⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 285850 in webkit


Ignore:
Timestamp:
Nov 15, 2021, 7:48:45 PM (5 years ago)
Author:
ysuzuki@apple.com
Message:

[JSC] Use operation path when PutByVal child1 is not speculated as a Cell
​https://bugs.webkit.org/show_bug.cgi?id=233147
rdar://85344310

Reviewed by Mark Lam.

JSTests:

  • stress/put-by-val-slow-dfg.js: Added.

(foo):

Source/JavaScriptCore:

r285530 removed non CellUse / non KnownCellUse case incorrectly (when we do not have Cell edge,
then we should use the slow operation path). This patch recovers it.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutByVal):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

Location:
trunk
Files:
1 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r285817 r285850  
     12021-11-15  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Use operation path when PutByVal child1 is not speculated as a Cell
     4        https://bugs.webkit.org/show_bug.cgi?id=233147
     5        rdar://85344310
     6
     7        Reviewed by Mark Lam.
     8
     9        * stress/put-by-val-slow-dfg.js: Added.
     10        (foo):
     11
    1122021-11-15  Angelos Oikonomopoulos  <angelos@igalia.com>
    213

  • trunk/Source/JavaScriptCore/ChangeLog

    r285795 r285850  
     12021-11-15  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Use operation path when PutByVal child1 is not speculated as a Cell
     4        https://bugs.webkit.org/show_bug.cgi?id=233147
     5        rdar://85344310
     6
     7        Reviewed by Mark Lam.
     8
     9        r285530 removed non CellUse / non KnownCellUse case incorrectly (when we do not have Cell edge,
     10        then we should use the slow operation path). This patch recovers it.
     11
     12        * dfg/DFGSpeculativeJIT.cpp:
     13        (JSC::DFG::SpeculativeJIT::compilePutByVal):
     14        * ftl/FTLLowerDFGToB3.cpp:
     15        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
     16
    1172021-11-14  Yusuke Suzuki  <ysuzuki@apple.com>
    218

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r285636 r285850  
    26272627{
    26282628    ArrayMode arrayMode = node->arrayMode().modeForPut();
     2629    Edge child1 = m_jit.graph().varArgChild(node, 0);
     2630    Edge child2 = m_jit.graph().varArgChild(node, 1);
     2631    Edge child3 = m_jit.graph().varArgChild(node, 2);
     2632    Edge child4 = m_jit.graph().varArgChild(node, 3);
     2633
    26292634    switch (arrayMode.type()) {
    26302635    case Array::AnyTypedArray:
    … …  
    26492654    case Array::Generic: {
    26502655        DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal || node->op() == PutByValDirect, node->op());
    2651         if (m_graph.m_slowPutByVal.contains(node)) {
    2652             if (m_jit.graph().varArgChild(node, 0).useKind() == CellUse) {
    2653                 if (m_jit.graph().varArgChild(node, 1).useKind() == StringUse) {
     2656        if (m_graph.m_slowPutByVal.contains(node) || (child1.useKind() != CellUse && child1.useKind() != KnownCellUse)) {
     2657            if (child1.useKind() == CellUse || child1.useKind() == KnownCellUse) {
     2658                if (child2.useKind() == StringUse) {
    26542659                    compilePutByValForCellWithString(node);
    26552660                    break;
    26562661                }
    26572662
    2658                 if (m_jit.graph().varArgChild(node, 1).useKind() == SymbolUse) {
     2663                if (child2.useKind() == SymbolUse) {
    26592664                    compilePutByValForCellWithSymbol(node);
    26602665                    break;
    … …  
    26622667            }
    26632668
    2664             JSValueOperand base(this, m_jit.graph().varArgChild(node, 0));
    2665             JSValueOperand property(this, m_jit.graph().varArgChild(node, 1));
    2666             JSValueOperand value(this, m_jit.graph().varArgChild(node, 2));
     2669            JSValueOperand base(this, child1);
     2670            JSValueOperand property(this, child2);
     2671            JSValueOperand value(this, child3);
    26672672            JSValueRegs baseRegs = base.jsValueRegs();
    26682673            JSValueRegs propertyRegs = property.jsValueRegs();
    … …  
    26802685        }
    26812686
    2682         JSValueOperand base(this, m_jit.graph().varArgChild(node, 0), ManualOperandSpeculation);
    2683         JSValueOperand property(this, m_jit.graph().varArgChild(node, 1), ManualOperandSpeculation);
    2684         JSValueOperand value(this, m_jit.graph().varArgChild(node, 2), ManualOperandSpeculation);
     2687        JSValueOperand base(this, child1, ManualOperandSpeculation);
     2688        JSValueOperand property(this, child2, ManualOperandSpeculation);
     2689        JSValueOperand value(this, child3, ManualOperandSpeculation);
    26852690        JSValueRegs baseRegs = base.jsValueRegs();
    26862691        JSValueRegs propertyRegs = property.jsValueRegs();
    … …  
    26942699        }
    26952700
    2696         speculate(node, m_jit.graph().varArgChild(node, 0));
    2697         speculate(node, m_jit.graph().varArgChild(node, 1));
    2698         speculate(node, m_jit.graph().varArgChild(node, 2));
     2701        speculate(node, child1);
     2702        speculate(node, child2);
     2703        speculate(node, child3);
    26992704
    27002705        CodeOrigin codeOrigin = node->origin.semantic;
    … …  
    27082713            baseRegs, propertyRegs, valueRegs, InvalidGPRReg, stubInfoGPR);
    27092714
    2710         if (m_state.forNode(m_jit.graph().varArgChild(node, 1)).isType(SpecString))
     2715        if (m_state.forNode(child2).isType(SpecString))
    27112716            gen.stubInfo()->propertyIsString = true;
    2712         else if (m_state.forNode(m_jit.graph().varArgChild(node, 1)).isType(SpecInt32Only))
     2717        else if (m_state.forNode(child2).isType(SpecInt32Only))
    27132718            gen.stubInfo()->propertyIsInt32 = true;
    2714         else if (m_state.forNode(m_jit.graph().varArgChild(node, 1)).isType(SpecSymbol))
     2719        else if (m_state.forNode(child2).isType(SpecSymbol))
    27152720            gen.stubInfo()->propertyIsSymbol = true;
    27162721
    … …  
    27402745    }
    27412746    case Array::Int32: {
    2742         speculateInt32(m_jit.graph().varArgChild(node, 2));
     2747        speculateInt32(child3);
    27432748        FALLTHROUGH;
    27442749    }
    … …  
    27532758    case Array::ArrayStorage:
    27542759    case Array::SlowPutArrayStorage: {
    2755         SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
    2756         SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1));
    2757         JSValueOperand value(this, m_jit.graph().varArgChild(node, 2));
    2758         StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
     2760        SpeculateCellOperand base(this, child1);
     2761        SpeculateStrictInt32Operand property(this, child2);
     2762        JSValueOperand value(this, child3);
     2763        StorageOperand storage(this, child4);
    27592764
    27602765        GPRReg baseReg = base.gpr();

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r285795 r285850  
    57215721        case Array::Generic: {
    57225722            if (m_graph.m_slowPutByVal.contains(m_node) || (child1.useKind() != CellUse && child1.useKind() != KnownCellUse)) {
    5723                 if (child1.useKind() == CellUse) {
     5723                if (child1.useKind() == CellUse || child1.useKind() == KnownCellUse) {
    57245724                    V_JITOperation_GCCJ operation = nullptr;
    57255725                    if (child2.useKind() == StringUse) {
Note: See TracChangeset for help on using the changeset viewer.