Changeset 206098 in webkit


Ignore:
Timestamp:
Sep 19, 2016 10:00:25 AM (8 years ago)
Author:
Yusuke Suzuki
Message:

[JSC][LLInt] Introduce is_cell_with_type
​https://bugs.webkit.org/show_bug.cgi?id=162132

Reviewed by Sam Weinig.

In this patch, we introduce is_cell_with_type bytecode. This bytecode can unify the following predicates,
op_is_string, op_is_jsarray, op_is_proxy_object, and op_is_derived_array!
And we now drop DFG node IsString since we can use IsCellWithType instead.
This automatically offers optimization to previous IsString node: dropping cell check by using CellUse edge filter.

Later, we are planning to use this is_cell_with_type to optimize @isRegExpObject, @isSet, and @isMap[1].

The performance results are neutral.

[1]: ​https://bugs.webkit.org/show_bug.cgi?id=162142

  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

  • bytecode/SpeculatedType.cpp:

(JSC::speculationFromJSType):

  • bytecode/SpeculatedType.h:
  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitEqualityOp):
(JSC::BytecodeGenerator::emitIsCellWithType):

  • bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitIsJSArray):
(JSC::BytecodeGenerator::emitIsProxyObject):
(JSC::BytecodeGenerator::emitIsDerivedArray):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupIsCellWithType):

  • dfg/DFGNode.h:

(JSC::DFG::Node::speculatedTypeForQuery):

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileIsString): Deleted.

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

  • jit/JIT.h:
  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_is_cell_with_type):
(JSC::JIT::emitIsCellWithType): Deleted.
(JSC::JIT::emit_op_is_string): Deleted.
(JSC::JIT::emit_op_is_jsarray): Deleted.
(JSC::JIT::emit_op_is_proxy_object): Deleted.
(JSC::JIT::emit_op_is_derived_array): Deleted.

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_is_cell_with_type):
(JSC::JIT::emitIsCellWithType): Deleted.
(JSC::JIT::emit_op_is_string): Deleted.
(JSC::JIT::emit_op_is_jsarray): Deleted.
(JSC::JIT::emit_op_is_proxy_object): Deleted.
(JSC::JIT::emit_op_is_derived_array): Deleted.

