Changeset 286580 in webkit

Timestamp:

Dec 6, 2021, 5:13:33 PM (5 years ago)

Author:

keith_miller@apple.com

Message:

TypeInfo should be materializable from Structures as a single load.
​https://bugs.webkit.org/show_bug.cgi?id=233875

Reviewed by Mark Lam.

This is mostly just the members of Structure and JSCell so that
JSType and InlineTypeFlags are at the end of the JSCell header.

• assembler/testmasm.cpp:

(JSC::testBranchIfType):
(JSC::testBranchIfNotType):

• ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

• runtime/JSCell.h:
• runtime/JSCellInlines.h:

(JSC::JSCell::JSCell):

• runtime/Structure.h:

(JSC::Structure::typeInfo const):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/testmasm.cpp (modified) (2 diffs)
• ftl/FTLAbstractHeapRepository.cpp (modified) (1 diff)
• runtime/JSCell.h (modified) (1 diff)
• runtime/JSCellInlines.h (modified) (1 diff)
• runtime/Structure.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-12-06  Keith Miller  <keith_miller@apple.com>
+
+        TypeInfo should be materializable from Structures as a single load.
+        https://bugs.webkit.org/show_bug.cgi?id=233875
+
+        Reviewed by Mark Lam.
+
+        This is mostly just the members of Structure and JSCell so that
+        JSType and InlineTypeFlags are at the end of the JSCell header.
+
+        * assembler/testmasm.cpp:
+        (JSC::testBranchIfType):
+        (JSC::testBranchIfNotType):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        * runtime/Structure.h:
+        (JSC::Structure::typeInfo const):
+
 2021-12-06  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/assembler/testmasm.cpp

@@ -5614 +5614 @@
         uint32_t structureID;
         uint8_t indexingType;
+        uint8_t cellState;
         JSType type;
     };
@@ -5648 +5649 @@
         uint32_t structureID;
         uint8_t indexingType;
+        uint8_t cellState;
         JSType type;
     };

trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp

@@ -79 +79 @@
     // Make sure that our explicit assumptions about the StructureIDBlob match reality.
     RELEASE_ASSERT(!(JSCell_indexingTypeAndMisc.offset() & (sizeof(int32_t) - 1)));
-    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_typeInfoType.offset());
-    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoFlags.offset());
-    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_cellState.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_cellState.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoType.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_typeInfoFlags.offset());
 
     JSCell_structureID.changeParent(&JSCell_header);

trunk/Source/JavaScriptCore/runtime/JSCell.h

@@ -267 +267 @@
     StructureID m_structureID;
     IndexingType m_indexingTypeAndMisc; // DO NOT store to this field. Always CAS.
+    CellState m_cellState;
     JSType m_type;
     TypeInfo::InlineTypeFlags m_flags;
-    CellState m_cellState;
 };
 

trunk/Source/JavaScriptCore/runtime/JSCellInlines.h

@@ -59 +59 @@
     : m_structureID(structure->id())
     , m_indexingTypeAndMisc(structure->indexingModeIncludingHistory())
+    , m_cellState(CellState::DefinitelyWhite)
     , m_type(structure->typeInfo().type())
     , m_flags(structure->typeInfo().inlineTypeFlags())
-    , m_cellState(CellState::DefinitelyWhite)
 {
     ASSERT(!isCompilationThread());

trunk/Source/JavaScriptCore/runtime/Structure.h

@@ -262 +262 @@
     
     // Type accessors.
+#if CPU(NEEDS_ALIGNED_ACCESS)
     TypeInfo typeInfo() const { return TypeInfo(m_cellHeaderType, m_cellHeaderInlineTypeFlags, m_outOfLineTypeFlags); }
+#else
+    TypeInfo typeInfo() const { return *reinterpret_cast_ptr<const TypeInfo*>(&m_cellHeaderType); }
+#endif
     bool isObject() const { return typeInfo().isObject(); }
 protected:
@@ -857 +861 @@
     // JSCell.
     IndexingType m_cellHeaderIndexingModeIncludingHistory;
+    const CellState m_cellHeaderDefaultCellState { CellState::DefinitelyWhite };
     const JSType m_cellHeaderType;
     TypeInfo::InlineTypeFlags m_cellHeaderInlineTypeFlags;
-    const CellState m_cellHeaderDefaultCellState { CellState::DefinitelyWhite };
     TypeInfo::OutOfLineTypeFlags m_outOfLineTypeFlags;