Changeset 188201 in webkit


Ignore:
Timestamp:
Aug 9, 2015 3:55:54 PM (9 years ago)
Author:
Chris Dumez
Message:

Regression(r188105): Seems to have caused crashes during PLT on some iPads
​https://bugs.webkit.org/show_bug.cgi?id=147818

Unreviewed, roll out r188105.

Source/JavaScriptCore:

  • bytecode/ByValInfo.h:

(JSC::ByValInfo::ByValInfo):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::getByValInfoMap): Deleted.
(JSC::CodeBlock::addByValInfo): Deleted.

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::getByValInfo):
(JSC::CodeBlock::setNumberOfByValInfos):
(JSC::CodeBlock::numberOfByValInfos):
(JSC::CodeBlock::byValInfo):

  • bytecode/ExitKind.cpp:

(JSC::exitKindToString): Deleted.

  • bytecode/ExitKind.h:
  • bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFor):
(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback): Deleted.

  • bytecode/GetByIdStatus.h:
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Deleted.

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize): Deleted.

  • dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC): Deleted.

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode): Deleted.
(JSC::DFG::FixupPhase::observeUseKindOnNode): Deleted.

  • dfg/DFGNode.h:

(JSC::DFG::Node::hasUidOperand): Deleted.
(JSC::DFG::Node::uidOperand): Deleted.

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate): Deleted.

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()): Deleted.
(JSC::DFG::safeToExecute): Deleted.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
(JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
(JSC::DFG::SpeculativeJIT::speculate): Deleted.

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile): Deleted.

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile): Deleted.

  • dfg/DFGUseKind.cpp:

(WTF::printInternal): Deleted.

  • dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor): Deleted.
(JSC::DFG::isCell): Deleted.

  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile): Deleted.

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::speculate): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol): Deleted.

  • jit/JIT.cpp:

(JSC::JIT::privateCompile):

  • jit/JIT.h:

(JSC::ByValCompilationInfo::ByValCompilationInfo):
(JSC::JIT::compileGetByValWithCachedId): Deleted.

  • jit/JITInlines.h:

(JSC::JIT::callOperation): Deleted.

  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_has_indexed_property):
(JSC::JIT::emitSlow_op_has_indexed_property):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_has_indexed_property):
(JSC::JIT::emitSlow_op_has_indexed_property):

  • jit/JITOperations.cpp:

(JSC::getByVal):

  • jit/JITOperations.h:
  • jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitGetByValWithCachedId): Deleted.
(JSC::JIT::privateCompileGetByVal): Deleted.
(JSC::JIT::privateCompileGetByValWithCachedId): Deleted.

  • jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitGetByValWithCachedId): Deleted.

  • runtime/Symbol.h:
  • tests/stress/get-by-val-with-string-constructor.js: Removed.
  • tests/stress/get-by-val-with-string-exit.js: Removed.
  • tests/stress/get-by-val-with-string-generated.js: Removed.
  • tests/stress/get-by-val-with-string-getter.js: Removed.
  • tests/stress/get-by-val-with-string.js: Removed.
  • tests/stress/get-by-val-with-symbol-constructor.js: Removed.
  • tests/stress/get-by-val-with-symbol-exit.js: Removed.
  • tests/stress/get-by-val-with-symbol-getter.js: Removed.
  • tests/stress/get-by-val-with-symbol.js: Removed.

LayoutTests:

