Changeset 287623 in webkit

Timestamp:

Jan 5, 2022, 10:20:50 AM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r286228. rdar://problem/87125189

[JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
​https://bugs.webkit.org/show_bug.cgi?id=233571
rdar://85812164

Reviewed by Mark Lam.

JSTests:

• stress/get-typed-array-length-as-int52-generic.js: Added. (foo.bar): (foo):

Source/JavaScriptCore:

If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.

• dfg/DFGClobberize.h: (JSC::DFG::clobberize):
• dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode):
• dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@286228 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/get-typed-array-length-as-int52-generic.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGClobberize.h (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

branches/safari-612-branch/JSTests/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r286228. rdar://problem/87125189
+
+    [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
+    https://bugs.webkit.org/show_bug.cgi?id=233571
+    rdar://85812164
+    
+    Reviewed by Mark Lam.
+    
+    JSTests:
+    
+    * stress/get-typed-array-length-as-int52-generic.js: Added.
+    (foo.bar):
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
+    In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
+    And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.
+    
+    * dfg/DFGClobberize.h:
+    (JSC::DFG::clobberize):
+    * dfg/DFGFixupPhase.cpp:
+    (JSC::DFG::FixupPhase::fixupNode):
+    * dfg/DFGSpeculativeJIT64.cpp:
+    (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
+    * ftl/FTLLowerDFGToB3.cpp:
+    (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286228 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
+            https://bugs.webkit.org/show_bug.cgi?id=233571
+            rdar://85812164
+
+            Reviewed by Mark Lam.
+
+            * stress/get-typed-array-length-as-int52-generic.js: Added.
+            (foo.bar):
+            (foo):
+
 2022-01-05  Russell Epstein  <repstein@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r286228. rdar://problem/87125189
+
+    [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
+    https://bugs.webkit.org/show_bug.cgi?id=233571
+    rdar://85812164
+    
+    Reviewed by Mark Lam.
+    
+    JSTests:
+    
+    * stress/get-typed-array-length-as-int52-generic.js: Added.
+    (foo.bar):
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
+    In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
+    And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.
+    
+    * dfg/DFGClobberize.h:
+    (JSC::DFG::clobberize):
+    * dfg/DFGFixupPhase.cpp:
+    (JSC::DFG::FixupPhase::fixupNode):
+    * dfg/DFGSpeculativeJIT64.cpp:
+    (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
+    * ftl/FTLLowerDFGToB3.cpp:
+    (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286228 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
+            https://bugs.webkit.org/show_bug.cgi?id=233571
+            rdar://85812164
+
+            Reviewed by Mark Lam.
+
+            If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
+            In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
+            And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.
+
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
+
 2022-01-05  Russell Epstein  <repstein@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -1445 +1445 @@
 
         default:
-            ASSERT(mode.isSomeTypedArrayView());
+            DFG_ASSERT(graph, node, mode.isSomeTypedArrayView());
             read(MiscFields);
             def(HeapLocation(ArrayLengthLoc, MiscFields, node->child1()), LazyNode(node));
@@ -1454 +1454 @@
     case GetTypedArrayLengthAsInt52: {
         ArrayMode mode = node->arrayMode();
-        RELEASE_ASSERT(mode.isSomeTypedArrayView());
-        read(MiscFields);
-        def(HeapLocation(TypedArrayLengthInt52Loc, MiscFields, node->child1()), LazyNode(node));
-        return;
+        DFG_ASSERT(graph, node, mode.isSomeTypedArrayView() || mode.type() == Array::ForceExit);
+        switch (mode.type()) {
+        case Array::ForceExit:
+            write(SideState);
+            return;
+        default:
+            read(MiscFields);
+            def(HeapLocation(TypedArrayLengthInt52Loc, MiscFields, node->child1()), LazyNode(node));
+            return;
+        }
     }
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -2160 +2160 @@
             if (arrayMode.type() == Array::Generic)
                 arrayMode = arrayMode.withType(Array::ForceExit);
-            ASSERT(arrayMode.isSpecific() || arrayMode.type() == Array::ForceExit);
+            DFG_ASSERT(m_graph, node, arrayMode.isSpecific() || arrayMode.type() == Array::ForceExit);
             node->setArrayMode(arrayMode);
             blessArrayOperation(node->child1(), Edge(), node->child2(), lengthNeedsStorage);
@@ -2170 +2170 @@
         case GetTypedArrayLengthAsInt52: {
             ArrayMode arrayMode = node->arrayMode().refine(m_graph, node, node->child1()->prediction(), ArrayMode::unusedIndexSpeculatedType);
-            ASSERT(arrayMode.isSomeTypedArrayView());
+            if (arrayMode.type() == Array::Generic)
+                arrayMode = arrayMode.withType(Array::ForceExit);
+            DFG_ASSERT(m_graph, node, arrayMode.isSomeTypedArrayView() || arrayMode.type() == Array::ForceExit);
             node->setArrayMode(arrayMode);
             blessArrayOperation(node->child1(), Edge(), node->child2(), lengthNeedsStorage);

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -2633 +2633 @@
 void SpeculativeJIT::compileGetTypedArrayLengthAsInt52(Node* node)
 {
-    RELEASE_ASSERT(node->arrayMode().isSomeTypedArrayView());
+    // If arrayMode is ForceExit, we would not compile this node and hence, should not have arrived here.
+    DFG_ASSERT(m_graph, node, node->arrayMode().isSomeTypedArrayView());
     SpeculateCellOperand base(this, node->child1());
     GPRTemporary result(this, Reuse, base);

branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -5091 +5091 @@
     void compileGetTypedArrayLengthAsInt52()
     {
+        // If arrayMode is ForceExit, we would not compile this node and hence, should not have arrived here.
         RELEASE_ASSERT(m_node->arrayMode().isSomeTypedArrayView());
         // The preprocessor chokes on RELEASE_ASSERT(USE(LARGE_TYPED_ARRAYS)), this is equivalent.