  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
Location:
trunk/Source/JavaScriptCore
Files:
29 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r206083 r206098  
     12016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [JSC][LLInt] Introduce is_cell_with_type
     4        https://bugs.webkit.org/show_bug.cgi?id=162132
     5
     6        Reviewed by Sam Weinig.
     7
     8        In this patch, we introduce is_cell_with_type bytecode. This bytecode can unify the following predicates,
     9        op_is_string, op_is_jsarray, op_is_proxy_object, and op_is_derived_array!
     10        And we now drop DFG node IsString since we can use IsCellWithType instead.
     11        This automatically offers optimization to previous IsString node: dropping cell check by using CellUse edge filter.
     12
     13        Later, we are planning to use this is_cell_with_type to optimize @isRegExpObject, @isSet, and @isMap[1].
     14
     15        The performance results are neutral.
     16
     17        [1]: https://bugs.webkit.org/show_bug.cgi?id=162142
     18
     19        * bytecode/BytecodeList.json:
     20        * bytecode/BytecodeUseDef.h:
     21        (JSC::computeUsesForBytecodeOffset):
     22        (JSC::computeDefsForBytecodeOffset):
     23        * bytecode/CodeBlock.cpp:
     24        (JSC::CodeBlock::dumpBytecode):
     25        * bytecode/SpeculatedType.cpp:
     26        (JSC::speculationFromJSType):
     27        * bytecode/SpeculatedType.h:
     28        * bytecompiler/BytecodeGenerator.cpp:
     29        (JSC::BytecodeGenerator::emitEqualityOp):
     30        (JSC::BytecodeGenerator::emitIsCellWithType):
     31        * bytecompiler/BytecodeGenerator.h:
     32        (JSC::BytecodeGenerator::emitIsJSArray):
     33        (JSC::BytecodeGenerator::emitIsProxyObject):
     34        (JSC::BytecodeGenerator::emitIsDerivedArray):
     35        * dfg/DFGAbstractInterpreterInlines.h:
     36        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     37        * dfg/DFGByteCodeParser.cpp:
     38        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
     39        (JSC::DFG::ByteCodeParser::parseBlock):
     40        * dfg/DFGCapabilities.cpp:
     41        (JSC::DFG::capabilityLevel):
     42        * dfg/DFGClobberize.h:
     43        (JSC::DFG::clobberize):
     44        * dfg/DFGDoesGC.cpp:
     45        (JSC::DFG::doesGC):
     46        * dfg/DFGFixupPhase.cpp:
     47        (JSC::DFG::FixupPhase::fixupNode):
     48        (JSC::DFG::FixupPhase::fixupIsCellWithType):
     49        * dfg/DFGNode.h:
     50        (JSC::DFG::Node::speculatedTypeForQuery):
     51        * dfg/DFGNodeType.h:
     52        * dfg/DFGPredictionPropagationPhase.cpp:
     53        * dfg/DFGSafeToExecute.h:
     54        (JSC::DFG::safeToExecute):
     55        * dfg/DFGSpeculativeJIT32_64.cpp:
     56        (JSC::DFG::SpeculativeJIT::compile):
     57        * dfg/DFGSpeculativeJIT64.cpp:
     58        (JSC::DFG::SpeculativeJIT::compile):
     59        * ftl/FTLCapabilities.cpp:
     60        (JSC::FTL::canCompile):
     61        * ftl/FTLLowerDFGToB3.cpp:
     62        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
     63        (JSC::FTL::DFG::LowerDFGToB3::compileIsString): Deleted.
     64        * jit/JIT.cpp:
     65        (JSC::JIT::privateCompileMainPass):
     66        * jit/JIT.h:
     67        * jit/JITOpcodes.cpp:
     68        (JSC::JIT::emit_op_is_cell_with_type):
     69        (JSC::JIT::emitIsCellWithType): Deleted.
     70        (JSC::JIT::emit_op_is_string): Deleted.
     71        (JSC::JIT::emit_op_is_jsarray): Deleted.
     72        (JSC::JIT::emit_op_is_proxy_object): Deleted.
     73        (JSC::JIT::emit_op_is_derived_array): Deleted.
     74        * jit/JITOpcodes32_64.cpp:
     75        (JSC::JIT::emit_op_is_cell_with_type):
     76        (JSC::JIT::emitIsCellWithType): Deleted.
     77        (JSC::JIT::emit_op_is_string): Deleted.
     78        (JSC::JIT::emit_op_is_jsarray): Deleted.
     79        (JSC::JIT::emit_op_is_proxy_object): Deleted.
     80        (JSC::JIT::emit_op_is_derived_array): Deleted.
     81        * llint/LLIntData.cpp:
     82        (JSC::LLInt::Data::performAssertions):
     83        * llint/LowLevelInterpreter32_64.asm:
     84        * llint/LowLevelInterpreter64.asm:
     85
    1862016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
    287

  • trunk/Source/JavaScriptCore/bytecode/BytecodeList.json

    r206065 r206098  
    5656            { "name" : "op_is_boolean", "length" : 3 },
    5757            { "name" : "op_is_number", "length" : 3 },
    58             { "name" : "op_is_string", "length" : 3 },
    59             { "name" : "op_is_jsarray", "length" : 3 },
    60             { "name" : "op_is_proxy_object", "length" : 3 },
    6158            { "name" : "op_is_object", "length" : 3 },
    6259            { "name" : "op_is_object_or_null", "length" : 3 },
    6360            { "name" : "op_is_function", "length" : 3 },
    64             { "name" : "op_is_derived_array", "length" : 3 },
     61            { "name" : "op_is_cell_with_type", "length" : 4 },
    6562            { "name" : "op_in", "length" : 4 },
    6663            { "name" : "op_get_array_length", "length" : 9 },

  • trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h

    r206065 r206098  
    164164    case op_is_boolean:
    165165    case op_is_number:
    166     case op_is_string:
    167     case op_is_jsarray:
    168     case op_is_proxy_object:
    169166    case op_is_object:
    170167    case op_is_object_or_null:
     168    case op_is_cell_with_type:
    171169    case op_is_function:
    172     case op_is_derived_array:
    173170    case op_to_number:
    174171    case op_to_string:
    … …  
    399396    case op_is_boolean:
    400397    case op_is_number:
    401     case op_is_string:
    402     case op_is_jsarray:
    403     case op_is_proxy_object:
    404398    case op_is_object:
    405399    case op_is_object_or_null:
     400    case op_is_cell_with_type:
    406401    case op_is_function:
    407     case op_is_derived_array:
    408402    case op_in:
    409403    case op_to_number:

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r206065 r206098  
    11031103            break;
    11041104        }
    1105         case op_is_string: {
    1106             printUnaryOp(out, exec, location, it, "is_string");
    1107             break;
    1108         }
    1109         case op_is_jsarray: {
    1110             printUnaryOp(out, exec, location, it, "is_jsarray");
    1111             break;
    1112         }
    1113         case op_is_proxy_object: {
    1114             printUnaryOp(out, exec, location, it, "is_proxy_object");
     1105        case op_is_cell_with_type: {
     1106            int r0 = (++it)->u.operand;
     1107            int r1 = (++it)->u.operand;
     1108            int type = (++it)->u.operand;
     1109            printLocationAndOp(out, exec, location, it, "is_cell_with_type");
     1110            out.printf("%s, %s, %d", registerName(r0).data(), registerName(r1).data(), type);
    11151111            break;
    11161112        }
    … …  
    11251121        case op_is_function: {
    11261122            printUnaryOp(out, exec, location, it, "is_function");
    1127             break;
    1128         }
    1129         case op_is_derived_array: {
    1130             printUnaryOp(out, exec, location, it, "is_derived_array");
    11311123            break;
    11321124        }

  • trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp

    r206065 r206098  
    472472}
    473473
     474SpeculatedType speculationFromJSType(JSType type)
     475{
     476    switch (type) {
     477    case StringType:
     478        return SpecString;
     479    case ArrayType:
     480        return SpecArray;
     481    case DerivedArrayType:
     482        return SpecDerivedArray;
     483    case RegExpObjectType:
     484        return SpecRegExpObject;
     485    case ProxyObjectType:
     486        return SpecProxyObject;
     487    default:
     488        ASSERT_NOT_REACHED();
     489    }
     490    return SpecNone;
     491}
     492
    474493SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType type)
    475494{

  • trunk/Source/JavaScriptCore/bytecode/SpeculatedType.h

    r206065 r206098  
    453453SpeculatedType speculationFromCell(JSCell*);
    454454SpeculatedType speculationFromValue(JSValue);
     455SpeculatedType speculationFromJSType(JSType);
    455456
    456457SpeculatedType speculationFromTypedArrayType(TypedArrayType); // only valid for typed views.

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r205321 r206098  
    16601660            if (value == "string") {
    16611661                rewindUnaryOp();
    1662                 emitOpcode(op_is_string);
     1662                emitOpcode(op_is_cell_with_type);
    16631663                instructions().append(dst->index());
    16641664                instructions().append(srcIndex);
     1665                instructions().append(StringType);
    16651666                return dst;
    16661667            }
    … …  
    42184219}
    42194220
     4221RegisterID* BytecodeGenerator::emitIsCellWithType(RegisterID* dst, RegisterID* src, JSType type)
     4222{
     4223    emitOpcode(op_is_cell_with_type);
     4224    instructions().append(dst->index());
     4225    instructions().append(src->index());
     4226    instructions().append(type);
     4227    return dst;
     4228}
    42204229
    42214230RegisterID* BytecodeGenerator::emitIsObject(RegisterID* dst, RegisterID* src)

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

    r206065 r206098  
    631631        RegisterID* emitToIndexString(RegisterID* dst, RegisterID* index);
    632632
    633         RegisterID* emitIsJSArray(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_is_jsarray, dst, src); }
    634         RegisterID* emitIsProxyObject(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_is_proxy_object, dst, src); }
     633        RegisterID* emitIsCellWithType(RegisterID* dst, RegisterID* src, JSType);
     634        RegisterID* emitIsJSArray(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, ArrayType); }
     635        RegisterID* emitIsProxyObject(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, ProxyObjectType); }
    635636        RegisterID* emitIsObject(RegisterID* dst, RegisterID* src);
    636637        RegisterID* emitIsUndefined(RegisterID* dst, RegisterID* src);
    637638        RegisterID* emitIsEmpty(RegisterID* dst, RegisterID* src);
    638         RegisterID* emitIsDerivedArray(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_is_derived_array, dst, src); }
     639        RegisterID* emitIsDerivedArray(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, DerivedArrayType); }
    639640        void emitRequireObjectCoercible(RegisterID* value, const String& error);
    640641