  • js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt: Removed.
  • js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
  • js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html: Removed.
  • js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html: Removed.
  • js/regress/get-by-val-with-string-chain-from-try-block-expected.txt: Removed.
  • js/regress/get-by-val-with-string-chain-from-try-block.html: Removed.
  • js/regress/get-by-val-with-string-check-structure-elimination-expected.txt: Removed.
  • js/regress/get-by-val-with-string-check-structure-elimination.html: Removed.
  • js/regress/get-by-val-with-string-proto-or-self-expected.txt: Removed.
  • js/regress/get-by-val-with-string-proto-or-self.html: Removed.
  • js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
  • js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html: Removed.
  • js/regress/get-by-val-with-string-self-or-proto-expected.txt: Removed.
  • js/regress/get-by-val-with-string-self-or-proto.html: Removed.
  • js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html: Removed.
  • js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html: Removed.
  • js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-chain-from-try-block.html: Removed.
  • js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-check-structure-elimination.html: Removed.
  • js/regress/get-by-val-with-symbol-proto-or-self-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-proto-or-self.html: Removed.
  • js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html: Removed.
  • js/regress/get-by-val-with-symbol-self-or-proto-expected.txt: Removed.
  • js/regress/get-by-val-with-symbol-self-or-proto.html: Removed.
  • js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js: Removed.
  • js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js: Removed.
  • js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js: Removed.
  • js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js: Removed.
  • js/regress/script-tests/get-by-val-with-string-proto-or-self.js: Removed.
  • js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js: Removed.
  • js/regress/script-tests/get-by-val-with-string-self-or-proto.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js: Removed.
  • js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js: Removed.
Location:
trunk
Files:
51 deleted
38 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r188195 r188201  
     12015-08-09  Chris Dumez  <cdumez@apple.com>
     2
     3        Regression(r188105): Seems to have caused crashes during PLT on some iPads
     4        https://bugs.webkit.org/show_bug.cgi?id=147818
     5
     6        Unreviewed, roll out r188105.
     7
     8        * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt: Removed.
     9        * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
     10        * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html: Removed.
     11        * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html: Removed.
     12        * js/regress/get-by-val-with-string-chain-from-try-block-expected.txt: Removed.
     13        * js/regress/get-by-val-with-string-chain-from-try-block.html: Removed.
     14        * js/regress/get-by-val-with-string-check-structure-elimination-expected.txt: Removed.
     15        * js/regress/get-by-val-with-string-check-structure-elimination.html: Removed.
     16        * js/regress/get-by-val-with-string-proto-or-self-expected.txt: Removed.
     17        * js/regress/get-by-val-with-string-proto-or-self.html: Removed.
     18        * js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
     19        * js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html: Removed.
     20        * js/regress/get-by-val-with-string-self-or-proto-expected.txt: Removed.
     21        * js/regress/get-by-val-with-string-self-or-proto.html: Removed.
     22        * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt: Removed.
     23        * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
     24        * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html: Removed.
     25        * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html: Removed.
     26        * js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt: Removed.
     27        * js/regress/get-by-val-with-symbol-chain-from-try-block.html: Removed.
     28        * js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt: Removed.
     29        * js/regress/get-by-val-with-symbol-check-structure-elimination.html: Removed.
     30        * js/regress/get-by-val-with-symbol-proto-or-self-expected.txt: Removed.
     31        * js/regress/get-by-val-with-symbol-proto-or-self.html: Removed.
     32        * js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
     33        * js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html: Removed.
     34        * js/regress/get-by-val-with-symbol-self-or-proto-expected.txt: Removed.
     35        * js/regress/get-by-val-with-symbol-self-or-proto.html: Removed.
     36        * js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js: Removed.
     37        * js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js: Removed.
     38        * js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js: Removed.
     39        * js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js: Removed.
     40        * js/regress/script-tests/get-by-val-with-string-proto-or-self.js: Removed.
     41        * js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js: Removed.
     42        * js/regress/script-tests/get-by-val-with-string-self-or-proto.js: Removed.
     43        * js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js: Removed.
     44        * js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js: Removed.
     45        * js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js: Removed.
     46        * js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js: Removed.
     47        * js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js: Removed.
     48        * js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js: Removed.
     49        * js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js: Removed.
     50
    1512015-08-09  Myles C. Maxfield  <mmaxfield@apple.com>
    252

