Changeset 283096 in webkit


Ignore:
Timestamp:
Sep 26, 2021, 9:25:46 PM (4 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, reverting r283095.
​https://bugs.webkit.org/show_bug.cgi?id=230815

We should land the original patch since this does not work
with bytecode cache

Reverted changeset:

"[JSC] Optimize PutByVal with for-in"
​https://bugs.webkit.org/show_bug.cgi?id=230801
​https://commits.webkit.org/r283095

Location:
trunk
Files:
1 deleted
28 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r283095 r283096  
     12021-09-26  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, reverting r283095.
     4        https://bugs.webkit.org/show_bug.cgi?id=230815
     5
     6        We should land the original patch since this does not work
     7        with bytecode cache
     8
     9        Reverted changeset:
     10
     11        "[JSC] Optimize PutByVal with for-in"
     12        https://bugs.webkit.org/show_bug.cgi?id=230801
     13        https://commits.webkit.org/r283095
     14
    1152021-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
    216

  • trunk/Source/JavaScriptCore/ChangeLog

    r283095 r283096  
     12021-09-26  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, reverting r283095.
     4        https://bugs.webkit.org/show_bug.cgi?id=230815
     5
     6        We should land the original patch since this does not work
     7        with bytecode cache
     8
     9        Reverted changeset:
     10
     11        "[JSC] Optimize PutByVal with for-in"
     12        https://bugs.webkit.org/show_bug.cgi?id=230801
     13        https://commits.webkit.org/r283095
     14
    1152021-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
    216

  • trunk/Source/JavaScriptCore/builtins/BuiltinNames.h

    r283095 r283096  
    183183    macro(entries) \
    184184    macro(outOfLineReactionCounts) \
    185     macro(emptyPropertyNameEnumerator) \
     185    macro(emptyPropertyNameEnumerator)
    186186
    187187

  • trunk/Source/JavaScriptCore/bytecode/BytecodeList.rb

    r283095 r283096  
    760760    args: {
    761761        value: VirtualRegister,
    762         targetLabel: BoundLabel,
    763     }
    764 
    765 op :jeq_ptr,
    766     args: {
    767         value: VirtualRegister,
    768         specialPointer: VirtualRegister,
    769762        targetLabel: BoundLabel,
    770763    }

  • trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp

    r283095 r283096  
    8181    case op_new_regexp:
    8282    case op_debug:
     83    case op_jneq_ptr:
    8384    case op_loop_hint:
    8485    case op_jmp:
    … …  
    135136    USES(OpJbelow, lhs, rhs)
    136137    USES(OpJbeloweq, lhs, rhs)
    137     USES(OpJeqPtr, value, specialPointer)
    138     USES(OpJneqPtr, value, specialPointer)
    139 
    140138    USES(OpSetFunctionName, function, name)
    141139    USES(OpLogShadowChickenTail, thisValue, scope)
    … …  
    368366    case op_jundefined_or_null:
    369367    case op_jnundefined_or_null:
    370     case op_jeq_ptr:
    371368    case op_jneq_ptr:
    372369    case op_jless:

  • trunk/Source/JavaScriptCore/bytecode/Opcode.h

    r283095 r283096  
    200200    case op_jundefined_or_null:
    201201    case op_jnundefined_or_null:
    202     case op_jeq_ptr:
    203202    case op_jneq_ptr:
    204203    case op_jless:

  • trunk/Source/JavaScriptCore/bytecode/PreciseJumpTargetsInlines.h

    r283095 r283096  
    4444    CASE_OP(OpJundefinedOrNull) \
    4545    CASE_OP(OpJnundefinedOrNull) \
    46     CASE_OP(OpJeqPtr) \
    4746    CASE_OP(OpJneqPtr) \
    4847    \

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r283095 r283096  
    106106        CASE(OpJstricteq)
    107107        CASE(OpJneq)
    108         CASE(OpJeqPtr)
    109108        CASE(OpJneqPtr)
    110109        CASE(OpJnstricteq)
    … …  
    14971496{
    14981497    OpJneqPtr::emit(this, cond, moveLinkTimeConstant(nullptr, LinkTimeConstant::applyFunction), target.bind(this));
    1499 }
    1500 
    1501 void BytecodeGenerator::emitJumpIfSentinelString(RegisterID* cond, Label& target)
    1502 {
    1503     OpJeqPtr::emit(this, cond, emitLoad(nullptr, JSValue(vm().smallStrings.sentinelString())), target.bind(this));
    15041498}
    15051499

