Changeset 285530 in webkit
- Timestamp:
- Nov 9, 2021, 1:33:34 PM (5 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 8 edited
-
ChangeLog (modified) (1 diff)
-
dfg/DFGOperations.cpp (modified) (2 diffs)
-
dfg/DFGOperations.h (modified) (2 diffs)
-
dfg/DFGSpeculativeJIT.cpp (modified) (15 diffs)
-
dfg/DFGSpeculativeJIT.h (modified) (3 diffs)
-
dfg/DFGSpeculativeJIT32_64.cpp (modified) (2 diffs)
-
dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)
-
jit/AssemblyHelpers.h (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r285525 r285530 1 2021-11-09 Mikhail R. Gadelha <mikhail@igalia.com> 2 3 Refactoring and PutByVal cleanup 4 https://bugs.webkit.org/show_bug.cgi?id=232265 5 6 Reviewed by Saam Barati. 7 8 Follow-up from https://bugs.webkit.org/show_bug.cgi?id=232242, 9 this patch includes several small code changes but the patch doesn't 10 add/remove any feature: 11 12 1. Removed several calls to operationPutByVal*Cell* that were 13 only used by the 32 bit code paths due to the lack of registers. 14 These calls were replaced by the calls used by the 64 bit paths, 15 that expect EncodedJSValues 16 2. Because of #1, this patch removes those methods, since no one 17 uses them anymore. 18 3. Created compilePutByVal to handle all cases (similar to compileGetByVal). 19 4. Removed the Edge& childX from the PutByVal handling (and all methods 20 that expected them) in favor of getting them from node when needed. 21 5. Unified compileContiguousPutByVal so it could be used by both 32 22 and 64 bit archs. 23 6. Removed a lot of whitespace. 24 25 * dfg/DFGOperations.cpp: 26 * dfg/DFGOperations.h: 27 * dfg/DFGSpeculativeJIT.cpp: 28 (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): 29 (JSC::DFG::SpeculativeJIT::compileDoublePutByVal): 30 (JSC::DFG::SpeculativeJIT::compilePutByVal): 31 (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): 32 (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): Deleted. 33 (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): Deleted. 34 (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString): Deleted. 35 (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol): Deleted. 36 (JSC::DFG::SpeculativeJIT::compileGetPrivateName): Deleted. 37 (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal): Deleted. 38 (JSC::DFG::SpeculativeJIT::compileGetPrivateNameById): Deleted. 39 (JSC::DFG::SpeculativeJIT::compilePutByValForCellWithString): Deleted. 40 (JSC::DFG::SpeculativeJIT::compilePutByValForCellWithSymbol): Deleted. 41 (JSC::DFG::SpeculativeJIT::compileGetByValWithThis): Deleted. 42 (JSC::DFG::SpeculativeJIT::compilePutPrivateName): Deleted. 43 (JSC::DFG::SpeculativeJIT::compilePutPrivateNameById): Deleted. 44 (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand): Deleted. 45 (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand): Deleted. 46 (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags): Deleted. 47 (JSC::DFG::SpeculativeJIT::compileParseInt): Deleted. 48 (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance): Deleted. 49 (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells): Deleted. 50 (JSC::DFG::SpeculativeJIT::compileInstanceOf): Deleted. 51 (JSC::DFG::SpeculativeJIT::compileValueBitNot): Deleted. 52 (JSC::DFG::SpeculativeJIT::compileBitwiseNot): Deleted. 53 (JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp): Deleted. 54 (JSC::DFG::SpeculativeJIT::compileValueBitwiseOp): Deleted. 55 (JSC::DFG::SpeculativeJIT::compileBitwiseOp): Deleted. 56 (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp): Deleted. 57 (JSC::DFG::SpeculativeJIT::compileValueLShiftOp): Deleted. 58 (JSC::DFG::SpeculativeJIT::compileValueBitRShift): Deleted. 59 (JSC::DFG::SpeculativeJIT::compileShiftOp): Deleted. 60 (JSC::DFG::SpeculativeJIT::compileValueAdd): Deleted. 61 (JSC::DFG::SpeculativeJIT::compileValueSub): Deleted. 62 (JSC::DFG::SpeculativeJIT::compileMathIC): Deleted. 63 (JSC::DFG::SpeculativeJIT::compileInstanceOfCustom): Deleted. 64 (JSC::DFG::SpeculativeJIT::compileIsCellWithType): Deleted. 65 (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView): Deleted. 66 (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor): Deleted. 67 (JSC::DFG::SpeculativeJIT::compileArithAdd): Deleted. 68 (JSC::DFG::SpeculativeJIT::compileArithAbs): Deleted. 69 (JSC::DFG::SpeculativeJIT::compileArithClz32): Deleted. 70 (JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp): Deleted. 71 (JSC::DFG::SpeculativeJIT::compileArithSub): Deleted. 72 (JSC::DFG::SpeculativeJIT::compileIncOrDec): Deleted. 73 (JSC::DFG::SpeculativeJIT::compileValueNegate): Deleted. 74 (JSC::DFG::SpeculativeJIT::compileArithNegate): Deleted. 75 (JSC::DFG::SpeculativeJIT::compileValueMul): Deleted. 76 (JSC::DFG::SpeculativeJIT::compileArithMul): Deleted. 77 (JSC::DFG::SpeculativeJIT::compileValueDiv): Deleted. 78 (JSC::DFG::SpeculativeJIT::compileArithDiv): Deleted. 79 (JSC::DFG::SpeculativeJIT::compileArithFRound): Deleted. 80 (JSC::DFG::SpeculativeJIT::compileValueMod): Deleted. 81 (JSC::DFG::SpeculativeJIT::compileArithMod): Deleted. 82 (JSC::DFG::SpeculativeJIT::compileArithRounding): Deleted. 83 (JSC::DFG::SpeculativeJIT::compileArithUnary): Deleted. 84 (JSC::DFG::SpeculativeJIT::compileArithSqrt): Deleted. 85 (JSC::DFG::SpeculativeJIT::compileArithMinMax): Deleted. 86 (JSC::DFG::compileArithPowIntegerFastPath): Deleted. 87 (JSC::DFG::SpeculativeJIT::compileValuePow): Deleted. 88 (JSC::DFG::SpeculativeJIT::compileArithPow): Deleted. 89 (JSC::DFG::SpeculativeJIT::compare): Deleted. 90 (JSC::DFG::SpeculativeJIT::compileCompareUnsigned): Deleted. 91 (JSC::DFG::SpeculativeJIT::compileStrictEq): Deleted. 92 (JSC::DFG::SpeculativeJIT::compileBooleanCompare): Deleted. 93 (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted. 94 (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted. 95 (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted. 96 (JSC::DFG::SpeculativeJIT::compileSymbolEquality): Deleted. 97 (JSC::DFG::SpeculativeJIT::compilePeepHoleSymbolEquality): Deleted. 98 (JSC::DFG::SpeculativeJIT::emitBitwiseJSValueEquality): Deleted. 99 (JSC::DFG::SpeculativeJIT::emitBranchOnBitwiseJSValueEquality): Deleted. 100 (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): Deleted. 101 (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): Deleted. 102 (JSC::DFG::SpeculativeJIT::compileStringEquality): Deleted. 103 (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality): Deleted. 104 (JSC::DFG::SpeculativeJIT::compileStringIdentEquality): Deleted. 105 (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality): Deleted. 106 (JSC::DFG::SpeculativeJIT::compileStringCompare): Deleted. 107 (JSC::DFG::SpeculativeJIT::compileStringIdentCompare): Deleted. 108 (JSC::DFG::SpeculativeJIT::compileSameValue): Deleted. 109 (JSC::DFG::SpeculativeJIT::compileToBooleanString): Deleted. 110 (JSC::DFG::SpeculativeJIT::compileToBooleanStringOrOther): Deleted. 111 (JSC::DFG::SpeculativeJIT::emitStringBranch): Deleted. 112 (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch): Deleted. 113 (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer): Deleted. 114 (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): Deleted. 115 (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): Deleted. 116 (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): Deleted. 117 (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments): Deleted. 118 (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments): Deleted. 119 (JSC::DFG::SpeculativeJIT::compileGetScope): Deleted. 120 (JSC::DFG::SpeculativeJIT::compileSkipScope): Deleted. 121 (JSC::DFG::SpeculativeJIT::compileGetGlobalObject): Deleted. 122 (JSC::DFG::SpeculativeJIT::compileGetGlobalThis): Deleted. 123 (JSC::DFG::SpeculativeJIT::canBeRope): Deleted. 124 (JSC::DFG::SpeculativeJIT::compileGetArrayLength): Deleted. 125 (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted. 126 (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon): Deleted. 127 (JSC::DFG::SpeculativeJIT::compileNewFunction): Deleted. 128 (JSC::DFG::SpeculativeJIT::compileSetFunctionName): Deleted. 129 (JSC::DFG::SpeculativeJIT::compileVarargsLength): Deleted. 130 (JSC::DFG::SpeculativeJIT::compileLoadVarargs): Deleted. 131 (JSC::DFG::SpeculativeJIT::compileForwardVarargs): Deleted. 132 (JSC::DFG::SpeculativeJIT::compileCreateActivation): Deleted. 133 (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments): Deleted. 134 (JSC::DFG::SpeculativeJIT::compileGetFromArguments): Deleted. 135 (JSC::DFG::SpeculativeJIT::compilePutToArguments): Deleted. 136 (JSC::DFG::SpeculativeJIT::compileGetArgument): Deleted. 137 (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments): Deleted. 138 (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments): Deleted. 139 (JSC::DFG::SpeculativeJIT::compileCreateArgumentsButterfly): Deleted. 140 (JSC::DFG::SpeculativeJIT::compileCreateRest): Deleted. 141 (JSC::DFG::SpeculativeJIT::compileSpread): Deleted. 142 (JSC::DFG::SpeculativeJIT::compileNewArray): Deleted. 143 (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread): Deleted. 144 (JSC::DFG::SpeculativeJIT::compileGetRestLength): Deleted. 