  • trunk/Source/JavaScriptCore/ChangeLog

    r188187 r188201  
     12015-08-09  Chris Dumez  <cdumez@apple.com>
     2
     3        Regression(r188105): Seems to have caused crashes during PLT on some iPads
     4        https://bugs.webkit.org/show_bug.cgi?id=147818
     5
     6        Unreviewed, roll out r188105.
     7
     8        * bytecode/ByValInfo.h:
     9        (JSC::ByValInfo::ByValInfo):
     10        * bytecode/CodeBlock.cpp:
     11        (JSC::CodeBlock::getByValInfoMap): Deleted.
     12        (JSC::CodeBlock::addByValInfo): Deleted.
     13        * bytecode/CodeBlock.h:
     14        (JSC::CodeBlock::getByValInfo):
     15        (JSC::CodeBlock::setNumberOfByValInfos):
     16        (JSC::CodeBlock::numberOfByValInfos):
     17        (JSC::CodeBlock::byValInfo):
     18        * bytecode/ExitKind.cpp:
     19        (JSC::exitKindToString): Deleted.
     20        * bytecode/ExitKind.h:
     21        * bytecode/GetByIdStatus.cpp:
     22        (JSC::GetByIdStatus::computeFor):
     23        (JSC::GetByIdStatus::computeForStubInfo):
     24        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback): Deleted.
     25        * bytecode/GetByIdStatus.h:
     26        * dfg/DFGAbstractInterpreterInlines.h:
     27        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
     28        * dfg/DFGByteCodeParser.cpp:
     29        (JSC::DFG::ByteCodeParser::parseBlock):
     30        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Deleted.
     31        * dfg/DFGClobberize.h:
     32        (JSC::DFG::clobberize): Deleted.
     33        * dfg/DFGConstantFoldingPhase.cpp:
     34        (JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
     35        * dfg/DFGDoesGC.cpp:
     36        (JSC::DFG::doesGC): Deleted.
     37        * dfg/DFGFixupPhase.cpp:
     38        (JSC::DFG::FixupPhase::fixupNode): Deleted.
     39        (JSC::DFG::FixupPhase::observeUseKindOnNode): Deleted.
     40        * dfg/DFGNode.h:
     41        (JSC::DFG::Node::hasUidOperand): Deleted.
     42        (JSC::DFG::Node::uidOperand): Deleted.
     43        * dfg/DFGNodeType.h:
     44        * dfg/DFGPredictionPropagationPhase.cpp:
     45        (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
     46        * dfg/DFGSafeToExecute.h:
     47        (JSC::DFG::SafeToExecuteEdge::operator()): Deleted.
     48        (JSC::DFG::safeToExecute): Deleted.
     49        * dfg/DFGSpeculativeJIT.cpp:
     50        (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
     51        (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
     52        (JSC::DFG::SpeculativeJIT::speculate): Deleted.
     53        * dfg/DFGSpeculativeJIT.h:
     54        * dfg/DFGSpeculativeJIT32_64.cpp:
     55        (JSC::DFG::SpeculativeJIT::compile): Deleted.
     56        * dfg/DFGSpeculativeJIT64.cpp:
     57        (JSC::DFG::SpeculativeJIT::compile): Deleted.
     58        * dfg/DFGUseKind.cpp:
     59        (WTF::printInternal): Deleted.
     60        * dfg/DFGUseKind.h:
     61        (JSC::DFG::typeFilterFor): Deleted.
     62        (JSC::DFG::isCell): Deleted.
     63        * ftl/FTLAbstractHeapRepository.h:
     64        * ftl/FTLCapabilities.cpp:
     65        (JSC::FTL::canCompile): Deleted.
     66        * ftl/FTLLowerDFGToLLVM.cpp:
     67        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
     68        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent): Deleted.
     69        (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol): Deleted.
     70        (JSC::FTL::DFG::LowerDFGToLLVM::speculate): Deleted.
     71        (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol): Deleted.
     72        (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol): Deleted.
     73        * jit/JIT.cpp:
     74        (JSC::JIT::privateCompile):
     75        * jit/JIT.h:
     76        (JSC::ByValCompilationInfo::ByValCompilationInfo):
     77        (JSC::JIT::compileGetByValWithCachedId): Deleted.
     78        * jit/JITInlines.h:
     79        (JSC::JIT::callOperation): Deleted.
     80        * jit/JITOpcodes.cpp:
     81        (JSC::JIT::emit_op_has_indexed_property):
     82        (JSC::JIT::emitSlow_op_has_indexed_property):
     83        * jit/JITOpcodes32_64.cpp:
     84        (JSC::JIT::emit_op_has_indexed_property):
     85        (JSC::JIT::emitSlow_op_has_indexed_property):
     86        * jit/JITOperations.cpp:
     87        (JSC::getByVal):
     88        * jit/JITOperations.h:
     89        * jit/JITPropertyAccess.cpp:
     90        (JSC::JIT::emit_op_get_by_val):
     91        (JSC::JIT::emitSlow_op_get_by_val):
     92        (JSC::JIT::emit_op_put_by_val):
     93        (JSC::JIT::emitSlow_op_put_by_val):
     94        (JSC::JIT::emitGetByValWithCachedId): Deleted.
     95        (JSC::JIT::privateCompileGetByVal): Deleted.
     96        (JSC::JIT::privateCompileGetByValWithCachedId): Deleted.
     97        * jit/JITPropertyAccess32_64.cpp:
     98        (JSC::JIT::emit_op_get_by_val):
     99        (JSC::JIT::emitSlow_op_get_by_val):
     100        (JSC::JIT::emit_op_put_by_val):
     101        (JSC::JIT::emitSlow_op_put_by_val):
     102        (JSC::JIT::emitGetByValWithCachedId): Deleted.
     103        * runtime/Symbol.h:
     104        * tests/stress/get-by-val-with-string-constructor.js: Removed.
     105        * tests/stress/get-by-val-with-string-exit.js: Removed.
     106        * tests/stress/get-by-val-with-string-generated.js: Removed.
     107        * tests/stress/get-by-val-with-string-getter.js: Removed.
     108        * tests/stress/get-by-val-with-string.js: Removed.
     109        * tests/stress/get-by-val-with-symbol-constructor.js: Removed.
     110        * tests/stress/get-by-val-with-symbol-exit.js: Removed.
     111        * tests/stress/get-by-val-with-symbol-getter.js: Removed.
     112        * tests/stress/get-by-val-with-symbol.js: Removed.
     113
    11142015-08-07  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
    2115