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

    r283095 r283096  
    859859        void emitJumpIfNotFunctionCall(RegisterID* cond, Label& target);
    860860        void emitJumpIfNotFunctionApply(RegisterID* cond, Label& target);
    861         void emitJumpIfSentinelString(RegisterID* cond, Label& target);
    862861        unsigned emitWideJumpIfNotFunctionHasOwnProperty(RegisterID* cond, Label& target);
    863862        void recordHasOwnPropertyInForInLoop(ForInContext&, unsigned branchOffset, Label& genericPath);

  • trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

    r283095 r283096  
    42284228        // FIXME: We should have a way to see if anyone is actually using the propertyName for something other than a get_by_val. If not, we could eliminate the toString in this opcode.
    42294229        generator.emitEnumeratorNext(propertyName.get(), mode.get(), index.get(), base.get(), enumerator.get());
    4230         generator.emitJumpIfSentinelString(propertyName.get(), scope->breakTarget());
     4230
     4231        // Note, choosing undefined or null helps please DFG's Abstract Interpreter as it doesn't distinguish null and undefined as types (via SpecOther).
     4232        generator.emitJumpIfTrue(generator.emitIsUndefinedOrNull(generator.newTemporary(), propertyName.get()), scope->breakTarget());
    42314233
    42324234        this->emitLoopHeader(generator, propertyName.get());

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r283095 r283096  
    43244324
    43254325    case EnumeratorNextUpdatePropertyName: {
    4326         setTypeForNode(node, SpecStringIdent);
     4326        setTypeForNode(node, SpecString | SpecOther);
    43274327        break;
    43284328    }

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r283095 r283096  
    76317631
    76327632            NEXT_OPCODE(op_iterator_next);
    7633         }
    7634 
    7635         case op_jeq_ptr: {
    7636             auto bytecode = currentInstruction->as<OpJeqPtr>();
    7637             FrozenValue* frozenPointer = m_graph.freezeStrong(m_inlineStackTop->m_codeBlock->getConstant(bytecode.m_specialPointer));
    7638             unsigned relativeOffset = jumpTarget(bytecode.m_targetLabel);
    7639             Node* child = get(bytecode.m_value);
    7640             Node* condition = addToGraph(CompareEqPtr, OpInfo(frozenPointer), child);
    7641             addToGraph(Branch, OpInfo(branchData(m_currentIndex.offset() + relativeOffset, m_currentIndex.offset() + currentInstruction->size())), condition);
    7642             LAST_OPCODE(op_jeq_ptr);
    76437633        }
    76447634

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r283095 r283096  
    241241    case op_put_to_arguments:
    242242    case op_get_argument:
    243     case op_jeq_ptr:
    244243    case op_jneq_ptr:
    245244    case op_typeof:

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r283095 r283096  
    8787
    8888template<bool strict, bool direct>
    89 static ALWAYS_INLINE void putByVal(JSGlobalObject* globalObject, VM& vm, JSValue baseValue, uint32_t index, JSValue value)
     89static inline void putByVal(JSGlobalObject* globalObject, VM& vm, JSValue baseValue, uint32_t index, JSValue value)
    9090{
    9191    ASSERT(isIndex(index));
    92     if constexpr (direct) {
     92    if (direct) {
    9393        RELEASE_ASSERT(baseValue.isObject());
    9494        asObject(baseValue)->putDirectIndex(globalObject, index, value, 0, strict ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
    … …  
    129129
    130130    PutPropertySlot slot(baseValue, strict);
    131     if constexpr (direct) {
     131    if (direct) {
    132132        RELEASE_ASSERT(baseValue.isObject());
    133133        JSObject* baseObject = asObject(baseValue);
    … …  
    149149{
    150150    PutPropertySlot slot(base, strict);
    151     if constexpr (direct) {
     151    if (direct) {
    152152        RELEASE_ASSERT(base->isObject());
    153153        JSObject* baseObject = asObject(base);
    … …  
    24872487}
    24882488
    2489 JSC_DEFINE_JIT_OPERATION(operationEnumeratorNextUpdatePropertyName, JSString*, (JSGlobalObject* globalObject, uint32_t index, int32_t modeNumber, JSPropertyNameEnumerator* enumerator))
     2489JSC_DEFINE_JIT_OPERATION(operationEnumeratorNextUpdatePropertyName, EncodedJSValue, (JSGlobalObject* globalObject, uint32_t index, int32_t modeNumber, JSPropertyNameEnumerator* enumerator))
    24902490{
    24912491    VM& vm = globalObject->vm();
    … …  
    24952495    if (modeNumber == JSPropertyNameEnumerator::IndexedMode) {
    24962496        if (index < enumerator->indexedLength())
    2497             return jsString(vm, Identifier::from(vm, index).string());
    2498         return vm.smallStrings.sentinelString();
     2497            return JSValue::encode(jsString(vm, Identifier::from(vm, index).string()));
     2498        return JSValue::encode(jsNull());
    24992499    }
    25002500
    25012501    JSString* result = enumerator->propertyNameAtIndex(index);
    25022502    if (!result)
    2503         return vm.smallStrings.sentinelString();
    2504 
    2505     return result;
     2503        return JSValue::encode(jsNull());
     2504
     2505    return JSValue::encode(result);
    25062506}
    25072507