145 (JSC::DFG::SpeculativeJIT::emitPopulateSliceIndex): Deleted. 146 (JSC::DFG::SpeculativeJIT::compileArraySlice): Deleted. 147 (JSC::DFG::SpeculativeJIT::compileArrayIndexOf): Deleted. 148 (JSC::DFG::SpeculativeJIT::compileArrayPush): Deleted. 149 (JSC::DFG::SpeculativeJIT::compileNotifyWrite): Deleted. 150 (JSC::DFG::SpeculativeJIT::compileIsObject): Deleted. 151 (JSC::DFG::SpeculativeJIT::compileTypeOfIsObject): Deleted. 152 (JSC::DFG::SpeculativeJIT::compileIsCallable): Deleted. 153 (JSC::DFG::SpeculativeJIT::compileIsConstructor): Deleted. 154 (JSC::DFG::SpeculativeJIT::compileTypeOf): Deleted. 155 (JSC::DFG::SpeculativeJIT::emitStructureCheck): Deleted. 156 (JSC::DFG::SpeculativeJIT::compileCheckIsConstant): Deleted. 157 (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty): Deleted. 158 (JSC::DFG::SpeculativeJIT::compileCheckStructure): Deleted. 159 (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): Deleted. 160 (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): Deleted. 161 (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly): Deleted. 162 (JSC::DFG::SpeculativeJIT::compileGetButterfly): Deleted. 163 (JSC::DFG::allocateTemporaryRegistersForSnippet): Deleted. 164 (JSC::DFG::SpeculativeJIT::compileCallDOM): Deleted. 165 (JSC::DFG::SpeculativeJIT::compileCallDOMGetter): Deleted. 166 (JSC::DFG::SpeculativeJIT::compileCheckJSCast): Deleted. 167 (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal): Deleted. 168 (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf): Deleted. 169 (JSC::DFG::getExecutable): Deleted. 170 (JSC::DFG::SpeculativeJIT::compileFunctionToString): Deleted. 171 (JSC::DFG::SpeculativeJIT::compileNumberToStringWithValidRadixConstant): Deleted. 172 (JSC::DFG::SpeculativeJIT::compileNumberToStringWithRadix): Deleted. 173 (JSC::DFG::SpeculativeJIT::compileNewStringObject): Deleted. 174 (JSC::DFG::SpeculativeJIT::compileNewSymbol): Deleted. 175 (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): Deleted. 176 (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): Deleted. 177 (JSC::DFG::SpeculativeJIT::compileNewRegexp): Deleted. 178 (JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering): Deleted. 179 (JSC::DFG::SpeculativeJIT::speculateCellType): Deleted. 180 (JSC::DFG::SpeculativeJIT::speculateInt32): Deleted. 181 (JSC::DFG::SpeculativeJIT::speculateNumber): Deleted. 182 (JSC::DFG::SpeculativeJIT::speculateRealNumber): Deleted. 183 (JSC::DFG::SpeculativeJIT::speculateDoubleRepReal): Deleted. 184 (JSC::DFG::SpeculativeJIT::speculateBoolean): Deleted. 185 (JSC::DFG::SpeculativeJIT::speculateCell): Deleted. 186 (JSC::DFG::SpeculativeJIT::speculateCellOrOther): Deleted. 187 (JSC::DFG::SpeculativeJIT::speculateObject): Deleted. 188 (JSC::DFG::SpeculativeJIT::speculateFunction): Deleted. 189 (JSC::DFG::SpeculativeJIT::speculateFinalObject): Deleted. 190 (JSC::DFG::SpeculativeJIT::speculateRegExpObject): Deleted. 191 (JSC::DFG::SpeculativeJIT::speculateArray): Deleted. 192 (JSC::DFG::SpeculativeJIT::speculateProxyObject): Deleted. 193 (JSC::DFG::SpeculativeJIT::speculateDerivedArray): Deleted. 194 (JSC::DFG::SpeculativeJIT::speculatePromiseObject): Deleted. 195 (JSC::DFG::SpeculativeJIT::speculateDateObject): Deleted. 196 (JSC::DFG::SpeculativeJIT::speculateMapObject): Deleted. 197 (JSC::DFG::SpeculativeJIT::speculateSetObject): Deleted. 198 (JSC::DFG::SpeculativeJIT::speculateWeakMapObject): Deleted. 199 (JSC::DFG::SpeculativeJIT::speculateWeakSetObject): Deleted. 200 (JSC::DFG::SpeculativeJIT::speculateDataViewObject): Deleted. 201 (JSC::DFG::SpeculativeJIT::speculateObjectOrOther): Deleted. 202 (JSC::DFG::SpeculativeJIT::speculateString): Deleted. 203 (JSC::DFG::SpeculativeJIT::speculateStringOrOther): Deleted. 204 (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage): Deleted. 205 (JSC::DFG::SpeculativeJIT::speculateStringIdent): Deleted. 206 (JSC::DFG::SpeculativeJIT::speculateStringObject): Deleted. 207 (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject): Deleted. 208 (JSC::DFG::SpeculativeJIT::speculateNotStringVar): Deleted. 209 (JSC::DFG::SpeculativeJIT::speculateNotSymbol): Deleted. 210 (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted. 211 (JSC::DFG::SpeculativeJIT::speculateHeapBigInt): Deleted. 212 (JSC::DFG::SpeculativeJIT::speculateNotCell): Deleted. 213 (JSC::DFG::SpeculativeJIT::speculateNotCellNorBigInt): Deleted. 214 (JSC::DFG::SpeculativeJIT::speculateNotDouble): Deleted. 215 (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigInt): Deleted. 216 (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): Deleted. 217 (JSC::DFG::SpeculativeJIT::speculateOther): Deleted. 218 (JSC::DFG::SpeculativeJIT::speculateMisc): Deleted. 219 (JSC::DFG::SpeculativeJIT::speculate): Deleted. 220 (JSC::DFG::SpeculativeJIT::emitSwitchIntJump): Deleted. 221 (JSC::DFG::SpeculativeJIT::emitSwitchImm): Deleted. 222 (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): Deleted. 223 (JSC::DFG::SpeculativeJIT::emitSwitchChar): Deleted. 224 (JSC::DFG::SpeculativeJIT::emitBinarySwitchStringRecurse): Deleted. 225 (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString): Deleted. 226 (JSC::DFG::SpeculativeJIT::emitSwitchString): Deleted. 227 (JSC::DFG::SpeculativeJIT::emitSwitch): Deleted. 228 (JSC::DFG::SpeculativeJIT::addBranch): Deleted. 229 (JSC::DFG::SpeculativeJIT::linkBranches): Deleted. 230 (JSC::DFG::SpeculativeJIT::compileStoreBarrier): Deleted. 231 (JSC::DFG::SpeculativeJIT::compilePutAccessorById): Deleted. 232 (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById): Deleted. 233 (JSC::DFG::SpeculativeJIT::compileResolveScope): Deleted. 234 (JSC::DFG::SpeculativeJIT::compileResolveScopeForHoistingFuncDeclInEval): Deleted. 235 (JSC::DFG::SpeculativeJIT::compileGetGlobalVariable): Deleted. 236 (JSC::DFG::SpeculativeJIT::compilePutGlobalVariable): Deleted. 237 (JSC::DFG::SpeculativeJIT::compileGetDynamicVar): Deleted. 238 (JSC::DFG::SpeculativeJIT::compilePutDynamicVar): Deleted. 239 (JSC::DFG::SpeculativeJIT::compileGetClosureVar): Deleted. 240 (JSC::DFG::SpeculativeJIT::compilePutClosureVar): Deleted. 241 (JSC::DFG::SpeculativeJIT::compileGetInternalField): Deleted. 242 (JSC::DFG::SpeculativeJIT::compilePutInternalField): Deleted. 243 (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal): Deleted. 244 (JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex): Deleted. 245 (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex): Deleted. 246 (JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted. 247 (JSC::DFG::SpeculativeJIT::compileRegExpTest): Deleted. 248 (JSC::DFG::SpeculativeJIT::compileStringReplace): Deleted. 249 (JSC::DFG::SpeculativeJIT::compileRegExpExecNonGlobalOrSticky): Deleted. 250 (JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal): Deleted. 251 (JSC::DFG::SpeculativeJIT::compileRegExpMatchFast): Deleted. 252 (JSC::DFG::SpeculativeJIT::compileLazyJSConstant): Deleted. 253 (JSC::DFG::SpeculativeJIT::compileMaterializeNewObject): Deleted. 254 (JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult): Deleted. 255 (JSC::DFG::SpeculativeJIT::compileDefineDataProperty): Deleted. 256 (JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty): Deleted. 257 (JSC::DFG::SpeculativeJIT::emitAllocateButterfly): Deleted. 258 (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey): Deleted. 259 (JSC::DFG::SpeculativeJIT::compileGetMapBucketHead): Deleted. 260 (JSC::DFG::SpeculativeJIT::compileGetMapBucketNext): Deleted. 261 (JSC::DFG::SpeculativeJIT::compileLoadKeyFromMapBucket): Deleted. 262 (JSC::DFG::SpeculativeJIT::compileLoadValueFromMapBucket): Deleted. 263 (JSC::DFG::SpeculativeJIT::compileExtractValueFromWeakMapGet): Deleted. 264 (JSC::DFG::SpeculativeJIT::compileThrow): Deleted. 265 (JSC::DFG::SpeculativeJIT::compileThrowStaticError): Deleted. 266 (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode): Deleted. 267 (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractIndex): Deleted. 268 (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractMode): Deleted. 269 (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): Deleted. 270 (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): Deleted. 271 (JSC::DFG::SpeculativeJIT::compileEnumeratorInByVal): Deleted. 272 (JSC::DFG::SpeculativeJIT::compileEnumeratorHasOwnProperty): Deleted. 273 (JSC::DFG::SpeculativeJIT::compilePutByIdFlush): Deleted. 274 (JSC::DFG::SpeculativeJIT::compilePutById): Deleted. 275 (JSC::DFG::SpeculativeJIT::compilePutByIdDirect): Deleted. 276 (JSC::DFG::SpeculativeJIT::compilePutByIdWithThis): Deleted. 277 (JSC::DFG::SpeculativeJIT::compileGetByOffset): Deleted. 278 (JSC::DFG::SpeculativeJIT::compilePutByOffset): Deleted. 279 (JSC::DFG::SpeculativeJIT::compileMatchStructure): Deleted. 280 (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator): Deleted. 281 (JSC::DFG::SpeculativeJIT::compileGetExecutable): Deleted. 282 (JSC::DFG::SpeculativeJIT::compileGetGetter): Deleted. 283 (JSC::DFG::SpeculativeJIT::compileGetSetter): Deleted. 284 (JSC::DFG::SpeculativeJIT::compileGetCallee): Deleted. 285 (JSC::DFG::SpeculativeJIT::compileSetCallee): Deleted. 286 (JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis): Deleted. 