Changeset 227434 in webkit


Ignore:
Timestamp:
Jan 23, 2018, 12:39:34 PM (7 years ago)
Author:
mark.lam@apple.com
Message:

Re-arrange TypedArray JSTypes to match the order of the TypedArrayType enum list.
​https://bugs.webkit.org/show_bug.cgi?id=181976
<rdar://problem/36766936>

Reviewed by Filip Pizlo.

  1. The order of TypedArray JSTypes now matches the order the TypedArrayType enum list. I also added static asserts in TypedArrayType.h to enforce this.

Also redefined FOR_EACH_TYPED_ARRAY_TYPE() in terms of

  1. Define 4 new values:
    1. FirstTypedArrayType
    2. LastTypedArrayType
    3. NumberOfTypedArrayTypesExcludingDataView
    4. NumberOfTypedArrayTypes

Use these everywhere where we iterate or bisect the TypedArray JSTypes.

  1. Removed NUMBER_OF_TYPED_ARRAY_TYPES, and use NumberOfTypedArrayTypes instead.
  1. Simplify the code that converts between TypedArrayType and JSType.

Changed typedArrayTypeForType() to be the mirror image of typeForTypedArrayType().
Previously, typedArrayTypeForType() converts DataViewType to NotTypedArray
instead of TypeDataView. Now, it converts to TypeDataView.

This does not result in any change of behavior because typedArrayTypeForType()
is only called in Structure::hasIndexingHeader(), and its result is passed to
isTypedView(), which handles TypeDataView correctly.

  1. Also fixed a bug in SpeculativeJIT::compileGetTypedArrayByteOffset(). If the vector is null, we can skip the rest of the checks. While the current code does not result in incorrect behavior, it is inefficient, and communicates wrong information to the reader i.e. implying that there's something in the dataGPR when there's not. The dataGPR should also be null in this case.
  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::isTypedArrayView):

  • ftl/FTLOSRExit.cpp:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::visitChildren):

  • runtime/JSType.h:
  • runtime/TypedArrayType.cpp:

(JSC::typeForTypedArrayType): Deleted.

  • runtime/TypedArrayType.h:

(JSC::typedArrayTypeForType):
(JSC::typeForTypedArrayType):

Location:
trunk/Source/JavaScriptCore
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r227431 r227434  
     12018-01-23  Mark Lam  <mark.lam@apple.com>
     2
     3        Re-arrange TypedArray JSTypes to match the order of the TypedArrayType enum list.
     4        https://bugs.webkit.org/show_bug.cgi?id=181976
     5        <rdar://problem/36766936>
     6
     7        Reviewed by Filip Pizlo.
     8
     9        1. The order of TypedArray JSTypes now matches the order the TypedArrayType enum
     10           list.  I also added static asserts in TypedArrayType.h to enforce this.
     11
     12           Also redefined FOR_EACH_TYPED_ARRAY_TYPE() in terms of
     13
     14        2. Define 4 new values:
     15           a. FirstTypedArrayType
     16           b. LastTypedArrayType
     17           c. NumberOfTypedArrayTypesExcludingDataView
     18           d. NumberOfTypedArrayTypes
     19
     20           Use these everywhere where we iterate or bisect the TypedArray JSTypes.
     21
     22        3. Removed NUMBER_OF_TYPED_ARRAY_TYPES, and use NumberOfTypedArrayTypes instead.
     23
     24        4. Simplify the code that converts between TypedArrayType and JSType.
     25
     26           Changed typedArrayTypeForType() to be the mirror image of typeForTypedArrayType().
     27           Previously, typedArrayTypeForType() converts DataViewType to NotTypedArray
     28           instead of TypeDataView.  Now, it converts to TypeDataView.
     29
     30           This does not result in any change of behavior because typedArrayTypeForType()
     31           is only called in Structure::hasIndexingHeader(), and its result is passed to
     32           isTypedView(), which handles TypeDataView correctly.
     33
     34        5. Also fixed a bug in SpeculativeJIT::compileGetTypedArrayByteOffset().
     35           If the vector is null, we can skip the rest of the checks.  While the current
     36           code does not result in incorrect behavior, it is inefficient, and communicates
     37           wrong information to the reader i.e. implying that there's something in the
     38           dataGPR when there's not.  The dataGPR should also be null in this case.
     39
     40        * dfg/DFGByteCodeParser.cpp:
     41        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
     42        * dfg/DFGSpeculativeJIT.cpp:
     43        (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
     44        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
     45        * ftl/FTLLowerDFGToB3.cpp:
     46        (JSC::FTL::DFG::LowerDFGToB3::isTypedArrayView):
     47        * ftl/FTLOSRExit.cpp:
     48        * llint/LowLevelInterpreter.asm:
     49        * llint/LowLevelInterpreter64.asm:
     50        * runtime/JSGlobalObject.cpp:
     51        (JSC::JSGlobalObject::visitChildren):
     52        * runtime/JSType.h:
     53        * runtime/TypedArrayType.cpp:
     54        (JSC::typeForTypedArrayType): Deleted.
     55        * runtime/TypedArrayType.h:
     56        (JSC::typedArrayTypeForType):
     57        (JSC::typeForTypedArrayType):
     58
    1592018-01-23  Filip Pizlo  <fpizlo@apple.com>
    260