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r283095 r283096  
    109109JSC_DECLARE_JIT_OPERATION(operationGetPropertyEnumeratorCell, JSCell*, (JSGlobalObject*, JSCell*));
    110110JSC_DECLARE_JIT_OPERATION(operationEnumeratorNextUpdateIndexAndMode, EncodedJSValue, (JSGlobalObject*, EncodedJSValue, uint32_t, int32_t, JSPropertyNameEnumerator*));
    111 JSC_DECLARE_JIT_OPERATION(operationEnumeratorNextUpdatePropertyName, JSString*, (JSGlobalObject*, uint32_t, int32_t, JSPropertyNameEnumerator*));
     111JSC_DECLARE_JIT_OPERATION(operationEnumeratorNextUpdatePropertyName, EncodedJSValue, (JSGlobalObject*, uint32_t, int32_t, JSPropertyNameEnumerator*));
    112112JSC_DECLARE_JIT_OPERATION(operationEnumeratorInByVal, EncodedJSValue, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, uint32_t, int32_t));
    113113JSC_DECLARE_JIT_OPERATION(operationEnumeratorHasOwnProperty, EncodedJSValue, (JSGlobalObject*, EncodedJSValue, EncodedJSValue, uint32_t, int32_t));

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r283095 r283096  
    12341234
    12351235        case EnumeratorNextUpdatePropertyName: {
    1236             setPrediction(SpecStringIdent);
     1236            setPrediction(SpecString | SpecOther);
    12371237            break;
    12381238        }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r283095 r283096  
    1364713647    SpeculateStrictInt32Operand modeOperand(this, node->child2());
    1364813648    SpeculateCellOperand enumeratorOperand(this, node->child3());
    13649     GPRTemporary result(this);
     13649    JSValueRegsTemporary resultTemp(this);
    1365013650
    1365113651    GPRReg index = indexOperand.gpr();
    1365213652    GPRReg mode = modeOperand.gpr();
    1365313653    GPRReg enumerator = enumeratorOperand.gpr();
    13654     GPRReg resultGPR = result.gpr();
     13654    JSValueRegs resultRegs = resultTemp.regs();
    1365513655
    1365613656    OptionSet seenModes = node->enumeratorMetadata();
    … …  
    1366813668        auto outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, index, MacroAssembler::Address(enumerator, JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
    1366913669
    13670         m_jit.loadPtr(MacroAssembler::Address(enumerator, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), resultGPR);
    13671         m_jit.loadPtr(MacroAssembler::BaseIndex(resultGPR, index, MacroAssembler::ScalePtr), resultGPR);
     13670        m_jit.loadPtr(MacroAssembler::Address(enumerator, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), resultRegs.payloadGPR());
     13671        m_jit.loadPtr(MacroAssembler::BaseIndex(resultRegs.payloadGPR(), index, MacroAssembler::ScalePtr), resultRegs.payloadGPR());
     13672#if USE(JSVALUE32_64)
     13673        m_jit.move(TrustedImm32(JSValue::CellTag), resultRegs.tagGPR());
     13674#endif
    1367213675        doneCases.append(m_jit.jump());
    1367313676
    1367413677        outOfBounds.link(&m_jit);
    13675         m_jit.move(TrustedImmPtr::weakPointer(m_graph, vm().smallStrings.sentinelString()), resultGPR);
     13678        m_jit.moveTrustedValue(jsNull(), resultRegs);
    1367613679        doneCases.append(m_jit.jump());
    1367713680        operationCall.link(&m_jit);
    1367813681    }
    1367913682
    13680     callOperation(operationEnumeratorNextUpdatePropertyName, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), index, mode, enumerator);
     13683    callOperation(operationEnumeratorNextUpdatePropertyName, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), index, mode, enumerator);
    1368113684    m_jit.exceptionCheck();
    1368213685
    1368313686    doneCases.link(&m_jit);
    13684     cellResult(resultGPR, node);
     13687    jsValueResult(resultRegs, node);
    1368513688}
    1368613689