287 (JSC::DFG::SpeculativeJIT::compileSetArgumentCountIncludingThis): Deleted. 288 (JSC::DFG::SpeculativeJIT::compileStrCat): Deleted. 289 (JSC::DFG::SpeculativeJIT::compileNewArrayBuffer): Deleted. 290 (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize): Deleted. 291 (JSC::DFG::SpeculativeJIT::compileNewTypedArray): Deleted. 292 (JSC::DFG::SpeculativeJIT::compileToThis): Deleted. 293 (JSC::DFG::SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames): Deleted. 294 (JSC::DFG::SpeculativeJIT::compileObjectAssign): Deleted. 295 (JSC::DFG::SpeculativeJIT::compileObjectCreate): Deleted. 296 (JSC::DFG::SpeculativeJIT::compileCreateThis): Deleted. 297 (JSC::DFG::SpeculativeJIT::compileCreatePromise): Deleted. 298 (JSC::DFG::SpeculativeJIT::compileCreateInternalFieldObject): Deleted. 299 (JSC::DFG::SpeculativeJIT::compileCreateGenerator): Deleted. 300 (JSC::DFG::SpeculativeJIT::compileCreateAsyncGenerator): Deleted. 301 (JSC::DFG::SpeculativeJIT::compileNewObject): Deleted. 302 (JSC::DFG::SpeculativeJIT::compileNewInternalFieldObjectImpl): Deleted. 303 (JSC::DFG::SpeculativeJIT::compileNewGenerator): Deleted. 304 (JSC::DFG::SpeculativeJIT::compileNewAsyncGenerator): Deleted. 305 (JSC::DFG::SpeculativeJIT::compileNewInternalFieldObject): Deleted. 306 (JSC::DFG::SpeculativeJIT::compileToPrimitive): Deleted. 307 (JSC::DFG::SpeculativeJIT::compileToPropertyKey): Deleted. 308 (JSC::DFG::SpeculativeJIT::compileToNumeric): Deleted. 309 (JSC::DFG::SpeculativeJIT::compileCallNumberConstructor): Deleted. 310 (JSC::DFG::SpeculativeJIT::compileLogShadowChickenPrologue): Deleted. 311 (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail): Deleted. 312 (JSC::DFG::SpeculativeJIT::compileSetAdd): Deleted. 313 (JSC::DFG::SpeculativeJIT::compileMapSet): Deleted. 314 (JSC::DFG::SpeculativeJIT::compileWeakMapGet): Deleted. 315 (JSC::DFG::SpeculativeJIT::compileWeakSetAdd): Deleted. 316 (JSC::DFG::SpeculativeJIT::compileWeakMapSet): Deleted. 317 (JSC::DFG::SpeculativeJIT::compileGetPrototypeOf): Deleted. 318 (JSC::DFG::SpeculativeJIT::compileIdentity): Deleted. 319 (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted. 320 (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted. 321 (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted. 322 (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty): Deleted. 323 (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal): Deleted. 324 (JSC::DFG::SpeculativeJIT::compileClearCatchLocals): Deleted. 325 (JSC::DFG::SpeculativeJIT::compileProfileType): Deleted. 326 (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted. 327 (JSC::DFG::SpeculativeJIT::genericJSValueNonPeepholeCompare): Deleted. 328 (JSC::DFG::SpeculativeJIT::genericJSValuePeepholeBranch): Deleted. 329 (JSC::DFG::SpeculativeJIT::compileHeapBigIntEquality): Deleted. 330 (JSC::DFG::SpeculativeJIT::compileMakeRope): Deleted. 331 (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted. 332 * dfg/DFGSpeculativeJIT.h: 333 * dfg/DFGSpeculativeJIT32_64.cpp: 334 (JSC::DFG::SpeculativeJIT::compile): 335 (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): Deleted. 336 * dfg/DFGSpeculativeJIT64.cpp: 337 (JSC::DFG::SpeculativeJIT::compile): 338 * jit/AssemblyHelpers.h: 339 (JSC::AssemblyHelpers::branchIfEmpty): 340 (JSC::AssemblyHelpers::branchIfNotEmpty): 341 1 342 2021-11-09 Saam Barati <sbarati@apple.com> 2 343 -
trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp
r285525 r285530 821 821 } 822 822 823 JSC_DEFINE_JIT_OPERATION(operationPutByValCellStrict, void, (JSGlobalObject* globalObject, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue))824 {825 VM& vm = globalObject->vm();826 CallFrame* callFrame = DECLARE_CALL_FRAME(vm);827 JITOperationPrologueCallFrameTracer tracer(vm, callFrame);828 829 putByValInternal<true, false>(globalObject, vm, JSValue::encode(cell), encodedProperty, encodedValue);830 }831 832 JSC_DEFINE_JIT_OPERATION(operationPutByValCellNonStrict, void, (JSGlobalObject* globalObject, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue))833 {834 VM& vm = globalObject->vm();835 CallFrame* callFrame = DECLARE_CALL_FRAME(vm);836 JITOperationPrologueCallFrameTracer tracer(vm, callFrame);837 838 putByValInternal<false, false>(globalObject, vm, JSValue::encode(cell), encodedProperty, encodedValue);839 }840 841 823 JSC_DEFINE_JIT_OPERATION(operationPutByValCellStringStrict, void, (JSGlobalObject* globalObject, JSCell* cell, JSCell* string, EncodedJSValue encodedValue)) 842 824 { … … 995 977 996 978 putByValInternal<false, true>(globalObject, vm, encodedBase, encodedProperty, encodedValue); 997 }998 999 JSC_DEFINE_JIT_OPERATION(operationPutByValDirectCellStrict, void, (JSGlobalObject* globalObject, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue))1000 {1001 VM& vm = globalObject->vm();1002 CallFrame* callFrame = DECLARE_CALL_FRAME(vm);1003 JITOperationPrologueCallFrameTracer tracer(vm, callFrame);1004 1005 putByValInternal<true, true>(globalObject, vm, JSValue::encode(cell), encodedProperty, encodedValue);1006 }1007 1008 JSC_DEFINE_JIT_OPERATION(operationPutByValDirectCellNonStrict, void, (JSGlobalObject* globalObject, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue))1009 {1010 VM& vm = globalObject->vm();1011 CallFrame* callFrame = DECLARE_CALL_FRAME(vm);1012 JITOperationPrologueCallFrameTracer tracer(vm, callFrame);1013 1014 putByValInternal<false, true>(globalObject, vm, JSValue::encode(cell), encodedProperty, encodedValue);1015 979 } 1016 980 -
trunk/Source/JavaScriptCore/dfg/DFGOperations.h
r285525 r285530 146 146 JSC_DECLARE_JIT_OPERATION(operationPutByValStrict, void, (JSGlobalObject*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)); 147 147 JSC_DECLARE_JIT_OPERATION(operationPutByValNonStrict, void, (JSGlobalObject*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)); 148 JSC_DECLARE_JIT_OPERATION(operationPutByValCellStrict, void, (JSGlobalObject*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue));149 JSC_DECLARE_JIT_OPERATION(operationPutByValCellNonStrict, void, (JSGlobalObject*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue));150 148 JSC_DECLARE_JIT_OPERATION(operationPutByValCellStringStrict, void, (JSGlobalObject*, JSCell*, JSCell* string, EncodedJSValue encodedValue)); 151 149 JSC_DECLARE_JIT_OPERATION(operationPutByValCellStringNonStrict, void, (JSGlobalObject*, JSCell*, JSCell* string, EncodedJSValue encodedValue)); … … 156 154 JSC_DECLARE_JIT_OPERATION(operationPutByValDirectStrict, void, (JSGlobalObject*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)); 157 155 JSC_DECLARE_JIT_OPERATION(operationPutByValDirectNonStrict, void, (JSGlobalObject*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)); 158 JSC_DECLARE_JIT_OPERATION(operationPutByValDirectCellStrict, void, (JSGlobalObject*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue));159 JSC_DECLARE_JIT_OPERATION(operationPutByValDirectCellNonStrict, void, (JSGlobalObject*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue));160 156 JSC_DECLARE_JIT_OPERATION(operationPutByValDirectCellStringStrict, void, (JSGlobalObject*, JSCell*, JSCell* string, EncodedJSValue encodedValue)); 161 157 JSC_DECLARE_JIT_OPERATION(operationPutByValDirectCellStringNonStrict, void, (JSGlobalObject*, JSCell*, JSCell* string, EncodedJSValue encodedValue)); -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r285525 r285530 2482 2482 } 2483 2483 2484 void SpeculativeJIT::compileDoublePutByVal(Node* node, SpeculateCellOperand& base, SpeculateStrictInt32Operand& property) 2485 { 2486 Edge child3 = m_jit.graph().varArgChild(node, 2); 2487 Edge child4 = m_jit.graph().varArgChild(node, 3); 2488 2489 ArrayMode arrayMode = node->arrayMode(); 2490 2484 void SpeculativeJIT::compileContiguousPutByVal(Node* node) 2485 { 2486 SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0)); 2487 SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1)); 2488 JSValueOperand value(this, m_jit.graph().varArgChild(node, 2), ManualOperandSpeculation); 2489 2491 2490 GPRReg baseReg = base.gpr(); 2492 2491 GPRReg propertyReg = property.gpr(); 2493 2494 SpeculateDoubleOperand value(this, child3); 2495 2496 FPRReg valueReg = value.fpr(); 2497 2498 DFG_TYPE_CHECK( 2499 JSValueRegs(), child3, SpecFullRealNumber, 2500 m_jit.branchIfNaN(valueReg)); 2501 2492 JSValueRegs valueRegs = value.jsValueRegs(); 2493 2502 2494 if (!m_compileOkay) 2503 2495 return; 2504 2505 StorageOperand storage(this, child4);2496 2497 StorageOperand storage(this, m_jit.graph().varArgChild(node, 3)); 2506 2498 GPRReg storageReg = storage.gpr(); 2507 2499 … … 2509 2501 // Store the value to the array. 