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r206065 r206098  
    10141014    case IsBoolean:
    10151015    case IsNumber:
    1016     case IsString:
    10171016    case IsObject:
    10181017    case IsObjectOrNull:
    … …  
    10381037            case IsNumber:
    10391038                setConstant(node, jsBoolean(child.value().isNumber()));
    1040                 break;
    1041             case IsString:
    1042                 setConstant(node, jsBoolean(isJSString(child.value())));
    10431039                break;
    10441040            case IsObject:
    … …  
    11431139           
    11441140            if (!(child.m_type & SpecFullNumber)) {
    1145                 setConstant(node, jsBoolean(false));
    1146                 constantWasSet = true;
    1147                 break;
    1148             }
    1149            
    1150             break;
    1151         case IsString:
    1152             if (!(child.m_type & ~SpecString)) {
    1153                 setConstant(node, jsBoolean(true));
    1154                 constantWasSet = true;
    1155                 break;
    1156             }
    1157            
    1158             if (!(child.m_type & SpecString)) {
    11591141                setConstant(node, jsBoolean(false));
    11601142                constantWasSet = true;

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r206065 r206098  
    23672367
    23682368        insertChecks();
    2369         Node* isRegExpObject = addToGraph(IsCellWithType, OpInfo(RegExpObjectType), OpInfo(SpecRegExpObject), get(virtualRegisterForArgument(1, registerOffset)));
     2369        Node* isRegExpObject = addToGraph(IsCellWithType, OpInfo(RegExpObjectType), get(virtualRegisterForArgument(1, registerOffset)));
    23702370        set(VirtualRegister(resultOperand), isRegExpObject);
    23712371        return true;
    … …  
    39713971        }
    39723972
    3973         case op_is_string: {
     3973        case op_is_cell_with_type: {
     3974            JSType type = static_cast<JSType>(currentInstruction[3].u.operand);
    39743975            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
    3975             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsString, value));
    3976             NEXT_OPCODE(op_is_string);
    3977         }
    3978 
    3979         case op_is_jsarray: {
    3980             Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
    3981             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsCellWithType, OpInfo(ArrayType), OpInfo(SpecArray), value));
    3982             NEXT_OPCODE(op_is_jsarray);
    3983         }
    3984 
    3985         case op_is_proxy_object: {
    3986             Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
    3987             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsCellWithType, OpInfo(ProxyObjectType), OpInfo(SpecProxyObject), value));
    3988             NEXT_OPCODE(op_is_proxy_object);
     3976            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsCellWithType, OpInfo(type), value));
     3977            NEXT_OPCODE(op_is_cell_with_type);
    39893978        }
    39903979
    … …  
    40053994            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsFunction, value));
    40063995            NEXT_OPCODE(op_is_function);
    4007         }
    4008 
    4009         case op_is_derived_array: {
    4010             Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
    4011             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsCellWithType, OpInfo(DerivedArrayType), OpInfo(SpecDerivedArray), value));
    4012             NEXT_OPCODE(op_is_derived_array);
    40133996        }
    40143997

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r206065 r206098  
    141141    case op_is_boolean:
    142142    case op_is_number:
    143     case op_is_string:
    144     case op_is_jsarray:
    145     case op_is_proxy_object:
    146143    case op_is_object:
    147144    case op_is_object_or_null:
     145    case op_is_cell_with_type:
    148146    case op_is_function:
    149     case op_is_derived_array:
    150147    case op_not:
    151148    case op_less:

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r206065 r206098  
    163163    case IsBoolean:
    164164    case IsNumber:
    165     case IsString:
    166165    case IsObject:
    167166    case IsTypedArrayView:

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r206065 r206098  
    162162    case IsBoolean:
    163163    case IsNumber:
    164     case IsString:
    165164    case IsObject:
    166165    case IsObjectOrNull:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r206065 r206098  
    13971397            break;
    13981398        }
    1399 
    1400         case IsString:
    1401             if (node->child1()->shouldSpeculateString()) {
    1402                 m_insertionSet.insertNode(
    1403                     m_indexInBlock, SpecNone, Check, node->origin,
    1404                     Edge(node->child1().node(), StringUse));
    1405                 m_graph.convertToConstant(node, jsBoolean(true));
    1406                 observeUseKindOnNode<StringUse>(node);
    1407             }
    1408             break;
    14091399
    14101400        case IsObject:
    … …  
    17681758    {
    17691759        switch (node->speculatedTypeForQuery()) {
     1760        case SpecString:
     1761            if (node->child1()->shouldSpeculateString()) {
     1762                m_insertionSet.insertNode(
     1763                    m_indexInBlock, SpecNone, Check, node->origin,
     1764                    Edge(node->child1().node(), StringUse));
     1765                m_graph.convertToConstant(node, jsBoolean(true));
     1766                observeUseKindOnNode<StringUse>(node);
     1767                return;
     1768            }
     1769            break;
     1770
    17701771        case SpecProxyObject:
    17711772            if (node->child1()->shouldSpeculateProxyObject()) {

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r206065 r206098  
    11801180    SpeculatedType speculatedTypeForQuery()
    11811181    {
    1182         return m_opInfo2.as<SpeculatedType>();
     1182        return speculationFromJSType(queriedType());
    11831183    }
    11841184   

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r206065 r206098  
    315315    macro(IsBoolean, NodeResultBoolean) \
    316316    macro(IsNumber, NodeResultBoolean) \
    317     macro(IsString, NodeResultBoolean) \
    318317    macro(IsObject, NodeResultBoolean) \
    319318    macro(IsObjectOrNull, NodeResultBoolean) \

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r206065 r206098  
    798798        case IsBoolean:
    799799        case IsNumber:
    800         case IsString:
    801800        case IsObject:
    802801        case IsObjectOrNull:

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r206065 r206098  
    268268    case IsBoolean:
    269269    case IsNumber:
    270     case IsString:
    271270    case IsObject:
    272271    case IsObjectOrNull:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r206065 r206098  
    46414641    }
    46424642
    4643     case IsString: {
    4644         JSValueOperand value(this, node->child1());
    4645         GPRTemporary result(this, Reuse, value, TagWord);
    4646        
    4647         JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
    4648        
    4649         m_jit.compare8(JITCompiler::Equal,
    4650             JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
    4651             TrustedImm32(StringType),
    4652             result.gpr());
    4653         JITCompiler::Jump done = m_jit.jump();
    4654        
    4655         isNotCell.link(&m_jit);
    4656         m_jit.move(TrustedImm32(0), result.gpr());
    4657        
    4658         done.link(&m_jit);
    4659         booleanResult(result.gpr(), node);
    4660         break;
    4661     }
    4662 
    46634643    case IsObject: {
    46644644        JSValueOperand value(this, node->child1());

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r206065 r206098  
    46124612    }
    46134613       
    4614     case IsString: {
    4615         JSValueOperand value(this, node->child1());
    4616         GPRTemporary result(this, Reuse, value);
    4617        
    4618         JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
    4619        
    4620         m_jit.compare8(JITCompiler::Equal,
    4621             JITCompiler::Address(value.gpr(), JSCell::typeInfoTypeOffset()),
    4622             TrustedImm32(StringType),
    4623             result.gpr());
    4624         m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
    4625         JITCompiler::Jump done = m_jit.jump();
    4626        
    4627         isNotCell.link(&m_jit);
    4628         m_jit.move(TrustedImm32(ValueFalse), result.gpr());
    4629        
    4630         done.link(&m_jit);
    4631         jsValueResult(result.gpr(), node, DataFormatJSBoolean);
    4632         break;
    4633     }
    4634 
    46354614    case MapHash: {
    46364615        JSValueOperand input(this, node->child1());