  • trunk/Source/JavaScriptCore/bytecode/ByValInfo.h

    r188105 r188201  
    2727#define ByValInfo_h
    2828
     29#if ENABLE(JIT)
     30
    2931#include "ClassInfo.h"
    3032#include "CodeLocation.h"
    31 #include "CodeOrigin.h"
    3233#include "IndexingType.h"
    3334#include "JITStubRoutine.h"
    3435#include "Structure.h"
    35 #include "StructureStubInfo.h"
    3636
    3737namespace JSC {
    38 
    39 #if ENABLE(JIT)
    4038
    4139enum JITArrayMode {
    … …  
    204202struct ByValInfo {
    205203    ByValInfo() { }
    206 
    207     ByValInfo(unsigned bytecodeIndex, CodeLocationJump notIndexJump, CodeLocationJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, int16_t badTypeJumpToDone, int16_t returnAddressToSlowPath)
     204   
     205    ByValInfo(unsigned bytecodeIndex, CodeLocationJump badTypeJump, JITArrayMode arrayMode, int16_t badTypeJumpToDone, int16_t returnAddressToSlowPath)
    208206        : bytecodeIndex(bytecodeIndex)
    209         , notIndexJump(notIndexJump)
    210207        , badTypeJump(badTypeJump)
    211208        , arrayMode(arrayMode)
    212         , arrayProfile(arrayProfile)
    213209        , badTypeJumpToDone(badTypeJumpToDone)
    214210        , returnAddressToSlowPath(returnAddressToSlowPath)
    215211        , slowPathCount(0)
    216         , stubInfo(nullptr)
    217         , tookSlowPath(false)
    218212    {
    219213    }
    220 
     214   
    221215    unsigned bytecodeIndex;
    222     CodeLocationJump notIndexJump;
    223216    CodeLocationJump badTypeJump;
    224217    JITArrayMode arrayMode; // The array mode that was baked into the inline JIT code.
    225     ArrayProfile* arrayProfile;
    226218    int16_t badTypeJumpToDone;
    227219    int16_t returnAddressToSlowPath;
    228220    unsigned slowPathCount;
    229221    RefPtr<JITStubRoutine> stubRoutine;
    230     Identifier cachedId;
    231     StructureStubInfo* stubInfo;
    232     bool tookSlowPath;
    233222};
    234223
    … …  
    238227}
    239228
    240 typedef HashMap<CodeOrigin, ByValInfo*, CodeOriginApproximateHash> ByValInfoMap;
    241 
    242 #else // ENABLE(JIT)
    243 
    244 typedef HashMap<int, void*> ByValInfoMap;
     229} // namespace JSC
    245230
    246231#endif // ENABLE(JIT)
    247232
    248 } // namespace JSC
    249 
    250233#endif // ByValInfo_h
    251234