2510 2502 GPRReg propertyReg = property.gpr(); 2511 FPRReg valueReg = value.fpr(); 2512 m_jit.storeDouble(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 2513 2514 noResult(m_currentNode); 2515 return; 2516 } 2517 2503 m_jit.storeValue(valueRegs, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 2504 noResult(node); 2505 return; 2506 } 2507 2518 2508 GPRTemporary temporary; 2519 2509 GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node); 2520 2510 2521 2511 MacroAssembler::Jump slowCase; 2522 2512 2513 ArrayMode arrayMode = node->arrayMode(); 2523 2514 if (arrayMode.isInBounds()) { 2524 2515 speculationCheck( … … 2527 2518 } else { 2528 2519 MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())); 2529 2520 2530 2521 slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())); 2531 2522 2532 2523 if (!arrayMode.isOutOfBounds()) 2533 2524 speculationCheck(OutOfBounds, JSValueRegs(), nullptr, slowCase); 2534 2525 2535 2526 m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg); 2536 2527 m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())); … … 2538 2529 inBounds.link(&m_jit); 2539 2530 } 2540 2541 m_jit.store Double(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));2531 2532 m_jit.storeValue(valueRegs, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 2542 2533 2543 2534 base.use(); … … 2545 2536 value.use(); 2546 2537 storage.use(); 2547 2538 2539 if (arrayMode.isOutOfBounds()) { 2540 addSlowPathGenerator(slowPathCall( 2541 slowCase, this, 2542 node->ecmaMode().isStrict() ? 2543 (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsStrict) : 2544 (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsNonStrict : operationPutByValBeyondArrayBoundsNonStrict), 2545 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueRegs)); 2546 } 2547 2548 noResult(node, UseChildrenCalledExplicitly); 2549 } 2550 2551 void SpeculativeJIT::compileDoublePutByVal(Node* node) 2552 { 2553 ArrayMode arrayMode = node->arrayMode(); 2554 2555 SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0)); 2556 SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1)); 2557 SpeculateDoubleOperand value(this, m_jit.graph().varArgChild(node, 2)); 2558 2559 GPRReg baseReg = base.gpr(); 2560 GPRReg propertyReg = property.gpr(); 2561 FPRReg valueReg = value.fpr(); 2562 2563 DFG_TYPE_CHECK( 2564 JSValueRegs(), m_jit.graph().varArgChild(node, 2), SpecFullRealNumber, 2565 m_jit.branchIfNaN(valueReg)); 2566 2567 if (!m_compileOkay) 2568 return; 2569 2570 StorageOperand storage(this, m_jit.graph().varArgChild(node, 3)); 2571 GPRReg storageReg = storage.gpr(); 2572 2573 if (node->op() == PutByValAlias) { 2574 // Store the value to the array. 2575 GPRReg propertyReg = property.gpr(); 2576 FPRReg valueReg = value.fpr(); 2577 m_jit.storeDouble(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 2578 2579 noResult(m_currentNode); 2580 return; 2581 } 2582 2583 GPRTemporary temporary; 2584 GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node); 2585 2586 MacroAssembler::Jump slowCase; 2587 2588 if (arrayMode.isInBounds()) { 2589 speculationCheck( 2590 OutOfBounds, JSValueRegs(), nullptr, 2591 m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()))); 2592 } else { 2593 MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())); 2594 2595 slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())); 2596 2597 if (!arrayMode.isOutOfBounds()) 2598 speculationCheck(OutOfBounds, JSValueRegs(), nullptr, slowCase); 2599 2600 m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg); 2601 m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())); 2602 2603 inBounds.link(&m_jit); 2604 } 2605 2606 m_jit.storeDouble(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 2607 2608 base.use(); 2609 property.use(); 2610 value.use(); 2611 storage.use(); 2612 2548 2613 if (arrayMode.isOutOfBounds()) { 2549 2614 addSlowPathGenerator( 2550 2615 slowPathCall( 2551 2616 slowCase, this, 2552 node->ecmaMode().isStrict() 2553 ? (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsStrict)2554 :(node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict),2617 node->ecmaMode().isStrict() ? 2618 (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsStrict) : 2619 (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict), 2555 2620 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueReg)); 2556 2621 } 2557 2622 2558 2623 noResult(m_currentNode, UseChildrenCalledExplicitly); 2624 } 2625 2626 void SpeculativeJIT::compilePutByVal(Node* node) 2627 { 2628 ArrayMode arrayMode = node->arrayMode().modeForPut(); 2629 switch (arrayMode.type()) { 2630 case Array::AnyTypedArray: 2631 case Array::ForceExit: 2632 case Array::SelectUsingArguments: 2633 case Array::SelectUsingPredictions: 2634 case Array::Unprofiled: 2635 case Array::String: 2636 case Array::DirectArguments: 2637 case Array::ScopedArguments: 2638 case Array::Undecided: 2639 #if USE(JSVALUE32_64) 2640 case Array::BigInt64Array: 2641 case Array::BigUint64Array: 2642 #endif 2643 DFG_CRASH(m_jit.graph(), node, "Bad array mode type"); 2644 break; 2645 #if USE(JSVALUE64) 2646 case Array::BigInt64Array: 2647 case Array::BigUint64Array: 2648 #endif 2649 case Array::Generic: { 2650 DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal || node->op() == PutByValDirect, node->op()); 2651 if (m_graph.m_slowPutByVal.contains(node)) { 2652 if (m_jit.graph().varArgChild(node, 0).useKind() == CellUse) { 2653 if (m_jit.graph().varArgChild(node, 1).useKind() == StringUse) { 2654 compilePutByValForCellWithString(node); 2655 break; 2656 } 2657 2658 if (m_jit.graph().varArgChild(node, 1).useKind() == SymbolUse) { 2659 compilePutByValForCellWithSymbol(node); 2660 break; 2661 } 2662 } 2663 2664 JSValueOperand base(this, m_jit.graph().varArgChild(node, 0)); 2665 JSValueOperand property(this, m_jit.graph().varArgChild(node, 1)); 2666 JSValueOperand value(this, m_jit.graph().varArgChild(node, 2)); 2667 JSValueRegs baseRegs = base.jsValueRegs(); 2668 JSValueRegs propertyRegs = property.jsValueRegs(); 2669 JSValueRegs valueRegs = value.jsValueRegs(); 2670 2671 flushRegisters(); 2672 if (node->op() == PutByValDirect) 2673 callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs); 2674 else 2675 callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs); 2676 m_jit.exceptionCheck(); 2677 2678 noResult(node); 2679 break; 2680 } 2681 2682 JSValueOperand base(this, m_jit.graph().varArgChild(node, 0), ManualOperandSpeculation); 2683 JSValueOperand property(this, m_jit.graph().varArgChild(node, 1), ManualOperandSpeculation); 2684 JSValueOperand value(this, m_jit.graph().varArgChild(node, 2), ManualOperandSpeculation); 2685 JSValueRegs baseRegs = base.jsValueRegs(); 2686 JSValueRegs propertyRegs = property.jsValueRegs(); 2687 JSValueRegs valueRegs = value.jsValueRegs(); 2688 2689 GPRReg stubInfoGPR = InvalidGPRReg; 2690 GPRTemporary stubInfo; 2691 if (JITCode::useDataIC(JITType::DFGJIT)) { 2692 stubInfo = GPRTemporary(this); 2693 stubInfoGPR = stubInfo.gpr(); 2694 } 2695 2696 speculate(node, m_jit.graph().varArgChild(node, 0)); 2697 speculate(node, m_jit.graph().varArgChild(node, 1)); 2698 speculate(node, m_jit.graph().varArgChild(node, 2)); 2699 2700 CodeOrigin codeOrigin = node->origin.semantic; 2701 CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size()); 2702 RegisterSet usedRegisters = this->usedRegisters(); 2703 bool isDirect = node->op() == PutByValDirect; 2704 ECMAMode ecmaMode = node->ecmaMode(); 2705 2706 JITPutByValGenerator gen( 2707 m_jit.codeBlock(), &m_jit.jitCode()->common.m_stubInfos, JITType::DFGJIT, codeOrigin, callSite, AccessType::PutByVal, usedRegisters, 2708 baseRegs, propertyRegs, valueRegs, InvalidGPRReg, stubInfoGPR); 2709 2710 if (m_state.forNode(m_jit.graph().varArgChild(node, 1)).isType(SpecString)) 2711 gen.stubInfo()->propertyIsString = true; 2712 else if (m_state.forNode(m_jit.graph().varArgChild(node, 1)).isType(SpecInt32Only)) 2713 gen.stubInfo()->propertyIsInt32 = true; 2714 else if (m_state.forNode(m_jit.graph().varArgChild(node, 1)).isType(SpecSymbol)) 2715 gen.stubInfo()->propertyIsSymbol = true; 2716 2717 gen.generateFastPath(m_jit); 2718 2719 JITCompiler::JumpList slowCases; 2720 if (!JITCode::useDataIC(JITType::DFGJIT)) 2721 slowCases.append(gen.slowPathJump()); 2722 2723 std::unique_ptr<SlowPathGenerator> slowPath; 2724 auto operation = isDirect ? (ecmaMode.isStrict() ? operationDirectPutByValStrictOptimize : operationDirectPutByValNonStrictOptimize) : (ecmaMode.isStrict() ? operationPutByValStrictOptimize : operationPutByValNonStrictOptimize); 2725 if (JITCode::useDataIC(JITType::DFGJIT)) { 2726 slowPath = slowPathICCall( 2727 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operation, 2728 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, stubInfoGPR, nullptr); 2729 } else { 2730 slowPath = slowPathCall( 2731 slowCases, this, operation, 2732 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, gen.stubInfo(), nullptr); 2733 } 2734 2735 m_jit.addPutByVal(gen, slowPath.get()); 2736 addSlowPathGenerator(WTFMove(slowPath)); 2737 2738 noResult(node); 2739 break; 2740 } 2741 case Array::Int32: { 2742 speculateInt32(m_jit.graph().varArgChild(node, 2)); 2743 FALLTHROUGH; 2744 } 2745 case Array::Contiguous: { 2746 compileContiguousPutByVal(node); 2747 break; 2748 } 2749 case Array::Double: { 2750 compileDoublePutByVal(node); 2751 break; 2752 } 2753 case Array::ArrayStorage: 2754 case Array::SlowPutArrayStorage: { 2755 SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0)); 2756 SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1)); 2757 JSValueOperand value(this, m_jit.graph().varArgChild(node, 2)); 2758 StorageOperand storage(this, m_jit.graph().varArgChild(node, 3)); 2759 2760 GPRReg baseReg = base.gpr(); 2761 GPRReg propertyReg = property.gpr(); 2762 JSValueRegs valueRegs = value.jsValueRegs(); 2763 GPRReg storageReg = storage.gpr(); 2764 2765 if (node->op() == PutByValAlias) { 2766 // Store the value to the array. 