Changeset 228727 in webkit

Timestamp:

Feb 19, 2018 8:33:33 PM (6 years ago)

Author:

Yusuke Suzuki

Message:

[FTL] Support ArrayPop for ArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=182783

Reviewed by Saam Barati.

JSTests:

• stress/array-pop-array-storage.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

This patch adds ArrayPop(ArrayStorage) support to FTL. We port the implementation in DFG to FTL.

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/array-pop-array-storage.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLCapabilities.cpp (modified) (2 diffs)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [FTL] Support ArrayPop for ArrayStorage
+        https://bugs.webkit.org/show_bug.cgi?id=182783
+
+        Reviewed by Saam Barati.
+
+        * stress/array-pop-array-storage.js: Added.
+        (shouldBe):
+        (test):
+
 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [FTL] Support ArrayPop for ArrayStorage
+        https://bugs.webkit.org/show_bug.cgi?id=182783
+
+        Reviewed by Saam Barati.
+
+        This patch adds ArrayPop(ArrayStorage) support to FTL. We port the implementation in DFG to FTL.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
+
 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

@@ -46 +46 @@
 #define FOR_EACH_ABSTRACT_FIELD(macro) \
     macro(ArrayBuffer_data, ArrayBuffer::offsetOfData()) \
+    macro(ArrayStorage_numValuesInVector, ArrayStorage::numValuesInVectorOffset()) \
     macro(Butterfly_arrayBuffer, Butterfly::offsetOfArrayBuffer()) \
     macro(Butterfly_publicLength, Butterfly::offsetOfPublicLength()) \

trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

@@ -319 +319 @@
     case ArraySlice:
     case ArrayIndexOf:
+    case ArrayPop:
     case ParseInt:
     case AtomicsAdd:
@@ -438 +439 @@
         break;
     case ArrayPush:
-    case ArrayPop:
         switch (node->arrayMode().type()) {
         case Array::Int32:

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -4744 +4744 @@
             m_out.jump(continuation);
             
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, results));
+            return;
+        }
+
+        case Array::ArrayStorage: {
+            LBasicBlock vectorLengthCheckCase = m_out.newBlock();
+            LBasicBlock popCheckCase = m_out.newBlock();
+            LBasicBlock fastCase = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
+
+            Vector<ValueFromBlock, 3> results;
+            results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
+            m_out.branch(
+                m_out.isZero32(prevLength), rarely(continuation), usually(vectorLengthCheckCase));
+
+            LBasicBlock lastNext = m_out.appendTo(vectorLengthCheckCase, popCheckCase);
+            LValue newLength = m_out.sub(prevLength, m_out.int32One);
+            m_out.branch(
+                m_out.aboveOrEqual(newLength, m_out.load32(storage, m_heaps.Butterfly_vectorLength)), rarely(slowCase), usually(popCheckCase));
+
+            m_out.appendTo(popCheckCase, fastCase);
+            TypedPointer pointer = m_out.baseIndex(m_heaps.ArrayStorage_vector, storage, m_out.zeroExtPtr(newLength));
+            LValue result = m_out.load64(pointer);
+            m_out.branch(m_out.notZero64(result), usually(fastCase), rarely(slowCase));
+
+            m_out.appendTo(fastCase, slowCase);
+            m_out.store32(newLength, storage, m_heaps.Butterfly_publicLength);
+            m_out.store64(m_out.int64Zero, pointer);
+            m_out.store32(
+                m_out.sub(m_out.load32(storage, m_heaps.ArrayStorage_numValuesInVector), m_out.int32One),
+                storage, m_heaps.ArrayStorage_numValuesInVector);
+            results.append(m_out.anchor(result));
+            m_out.jump(continuation);
+
+            m_out.appendTo(slowCase, continuation);
+            results.append(m_out.anchor(vmCall(
+                Int64, m_out.operation(operationArrayPop), m_callFrame, base)));
+            m_out.jump(continuation);
+
             m_out.appendTo(continuation, lastNext);
             setJSValue(m_out.phi(Int64, results));