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r227431 r227434  
    34413441    }
    34423442
    3443     for (unsigned typeIndex = 0; typeIndex < NUMBER_OF_TYPED_ARRAY_TYPES; ++typeIndex) {
     3443    for (unsigned typeIndex = 0; typeIndex < NumberOfTypedArrayTypes; ++typeIndex) {
    34443444        bool result = handleTypedArrayConstructor(
    34453445            resultOperand, function, registerOffset, argumentCountIncludingThis,

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r227410 r227434  
    40344034
    40354035    m_jit.load8(JITCompiler::Address(valueRegs.payloadGPR(), JSCell::typeInfoTypeOffset()), resultGPR);
    4036     m_jit.sub32(TrustedImm32(Int8ArrayType), resultGPR);
    4037     m_jit.compare32(JITCompiler::BelowOrEqual,
     4036    m_jit.sub32(TrustedImm32(FirstTypedArrayType), resultGPR);
     4037    m_jit.compare32(JITCompiler::Below,
    40384038        resultGPR,
    4039         TrustedImm32(Float64ArrayType - Int8ArrayType),
     4039        TrustedImm32(NumberOfTypedArrayTypesExcludingDataView),
    40404040        resultGPR);
    40414041    blessBoolean(resultGPR);
    … …  
    63886388    JITCompiler::Jump nullVector = m_jit.branchTestPtr(JITCompiler::Zero, vectorGPR);
    63896389    cageTypedArrayStorage(vectorGPR);
    6390     nullVector.link(&m_jit);
     6390
    63916391    m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);
    63926392    // FIXME: This needs caging.
    … …  
    64016401   
    64026402    done.link(&m_jit);
     6403    nullVector.link(&m_jit);
    64036404
    64046405    int32Result(vectorGPR, node);

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r227410 r227434  
    1438814388        LValue jsType = m_out.sub(
    1438914389            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
    14390             m_out.constInt32(Int8ArrayType));
    14391         return m_out.belowOrEqual(
     14390            m_out.constInt32(FirstTypedArrayType));
     14391        return m_out.below(
    1439214392            jsType,
    14393             m_out.constInt32(Float64ArrayType - Int8ArrayType));
     14393            m_out.constInt32(NumberOfTypedArrayTypesExcludingDataView));
    1439414394    }
    1439514395   