2767 GPRReg propertyReg = property.gpr(); 2768 m_jit.storeValue(valueRegs, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset())); 2769 noResult(node); 2770 break; 2771 } 2772 2773 GPRTemporary temporary; 2774 GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node); 2775 2776 MacroAssembler::JumpList slowCases; 2777 2778 MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())); 2779 if (!arrayMode.isOutOfBounds()) 2780 speculationCheck(OutOfBounds, JSValueRegs(), nullptr, beyondArrayBounds); 2781 else 2782 slowCases.append(beyondArrayBounds); 2783 2784 // Check if we're writing to a hole; if so increment m_numValuesInVector. 2785 if (arrayMode.isInBounds()) { 2786 speculationCheck( 2787 StoreToHole, JSValueRegs(), nullptr, 2788 m_jit.branchIfEmpty(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset()))); 2789 } else { 2790 MacroAssembler::Jump notHoleValue = m_jit.branchIfNotEmpty(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset())); 2791 if (arrayMode.isSlowPut()) { 2792 // This is sort of strange. If we wanted to optimize this code path, we would invert 2793 // the above branch. But it's simply not worth it since this only happens if we're 2794 // already having a bad time. 2795 slowCases.append(m_jit.jump()); 2796 } else { 2797 m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset())); 2798 2799 // If we're writing to a hole we might be growing the array; 2800 MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset())); 2801 m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg); 2802 m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset())); 2803 2804 lengthDoesNotNeedUpdate.link(&m_jit); 2805 } 2806 notHoleValue.link(&m_jit); 2807 } 2808 2809 // Store the value to the array. 2810 m_jit.storeValue(valueRegs, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset())); 2811 2812 base.use(); 2813 property.use(); 2814 value.use(); 2815 storage.use(); 2816 2817 if (!slowCases.empty()) { 2818 addSlowPathGenerator(slowPathCall( 2819 slowCases, this, 2820 node->ecmaMode().isStrict() ? 2821 (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsStrict) : 2822 (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsNonStrict : operationPutByValBeyondArrayBoundsNonStrict), 2823 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueRegs)); 2824 } 2825 2826 noResult(node, UseChildrenCalledExplicitly); 2827 break; 2828 } 2829 case Array::Int8Array: 2830 case Array::Int16Array: 2831 case Array::Int32Array: 2832 case Array::Uint8Array: 2833 case Array::Uint8ClampedArray: 2834 case Array::Uint16Array: 2835 case Array::Uint32Array: 2836 case Array::Float32Array: 2837 case Array::Float64Array: { 2838 TypedArrayType type = arrayMode.typedArrayType(); 2839 if (isInt(type)) 2840 compilePutByValForIntTypedArray(node, type); 2841 else 2842 compilePutByValForFloatTypedArray(node, type); 2843 } } 2559 2844 } 2560 2845 … … 3568 3853 } 3569 3854 3570 void SpeculativeJIT::compilePutByValForIntTypedArray( GPRReg base, GPRReg property,Node* node, TypedArrayType type)3855 void SpeculativeJIT::compilePutByValForIntTypedArray(Node* node, TypedArrayType type) 3571 3856 { 3572 3857 ASSERT(isInt(type)); 3573 3858 3859 SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0)); 3860 SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1)); 3574 3861 StorageOperand storage(this, m_jit.graph().varArgChild(node, 3)); 3862 3575 3863 GPRTemporary scratch(this); 3576 3864 GPRReg storageReg = storage.gpr(); 3577 3578 Edge valueUse = m_jit.graph().varArgChild(node, 2);3579 3865 GPRReg baseReg = base.gpr(); 3866 GPRReg propertyReg = property.gpr(); 3867 3580 3868 GPRTemporary value; 3581 3869 #if USE(JSVALUE32_64) … … 3585 3873 3586 3874 JITCompiler::JumpList slowPathCases; 3587 3875 3588 3876 bool result = getIntTypedArrayStoreOperand( 3589 value, property ,3877 value, propertyReg, 3590 3878 #if USE(JSVALUE32_64) 3591 3879 propertyTag, valueTag, 3592 3880 #endif 3593 valueUse, slowPathCases, isClamped(type));3881 m_jit.graph().varArgChild(node, 2), slowPathCases, isClamped(type)); 3594 3882 if (!result) { 3595 3883 noResult(node); … … 3603 3891 #endif 3604 3892 3605 ASSERT_UNUSED(valueGPR, valueGPR != property );3606 ASSERT(valueGPR != base );3893 ASSERT_UNUSED(valueGPR, valueGPR != propertyReg); 3894 ASSERT(valueGPR != baseReg); 3607 3895 ASSERT(valueGPR != storageReg); 3608 JITCompiler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, base , property, scratch.gpr());3896 JITCompiler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, baseReg, propertyReg, scratch.gpr()); 3609 3897 3610 3898 switch (elementSize(type)) { 3611 3899 case 1: 3612 m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property , MacroAssembler::TimesOne));3900 m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne)); 3613 3901 break; 3614 3902 case 2: 3615 m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, property , MacroAssembler::TimesTwo));3903 m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo)); 3616 3904 break; 3617 3905 case 4: 3618 m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, property , MacroAssembler::TimesFour));3906 m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour)); 3619 3907 break; 3620 3908 default: … … 3622 3910 } 3623 3911 3624 JITCompiler::Jump done = jumpForTypedArrayIsDetachedIfOutOfBounds(node, base , outOfBounds);3912 JITCompiler::Jump done = jumpForTypedArrayIsDetachedIfOutOfBounds(node, baseReg, outOfBounds); 3625 3913 if (done.isSet()) 3626 3914 done.link(&m_jit); 3627 3915 3628 3916 if (!slowPathCases.empty()) { 3917 addSlowPathGenerator(slowPathCall( 3918 slowPathCases, this, 3919 node->ecmaMode().isStrict() ? 3920 (node->op() == PutByValDirect ? operationPutByValDirectStrict : operationPutByValStrict) : 3921 (node->op() == PutByValDirect ? operationPutByValDirectNonStrict : operationPutByValNonStrict), 3629 3922 #if USE(JSVALUE64) 3630 if (node->op() == PutByValDirect) { 3631 addSlowPathGenerator(slowPathCall( 3632 slowPathCases, this, 3633 node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, 3634 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), base, property, valueGPR)); 3635 } else { 3636 addSlowPathGenerator(slowPathCall( 3637 slowPathCases, this, 3638 node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, 3639 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), base, property, valueGPR)); 3640 } 3923 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueGPR)); 3641 3924 #else // not USE(JSVALUE64) 3642 if (node->op() == PutByValDirect) { 3643 addSlowPathGenerator(slowPathCall( 3644 slowPathCases, this, 3645 node->ecmaMode().isStrict() ? operationPutByValDirectCellStrict : operationPutByValDirectCellNonStrict, 3646 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), base, JSValueRegs(propertyTagGPR, property), JSValueRegs(valueTagGPR, valueGPR))); 3647 } else { 3648 addSlowPathGenerator(slowPathCall( 3649 slowPathCases, this, 3650 node->ecmaMode().isStrict() ? operationPutByValCellStrict : operationPutByValCellNonStrict, 3651 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), base, JSValueRegs(propertyTagGPR, property), JSValueRegs(valueTagGPR, valueGPR))); 3652 } 3925 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseReg), JSValueRegs(propertyTagGPR, propertyReg), JSValueRegs(valueTagGPR, valueGPR))); 3653 3926 #endif 3654 3927 } 3655 3928 3656 3929 noResult(node); 3657 3930 } … … 3700 3973 } 3701 3974 3702 void SpeculativeJIT::compilePutByValForFloatTypedArray( GPRReg base, GPRReg property,Node* node, TypedArrayType type)3975 void SpeculativeJIT::compilePutByValForFloatTypedArray(Node* node, TypedArrayType type) 3703 3976 { 3704 3977 ASSERT(isFloat(type)); 3705 3978 3979 SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0)); 3980 SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1)); 3981 SpeculateDoubleOperand valueOp(this, m_jit.graph().varArgChild(node, 2)); 3706 3982 StorageOperand storage(this, m_jit.graph().varArgChild(node, 3)); 3707 GPRReg storageReg = storage.gpr(); 3708 3709 Edge valueUse = m_jit.graph().varArgChild(node, 2); 3710 3711 SpeculateDoubleOperand valueOp(this, valueUse); 3983 3712 3984 FPRTemporary scratch(this); 3713 3985 GPRTemporary gpScratch(this); 3714 3986 FPRReg valueFPR = valueOp.fpr(); 3715 3987 FPRReg scratchFPR = scratch.fpr(); 3988 GPRReg baseReg = base.gpr(); 3989 GPRReg propertyReg = property.gpr(); 3716 3990 GPRReg scratchGPR = gpScratch.gpr(); 3717 3718 MacroAssembler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, base, property, scratchGPR); 3719 3991 GPRReg storageReg = storage.gpr(); 3992 3993 MacroAssembler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, baseReg, propertyReg, scratchGPR); 3720 3994 switch (elementSize(type)) { 3721 3995 case 4: { 3722 3996 m_jit.moveDouble(valueFPR, scratchFPR); 3723 3997 m_jit.convertDoubleToFloat(valueFPR, scratchFPR); 3724 m_jit.storeFloat(scratchFPR, MacroAssembler::BaseIndex(storageReg, property , MacroAssembler::TimesFour));3998 m_jit.storeFloat(scratchFPR, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour)); 3725 3999 break; 3726 4000 } 3727 4001 case 8: 3728 m_jit.storeDouble(valueFPR, MacroAssembler::BaseIndex(storageReg, property , MacroAssembler::TimesEight));4002 m_jit.storeDouble(valueFPR, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 3729 4003 break; 3730 4004 default: … … 3732 4006 } 3733 4007 3734 JITCompiler::Jump done = jumpForTypedArrayIsDetachedIfOutOfBounds(node, base , outOfBounds);4008 JITCompiler::Jump done = jumpForTypedArrayIsDetachedIfOutOfBounds(node, baseReg, outOfBounds); 3735 4009 if (done.isSet()) 3736 4010 done.link(&m_jit); … … 3920 4194 } 3921 4195 3922 void SpeculativeJIT::compilePutByValForCellWithString(Node* node , Edge& child1, Edge& child2, Edge& child3)3923 { 3924 SpeculateCellOperand arg1(this, child1);3925 SpeculateCellOperand arg2(this, child2);3926 JSValueOperand arg3(this, child3);4196 void SpeculativeJIT::compilePutByValForCellWithString(Node* node) 4197 { 4198 SpeculateCellOperand arg1(this, m_jit.graph().varArgChild(node, 0)); 4199 SpeculateCellOperand arg2(this, m_jit.graph().varArgChild(node, 1)); 4200 JSValueOperand arg3(this, m_jit.graph().varArgChild(node, 2)); 3927 4201 3928 4202 GPRReg arg1GPR = arg1.gpr(); … … 3930 4204 JSValueRegs arg3Regs = arg3.jsValueRegs(); 3931 4205 3932 speculateString( child2, arg2GPR);4206 speculateString(m_jit.graph().varArgChild(node, 1), arg2GPR); 3933 4207 3934 4208 flushRegisters(); 3935 4209 callOperation( 3936 node->ecmaMode().isStrict() 3937 ? (node->op() == PutByValDirect ? operationPutByValDirectCellStringStrict : operationPutByValCellStringStrict)3938 :(node->op() == PutByValDirect ? operationPutByValDirectCellStringNonStrict : operationPutByValCellStringNonStrict),4210 node->ecmaMode().isStrict() ? 4211 (node->op() == PutByValDirect ? operationPutByValDirectCellStringStrict : operationPutByValCellStringStrict) : 4212 (node->op() == PutByValDirect ? operationPutByValDirectCellStringNonStrict : operationPutByValCellStringNonStrict), 3939 4213 TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3Regs); 3940 4214 m_jit.exceptionCheck(); … … 3943 4217 } 3944 4218 3945 void SpeculativeJIT::compilePutByValForCellWithSymbol(Node* node , Edge& child1, Edge& child2, Edge& child3)3946 { 3947 SpeculateCellOperand arg1(this, child1);3948 SpeculateCellOperand arg2(this, child2);3949 JSValueOperand arg3(this, child3);4219 void SpeculativeJIT::compilePutByValForCellWithSymbol(Node* node) 4220 { 4221 SpeculateCellOperand arg1(this, m_jit.graph().varArgChild(node, 0)); 4222 SpeculateCellOperand arg2(this, m_jit.graph().varArgChild(node, 1)); 4223 JSValueOperand arg3(this, m_jit.graph().varArgChild(node, 2)); 3950 4224 3951 4225 GPRReg arg1GPR = arg1.gpr(); … … 3953 4227 JSValueRegs arg3Regs = arg3.jsValueRegs(); 3954 4228 3955 speculateSymbol( child2, arg2GPR);4229 speculateSymbol(m_jit.graph().varArgChild(node, 1), arg2GPR); 3956 4230 3957 4231 flushRegisters(); -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
r284851 r285530 1343 1343 void compileIdentity(Node*); 1344 1344 1345 #if USE(JSVALUE32_64) 1346 template<typename BaseOperandType, typename PropertyOperandType, typename ValueOperandType, typename TagType> 1347 void compileContiguousPutByVal(Node*, BaseOperandType&, PropertyOperandType&, ValueOperandType&, GPRReg valuePayloadReg, TagType valueTag); 1348 #endif 1349 void compileDoublePutByVal(Node*, SpeculateCellOperand& base, SpeculateStrictInt32Operand& property); 1345 void compileContiguousPutByVal(Node*); 1346 void compileDoublePutByVal(Node*); 1350 1347 bool putByValWillNeedExtraRegister(ArrayMode arrayMode) 1351 1348 { … … 1358 1355 } 1359 1356 1357 void compilePutByVal(Node*); 1358 1360 1359 // We use a scopedLambda to placate register allocation validation. 1361 1360 enum class CanUseFlush { Yes, No }; … … 1448 1447 #endif 1449 1448 void compileGetByValOnIntTypedArray(Node*, TypedArrayType, const ScopedLambda<std::tuple<JSValueRegs, DataFormat, CanUseFlush>(DataFormat preferredFormat)>& prefix); 1450 void compilePutByValForIntTypedArray( GPRReg base, GPRReg property,Node*, TypedArrayType);1449 void compilePutByValForIntTypedArray(Node*, TypedArrayType); 1451 1450 void compileGetByValOnFloatTypedArray(Node*, TypedArrayType, const ScopedLambda<std::tuple<JSValueRegs, DataFormat, CanUseFlush>(DataFormat preferredFormat)>& prefix); 1452 void compilePutByValForFloatTypedArray( GPRReg base, GPRReg property,Node*, TypedArrayType);1451 void compilePutByValForFloatTypedArray(Node*, TypedArrayType); 1453 1452 void compileGetByValForObjectWithString(Node*, const ScopedLambda<std::tuple<JSValueRegs, DataFormat, CanUseFlush>(DataFormat preferredFormat)>& prefix); 1454 1453 void compileGetByValForObjectWithSymbol(Node*, const ScopedLambda<std::tuple<JSValueRegs, DataFormat, CanUseFlush>(DataFormat preferredFormat)>& prefix); 1455 void compilePutByValForCellWithString(Node* , Edge& child1, Edge& child2, Edge& child3);1456 void compilePutByValForCellWithSymbol(Node* , Edge& child1, Edge& child2, Edge& child3);1454 void compilePutByValForCellWithString(Node*); 1455 void compilePutByValForCellWithSymbol(Node*); 1457 1456 void compileGetByValWithThis(Node*); 1458 1457 void compilePutPrivateName(Node*); -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
r285078 r285530 1747 1747 } 1748 1748 1749 template<typename BaseOperandType, typename PropertyOperandType, typename ValueOperandType, typename TagType>1750 void SpeculativeJIT::compileContiguousPutByVal(Node* node, BaseOperandType& base, PropertyOperandType& property, ValueOperandType& value, GPRReg valuePayloadReg, TagType valueTag)1751 {1752 Edge child4 = m_jit.graph().varArgChild(node, 3);1753 1754 ArrayMode arrayMode = node->arrayMode();1755 1756 GPRReg baseReg = base.gpr();1757 GPRReg propertyReg = property.gpr();1758 1759 StorageOperand storage(this, child4);1760 GPRReg storageReg = storage.gpr();1761 1762 if (node->op() == PutByValAlias) {1763 // Store the value to the array.1764 GPRReg propertyReg = property.gpr();1765 m_jit.store32(valueTag, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));1766 m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));1767 1768 noResult(node);1769 return;1770 }1771 1772 MacroAssembler::Jump slowCase;1773 1774 if (arrayMode.isInBounds()) {1775 speculationCheck(1776 OutOfBounds, JSValueRegs(), 0,1777 m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));1778 } else {1779 MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));1780 1781 slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength()));1782 1783 if (!arrayMode.isOutOfBounds())1784 speculationCheck(OutOfBounds, JSValueRegs(), 0, slowCase);1785 1786 m_jit.add32(TrustedImm32(1), propertyReg);1787 m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));1788 m_jit.sub32(TrustedImm32(1), propertyReg);1789 1790 inBounds.link(&m_jit);1791 }1792 1793 m_jit.store32(valueTag, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));1794 m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));1795 1796 base.use();1797 property.use();1798 value.use();1799 storage.use();1800 1801 if (arrayMode.isOutOfBounds()) {1802 if (node->op() == PutByValDirect) {1803 addSlowPathGenerator(slowPathCall(1804 slowCase, this,1805 node->ecmaMode().isStrict() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,1806 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, JSValueRegs(valueTag, valuePayloadReg)));1807 } else {1808 addSlowPathGenerator(slowPathCall(1809 slowCase, this,1810 node->ecmaMode().isStrict() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,1811 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, JSValueRegs(valueTag, valuePayloadReg)));1812 }1813 }1814 1815 noResult(node, UseChildrenCalledExplicitly);1816 }1817 1818 1749 void SpeculativeJIT::compileGetByVal(Node* node, const ScopedLambda<std::tuple<JSValueRegs, DataFormat, CanUseFlush>(DataFormat preferredFormat)>& prefix) 1819 1750 { … … 2713 2644 case PutByVal: 2714 2645 case PutByValAlias: { 2715 Edge child1 = m_jit.graph().varArgChild(node, 0); 2716 Edge child2 = m_jit.graph().varArgChild(node, 1); 2717 Edge child3 = m_jit.graph().varArgChild(node, 2); 2718 Edge child4 = m_jit.graph().varArgChild(node, 3); 2719 2720 ArrayMode arrayMode = node->arrayMode().modeForPut(); 2721 bool alreadyHandled = false; 2722 2723 switch (arrayMode.type()) { 2724 case Array::SelectUsingPredictions: 2725 case Array::ForceExit: 2726 RELEASE_ASSERT_NOT_REACHED(); 2727 #if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE) 2728 terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0); 2729 alreadyHandled = true; 2730 #endif 2731 break; 2732 case Array::Generic: { 2733 ASSERT(node->op() == PutByVal || node->op() == PutByValDirect); 2734 if (m_graph.m_slowPutByVal.contains(node)) { 2735 if (child1.useKind() == CellUse) { 2736 if (child2.useKind() == StringUse) { 2737 compilePutByValForCellWithString(node, child1, child2, child3); 2738 alreadyHandled = true; 2739 break; 2740 } 2741 2742 if (child2.useKind() == SymbolUse) { 2743 compilePutByValForCellWithSymbol(node, child1, child2, child3); 