Title: [286580] trunk/Source/_javascript_Core
- Revision
- 286580
- Author
- [email protected]
- Date
- 2021-12-06 17:13:33 -0800 (Mon, 06 Dec 2021)
Log Message
TypeInfo should be materializable from Structures as a single load.
https://bugs.webkit.org/show_bug.cgi?id=233875
Reviewed by Mark Lam.
This is mostly just the members of Structure and JSCell so that
JSType and InlineTypeFlags are at the end of the JSCell header.
* assembler/testmasm.cpp:
(JSC::testBranchIfType):
(JSC::testBranchIfNotType):
* ftl/FTLAbstractHeapRepository.cpp:
(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
* runtime/JSCell.h:
* runtime/JSCellInlines.h:
(JSC::JSCell::JSCell):
* runtime/Structure.h:
(JSC::Structure::typeInfo const):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (286579 => 286580)
--- trunk/Source/_javascript_Core/ChangeLog 2021-12-07 00:38:11 UTC (rev 286579)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-12-07 01:13:33 UTC (rev 286580)
@@ -1,3 +1,24 @@
+2021-12-06 Keith Miller <[email protected]>
+
+ TypeInfo should be materializable from Structures as a single load.
+ https://bugs.webkit.org/show_bug.cgi?id=233875
+
+ Reviewed by Mark Lam.
+
+ This is mostly just the members of Structure and JSCell so that
+ JSType and InlineTypeFlags are at the end of the JSCell header.
+
+ * assembler/testmasm.cpp:
+ (JSC::testBranchIfType):
+ (JSC::testBranchIfNotType):
+ * ftl/FTLAbstractHeapRepository.cpp:
+ (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+ * runtime/JSCell.h:
+ * runtime/JSCellInlines.h:
+ (JSC::JSCell::JSCell):
+ * runtime/Structure.h:
+ (JSC::Structure::typeInfo const):
+
2021-12-06 Mark Lam <[email protected]>
Remove unneeded virtual allocator methods from Subspace.
Modified: trunk/Source/_javascript_Core/assembler/testmasm.cpp (286579 => 286580)
--- trunk/Source/_javascript_Core/assembler/testmasm.cpp 2021-12-07 00:38:11 UTC (rev 286579)
+++ trunk/Source/_javascript_Core/assembler/testmasm.cpp 2021-12-07 01:13:33 UTC (rev 286580)
@@ -5613,6 +5613,7 @@
struct CellLike {
uint32_t structureID;
uint8_t indexingType;
+ uint8_t cellState;
JSType type;
};
CHECK_EQ(JSCell::typeInfoTypeOffset(), OBJECT_OFFSETOF(CellLike, type));
@@ -5647,6 +5648,7 @@
struct CellLike {
uint32_t structureID;
uint8_t indexingType;
+ uint8_t cellState;
JSType type;
};
CHECK_EQ(JSCell::typeInfoTypeOffset(), OBJECT_OFFSETOF(CellLike, type));
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp (286579 => 286580)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp 2021-12-07 00:38:11 UTC (rev 286579)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp 2021-12-07 01:13:33 UTC (rev 286580)
@@ -78,9 +78,9 @@
// Make sure that our explicit assumptions about the StructureIDBlob match reality.
RELEASE_ASSERT(!(JSCell_indexingTypeAndMisc.offset() & (sizeof(int32_t) - 1)));
- RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_typeInfoType.offset());
- RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoFlags.offset());
- RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_cellState.offset());
+ RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_cellState.offset());
+ RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoType.offset());
+ RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_typeInfoFlags.offset());
JSCell_structureID.changeParent(&JSCell_header);
JSCell_usefulBytes.changeParent(&JSCell_header);
Modified: trunk/Source/_javascript_Core/runtime/JSCell.h (286579 => 286580)
--- trunk/Source/_javascript_Core/runtime/JSCell.h 2021-12-07 00:38:11 UTC (rev 286579)
+++ trunk/Source/_javascript_Core/runtime/JSCell.h 2021-12-07 01:13:33 UTC (rev 286580)
@@ -266,9 +266,9 @@
StructureID m_structureID;
IndexingType m_indexingTypeAndMisc; // DO NOT store to this field. Always CAS.
+ CellState m_cellState;
JSType m_type;
TypeInfo::InlineTypeFlags m_flags;
- CellState m_cellState;
};
class JSCellLock : public JSCell {
Modified: trunk/Source/_javascript_Core/runtime/JSCellInlines.h (286579 => 286580)
--- trunk/Source/_javascript_Core/runtime/JSCellInlines.h 2021-12-07 00:38:11 UTC (rev 286579)
+++ trunk/Source/_javascript_Core/runtime/JSCellInlines.h 2021-12-07 01:13:33 UTC (rev 286580)
@@ -58,9 +58,9 @@
inline JSCell::JSCell(VM&, Structure* structure)
: m_structureID(structure->id())
, m_indexingTypeAndMisc(structure->indexingModeIncludingHistory())
+ , m_cellState(CellState::DefinitelyWhite)
, m_type(structure->typeInfo().type())
, m_flags(structure->typeInfo().inlineTypeFlags())
- , m_cellState(CellState::DefinitelyWhite)
{
ASSERT(!isCompilationThread());
Modified: trunk/Source/_javascript_Core/runtime/Structure.h (286579 => 286580)
--- trunk/Source/_javascript_Core/runtime/Structure.h 2021-12-07 00:38:11 UTC (rev 286579)
+++ trunk/Source/_javascript_Core/runtime/Structure.h 2021-12-07 01:13:33 UTC (rev 286580)
@@ -261,7 +261,11 @@
}
// Type accessors.
+#if CPU(NEEDS_ALIGNED_ACCESS)
TypeInfo typeInfo() const { return TypeInfo(m_cellHeaderType, m_cellHeaderInlineTypeFlags, m_outOfLineTypeFlags); }
+#else
+ TypeInfo typeInfo() const { return *reinterpret_cast_ptr<const TypeInfo*>(&m_cellHeaderType); }
+#endif
bool isObject() const { return typeInfo().isObject(); }
protected:
// You probably want typeInfo().type()
@@ -856,9 +860,9 @@
// part of the object. And need to match the order of the equivalent properties in
// JSCell.
IndexingType m_cellHeaderIndexingModeIncludingHistory;
+ const CellState m_cellHeaderDefaultCellState { CellState::DefinitelyWhite };
const JSType m_cellHeaderType;
TypeInfo::InlineTypeFlags m_cellHeaderInlineTypeFlags;
- const CellState m_cellHeaderDefaultCellState { CellState::DefinitelyWhite };
TypeInfo::OutOfLineTypeFlags m_outOfLineTypeFlags;
uint8_t m_inlineCapacity;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