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r206065 r206098  
    191191    case IsBoolean:
    192192    case IsNumber:
    193     case IsString:
    194193    case IsObject:
    195194    case IsObjectOrNull:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r206065 r206098  
    896896        case IsNumber:
    897897            compileIsNumber();
    898             break;
    899         case IsString:
    900             compileIsString();
    901898            break;
    902899        case IsCellWithType:
    … …  
    62656262    }
    62666263   
    6267     void compileIsString()
    6268     {
    6269         LValue value = lowJSValue(m_node->child1());
    6270        
    6271         LBasicBlock isCellCase = m_out.newBlock();
    6272         LBasicBlock continuation = m_out.newBlock();
    6273        
    6274         ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
    6275         m_out.branch(
    6276             isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
    6277        
    6278         LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
    6279         ValueFromBlock cellResult = m_out.anchor(isString(value, provenType(m_node->child1())));
    6280         m_out.jump(continuation);
    6281        
    6282         m_out.appendTo(continuation, lastNext);
    6283         setBoolean(m_out.phi(Int32, notCellResult, cellResult));
    6284     }
    6285 
    62866264    void compileIsCellWithType()
    62876265    {

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r206065 r206098  
    269269        DEFINE_OP(op_is_boolean)
    270270        DEFINE_OP(op_is_number)
    271         DEFINE_OP(op_is_string)
    272         DEFINE_OP(op_is_jsarray)
    273         DEFINE_OP(op_is_proxy_object)
    274271        DEFINE_OP(op_is_object)
    275         DEFINE_OP(op_is_derived_array)
     272        DEFINE_OP(op_is_cell_with_type)
    276273        DEFINE_OP(op_jeq_null)
    277274        DEFINE_OP(op_jfalse)

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r206065 r206098  
    401401        int32_t getOperandConstantInt(int src);
    402402        double getOperandConstantDouble(int src);
    403 
    404         void emitIsCellWithType(Instruction*, JSType);
    405403
    406404#if USE(JSVALUE32_64)
    … …  
    517515        void emit_op_is_boolean(Instruction*);
    518516        void emit_op_is_number(Instruction*);
    519         void emit_op_is_string(Instruction*);
    520         void emit_op_is_jsarray(Instruction*);
    521         void emit_op_is_proxy_object(Instruction*);
    522517        void emit_op_is_object(Instruction*);
    523         void emit_op_is_derived_array(Instruction*);
     518        void emit_op_is_cell_with_type(Instruction*);
    524519        void emit_op_jeq_null(Instruction*);
    525520        void emit_op_jfalse(Instruction*);

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r206065 r206098  
    244244}
    245245
    246 void JIT::emitIsCellWithType(Instruction* currentInstruction, JSType type)
     246void JIT::emit_op_is_cell_with_type(Instruction* currentInstruction)
    247247{
    248248    int dst = currentInstruction[1].u.operand;
    249249    int value = currentInstruction[2].u.operand;
     250    int type = currentInstruction[3].u.operand;
    250251
    251252    emitGetVirtualRegister(value, regT0);
    … …  
    261262    done.link(this);
    262263    emitPutVirtualRegister(dst);
    263 }
    264 
    265 void JIT::emit_op_is_string(Instruction* currentInstruction)
    266 {
    267     emitIsCellWithType(currentInstruction, StringType);
    268 }
    269 
    270 void JIT::emit_op_is_jsarray(Instruction* currentInstruction)
    271 {
    272     emitIsCellWithType(currentInstruction, ArrayType);
    273 }
    274 
    275 void JIT::emit_op_is_proxy_object(Instruction* currentInstruction)
    276 {
    277     emitIsCellWithType(currentInstruction, ProxyObjectType);
    278 }
    279 
    280 void JIT::emit_op_is_derived_array(Instruction* currentInstruction)
    281 {
    282     emitIsCellWithType(currentInstruction, DerivedArrayType);
    283264}
    284265

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r206065 r206098  
    355355}
    356356
    357 void JIT::emitIsCellWithType(Instruction* currentInstruction, JSType type)
     357void JIT::emit_op_is_cell_with_type(Instruction* currentInstruction)
    358358{
    359359    int dst = currentInstruction[1].u.operand;
    360360    int value = currentInstruction[2].u.operand;
     361    int type = currentInstruction[3].u.operand;
    361362
    362363    emitLoad(value, regT1, regT0);
    … …  
    371372    done.link(this);
    372373    emitStoreBool(dst, regT0);
    373 }
    374 
    375 void JIT::emit_op_is_string(Instruction* currentInstruction)
    376 {
    377     emitIsCellWithType(currentInstruction, StringType);
    378 }
    379 
    380 void JIT::emit_op_is_jsarray(Instruction* currentInstruction)
    381 {
    382     emitIsCellWithType(currentInstruction, ArrayType);
    383 }
    384 
    385 void JIT::emit_op_is_proxy_object(Instruction* currentInstruction)
    386 {
    387     emitIsCellWithType(currentInstruction, ProxyObjectType);
    388 }
    389 
    390 void JIT::emit_op_is_derived_array(Instruction* currentInstruction)
    391 {
    392     emitIsCellWithType(currentInstruction, DerivedArrayType);
    393374}
    394375