2744 alreadyHandled = true; 2745 break; 2746 } 2747 } 2748 2749 JSValueOperand base(this, child1); 2750 JSValueOperand property(this, child2); 2751 JSValueOperand value(this, child3); 2752 JSValueRegs baseRegs = base.jsValueRegs(); 2753 JSValueRegs propertyRegs = property.jsValueRegs(); 2754 JSValueRegs valueRegs = value.jsValueRegs(); 2755 2756 flushRegisters(); 2757 if (node->op() == PutByValDirect) 2758 callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs); 2759 else 2760 callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs); 2761 m_jit.exceptionCheck(); 2762 2763 noResult(node); 2764 alreadyHandled = true; 2765 break; 2766 } 2767 2768 JSValueOperand base(this, child1, ManualOperandSpeculation); 2769 JSValueOperand property(this, child2, ManualOperandSpeculation); 2770 JSValueOperand value(this, child3, ManualOperandSpeculation); 2771 JSValueRegs baseRegs = base.jsValueRegs(); 2772 JSValueRegs propertyRegs = property.jsValueRegs(); 2773 JSValueRegs valueRegs = value.jsValueRegs(); 2774 2775 speculate(node, child1); 2776 speculate(node, child2); 2777 speculate(node, child3); 2778 2779 CodeOrigin codeOrigin = node->origin.semantic; 2780 CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size()); 2781 RegisterSet usedRegisters = this->usedRegisters(); 2782 bool isDirect = node->op() == PutByValDirect; 2783 ECMAMode ecmaMode = node->ecmaMode(); 2784 2785 JITPutByValGenerator gen( 2786 m_jit.codeBlock(), &m_jit.jitCode()->common.m_stubInfos, JITType::DFGJIT, codeOrigin, callSite, AccessType::PutByVal, usedRegisters, 2787 baseRegs, propertyRegs, valueRegs, InvalidGPRReg, InvalidGPRReg); 2788 2789 if (m_state.forNode(child2).isType(SpecString)) 2790 gen.stubInfo()->propertyIsString = true; 2791 else if (m_state.forNode(child2).isType(SpecInt32Only)) 2792 gen.stubInfo()->propertyIsInt32 = true; 2793 else if (m_state.forNode(child2).isType(SpecSymbol)) 2794 gen.stubInfo()->propertyIsSymbol = true; 2795 2796 gen.generateFastPath(m_jit); 2797 2798 JITCompiler::JumpList slowCases; 2799 slowCases.append(gen.slowPathJump()); 2800 2801 std::unique_ptr<SlowPathGenerator> slowPath; 2802 auto operation = isDirect ? (ecmaMode.isStrict() ? operationDirectPutByValStrictOptimize : operationDirectPutByValNonStrictOptimize) : (ecmaMode.isStrict() ? operationPutByValStrictOptimize : operationPutByValNonStrictOptimize); 2803 slowPath = slowPathCall( 2804 slowCases, this, operation, 2805 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, gen.stubInfo(), nullptr); 2806 2807 m_jit.addPutByVal(gen, slowPath.get()); 2808 addSlowPathGenerator(WTFMove(slowPath)); 2809 2810 noResult(node); 2811 alreadyHandled = true; 2812 break; 2813 } 2814 default: 2815 break; 2816 } 2817 2818 if (alreadyHandled) 2819 break; 2820 2821 SpeculateCellOperand base(this, child1); 2822 SpeculateStrictInt32Operand property(this, child2); 2823 2824 GPRReg baseReg = base.gpr(); 2825 GPRReg propertyReg = property.gpr(); 2826 2827 switch (arrayMode.type()) { 2828 case Array::Int32: { 2829 speculateInt32(child3); 2830 FALLTHROUGH; 2831 } 2832 case Array::Contiguous: { 2833 JSValueOperand value(this, child3, ManualOperandSpeculation); 2834 2835 GPRReg valueTagReg = value.tagGPR(); 2836 GPRReg valuePayloadReg = value.payloadGPR(); 2837 2838 if (!m_compileOkay) 2839 return; 2840 2841 compileContiguousPutByVal(node, base, property, value, valuePayloadReg, valueTagReg); 2842 break; 2843 } 2844 case Array::Double: { 2845 compileDoublePutByVal(node, base, property); 2846 break; 2847 } 2848 case Array::ArrayStorage: 2849 case Array::SlowPutArrayStorage: { 2850 JSValueOperand value(this, child3); 2851 2852 GPRReg valueTagReg = value.tagGPR(); 2853 GPRReg valuePayloadReg = value.payloadGPR(); 2854 2855 if (!m_compileOkay) 2856 return; 2857 2858 StorageOperand storage(this, child4); 2859 GPRReg storageReg = storage.gpr(); 2860 2861 if (node->op() == PutByValAlias) { 2862 // Store the value to the array. 2863 GPRReg propertyReg = property.gpr(); 2864 m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag))); 2865 m_jit.store32(value.payloadGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload))); 2866 2867 noResult(node); 2868 break; 2869 } 2870 2871 MacroAssembler::JumpList slowCases; 2872 2873 MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())); 2874 if (!arrayMode.isOutOfBounds()) 2875 speculationCheck(OutOfBounds, JSValueRegs(), 0, beyondArrayBounds); 2876 else 2877 slowCases.append(beyondArrayBounds); 2878 2879 // Check if we're writing to a hole; if so increment m_numValuesInVector. 2880 if (arrayMode.isInBounds()) { 2881 speculationCheck( 2882 StoreToHole, JSValueRegs(), 0, 2883 m_jit.branch32(MacroAssembler::Equal, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag))); 2884 } else { 2885 MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag)); 2886 if (arrayMode.isSlowPut()) { 2887 // This is sort of strange. If we wanted to optimize this code path, we would invert 2888 // the above branch. But it's simply not worth it since this only happens if we're 2889 // already having a bad time. 2890 slowCases.append(m_jit.jump()); 2891 } else { 2892 m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset())); 2893 2894 // If we're writing to a hole we might be growing the array; 2895 MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset())); 2896 m_jit.add32(TrustedImm32(1), propertyReg); 2897 m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset())); 2898 m_jit.sub32(TrustedImm32(1), propertyReg); 2899 2900 lengthDoesNotNeedUpdate.link(&m_jit); 2901 } 2902 notHoleValue.link(&m_jit); 2903 } 2904 2905 // Store the value to the array. 2906 m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag))); 2907 m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload))); 2908 2909 base.use(); 2910 property.use(); 2911 value.use(); 2912 storage.use(); 2913 2914 if (!slowCases.empty()) { 2915 if (node->op() == PutByValDirect) { 2916 addSlowPathGenerator(slowPathCall( 2917 slowCases, this, 2918 node->ecmaMode().isStrict() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict, 2919 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, JSValueRegs(valueTagReg, valuePayloadReg))); 2920 } else { 2921 addSlowPathGenerator(slowPathCall( 2922 slowCases, this, 2923 node->ecmaMode().isStrict() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict, 2924 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, JSValueRegs(valueTagReg, valuePayloadReg))); 2925 } 2926 } 2927 2928 noResult(node, UseChildrenCalledExplicitly); 2929 break; 2930 } 2931 2932 default: { 2933 TypedArrayType type = arrayMode.typedArrayType(); 2934 if (isInt(type)) 2935 compilePutByValForIntTypedArray(base.gpr(), property.gpr(), node, type); 2936 else 2937 compilePutByValForFloatTypedArray(base.gpr(), property.gpr(), node, type); 2938 } } 2646 compilePutByVal(node); 2939 2647 break; 2940 2648 } -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
r285078 r285530 3335 3335 case PutByVal: 3336 3336 case PutByValAlias: { 3337 Edge child1 = m_jit.graph().varArgChild(node, 0); 3338 Edge child2 = m_jit.graph().varArgChild(node, 1); 3339 Edge child3 = m_jit.graph().varArgChild(node, 2); 3340 Edge child4 = m_jit.graph().varArgChild(node, 3); 3341 3342 ArrayMode arrayMode = node->arrayMode().modeForPut(); 3343 bool alreadyHandled = false; 3344 3345 switch (arrayMode.type()) { 3346 case Array::SelectUsingPredictions: 3347 case Array::ForceExit: 3348 DFG_CRASH(m_jit.graph(), node, "Bad array mode type"); 3349 break; 3350 case Array::BigInt64Array: 3351 case Array::BigUint64Array: 3352 case Array::Generic: { 3353 DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal || node->op() == PutByValDirect, node->op()); 3354 if (m_graph.m_slowPutByVal.contains(node) || (child1.useKind() != CellUse && child1.useKind() != KnownCellUse)) { 3355 if (child1.useKind() == CellUse) { 3356 if (child2.useKind() == StringUse) { 3357 compilePutByValForCellWithString(node, child1, child2, child3); 3358 alreadyHandled = true; 3359 break; 3360 } 3361 3362 if (child2.useKind() == SymbolUse) { 3363 compilePutByValForCellWithSymbol(node, child1, child2, child3); 3364 alreadyHandled = true; 3365 break; 3366 } 3367 } 3368 3369 JSValueOperand arg1(this, child1); 3370 JSValueOperand arg2(this, child2); 3371 JSValueOperand arg3(this, child3); 3372 GPRReg arg1GPR = arg1.gpr(); 3373 GPRReg arg2GPR = arg2.gpr(); 3374 GPRReg arg3GPR = arg3.gpr(); 3375 flushRegisters(); 3376 if (node->op() == PutByValDirect) 3377 callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3GPR); 3378 else 3379 callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3GPR); 3380 m_jit.exceptionCheck(); 3381 3382 noResult(node); 3383 alreadyHandled = true; 3384 break; 3385 } 3386 3387 SpeculateCellOperand base(this, child1); 3388 JSValueOperand property(this, child2, ManualOperandSpeculation); 3389 JSValueOperand value(this, child3, ManualOperandSpeculation); 3390 GPRReg baseGPR = base.gpr(); 3391 GPRReg propertyGPR = property.gpr(); 3392 GPRReg valueGPR = value.gpr(); 3393 3394 GPRTemporary stubInfo; 3395 GPRReg stubInfoGPR = InvalidGPRReg; 3396 if (JITCode::useDataIC(JITType::DFGJIT)) { 3397 stubInfo = GPRTemporary(this); 