedard <[email protected]>
[kill-old-processes] Invoke with Python 3
Modified: trunk/Tools/Scripts/run-jsc-benchmarks (281683 => 281684)
--- trunk/Tools/Scripts/run-jsc-benchmarks 2021-08-27 03:52:54 UTC (rev 281683)
+++ trunk/Tools/Scripts/run-jsc-benchmarks 2021-08-27 04:26:35 UTC (rev 281684)
@@ -51,7 +51,6 @@
TAILBENCH_PATH = PERFORMANCETESTS_PATH + "TailBench9000"
BIGINTBENCH_PATH = PERFORMANCETESTS_PATH + "BigIntBench"
MICROBENCHMARKS_PATH = OPENSOURCE_PATH + "JSTests" + "microbenchmarks"
-PRIVATEFIELDSBENCH_PATH = MICROBENCHMARKS_PATH + "class-fields-private"
SLOW_MICROBENCHMARKS_PATH = OPENSOURCE_PATH + "JSTests" + "slowMicrobenchmarks"
OPENSOURCE_OCTANE_PATH = PERFORMANCETESTS_PATH + "Octane"
OCTANE_WRAPPER_PATH = OPENSOURCE_OCTANE_PATH + "wrappers"
@@ -236,7 +235,6 @@
$includeSixSpeed = false
$includeTailBench = true
$includeBigIntBench = false
-$includePrivateFieldsBench = false
$ldd=nil
$measureGC=false
$benchmarkPattern=nil
@@ -1786,22 +1784,6 @@
end
end
-class PrivateFieldsBenchmark
- include Benchmark
-
- def initialize(name)
- @name = name
- end
-
- def emitRunCode(plan)
- emitBenchRunCode(fullname, plan, SingleFileTimedBenchmarkParameters.new(ensureFile("PrivateFieldsBench-#{@name}", "#{PRIVATEFIELDSBENCH_PATH}/#{@name}.js")))
- end
-
- def environment
- {}
- end
-end
-
class MicrobenchmarksBenchmark
include Benchmark
@@ -2910,7 +2892,6 @@
['--six-speed', GetoptLong::NO_ARGUMENT],
['--tail-bench', GetoptLong::NO_ARGUMENT],
['--big-int-bench', GetoptLong::NO_ARGUMENT],
- ['--private-fields-bench', GetoptLong::NO_ARGUMENT],
['--benchmarks', GetoptLong::REQUIRED_ARGUMENT],
['--measure-gc', GetoptLong::OPTIONAL_ARGUMENT],
['--force-vm-kind', GetoptLong::REQUIRED_ARGUMENT],
@@ -3028,9 +3009,6 @@
when '--big-int-bench'
resetBenchOptionsIfNecessary
$includeBigIntBench = true
- when '--private-fields-bench'
- resetBenchOptionsIfNecessary
- $includePrivateFieldsBench = true
when '--benchmarks'
$benchmarkPattern = Regexp.new(arg)
when '--measure-gc'
@@ -3270,15 +3248,6 @@
end
}
- PRIVATEFIELDSBENCH = BenchmarkSuite.new("PrivateFieldsBench", :geometricMean, 0)
- Dir.foreach(PRIVATEFIELDSBENCH_PATH) {
- | filename |
- if filename =~ /\.js$/
- name = $~.pre_match
- PRIVATEFIELDSBENCH.add PrivateFieldsBenchmark.new(name)
- end
- }
-
MICROBENCHMARKS = BenchmarkSuite.new("Microbenchmarks", :geometricMean, 0)
Dir.foreach(MICROBENCHMARKS_PATH) {
| filename |
@@ -3450,10 +3419,6 @@
$suites << BIGINTBENCH
end
- if $includePrivateFieldsBench and not PRIVATEFIELDSBENCH.empty?
- $suites << PRIVATEFIELDSBENCH
- end
-
if $includeAsmBench and not ASMBENCH.empty?
if ASMBENCH_PATH
$suites << ASMBENCH
