Changeset 228726 in webkit


Ignore:
Timestamp:
Feb 19, 2018 8:00:16 PM (6 years ago)
Author:
Yusuke Suzuki
Message:

[FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=182731

Reviewed by Saam Barati.

JSTests:

  • stress/arrayify-array-storage-array.js: Added.

(shouldBe):
(testArrayStorage):

  • stress/arrayify-array-storage-non-array.js: Added.

(shouldBe):
(testArrayStorage):

  • stress/arrayify-array-storage.js: Added.

(shouldBe):
(testArrayStorage):

  • stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.

(shouldBe):
(testArrayStorage):

  • stress/arrayify-slow-put-array-storage.js: Added.

(shouldBe):
(testArrayStorage):

Source/JavaScriptCore:

This patch adds support for Arrayify(ArrayStorage/SlowPutArrayStorage) to FTL.
Due to ArrayifyToStructure and CheckArray changes, necessary changes for
supporting Arrayify in FTL are already done. Just allowing it in FTLCapabilities.cpp
is enough.

We fix FTL's CheckArray logic. Previously, CheckArray(SlowPutArrayStorage) does not pass
ArrayStorage in FTL. But now it passes this as DFG does. Moreover, we fix DFG's CheckArray
where CheckArray(ArrayStorage+NonArray) can pass ArrayStorage+Array.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):

  • dfg/DFGSpeculativeJIT.h:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):

Location:
trunk
Files:
5 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r228725 r228726  
     12018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
     4        https://bugs.webkit.org/show_bug.cgi?id=182731
     5
     6        Reviewed by Saam Barati.
     7
     8        * stress/arrayify-array-storage-array.js: Added.
     9        (shouldBe):
     10        (testArrayStorage):
     11        * stress/arrayify-array-storage-non-array.js: Added.
     12        (shouldBe):
     13        (testArrayStorage):
     14        * stress/arrayify-array-storage.js: Added.
     15        (shouldBe):
     16        (testArrayStorage):
     17        * stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
     18        (shouldBe):
     19        (testArrayStorage):
     20        * stress/arrayify-slow-put-array-storage.js: Added.
     21        (shouldBe):
     22        (testArrayStorage):
     23
    1242018-02-19  Saam Barati  <sbarati@apple.com>
    225

  • trunk/Source/JavaScriptCore/ChangeLog

    r228725 r228726  
     12018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
     4        https://bugs.webkit.org/show_bug.cgi?id=182731
     5
     6        Reviewed by Saam Barati.
     7
     8        This patch adds support for Arrayify(ArrayStorage/SlowPutArrayStorage) to FTL.
     9        Due to ArrayifyToStructure and CheckArray changes, necessary changes for
     10        supporting Arrayify in FTL are already done. Just allowing it in FTLCapabilities.cpp
     11        is enough.
     12
     13        We fix FTL's CheckArray logic. Previously, CheckArray(SlowPutArrayStorage) does not pass
     14        ArrayStorage in FTL. But now it passes this as DFG does. Moreover, we fix DFG's CheckArray
     15        where CheckArray(ArrayStorage+NonArray) can pass ArrayStorage+Array.
     16
     17        * dfg/DFGSpeculativeJIT.cpp:
     18        (JSC::DFG::SpeculativeJIT::silentFill):
     19        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
     20        * dfg/DFGSpeculativeJIT.h:
     21        * ftl/FTLCapabilities.cpp:
     22        (JSC::FTL::canCompile):
     23        * ftl/FTLLowerDFGToB3.cpp:
     24        (JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):
     25
    1262018-02-19  Saam Barati  <sbarati@apple.com>
    227