3398 stubInfoGPR = stubInfo.gpr(); 3399 } 3400 3401 speculate(node, child2); 3402 speculate(node, child3); 3403 3404 CodeOrigin codeOrigin = node->origin.semantic; 3405 CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size()); 3406 RegisterSet usedRegisters = this->usedRegisters(); 3407 bool isDirect = node->op() == PutByValDirect; 3408 ECMAMode ecmaMode = node->ecmaMode(); 3409 3410 JITPutByValGenerator gen( 3411 m_jit.codeBlock(), &m_jit.jitCode()->common.m_stubInfos, JITType::DFGJIT, codeOrigin, callSite, AccessType::PutByVal, usedRegisters, 3412 JSValueRegs(baseGPR), JSValueRegs(propertyGPR), JSValueRegs(valueGPR), InvalidGPRReg, stubInfoGPR); 3413 3414 if (m_state.forNode(child2).isType(SpecString)) 3415 gen.stubInfo()->propertyIsString = true; 3416 else if (m_state.forNode(child2).isType(SpecInt32Only)) 3417 gen.stubInfo()->propertyIsInt32 = true; 3418 else if (m_state.forNode(child2).isType(SpecSymbol)) 3419 gen.stubInfo()->propertyIsSymbol = true; 3420 3421 gen.generateFastPath(m_jit); 3422 3423 JITCompiler::JumpList slowCases; 3424 if (!JITCode::useDataIC(JITType::DFGJIT)) 3425 slowCases.append(gen.slowPathJump()); 3426 3427 std::unique_ptr<SlowPathGenerator> slowPath; 3428 auto operation = isDirect ? (ecmaMode.isStrict() ? operationDirectPutByValStrictOptimize : operationDirectPutByValNonStrictOptimize) : (ecmaMode.isStrict() ? operationPutByValStrictOptimize : operationPutByValNonStrictOptimize); 3429 if (JITCode::useDataIC(JITType::DFGJIT)) { 3430 slowPath = slowPathICCall( 3431 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operation, 3432 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseGPR, propertyGPR, valueGPR, stubInfoGPR, nullptr); 3433 } else { 3434 slowPath = slowPathCall( 3435 slowCases, this, operation, 3436 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseGPR, propertyGPR, valueGPR, gen.stubInfo(), nullptr); 3437 } 3438 3439 m_jit.addPutByVal(gen, slowPath.get()); 3440 addSlowPathGenerator(WTFMove(slowPath)); 3441 3442 noResult(node); 3443 alreadyHandled = true; 3444 break; 3445 } 3446 default: 3447 break; 3448 } 3449 3450 if (alreadyHandled) 3451 break; 3452 3453 SpeculateCellOperand base(this, child1); 3454 SpeculateStrictInt32Operand property(this, child2); 3455 3456 GPRReg baseReg = base.gpr(); 3457 GPRReg propertyReg = property.gpr(); 3458 3459 switch (arrayMode.type()) { 3460 case Array::Int32: 3461 case Array::Contiguous: { 3462 JSValueOperand value(this, child3, ManualOperandSpeculation); 3463 3464 GPRReg valueReg = value.gpr(); 3465 3466 if (!m_compileOkay) 3467 return; 3468 3469 if (arrayMode.type() == Array::Int32) { 3470 DFG_TYPE_CHECK( 3471 JSValueRegs(valueReg), child3, SpecInt32Only, 3472 m_jit.branchIfNotInt32(valueReg)); 3473 } 3474 3475 StorageOperand storage(this, child4); 3476 GPRReg storageReg = storage.gpr(); 3477 3478 if (node->op() == PutByValAlias) { 3479 // Store the value to the array. 3480 GPRReg propertyReg = property.gpr(); 3481 GPRReg valueReg = value.gpr(); 3482 m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 3483 3484 noResult(node); 3485 break; 3486 } 3487 3488 GPRTemporary temporary; 3489 GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node); 3490 3491 MacroAssembler::Jump slowCase; 3492 3493 if (arrayMode.isInBounds()) { 3494 speculationCheck( 3495 OutOfBounds, JSValueRegs(), nullptr, 3496 m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()))); 3497 } else { 3498 MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())); 3499 3500 slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())); 3501 3502 if (!arrayMode.isOutOfBounds()) 3503 speculationCheck(OutOfBounds, JSValueRegs(), nullptr, slowCase); 3504 3505 m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg); 3506 m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())); 3507 3508 inBounds.link(&m_jit); 3509 } 3510 3511 m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight)); 3512 3513 base.use(); 3514 property.use(); 3515 value.use(); 3516 storage.use(); 3517 3518 if (arrayMode.isOutOfBounds()) { 3519 addSlowPathGenerator(slowPathCall( 3520 slowCase, this, 3521 node->ecmaMode().isStrict() 3522 ? (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsStrict) 3523 : (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsNonStrict : operationPutByValBeyondArrayBoundsNonStrict), 3524 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueReg)); 3525 } 3526 3527 noResult(node, UseChildrenCalledExplicitly); 3528 break; 3529 } 3530 3531 case Array::Double: { 3532 compileDoublePutByVal(node, base, property); 3533 break; 3534 } 3535 3536 case Array::ArrayStorage: 3537 case Array::SlowPutArrayStorage: { 3538 JSValueOperand value(this, child3); 3539 3540 GPRReg valueReg = value.gpr(); 3541 3542 if (!m_compileOkay) 3543 return; 3544 3545 StorageOperand storage(this, child4); 3546 GPRReg storageReg = storage.gpr(); 3547 3548 if (node->op() == PutByValAlias) { 3549 // Store the value to the array. 3550 GPRReg propertyReg = property.gpr(); 3551 GPRReg valueReg = value.gpr(); 3552 m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset())); 3553 3554 noResult(node); 3555 break; 3556 } 3557 3558 GPRTemporary temporary; 3559 GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node); 3560 3561 MacroAssembler::JumpList slowCases; 3562 3563 MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())); 3564 if (!arrayMode.isOutOfBounds()) 3565 speculationCheck(OutOfBounds, JSValueRegs(), nullptr, beyondArrayBounds); 3566 else 3567 slowCases.append(beyondArrayBounds); 3568 3569 // Check if we're writing to a hole; if so increment m_numValuesInVector. 3570 if (arrayMode.isInBounds()) { 3571 speculationCheck( 3572 StoreToHole, JSValueRegs(), nullptr, 3573 m_jit.branchTest64(MacroAssembler::Zero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset()))); 3574 } else { 3575 MacroAssembler::Jump notHoleValue = m_jit.branchTest64(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset())); 3576 if (arrayMode.isSlowPut()) { 3577 // This is sort of strange. If we wanted to optimize this code path, we would invert 3578 // the above branch. But it's simply not worth it since this only happens if we're 3579 // already having a bad time. 3580 slowCases.append(m_jit.jump()); 3581 } else { 3582 m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset())); 3583 3584 // If we're writing to a hole we might be growing the array; 3585 MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset())); 3586 m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg); 3587 m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset())); 3588 3589 lengthDoesNotNeedUpdate.link(&m_jit); 3590 } 3591 notHoleValue.link(&m_jit); 3592 } 3593 3594 // Store the value to the array. 3595 m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, ArrayStorage::vectorOffset())); 3596 3597 base.use(); 3598 property.use(); 3599 value.use(); 3600 storage.use(); 3601 3602 if (!slowCases.empty()) { 3603 addSlowPathGenerator(slowPathCall( 3604 slowCases, this, 3605 node->ecmaMode().isStrict() 3606 ? (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsStrict) 3607 : (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsNonStrict : operationPutByValBeyondArrayBoundsNonStrict), 3608 NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueReg)); 3609 } 3610 3611 noResult(node, UseChildrenCalledExplicitly); 3612 break; 3613 } 3614 3615 case Array::Int8Array: 3616 case Array::Int16Array: 3617 case Array::Int32Array: 3618 case Array::Uint8Array: 3619 case Array::Uint8ClampedArray: 3620 case Array::Uint16Array: 3621 case Array::Uint32Array: 3622 case Array::Float32Array: 3623 case Array::Float64Array: { 3624 TypedArrayType type = arrayMode.typedArrayType(); 3625 if (isInt(type)) 3626 compilePutByValForIntTypedArray(base.gpr(), property.gpr(), node, type); 3627 else 3628 compilePutByValForFloatTypedArray(base.gpr(), property.gpr(), node, type); 3629 break; 3630 } 3631 3632 case Array::AnyTypedArray: 3633 case Array::String: 3634 case Array::DirectArguments: 3635 case Array::ForceExit: 3636 case Array::Generic: 3637 case Array::ScopedArguments: 3638 case Array::SelectUsingArguments: 3639 case Array::SelectUsingPredictions: 3640 case Array::Undecided: 3641 case Array::Unprofiled: 3642 case Array::BigInt64Array: 3643 case Array::BigUint64Array: 3644 RELEASE_ASSERT_NOT_REACHED(); 3645 } 3337 compilePutByVal(node); 3646 3338 break; 3647 3339 } -
trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h
r284213 r285530 970 970 } 971 971 972 Jump branchIfEmpty(BaseIndex address) 973 { 974 #if USE(JSVALUE64) 975 return branchTest64(Zero, address); 976 #else 977 return branch32(Equal, address.withOffset(TagOffset), TrustedImm32(JSValue::EmptyValueTag)); 978 #endif 979 } 980 972 981 Jump branchIfEmpty(GPRReg gpr) 973 982 { … … 985 994 #else 986 995 return branchIfEmpty(regs.tagGPR()); 996 #endif 997 } 998 999 Jump branchIfNotEmpty(BaseIndex address) 1000 { 1001 #if USE(JSVALUE64) 1002 return branchTest64(NonZero, address); 1003 #else 1004 return branch32(NotEqual, address.withOffset(TagOffset), TrustedImm32(JSValue::EmptyValueTag)); 987 1005 #endif 988 1006 }
Note:
See TracChangeset
for help on using the changeset viewer.
