Modified: trunk/Source/_javascript_Core/ChangeLog (153251 => 153252)
--- trunk/Source/_javascript_Core/ChangeLog 2013-07-25 04:03:56 UTC (rev 153251)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-07-25 04:03:57 UTC (rev 153252)
@@ -1,5 +1,21 @@
2013-06-26 Filip Pizlo <[email protected]>
+ fourthTier: FTL should support ArrayifyToStructure
+ https://bugs.webkit.org/show_bug.cgi?id=118095
+
+ Reviewed by Mark Hahnenberg.
+
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLIntrinsicRepository.h:
+ (FTL):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+ (LowerDFGToLLVM):
+
+2013-06-26 Filip Pizlo <[email protected]>
+
fourthTier: FTL should support ForwardCheckStructure/ForwardStructureTransitionWatchpoint and doing so shouldn't break V8/crypto
https://bugs.webkit.org/show_bug.cgi?id=118091
Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (153251 => 153252)
--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2013-07-25 04:03:56 UTC (rev 153251)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2013-07-25 04:03:57 UTC (rev 153252)
@@ -57,6 +57,7 @@
case ForwardCheckStructure:
case StructureTransitionWatchpoint:
case ForwardStructureTransitionWatchpoint:
+ case ArrayifyToStructure:
case PutStructure:
case PhantomPutStructure:
case GetButterfly:
Modified: trunk/Source/_javascript_Core/ftl/FTLIntrinsicRepository.h (153251 => 153252)
--- trunk/Source/_javascript_Core/ftl/FTLIntrinsicRepository.h 2013-07-25 04:03:56 UTC (rev 153251)
+++ trunk/Source/_javascript_Core/ftl/FTLIntrinsicRepository.h 2013-07-25 04:03:57 UTC (rev 153252)
@@ -43,7 +43,8 @@
macro(doubleAbs, "llvm.fabs.f64", functionType(doubleType, doubleType))
#define FOR_EACH_FUNCTION_TYPE(macro) \
- macro(I_DFGOperation_EJss, functionType(intPtr, intPtr, intPtr))
+ macro(I_DFGOperation_EJss, functionType(intPtr, intPtr, intPtr)) \
+ macro(P_DFGOperation_EC, functionType(intPtr, intPtr, intPtr))
class IntrinsicRepository : public CommonValues {
public:
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (153251 => 153252)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2013-07-25 04:03:56 UTC (rev 153251)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2013-07-25 04:03:57 UTC (rev 153252)
@@ -360,6 +360,9 @@
case ForwardStructureTransitionWatchpoint:
compileStructureTransitionWatchpoint();
break;
+ case ArrayifyToStructure:
+ compileArrayifyToStructure();
+ break;
case PutStructure:
compilePutStructure();
break;
@@ -1135,6 +1138,67 @@
speculateCell(m_node->child1());
}
+ void compileArrayifyToStructure()
+ {
+ LValue cell = lowCell(m_node->child1());
+ LValue property = !!m_node->child2() ? lowInt32(m_node->child2()) : 0;
+
+ LBasicBlock unexpectedStructure = FTL_NEW_BLOCK(m_out, ("ArrayifyToStructure unexpected structure"));
+ LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArrayifyToStructure continuation"));
+
+ LValue structure = m_out.loadPtr(cell, m_heaps.JSCell_structure);
+
+ m_out.branch(
+ m_out.notEqual(structure, weakPointer(m_node->structure())),
+ unexpectedStructure, continuation);
+
+ LBasicBlock lastNext = m_out.appendTo(unexpectedStructure, continuation);
+
+ if (property) {
+ switch (m_node->arrayMode().type()) {
+ case Array::Int32:
+ case Array::Double:
+ case Array::Contiguous:
+ speculate(
+ Uncountable, noValue(), 0,
+ m_out.aboveOrEqual(property, m_out.constInt32(MIN_SPARSE_ARRAY_INDEX)));
+ break;
+ default:
+ break;
+ }
+ }
+
+ switch (m_node->arrayMode().type()) {
+ case Array::Int32:
+ vmCall(m_out.operation(operationEnsureInt32), m_callFrame, cell);
+ break;
+ case Array::Double:
+ vmCall(m_out.operation(operationEnsureDouble), m_callFrame, cell);
+ break;
+ case Array::Contiguous:
+ if (m_node->arrayMode().conversion() == Array::RageConvert)
+ vmCall(m_out.operation(operationRageEnsureContiguous), m_callFrame, cell);
+ else
+ vmCall(m_out.operation(operationEnsureContiguous), m_callFrame, cell);
+ break;
+ case Array::ArrayStorage:
+ case Array::SlowPutArrayStorage:
+ vmCall(m_out.operation(operationEnsureArrayStorage), m_callFrame, cell);
+ break;
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+
+ structure = m_out.loadPtr(cell, m_heaps.JSCell_structure);
+ speculate(
+ BadIndexingType, jsValueValue(cell), 0,
+ m_out.notEqual(structure, weakPointer(m_node->structure())));
+ m_out.jump(continuation);
+
+ m_out.appendTo(continuation, lastNext);
+ }
+
void compilePutStructure()
{
m_ftlState.jitCode->common.notifyCompilingStructureTransition(codeBlock(), m_node);