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r283095 r283096  
    1352713527            {
    1352813528                m_out.appendTo(outOfBoundsBlock);
    13529                 results.append(m_out.anchor(weakPointer(vm().smallStrings.sentinelString())));
     13529                results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsNull()))));
    1353013530                m_out.jump(continuation);
    1353113531            }
    … …  
    1353413534                m_out.appendTo(loadPropertyNameBlock);
    1353513535                LValue namesVector = m_out.loadPtr(enumerator, m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVector);
    13536                 results.append(m_out.anchor(m_out.loadPtr(m_out.baseIndex(m_heaps.WriteBarrierBuffer_bufferContents.atAnyIndex(), namesVector, m_out.zeroExt(index, Int64), ScalePtr))));
     13536                results.append(m_out.anchor(m_out.zeroExtPtr(m_out.loadPtr(m_out.baseIndex(m_heaps.WriteBarrierBuffer_bufferContents.atAnyIndex(), namesVector, m_out.zeroExt(index, Int64), ScalePtr)))));
    1353713537                m_out.jump(continuation);
    1353813538            }
    … …  
    1354213542            m_out.appendTo(operationBlock);
    1354313543        // Note: We can't omit the operation because we have no guarantee that the mode will match what we profiled.
    13544         results.append(m_out.anchor(vmCall(pointerType(), operationEnumeratorNextUpdatePropertyName, weakPointer(globalObject), index, mode, enumerator)));
     13544        results.append(m_out.anchor(vmCall(Int64, operationEnumeratorNextUpdatePropertyName, weakPointer(globalObject), index, mode, enumerator)));
    1354513545        if (continuation) {
    1354613546            m_out.jump(continuation);
    … …  
    1354913549
    1355013550        ASSERT(results.size());
    13551         LValue result = m_out.phi(pointerType(), results);
     13551        LValue result = m_out.phi(Int64, results);
    1355213552        setJSValue(result);
    1355313553    }

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r283095 r283096  
    388388        DEFINE_OP(op_jundefined_or_null)
    389389        DEFINE_OP(op_jnundefined_or_null)
    390         DEFINE_OP(op_jeq_ptr)
    391390        DEFINE_OP(op_jneq_ptr)
    392391        DEFINE_OP(op_jless)

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r283095 r283096  
    462462        void emit_op_jundefined_or_null(const Instruction*);
    463463        void emit_op_jnundefined_or_null(const Instruction*);
    464         void emit_op_jeq_ptr(const Instruction*);
    465464        void emit_op_jneq_ptr(const Instruction*);
    466465        void emit_op_jless(const Instruction*);

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r283095 r283096  
    580580}
    581581
    582 void JIT::emit_op_jeq_ptr(const Instruction* currentInstruction)
    583 {
    584     auto bytecode = currentInstruction->as<OpJeqPtr>();
    585     VirtualRegister src = bytecode.m_value;
    586     JSValue specialPointer = getConstantOperand(bytecode.m_specialPointer);
    587     ASSERT(specialPointer.isCell());
    588     unsigned target = jumpTarget(currentInstruction, bytecode.m_targetLabel);
    589 
    590     emitGetVirtualRegister(src, regT0);
    591     addJump(branchPtr(Equal, regT0, TrustedImmPtr(specialPointer.asCell())), target);
    592 }
    593 
    594582void JIT::emit_op_jneq_ptr(const Instruction* currentInstruction)
    595583{

