Diff
Modified: branches/dfgFourthTier/Source/_javascript_Core/ChangeLog (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-04-02 17:28:45 UTC (rev 147446)
@@ -1,3 +1,46 @@
+2013-04-02 Filip Pizlo <[email protected]>
+
+ fourthTier: FTL should support fast property stores
+ https://bugs.webkit.org/show_bug.cgi?id=113757
+
+ Reviewed by Oliver Hunt.
+
+ Simplified the task of handling property transitions and reduced amount of code
+ duplication between the JITs.
+
+ Added PutByOffset, PutStructure, PhantomPutStructure, WeakJSConstant, and a
+ stub form of StructureTransitionWatchpoint to the FTL.
+
+ Also simplified the creation of pointer constants, and fixed a bug in
+ speculateObject().
+
+ * dfg/DFGGraph.h:
+ (JSC::DFG::Graph::notifyCompilingStructureTransition):
+ (Graph):
+ * dfg/DFGJITCompiler.h:
+ (JITCompiler):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::lower):
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant):
+ (LowerDFGToLLVM):
+ (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint):
+ (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+ (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+ (JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
+ (JSC::FTL::LowerDFGToLLVM::speculateObject):
+ (JSC::FTL::LowerDFGToLLVM::weakPointer):
+ * ftl/FTLOutput.h:
+ (Output):
+ (JSC::FTL::Output::constIntPtr):
+ (JSC::FTL::Output::absolute):
+
2013-04-01 Filip Pizlo <[email protected]>
fourthTier: FTL should support some more integer arithmetic ops (negate, xor, urshift)
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGGraph.h (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGGraph.h 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGGraph.h 2013-04-02 17:28:45 UTC (rev 147446)
@@ -687,6 +687,16 @@
}
}
+ void notifyCompilingStructureTransition(Node* node)
+ {
+ ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
+
+ m_codeBlock->appendWeakReferenceTransition(
+ node->codeOrigin.codeOriginOwner(),
+ node->structureTransitionData().previousStructure,
+ node->structureTransitionData().newStructure);
+ }
+
JSGlobalData& m_globalData;
CodeBlock* m_codeBlock;
RefPtr<Profiler::Compilation> m_compilation;
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGJITCompiler.h (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGJITCompiler.h 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGJITCompiler.h 2013-04-02 17:28:45 UTC (rev 147446)
@@ -377,11 +377,6 @@
addWeakReference(structureSet[i]);
}
- void addWeakReferenceTransition(JSCell* codeOrigin, JSCell* from, JSCell* to)
- {
- m_codeBlock->appendWeakReferenceTransition(codeOrigin, from, to);
- }
-
template<typename T>
Jump branchWeakPtr(RelationalCondition cond, T left, JSCell* weakPtr)
{
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-04-02 17:28:45 UTC (rev 147446)
@@ -4035,26 +4035,17 @@
case PhantomPutStructure: {
ASSERT(isKnownCell(node->child1().node()));
- ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
- m_jit.addWeakReferenceTransition(
- node->codeOrigin.codeOriginOwner(),
- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
+ m_jit.graph().notifyCompilingStructureTransition(node);
noResult(node);
break;
}
case PutStructure: {
- ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
+ m_jit.graph().notifyCompilingStructureTransition(node);
SpeculateCellOperand base(this, node->child1());
GPRReg baseGPR = base.gpr();
- m_jit.addWeakReferenceTransition(
- node->codeOrigin.codeOriginOwner(),
- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
-
#if ENABLE(WRITE_BARRIER_PROFILING)
// Must always emit this write barrier as the structure transition itself requires it
writeBarrier(baseGPR, node->structureTransitionData().newStructure, WriteBarrierForGenericAccess);
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-04-02 17:28:45 UTC (rev 147446)
@@ -3941,26 +3941,17 @@
case PhantomPutStructure: {
ASSERT(isKnownCell(node->child1().node()));
-
- ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
- m_jit.addWeakReferenceTransition(
- node->codeOrigin.codeOriginOwner(),
- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
+ m_jit.graph().notifyCompilingStructureTransition(node);
noResult(node);
break;
}
case PutStructure: {
- ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
+ m_jit.graph().notifyCompilingStructureTransition(node);
SpeculateCellOperand base(this, node->child1());
GPRReg baseGPR = base.gpr();
- m_jit.addWeakReferenceTransition(
- node->codeOrigin.codeOriginOwner(),
- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
#if ENABLE(WRITE_BARRIER_PROFILING)
// Must always emit this write barrier as the structure transition itself requires it
Modified: branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLCapabilities.cpp (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2013-04-02 17:28:45 UTC (rev 147446)
@@ -64,6 +64,7 @@
switch (node->op()) {
case JSConstant:
+ case WeakJSConstant:
case GetLocal:
case SetLocal:
case MovHintAndCheck:
@@ -81,8 +82,12 @@
case BitLShift:
case BitURShift:
case CheckStructure:
+ case StructureTransitionWatchpoint:
+ case PutStructure:
+ case PhantomPutStructure:
case GetButterfly:
case GetByOffset:
+ case PutByOffset:
case GetGlobalVar:
case PutGlobalVar:
// These are OK.
