Changeset 286228 in webkit

Timestamp:

Nov 29, 2021, 11:10:22 AM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
​https://bugs.webkit.org/show_bug.cgi?id=233571
rdar://85812164

Reviewed by Mark Lam.

JSTests:

• stress/get-typed-array-length-as-int52-generic.js: Added.

(foo.bar):
(foo):

Source/JavaScriptCore:

If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-typed-array-length-as-int52-generic.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGClobberize.h (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
+        https://bugs.webkit.org/show_bug.cgi?id=233571
+        rdar://85812164
+
+        Reviewed by Mark Lam.
+
+        * stress/get-typed-array-length-as-int52-generic.js: Added.
+        (foo.bar):
+        (foo):
+
 2021-11-24  Michael Catanzaro  <mcatanzaro@gnome.org>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
+        https://bugs.webkit.org/show_bug.cgi?id=233571
+        rdar://85812164
+
+        Reviewed by Mark Lam.
+
+        If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
+        In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
+        And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
+
 2021-11-29  Zan Dobersek  <zdobersek@igalia.com>
 

trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -1457 +1457 @@
 
         default:
-            ASSERT(mode.isSomeTypedArrayView());
+            DFG_ASSERT(graph, node, mode.isSomeTypedArrayView());
             read(MiscFields);
             def(HeapLocation(ArrayLengthLoc, MiscFields, node->child1()), LazyNode(node));
@@ -1466 +1466 @@
     case GetTypedArrayLengthAsInt52: {
         ArrayMode mode = node->arrayMode();
-        RELEASE_ASSERT(mode.isSomeTypedArrayView());
-        read(MiscFields);
-        def(HeapLocation(TypedArrayLengthInt52Loc, MiscFields, node->child1()), LazyNode(node));
-        return;
+        DFG_ASSERT(graph, node, mode.isSomeTypedArrayView() || mode.type() == Array::ForceExit);
+        switch (mode.type()) {
+        case Array::ForceExit:
+            write(SideState);
+            return;
+        default:
+            read(MiscFields);
+            def(HeapLocation(TypedArrayLengthInt52Loc, MiscFields, node->child1()), LazyNode(node));
+            return;
+        }
     }
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -2155 +2155 @@
             if (arrayMode.type() == Array::Generic)
                 arrayMode = arrayMode.withType(Array::ForceExit);
-            ASSERT(arrayMode.isSpecific() || arrayMode.type() == Array::ForceExit);
+            DFG_ASSERT(m_graph, node, arrayMode.isSpecific() || arrayMode.type() == Array::ForceExit);
             node->setArrayMode(arrayMode);
             blessArrayOperation(node->child1(), Edge(), node->child2(), lengthNeedsStorage);
@@ -2165 +2165 @@
         case GetTypedArrayLengthAsInt52: {
             ArrayMode arrayMode = node->arrayMode().refine(m_graph, node, node->child1()->prediction(), ArrayMode::unusedIndexSpeculatedType);
-            ASSERT(arrayMode.isSomeTypedArrayView());
+            if (arrayMode.type() == Array::Generic)
+                arrayMode = arrayMode.withType(Array::ForceExit);
+            DFG_ASSERT(m_graph, node, arrayMode.isSomeTypedArrayView() || arrayMode.type() == Array::ForceExit);
             node->setArrayMode(arrayMode);
             blessArrayOperation(node->child1(), Edge(), node->child2(), lengthNeedsStorage);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -2909 +2909 @@
 void SpeculativeJIT::compileGetTypedArrayLengthAsInt52(Node* node)
 {
-    RELEASE_ASSERT(node->arrayMode().isSomeTypedArrayView());
+    // If arrayMode is ForceExit, we would not compile this node and hence, should not have arrived here.
+    DFG_ASSERT(m_graph, node, node->arrayMode().isSomeTypedArrayView());
     SpeculateCellOperand base(this, node->child1());
     GPRTemporary result(this, Reuse, base);

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -5108 +5108 @@
     void compileGetTypedArrayLengthAsInt52()
     {
+        // If arrayMode is ForceExit, we would not compile this node and hence, should not have arrived here.
         RELEASE_ASSERT(m_node->arrayMode().isSomeTypedArrayView());
         // The preprocessor chokes on RELEASE_ASSERT(USE(LARGE_TYPED_ARRAYS)), this is equivalent.