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r283095 r283096  
    502502}
    503503
    504 void JIT::emit_op_jeq_ptr(const Instruction* currentInstruction)
    505 {
    506     auto bytecode = currentInstruction->as<OpJeqPtr>();
    507     auto& metadata = bytecode.metadata(m_profiledCodeBlock);
    508     VirtualRegister src = bytecode.m_value;
    509     JSValue specialPointer = getConstantOperand(bytecode.m_specialPointer);
    510     ASSERT(specialPointer.isCell());
    511     unsigned target = jumpTarget(currentInstruction, bytecode.m_targetLabel);
    512 
    513     emitLoad(src, regT1, regT0);
    514     Jump notCell = branchIfNotCell(regT1);
    515     addJump(branchPtr(Equal, regT0, TrustedImmPtr(specialPointer.asCell())), target);
    516     notCell.link(this);
    517 }
    518 
    519504void JIT::emit_op_jneq_ptr(const Instruction* currentInstruction)
    520505{

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r283095 r283096  
    28672867
    28682868        outOfBounds.link(this);
    2869         storeTrustedValue(vm().smallStrings.sentinelString(), addressFor(propertyName));
     2869        storeTrustedValue(jsNull(), addressFor(propertyName));
    28702870        done.append(jump());
    28712871    }

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r283095 r283096  
    19451945    macro (value, target) bineq value, NullTag, target end)
    19461946
    1947 llintOpWithReturn(op_jeq_ptr, OpJeqPtr, macro (size, get, dispatch, return)
    1948     get(m_value, t0)
    1949     get(m_specialPointer, t1)
    1950     loadConstant(size, t1, t3, t2)
    1951     bineq TagOffset[cfr, t0, 8], CellTag, .opJeqPtrFallThrough
    1952     bpneq PayloadOffset[cfr, t0, 8], t2, .opJeqPtrFallThrough
    1953 .opJeqPtrBranch:
    1954     get(m_targetLabel, t0)
    1955     jumpImpl(dispatchIndirect, t0)
    1956 .opJeqPtrFallThrough:
    1957     dispatch()
    1958 end)
    1959 
    1960 
    19611947llintOpWithMetadata(op_jneq_ptr, OpJneqPtr, macro (size, get, dispatch, metadata, return)
    19621948    get(m_value, t0)

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r283095 r283096  
    20722072undefinedOrNullJumpOp(jnundefined_or_null, OpJnundefinedOrNull,
    20732073    macro (value, target) bqneq value, ValueNull, target end)
    2074 
    2075 llintOpWithReturn(op_jeq_ptr, OpJeqPtr, macro (size, get, dispatch, return)
    2076     get(m_value, t0)
    2077     get(m_specialPointer, t1)
    2078     loadConstant(size, t1, t2)
    2079     bpeq t2, [cfr, t0, 8], .opJeqPtrTarget
    2080     dispatch()
    2081 
    2082 .opJeqPtrTarget:
    2083     get(m_targetLabel, t0)
    2084     jumpImpl(dispatchIndirect, t0)
    2085 end)
    2086 
    20872074
    20882075llintOpWithMetadata(op_jneq_ptr, OpJneqPtr, macro (size, get, dispatch, metadata, return)

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r283095 r283096  
    10021002    modeRegister = jsNumber(static_cast<uint8_t>(mode));
    10031003    indexRegister = jsNumber(index);
    1004     nameRegister = name ? name : vm.smallStrings.sentinelString();
     1004    nameRegister = name ? name : jsNull();
    10051005    END();
    10061006}

  • trunk/Source/JavaScriptCore/runtime/SmallStrings.cpp

    r283095 r283096  
    6363    initialize(&vm, m_timedOutString, "timed-out");
    6464    initialize(&vm, m_okString, "ok");
    65     initialize(&vm, m_sentinelString, "$");
    6665
    6766    setIsInitialized(true);
    … …  
    8584    visitor.appendUnbarriered(m_timedOutString);
    8685    visitor.appendUnbarriered(m_okString);
    87     visitor.appendUnbarriered(m_sentinelString);
    8886}
    8987

  • trunk/Source/JavaScriptCore/runtime/SmallStrings.h

    r283095 r283096  
    120120    JSString* timedOutString() const { return m_timedOutString; }
    121121    JSString* okString() const { return m_okString; }
    122     JSString* sentinelString() const { return m_sentinelString; }
    123122
    124123    bool needsToBeVisited(CollectionScope scope) const
    … …  
    145144    JSString* m_timedOutString { nullptr };
    146145    JSString* m_okString { nullptr };
    147     JSString* m_sentinelString { nullptr };
    148146    JSString* m_singleCharacterStrings[singleCharacterStringCount] { nullptr };
    149147    bool m_needsToBeVisited { true };
Note: See TracChangeset for help on using the changeset viewer.