Changeset 287004 in webkit

Timestamp:

Dec 13, 2021, 7:27:46 PM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r286580. rdar://problem/86445989

TypeInfo should be materializable from Structures as a single load.
​https://bugs.webkit.org/show_bug.cgi?id=233875

Reviewed by Mark Lam.

This is mostly just the members of Structure and JSCell so that
JSType and InlineTypeFlags are at the end of the JSCell header.

• assembler/testmasm.cpp: (JSC::testBranchIfType): (JSC::testBranchIfNotType):
• ftl/FTLAbstractHeapRepository.cpp: (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
• runtime/JSCell.h:
• runtime/JSCellInlines.h: (JSC::JSCell::JSCell):
• runtime/Structure.h: (JSC::Structure::typeInfo const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@286580 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-613.1.11-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/testmasm.cpp (modified) (2 diffs)
• ftl/FTLAbstractHeapRepository.cpp (modified) (1 diff)
• runtime/JSCell.h (modified) (1 diff)
• runtime/JSCellInlines.h (modified) (1 diff)
• runtime/Structure.h (modified) (2 diffs)

branches/safari-613.1.11-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-12-13  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r286580. rdar://problem/86445989
+
+    TypeInfo should be materializable from Structures as a single load.
+    https://bugs.webkit.org/show_bug.cgi?id=233875
+    
+    Reviewed by Mark Lam.
+    
+    This is mostly just the members of Structure and JSCell so that
+    JSType and InlineTypeFlags are at the end of the JSCell header.
+    
+    * assembler/testmasm.cpp:
+    (JSC::testBranchIfType):
+    (JSC::testBranchIfNotType):
+    * ftl/FTLAbstractHeapRepository.cpp:
+    (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+    * runtime/JSCell.h:
+    * runtime/JSCellInlines.h:
+    (JSC::JSCell::JSCell):
+    * runtime/Structure.h:
+    (JSC::Structure::typeInfo const):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286580 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-12-06  Keith Miller  <keith_miller@apple.com>
+
+            TypeInfo should be materializable from Structures as a single load.
+            https://bugs.webkit.org/show_bug.cgi?id=233875
+
+            Reviewed by Mark Lam.
+
+            This is mostly just the members of Structure and JSCell so that
+            JSType and InlineTypeFlags are at the end of the JSCell header.
+
+            * assembler/testmasm.cpp:
+            (JSC::testBranchIfType):
+            (JSC::testBranchIfNotType):
+            * ftl/FTLAbstractHeapRepository.cpp:
+            (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+            * runtime/JSCell.h:
+            * runtime/JSCellInlines.h:
+            (JSC::JSCell::JSCell):
+            * runtime/Structure.h:
+            (JSC::Structure::typeInfo const):
+
 2021-12-03  Keith Miller  <keith_miller@apple.com>
 

branches/safari-613.1.11-branch/Source/JavaScriptCore/assembler/testmasm.cpp

@@ -5614 +5614 @@
         uint32_t structureID;
         uint8_t indexingType;
+        uint8_t cellState;
         JSType type;
     };
@@ -5648 +5649 @@
         uint32_t structureID;
         uint8_t indexingType;
+        uint8_t cellState;
         JSType type;
     };

branches/safari-613.1.11-branch/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp

@@ -79 +79 @@
     // Make sure that our explicit assumptions about the StructureIDBlob match reality.
     RELEASE_ASSERT(!(JSCell_indexingTypeAndMisc.offset() & (sizeof(int32_t) - 1)));
-    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_typeInfoType.offset());
-    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoFlags.offset());
-    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_cellState.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_cellState.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoType.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_typeInfoFlags.offset());
 
     JSCell_structureID.changeParent(&JSCell_header);

branches/safari-613.1.11-branch/Source/JavaScriptCore/runtime/JSCell.h

@@ -267 +267 @@
     StructureID m_structureID;
     IndexingType m_indexingTypeAndMisc; // DO NOT store to this field. Always CAS.
+    CellState m_cellState;
     JSType m_type;
     TypeInfo::InlineTypeFlags m_flags;
-    CellState m_cellState;
 };
 

branches/safari-613.1.11-branch/Source/JavaScriptCore/runtime/JSCellInlines.h

@@ -59 +59 @@
     : m_structureID(structure->id())
     , m_indexingTypeAndMisc(structure->indexingModeIncludingHistory())
+    , m_cellState(CellState::DefinitelyWhite)
     , m_type(structure->typeInfo().type())
     , m_flags(structure->typeInfo().inlineTypeFlags())
-    , m_cellState(CellState::DefinitelyWhite)
 {
     ASSERT(!isCompilationThread());

branches/safari-613.1.11-branch/Source/JavaScriptCore/runtime/Structure.h

@@ -262 +262 @@
     
     // Type accessors.
+#if CPU(NEEDS_ALIGNED_ACCESS)
     TypeInfo typeInfo() const { return TypeInfo(m_cellHeaderType, m_cellHeaderInlineTypeFlags, m_outOfLineTypeFlags); }
+#else
+    TypeInfo typeInfo() const { return *reinterpret_cast_ptr<const TypeInfo*>(&m_cellHeaderType); }
+#endif
     bool isObject() const { return typeInfo().isObject(); }
 protected:
@@ -857 +861 @@
     // JSCell.
     IndexingType m_cellHeaderIndexingModeIncludingHistory;
+    const CellState m_cellHeaderDefaultCellState { CellState::DefinitelyWhite };
     const JSType m_cellHeaderType;
     TypeInfo::InlineTypeFlags m_cellHeaderInlineTypeFlags;
-    const CellState m_cellHeaderDefaultCellState { CellState::DefinitelyWhite };
     TypeInfo::OutOfLineTypeFlags m_outOfLineTypeFlags;