  • trunk/Source/JavaScriptCore/llint/LLIntData.cpp

    r206083 r206098  
    218218    ASSERT(bitwise_cast<uintptr_t>(ShadowChicken::Packet::tailMarker()) == static_cast<uintptr_t>(0x7a11));
    219219
    220     STATIC_ASSERT(OPCODE_LENGTH(op_is_string) == 3);
    221     STATIC_ASSERT(OPCODE_LENGTH(op_is_jsarray) == 3);
    222     STATIC_ASSERT(OPCODE_LENGTH(op_is_proxy_object) == 3);
    223     STATIC_ASSERT(OPCODE_LENGTH(op_is_derived_array) == 3);
    224 
    225220    // FIXME: make these assertions less horrible.
    226221#if !ASSERT_DISABLED

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r206065 r206098  
    12581258
    12591259
    1260 macro isCellWithType(type)
     1260_llint_op_is_cell_with_type:
     1261    traceExecution()
    12611262    loadi 8[PC], t1
    12621263    loadi 4[PC], t2
    … …  
    12641265    storei BooleanTag, TagOffset[cfr, t2, 8]
    12651266    bineq t0, CellTag, .notCellCase
    1266     cbeq JSCell::m_type[t3], type, t1
     1267    loadi 12[PC], t0
     1268    cbeq JSCell::m_type[t3], t0, t1
    12671269    storei t1, PayloadOffset[cfr, t2, 8]
    1268     dispatch(3)
     1270    dispatch(4)
    12691271.notCellCase:
    12701272    storep 0, PayloadOffset[cfr, t2, 8]
    1271     dispatch(3)
    1272 end
    1273 
    1274 
    1275 _llint_op_is_string:
    1276     traceExecution()
    1277     isCellWithType(StringType)
    1278 
    1279 
    1280 _llint_op_is_jsarray:
    1281     traceExecution()
    1282     isCellWithType(ArrayType)
    1283 
    1284 
    1285 _llint_op_is_proxy_object:
    1286     traceExecution()
    1287     isCellWithType(ProxyObjectType)
    1288 
    1289 
    1290 _llint_op_is_derived_array:
    1291     traceExecution()
    1292     isCellWithType(DerivedArrayType)
     1273    dispatch(4)
    12931274
    12941275

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r206065 r206098  
    11471147
    11481148
    1149 macro isCellWithType(type)
     1149_llint_op_is_cell_with_type:
     1150    traceExecution()
     1151    loadisFromInstruction(3, t3)
    11501152    loadisFromInstruction(2, t1)
    11511153    loadisFromInstruction(1, t2)
    11521154    loadConstantOrVariable(t1, t0)
    11531155    btqnz t0, tagMask, .notCellCase
    1154     cbeq JSCell::m_type[t0], type, t1
     1156    cbeq JSCell::m_type[t0], t3, t1
    11551157    orq ValueFalse, t1
    11561158    storeq t1, [cfr, t2, 8]
    1157     dispatch(3)
     1159    dispatch(4)
    11581160.notCellCase:
    11591161    storeq ValueFalse, [cfr, t2, 8]
    1160     dispatch(3)
    1161 end
    1162 
    1163 
    1164 _llint_op_is_string:
    1165     traceExecution()
    1166     isCellWithType(StringType)
    1167 
    1168 
    1169 _llint_op_is_jsarray:
    1170     traceExecution()
    1171     isCellWithType(ArrayType)
    1172 
    1173 
    1174 _llint_op_is_proxy_object:
    1175     traceExecution()
    1176     isCellWithType(ProxyObjectType)
    1177 
    1178 
    1179 _llint_op_is_derived_array:
    1180     traceExecution()
    1181     isCellWithType(DerivedArrayType)
     1162    dispatch(4)
    11821163
    11831164
Note: See TracChangeset for help on using the changeset viewer.