  • trunk/Source/JavaScriptCore/ftl/FTLOSRExit.cpp

    r201182 r227434  
    119119#endif // ENABLE(FTL_JIT)
    120120
     121

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r226940 r227434  
    384384# switch statement in get_by_val and put_by_val.
    385385const Int8ArrayType = constexpr Int8ArrayType
    386 const Int16ArrayType = constexpr Int16ArrayType
    387 const Int32ArrayType = constexpr Int32ArrayType
    388386const Uint8ArrayType = constexpr Uint8ArrayType
    389387const Uint8ClampedArrayType = constexpr Uint8ClampedArrayType
     388const Int16ArrayType = constexpr Int16ArrayType
    390389const Uint16ArrayType = constexpr Uint16ArrayType
     390const Int32ArrayType = constexpr Int32ArrayType
    391391const Uint32ArrayType = constexpr Uint32ArrayType
    392392const Float32ArrayType = constexpr Float32ArrayType
    393393const Float64ArrayType = constexpr Float64ArrayType
    394394
    395 const FirstArrayType = Int8ArrayType
    396 const LastArrayType = Float64ArrayType
     395const FirstArrayType = constexpr FirstTypedArrayType
     396const NumberOfTypedArrayTypesExcludingDataView = constexpr NumberOfTypedArrayTypesExcludingDataView
    397397
    398398# Type flags constants.

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r226940 r227434  
    15391539    loadb JSCell::m_type[t0], t2
    15401540    subi FirstArrayType, t2
    1541     bia t2, LastArrayType - FirstArrayType, .opGetByValSlow
     1541    biaeq t2, NumberOfTypedArrayTypesExcludingDataView, .opGetByValSlow
    15421542   
    15431543    # Sweet, now we know that we have a typed array. Do some basic things now.
    … …  
    15451545    biaeq t1, JSArrayBufferView::m_length[t0], .opGetByValSlow
    15461546   
    1547     # Now bisect through the various types. Note that we can treat Uint8ArrayType and
    1548     # Uint8ClampedArrayType the same.
    1549     bia t2, Uint8ClampedArrayType - FirstArrayType, .opGetByValAboveUint8ClampedArray
    1550    
    1551     # We have one of Int8ArrayType .. Uint8ClampedArrayType.
    1552     bia t2, Int16ArrayType - FirstArrayType, .opGetByValInt32ArrayOrUint8Array
    1553    
    1554     # We have one of Int8ArrayType or Int16ArrayType
    1555     bineq t2, Int8ArrayType - FirstArrayType, .opGetByValInt16Array
    1556    
     1547    # Now bisect through the various types:
     1548    #    Int8ArrayType,
     1549    #    Uint8ArrayType,
     1550    #    Uint8ClampedArrayType,
     1551    #    Int16ArrayType,
     1552    #    Uint16ArrayType,
     1553    #    Int32ArrayType,
     1554    #    Uint32ArrayType,
     1555    #    Float32ArrayType,
     1556    #    Float64ArrayType,
     1557
     1558    bia t2, Uint16ArrayType - FirstArrayType, .opGetByValAboveUint16Array
     1559
     1560    # We have one of Int8ArrayType .. Uint16ArrayType.
     1561    bia t2, Uint8ClampedArrayType - FirstArrayType, .opGetByValInt16ArrayOrUint16Array
     1562
     1563    # We have one of Int8ArrayType ... Uint8ClampedArrayType
     1564    bineq t2, Int8ArrayType - FirstArrayType, .opGetByValUint8ArrayOrUint8ClampedArray
     1565
    15571566    # We have Int8ArrayType
    15581567    loadbs [t3, t1], t0
    15591568    finishIntGetByVal(t0, t1)
    15601569
    1561 .opGetByValInt16Array:
     1570.opGetByValUint8ArrayOrUint8ClampedArray:
     1571    # We have either Uint8ArrayType or Uint8ClampedArrayType. They behave the same so that's cool.
     1572    loadb [t3, t1], t0
     1573    finishIntGetByVal(t0, t1)
     1574
     1575.opGetByValInt16ArrayOrUint16Array:
     1576    # We have either Int16ArrayType or Uint16ClampedArrayType.
     1577    bieq t2, Uint16ArrayType - FirstArrayType, .opGetByValUint16Array
     1578
     1579    # We have Int16ArrayType.
    15621580    loadhs [t3, t1, 2], t0
    15631581    finishIntGetByVal(t0, t1)
    15641582
    1565 .opGetByValInt32ArrayOrUint8Array:
    1566     # We have one of Int16Array, Uint8Array, or Uint8ClampedArray.
    1567     bieq t2, Int32ArrayType - FirstArrayType, .opGetByValInt32Array
    1568    
    1569     # We have either Uint8Array or Uint8ClampedArray. They behave the same so that's cool.
    1570     loadb [t3, t1], t0
    1571     finishIntGetByVal(t0, t1)
    1572 
    1573 .opGetByValInt32Array:
    1574     loadi [t3, t1, 4], t0
    1575     finishIntGetByVal(t0, t1)
    1576 
    1577 .opGetByValAboveUint8ClampedArray:
    1578     # We have one of Uint16ArrayType .. Float64ArrayType.
    1579     bia t2, Uint32ArrayType - FirstArrayType, .opGetByValAboveUint32Array
    1580    
    1581     # We have either Uint16ArrayType or Uint32ArrayType.
    1582     bieq t2, Uint32ArrayType - FirstArrayType, .opGetByValUint32Array
    1583 
     1583.opGetByValUint16Array:
    15841584    # We have Uint16ArrayType.
    15851585    loadh [t3, t1, 2], t0
    15861586    finishIntGetByVal(t0, t1)
    15871587
     1588.opGetByValAboveUint16Array:
     1589    # We have one of Int32ArrayType .. Float64ArrayType.
     1590    bia t2, Uint32ArrayType - FirstArrayType, .opGetByValFloat32ArrayOrFloat64Array
     1591
     1592    # We have either Int32ArrayType or Uint32ArrayType
     1593    bineq t2, Int32ArrayType - FirstArrayType, .opGetByValUint32Array
     1594
     1595    # We have Int32ArrayType
     1596    loadi [t3, t1, 4], t0
     1597    finishIntGetByVal(t0, t1)
     1598
    15881599.opGetByValUint32Array:
     1600    # We have Uint32ArrayType.
    15891601    # This is the hardest part because of large unsigned values.
    15901602    loadi [t3, t1, 4], t0
    … …  
    15921604    finishIntGetByVal(t0, t1)
    15931605
    1594 .opGetByValAboveUint32Array:
     1606.opGetByValFloat32ArrayOrFloat64Array:
    15951607    # We have one of Float32ArrayType or Float64ArrayType. Sadly, we cannot handle Float32Array
    15961608    # inline yet. That would require some offlineasm changes.