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r188136 r188201  
    26732673}
    26742674
    2675 void CodeBlock::getByValInfoMap(const ConcurrentJITLocker&, ByValInfoMap& result)
    2676 {
    2677 #if ENABLE(JIT)
    2678     for (auto* byValInfo : m_byValInfos)
    2679         result.add(CodeOrigin(byValInfo->bytecodeIndex), byValInfo);
    2680 #else
    2681     UNUSED_PARAM(result);
    2682 #endif
    2683 }
    2684 
    2685 void CodeBlock::getByValInfoMap(ByValInfoMap& result)
    2686 {
    2687     ConcurrentJITLocker locker(m_lock);
    2688     getByValInfoMap(locker, result);
    2689 }
    2690 
    26912675#if ENABLE(JIT)
    26922676StructureStubInfo* CodeBlock::addStubInfo()
    … …  
    27032687    }
    27042688    return nullptr;
    2705 }
    2706 
    2707 ByValInfo* CodeBlock::addByValInfo()
    2708 {
    2709     ConcurrentJITLocker locker(m_lock);
    2710     return m_byValInfos.add();
    27112689}
    27122690

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r188105 r188201  
    201201    void getCallLinkInfoMap(const ConcurrentJITLocker&, CallLinkInfoMap& result);
    202202    void getCallLinkInfoMap(CallLinkInfoMap& result);
    203 
    204     void getByValInfoMap(const ConcurrentJITLocker&, ByValInfoMap& result);
    205     void getByValInfoMap(ByValInfoMap& result);
    206203   
    207204#if ENABLE(JIT)
    … …  
    215212
    216213    void resetStub(StructureStubInfo&);
    217 
    218     ByValInfo* addByValInfo();
     214   
     215    ByValInfo& getByValInfo(unsigned bytecodeIndex)
     216    {
     217        return *(binarySearch<ByValInfo, unsigned>(m_byValInfos, m_byValInfos.size(), bytecodeIndex, getByValInfoBytecodeIndex));
     218    }
    219219
    220220    CallLinkInfo* addCallLinkInfo();
    … …  
    367367
    368368    String nameForRegister(VirtualRegister);
     369
     370#if ENABLE(JIT)
     371    void setNumberOfByValInfos(size_t size) { m_byValInfos.resizeToFit(size); }
     372    size_t numberOfByValInfos() const { return m_byValInfos.size(); }
     373    ByValInfo& byValInfo(size_t index) { return m_byValInfos[index]; }
     374#endif
    369375
    370376    unsigned numberOfArgumentValueProfiles()
    … …  
    10111017#if ENABLE(JIT)
    10121018    Bag<StructureStubInfo> m_stubInfos;
    1013     Bag<ByValInfo> m_byValInfos;
     1019    Vector<ByValInfo> m_byValInfos;
    10141020    Bag<CallLinkInfo> m_callLinkInfos;
    10151021    SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo>> m_incomingCalls;

  • trunk/Source/JavaScriptCore/bytecode/ExitKind.cpp

    r188105 r188201  
    4141    case BadCell:
    4242        return "BadCell";
    43     case BadIdent:
    44         return "BadIdent";
    4543    case BadExecutable:
    4644        return "BadExecutable";

  • trunk/Source/JavaScriptCore/bytecode/ExitKind.h

    r188105 r188201  
    3333    BadType, // We exited because a type prediction was wrong.
    3434    BadCell, // We exited because we made an incorrect assumption about what cell we would see. Usually used for function checks.
    35     BadIdent, // We exited because we made an incorrect assumption about what identifier we would see. Usually used for cached Id check in get_by_val.
    3635    BadExecutable, // We exited because we made an incorrect assumption about what executable we would see.
    3736    BadCache, // We exited because an inline cache was wrong.

  • trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp

    r188105 r188201  
    9999
    100100#if ENABLE(DFG_JIT)
    101     result = computeForStubInfoWithoutExitSiteFeedback(
     101    result = computeForStubInfo(
    102102        locker, profiledBlock, map.get(CodeOrigin(bytecodeIndex)), uid,
    103103        CallLinkStatus::computeExitSiteData(locker, profiledBlock, bytecodeIndex));
    … …  
    117117
    118118#if ENABLE(JIT)
    119 GetByIdStatus GetByIdStatus::computeForStubInfo(const ConcurrentJITLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin, UniquedStringImpl* uid)
    120 {
    121     GetByIdStatus result = GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
    122         locker, profiledBlock, stubInfo, uid,
    123         CallLinkStatus::computeExitSiteData(locker, profiledBlock, codeOrigin.bytecodeIndex));
    124 
    125     if (!result.takesSlowPath() && GetByIdStatus::hasExitSite(locker, profiledBlock, codeOrigin.bytecodeIndex))
    126         return GetByIdStatus(result.makesCalls() ? GetByIdStatus::MakesCalls : GetByIdStatus::TakesSlowPath, true);
    127     return result;
    128 }
    129 #endif // ENABLE(JIT)
    130 
    131 #if ENABLE(JIT)
    132 GetByIdStatus GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
     119GetByIdStatus GetByIdStatus::computeForStubInfo(
    133120    const ConcurrentJITLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, UniquedStringImpl* uid,
    134121    CallLinkStatus::ExitSiteData callExitSiteData)
    … …  
    256243        {
    257244            ConcurrentJITLocker locker(dfgBlock->m_lock);
    258             result = computeForStubInfoWithoutExitSiteFeedback(
     245            result = computeForStubInfo(
    259246                locker, dfgBlock, dfgMap.get(codeOrigin), uid, exitSiteData);
    260247        }

  • trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h

    r188105 r188201  
    7272   
    7373    static GetByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, UniquedStringImpl* uid);
    74 
    75 #if ENABLE(JIT)
    76     static GetByIdStatus computeForStubInfo(const ConcurrentJITLocker&, CodeBlock* baselineBlock, StructureStubInfo*, CodeOrigin, UniquedStringImpl* uid);
    77 #endif
    78 
     74   
    7975    State state() const { return m_state; }
    8076   
    … …  
    10096#endif
    10197#if ENABLE(JIT)
    102     static GetByIdStatus computeForStubInfoWithoutExitSiteFeedback(
     98    static GetByIdStatus computeForStubInfo(
    10399        const ConcurrentJITLocker&, CodeBlock* profiledBlock, StructureStubInfo*,
    104100        UniquedStringImpl* uid, CallLinkStatus::ExitSiteData);

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r188105 r188201  
    21642164    }
    21652165
    2166     case CheckIdent: {
    2167         AbstractValue& value = forNode(node->child1());
    2168         UniquedStringImpl* uid = node->uidOperand();
    2169         ASSERT(uid->isSymbol() ? !(value.m_type & ~SpecSymbol) : !(value.m_type & ~SpecStringIdent)); // Edge filtering should have already ensured this.
    2170 
    2171         JSValue childConstant = value.value();
    2172         if (childConstant) {
    2173             if (uid->isSymbol()) {
    2174                 ASSERT(childConstant.isSymbol());
    2175                 if (asSymbol(childConstant)->privateName().uid() == uid) {
    2176                     m_state.setFoundConstants(true);
    2177                     break;
    2178                 }
    2179             } else {
    2180                 ASSERT(childConstant.isString());
    2181                 if (asString(childConstant)->tryGetValueImpl() == uid) {
    2182                     m_state.setFoundConstants(true);
    2183                     break;
    2184                 }
    2185             }
    2186         }
    2187 
    2188         filter(value, uid->isSymbol() ? SpecSymbol : SpecStringIdent);
    2189         break;
    2190     }
    2191 
    21922166    case CheckInBounds: {
    21932167        JSValue left = forNode(node->child1()).value();