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r228421 r228726  
    724724    }
    725725}
    726    
    727 JITCompiler::Jump SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGPR, ArrayMode arrayMode, IndexingType shape)
    728 {
    729     switch (arrayMode.arrayClass()) {
    730     case Array::OriginalArray: {
    731         CRASH();
    732 #if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
    733         JITCompiler::Jump result; // I already know that VC++ takes unkindly to the expression "return Jump()", so I'm doing it this way in anticipation of someone eventually using VC++ to compile the DFG.
    734         return result;
    735 #endif
    736     }
    737        
    738     case Array::Array:
    739         m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
    740         return m_jit.branch32(
    741             MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | shape));
    742        
    743     case Array::NonArray:
    744     case Array::OriginalNonArray:
    745         m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
    746         return m_jit.branch32(
    747             MacroAssembler::NotEqual, tempGPR, TrustedImm32(shape));
    748        
    749     case Array::PossiblyArray:
    750         m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
    751         return m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(shape));
    752     }
    753    
    754     RELEASE_ASSERT_NOT_REACHED();
    755     return JITCompiler::Jump();
    756 }
    757726
    758727JITCompiler::JumpList SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGPR, ArrayMode arrayMode)
    … …  
    765734    case Array::Contiguous:
    766735    case Array::Undecided:
    767         return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, arrayMode.shapeMask());
    768 
    769     case Array::ArrayStorage:
     736    case Array::ArrayStorage: {
     737        IndexingType shape = arrayMode.shapeMask();
     738        switch (arrayMode.arrayClass()) {
     739        case Array::OriginalArray:
     740            RELEASE_ASSERT_NOT_REACHED();
     741            return result;
     742
     743        case Array::Array:
     744            m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
     745            result.append(m_jit.branch32(
     746                MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | shape)));
     747            return result;
     748
     749        case Array::NonArray:
     750        case Array::OriginalNonArray:
     751            m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
     752            result.append(m_jit.branch32(
     753                MacroAssembler::NotEqual, tempGPR, TrustedImm32(shape)));
     754            return result;
     755
     756        case Array::PossiblyArray:
     757            m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
     758            result.append(m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(shape)));
     759            return result;
     760        }
     761
     762        RELEASE_ASSERT_NOT_REACHED();
     763        return result;
     764    }
     765
    770766    case Array::SlowPutArrayStorage: {
    771767        ASSERT(!arrayMode.isJSArrayWithOriginalStructure());
    772        
    773         if (arrayMode.isJSArray()) {
    774             if (arrayMode.isSlowPut()) {
    775                 result.append(
    776                     m_jit.branchTest32(
    777                         MacroAssembler::Zero, tempGPR, MacroAssembler::TrustedImm32(IsArray)));
    778                 m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
    779                 m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
    780                 result.append(
    781                     m_jit.branch32(
    782                         MacroAssembler::Above, tempGPR,
    783                         TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
    784                 break;
    785             }
    786             m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
     768
     769        switch (arrayMode.arrayClass()) {
     770        case Array::OriginalArray:
     771            RELEASE_ASSERT_NOT_REACHED();
     772            return result;
     773
     774        case Array::Array:
    787775            result.append(
    788                 m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | ArrayStorageShape)));
     776                m_jit.branchTest32(
     777                    MacroAssembler::Zero, tempGPR, MacroAssembler::TrustedImm32(IsArray)));
    789778            break;
    790         }
     779
     780        case Array::NonArray:
     781        case Array::OriginalNonArray:
     782            result.append(
     783                m_jit.branchTest32(
     784                    MacroAssembler::NonZero, tempGPR, MacroAssembler::TrustedImm32(IsArray)));
     785            break;
     786
     787        case Array::PossiblyArray:
     788            break;
     789        }
     790
    791791        m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
    792         if (arrayMode.isSlowPut()) {
    793             m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
    794             result.append(
    795                 m_jit.branch32(
    796                     MacroAssembler::Above, tempGPR,
    797                     TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
    798             break;
    799         }
     792        m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
    800793        result.append(
    801             m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(ArrayStorageShape)));
    802         break;
     794            m_jit.branch32(
     795                MacroAssembler::Above, tempGPR,
     796                TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
     797        return result;
    803798    }
    804799    default:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r228420 r228726  
    33073307    void speculate(Node*, Edge);
    33083308   
    3309     JITCompiler::Jump jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode, IndexingType);
    33103309    JITCompiler::JumpList jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode);
    33113310    void checkArray(Node*);