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r227104 r227434  
    14211421#undef VISIT_LAZY_TYPE
    14221422
    1423     for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;)
     1423    for (unsigned i = NumberOfTypedArrayTypes; i--;)
    14241424        thisObject->lazyTypedArrayStructure(indexToTypedArrayType(i)).visit(visitor);
    14251425   

  • trunk/Source/JavaScriptCore/runtime/JSType.h

    r226783 r227434  
    11/*
    2  *  Copyright (C) 2006-2011, 2015-2016 Apple Inc. All rights reserved.
     2 *  Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 *
    44 *  This library is free software; you can redistribute it and/or
    … …  
    7171
    7272    Int8ArrayType,
    73     Int16ArrayType,
    74     Int32ArrayType,
    7573    Uint8ArrayType,
    7674    Uint8ClampedArrayType,
     75    Int16ArrayType,
    7776    Uint16ArrayType,
     77    Int32ArrayType,
    7878    Uint32ArrayType,
    7979    Float32ArrayType,
    … …  
    105105};
    106106
     107static const uint32_t FirstTypedArrayType = Int8ArrayType;
     108static const uint32_t LastTypedArrayType = DataViewType;
     109static constexpr uint32_t NumberOfTypedArrayTypes = LastTypedArrayType - FirstTypedArrayType + 1;
     110static constexpr uint32_t NumberOfTypedArrayTypesExcludingDataView = NumberOfTypedArrayTypes - 1;
     111
    107112static_assert(sizeof(JSType) == sizeof(uint8_t), "sizeof(JSType) is one byte.");
    108113static_assert(LastJSCObjectType < 128, "The highest bit is reserved for embedder's extension.");