Modified: branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2013-04-02 17:28:45 UTC (rev 147446)
@@ -84,7 +84,7 @@
m_tagMask = m_out.constInt64(TagMask);
m_abortFunction = constIntToPtr(
- m_out.constIntPtr(bitwise_cast<intptr_t>(abort)),
+ m_out.constIntPtr(abort),
pointerType(functionType(m_out.voidType)));
for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
@@ -248,6 +248,9 @@
case JSConstant:
compileJSConstant();
break;
+ case WeakJSConstant:
+ compileWeakJSConstant();
+ break;
case GetLocal:
compileGetLocal();
break;
@@ -304,6 +307,15 @@
case CheckStructure:
compileCheckStructure();
break;
+ case StructureTransitionWatchpoint:
+ compileStructureTransitionWatchpoint();
+ break;
+ case PutStructure:
+ compilePutStructure();
+ break;
+ case PhantomPutStructure:
+ compilePhantomPutStructure();
+ break;
case GetButterfly:
compileGetButterfly();
break;
@@ -316,6 +328,9 @@
case GetByOffset:
compileGetByOffset();
break;
+ case PutByOffset:
+ compilePutByOffset();
+ break;
case GetGlobalVar:
compileGetGlobalVar();
break;
@@ -345,6 +360,11 @@
m_jsValueValues.add(m_node, m_out.constInt64(JSValue::encode(m_graph.valueOfJSConstant(m_node))));
}
+ void compileWeakJSConstant()
+ {
+ m_jsValueValues.add(m_node, weakPointer(m_node->weakConstant()));
+ }
+
void compileGetLocal()
{
VariableAccessData* variable = m_node->variableAccessData();
@@ -679,6 +699,30 @@
m_out.appendTo(continuation, lastNext);
}
+ void compileStructureTransitionWatchpoint()
+ {
+ codeBlock()->appendWeakReference(m_node->structure());
+
+ // FIXME: Implement structure transition watchpoints.
+ // https://bugs.webkit.org/show_bug.cgi?id=113647
+
+ speculateCell(m_node->child1());
+ }
+
+ void compilePutStructure()
+ {
+ m_graph.notifyCompilingStructureTransition(m_node);
+
+ m_out.store64(
+ m_out.constIntPtr(m_node->structureTransitionData().newStructure),
+ lowCell(m_node->child1()), m_heaps.JSCell_structure);
+ }
+
+ void compilePhantomPutStructure()
+ {
+ m_graph.notifyCompilingStructureTransition(m_node);
+ }
+
void compileGetButterfly()
{
m_storageValues.add(
@@ -749,6 +793,19 @@
data.offset * sizeof(EncodedJSValue))));
}
+ void compilePutByOffset()
+ {
+ StorageAccessData& data =
+ m_graph.m_storageAccessData[m_node->storageAccessDataIndex()];
+
+ m_out.store64(
+ lowJSValue(m_node->child3()),
+ m_out.address(
+ m_heaps.properties[data.identifierNumber],
+ lowStorage(m_node->child2()),
+ data.offset * sizeof(EncodedJSValue)));
+ }
+
void compileGetGlobalVar()
{
m_jsValueValues.add(m_node, m_out.load64(m_out.absolute(m_node->registerPointer())));
@@ -1040,7 +1097,7 @@
cell, edge, SpecObject,
m_out.equal(
m_out.loadPtr(cell, m_heaps.JSCell_structure),
- accountedPointer(globalData().structureStructure.get())));
+ m_out.constIntPtr(globalData().stringStructure.get())));
}
void speculateObject(Edge edge)
@@ -1048,15 +1105,10 @@
speculateObject(edge, lowCell(edge));
}
- LValue accountedPointer(JSCell* pointer)
- {
- return m_out.constIntPtr(bitwise_cast<intptr_t>(pointer));
- }
-
LValue weakPointer(JSCell* pointer)
{
codeBlock()->appendWeakReference(pointer);
- return accountedPointer(pointer);
+ return accountedPointer(m_out.constIntPtr(pointer));
}
TypedPointer addressFor(LValue base, int operand, ptrdiff_t offset = 0)
Modified: branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLOutput.h (147445 => 147446)
--- branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLOutput.h 2013-04-02 17:24:24 UTC (rev 147445)
+++ branches/dfgFourthTier/Source/_javascript_Core/ftl/FTLOutput.h 2013-04-02 17:28:45 UTC (rev 147446)
@@ -104,7 +104,8 @@
LValue param(unsigned index) { return getParam(m_function, index); }
LValue constBool(bool value) { return constInt(boolean, value, ZeroExtend); }
LValue constInt32(int32_t value) { return constInt(int32, value, SignExtend); }
- LValue constIntPtr(intptr_t value) { return constInt(intPtr, value, SignExtend); }
+ template<typename T>
+ LValue constIntPtr(T value) { return constInt(intPtr, bitwise_cast<intptr_t>(value), SignExtend); }
LValue constInt64(int64_t value) { return constInt(int64, value, SignExtend); }
LValue add(LValue left, LValue right) { return buildAdd(m_builder, left, right); }
@@ -214,8 +215,7 @@
TypedPointer absolute(void* address)
{
- return TypedPointer(
- m_heaps->absolute[address], constIntPtr(bitwise_cast<intptr_t>(address)));
+ return TypedPointer(m_heaps->absolute[address], constIntPtr(address));
}
LValue load32(LValue base, const AbstractField& field) { return load32(address(base, field)); }