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r228421 r228726  
    6868    case CheckStructureOrEmpty:
    6969    case DoubleAsInt32:
     70    case Arrayify:
    7071    case ArrayifyToStructure:
    7172    case PutStructure:
    … …  
    341342        // pipeline failed to optimize out an Identity.
    342343        break;
    343     case Arrayify:
    344         switch (node->arrayMode().type()) {
    345         case Array::Int32:
    346         case Array::Double:
    347         case Array::Contiguous:
    348             break;
    349         default:
    350             return CannotCompile;
    351         }
    352         break;
    353344    case CheckArray:
    354345        switch (node->arrayMode().type()) {

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r228421 r228726  
    1455114551        case Array::Contiguous:
    1455214552        case Array::Undecided:
    14553         case Array::ArrayStorage:
    14554         case Array::SlowPutArrayStorage: {
     14553        case Array::ArrayStorage: {
    1455514554            IndexingType shape = arrayMode.shapeMask();
    1455614555            LValue indexingType = m_out.load8ZeroExt32(cell, m_heaps.JSCell_indexingTypeAndMisc);
    … …  
    1455914558            case Array::OriginalArray:
    1456014559                DFG_CRASH(m_graph, m_node, "Unexpected original array");
    14561                 return 0;
     14560                return nullptr;
    1456214561
    1456314562            case Array::Array:
    … …  
    1457814577            }
    1457914578            break;
     14579        }
     14580
     14581        case Array::SlowPutArrayStorage: {
     14582            ASSERT(!arrayMode.isJSArrayWithOriginalStructure());
     14583            LValue indexingType = m_out.load8ZeroExt32(cell, m_heaps.JSCell_indexingTypeAndMisc);
     14584
     14585            LBasicBlock trueCase = m_out.newBlock();
     14586            LBasicBlock checkCase = m_out.newBlock();
     14587            LBasicBlock continuation = m_out.newBlock();
     14588
     14589            ValueFromBlock falseValue = m_out.anchor(m_out.booleanFalse);
     14590            LValue isAnArrayStorageShape = m_out.belowOrEqual(
     14591                m_out.sub(
     14592                    m_out.bitAnd(indexingType, m_out.constInt32(IndexingShapeMask)),
     14593                    m_out.constInt32(ArrayStorageShape)),
     14594                m_out.constInt32(SlowPutArrayStorageShape - ArrayStorageShape));
     14595            m_out.branch(isAnArrayStorageShape, usually(checkCase), usually(continuation));
     14596
     14597            LBasicBlock lastNext = m_out.appendTo(checkCase, trueCase);
     14598            switch (arrayMode.arrayClass()) {
     14599            case Array::OriginalArray:
     14600                DFG_CRASH(m_graph, m_node, "Unexpected original array");
     14601                return nullptr;
     14602
     14603            case Array::Array:
     14604                m_out.branch(
     14605                    m_out.testNonZero32(indexingType, m_out.constInt32(IsArray)),
     14606                    usually(trueCase), usually(continuation));
     14607                break;
     14608
     14609            case Array::NonArray:
     14610            case Array::OriginalNonArray:
     14611                m_out.branch(
     14612                    m_out.testIsZero32(indexingType, m_out.constInt32(IsArray)),
     14613                    usually(trueCase), usually(continuation));
     14614                break;
     14615
     14616            case Array::PossiblyArray:
     14617                m_out.jump(trueCase);
     14618                break;
     14619            }
     14620
     14621            m_out.appendTo(trueCase, continuation);
     14622            ValueFromBlock trueValue = m_out.anchor(m_out.booleanTrue);
     14623            m_out.jump(continuation);
     14624
     14625            m_out.appendTo(continuation, lastNext);
     14626            return m_out.phi(Int32, falseValue, trueValue);
    1458014627        }
    1458114628
Note: See TracChangeset for help on using the changeset viewer.