  • trunk/Source/JavaScriptCore/runtime/TypedArrayType.cpp

    r226311 r227434  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3232
    3333namespace JSC {
    34 
    35 JSType typeForTypedArrayType(TypedArrayType type)
    36 {
    37     switch (type) {
    38     case NotTypedArray:
    39         RELEASE_ASSERT_NOT_REACHED();
    40         return Int8ArrayType;
    41     case TypeInt8:
    42         return Int8ArrayType;
    43     case TypeUint8:
    44         return Uint8ArrayType;
    45     case TypeUint8Clamped:
    46         return Uint8ClampedArrayType;
    47     case TypeInt16:
    48         return Int16ArrayType;
    49     case TypeUint16:
    50         return Uint16ArrayType;
    51     case TypeInt32:
    52         return Int32ArrayType;
    53     case TypeUint32:
    54         return Uint32ArrayType;
    55     case TypeFloat32:
    56         return Float32ArrayType;
    57     case TypeFloat64:
    58         return Float64ArrayType;
    59     case TypeDataView:
    60         return DataViewType;
    61 
    62     default:
    63         RELEASE_ASSERT_NOT_REACHED();
    64         return Int8ArrayType;
    65     }
    66 }
    6734
    6835const ClassInfo* constructorClassInfoForType(TypedArrayType type)

  • trunk/Source/JavaScriptCore/runtime/TypedArrayType.h

    r218794 r227434  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3333struct ClassInfo;
    3434
    35 #define FOR_EACH_TYPED_ARRAY_TYPE(macro) \
    36     macro(Int8) \
    37     macro(Uint8) \
    38     macro(Uint8Clamped) \
    39     macro(Int16) \
    40     macro(Uint16) \
    41     macro(Int32) \
    42     macro(Uint32) \
    43     macro(Float32) \
    44     macro(Float64) \
    45     macro(DataView)
    46 
    4735#define FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(macro) \
    4836    macro(Int8) \
    … …  
    5644    macro(Float64)
    5745
     46#define FOR_EACH_TYPED_ARRAY_TYPE(macro) \
     47    FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(macro) \
     48    macro(DataView)
     49
    5850enum TypedArrayType {
    5951    NotTypedArray,
    … …  
    6355};
    6456
    65 #define NUMBER_OF_TYPED_ARRAY_TYPES TypeDataView
     57#define ASSERT_TYPED_ARRAY_TYPE(name) \
     58    static_assert(Type ## name == (name ## ArrayType - FirstTypedArrayType + TypeInt8), "");
     59    FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(ASSERT_TYPED_ARRAY_TYPE)
     60#undef ASSERT_TYPED_ARRAY_TYPE
     61
     62static_assert(TypeDataView == (DataViewType - FirstTypedArrayType + TypeInt8), "");
    6663
    6764inline unsigned toIndex(TypedArrayType type)
    … …  
    118115
    119116const ClassInfo* constructorClassInfoForType(TypedArrayType);
    120 JSType typeForTypedArrayType(TypedArrayType);
    121117
    122118inline TypedArrayType typedArrayTypeForType(JSType type)
    123119{
    124     switch (type) {
    125     case Int8ArrayType:
    126         return TypeInt8;
    127     case Int16ArrayType:
    128         return TypeInt16;
    129     case Int32ArrayType:
    130         return TypeInt32;
    131     case Uint8ArrayType:
    132         return TypeUint8;
    133     case Uint8ClampedArrayType:
    134         return TypeUint8Clamped;
    135     case Uint16ArrayType:
    136         return TypeUint16;
    137     case Uint32ArrayType:
    138         return TypeUint32;
    139     case Float32ArrayType:
    140         return TypeFloat32;
    141     case Float64ArrayType:
    142         return TypeFloat64;
    143     default:
    144         return NotTypedArray;
    145     }
     120    if (type >= FirstTypedArrayType && type <= LastTypedArrayType)
     121        return static_cast<TypedArrayType>(type - FirstTypedArrayType + TypeInt8);
     122    return NotTypedArray;
     123}
     124
     125inline JSType typeForTypedArrayType(TypedArrayType type)
     126{
     127    if (type >= TypeInt8 && type <= TypeDataView)
     128        return static_cast<JSType>(type - TypeInt8 + FirstTypedArrayType);
     129
     130    RELEASE_ASSERT_NOT_REACHED();
     131    return Int8ArrayType;
    146132}
    147133
Note: See TracChangeset for help on using the changeset viewer.