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r188105 r188201  
    970970        CallLinkInfoMap m_callLinkInfos;
    971971        StubInfoMap m_stubInfos;
    972         ByValInfoMap m_byValInfos;
    973972       
    974973        // Did we see any returns? We need to handle the (uncommon but necessary)
    … …  
    33993398        case op_get_by_val: {
    34003399            SpeculatedType prediction = getPredictionWithoutOSRExit();
    3401 
     3400           
    34023401            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
     3402            ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
    34033403            Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
    3404             bool compiledAsGetById = false;
    3405             {
    3406                 ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
    3407                 ByValInfo* byValInfo = m_inlineStackTop->m_byValInfos.get(CodeOrigin(currentCodeOrigin().bytecodeIndex));
    3408                 // FIXME: When the bytecode is not compiled in the baseline JIT, byValInfo becomes null.
    3409                 // At that time, there is no information.
    3410                 if (byValInfo && byValInfo->stubInfo && !byValInfo->tookSlowPath && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIdent)) {
    3411                     compiledAsGetById = true;
    3412                     unsigned identifierNumber = m_graph.identifiers().ensure(byValInfo->cachedId.impl());
    3413                     UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
    3414 
    3415                     addToGraph(CheckIdent, OpInfo(uid), property);
    3416 
    3417                     GetByIdStatus getByIdStatus = GetByIdStatus::computeForStubInfo(
    3418                         locker, m_inlineStackTop->m_profiledBlock,
    3419                         byValInfo->stubInfo, currentCodeOrigin(), uid);
    3420 
    3421                     handleGetById(currentInstruction[1].u.operand, prediction, base, identifierNumber, getByIdStatus);
    3422                 }
    3423             }
    3424 
    3425             if (!compiledAsGetById) {
    3426                 ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
    3427                 Node* getByVal = addToGraph(GetByVal, OpInfo(arrayMode.asWord()), OpInfo(prediction), base, property);
    3428                 set(VirtualRegister(currentInstruction[1].u.operand), getByVal);
    3429             }
     3404            Node* getByVal = addToGraph(GetByVal, OpInfo(arrayMode.asWord()), OpInfo(prediction), base, property);
     3405            set(VirtualRegister(currentInstruction[1].u.operand), getByVal);
    34303406
    34313407            NEXT_OPCODE(op_get_by_val);
    … …  
    43304306            m_profiledBlock->getStubInfoMap(locker, m_stubInfos);
    43314307            m_profiledBlock->getCallLinkInfoMap(locker, m_callLinkInfos);
    4332             m_profiledBlock->getByValInfoMap(locker, m_byValInfos);
    43334308        }
    43344309    }

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r188105 r188201  
    269269        return;
    270270
    271     case CheckIdent:
    272         def(PureValue(CheckIdent, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->uidOperand()));
    273         return;
    274 
    275271    case ConstantStoragePointer:
    276272        def(PureValue(node, node->storagePointer()));

  • trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

    r188105 r188201  
    209209            }
    210210
    211             case CheckIdent: {
    212                 UniquedStringImpl* uid = node->uidOperand();
    213                 JSValue childConstant = m_state.forNode(node->child1()).value();
    214                 const UniquedStringImpl* constantUid = nullptr;
    215                 if (childConstant) {
    216                     if (uid->isSymbol()) {
    217                         if (childConstant.isSymbol())
    218                             constantUid = asSymbol(childConstant)->privateName().uid();
    219                     } else {
    220                         if (childConstant.isString()) {
    221                             // Since we already filtered the value with StringIdentUse,
    222                             // the held impl is always atomic.
    223                             if (const auto* impl = asString(childConstant)->tryGetValueImpl()) {
    224                                 ASSERT(impl->isAtomic());
    225                                 constantUid = static_cast<const UniquedStringImpl*>(impl);
    226                             }
    227                         }
    228                     }
    229                 }
    230 
    231                 if (constantUid == uid) {
    232                     node->remove();
    233                     eliminated = true;
    234                 }
    235                 break;
    236             }
    237 
    238211            case CheckInBounds: {
    239212                JSValue left = m_state.forNode(node->child1()).value();

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r188105 r188201  
    108108    case CheckCell:
    109109    case CheckNotEmpty:
    110     case CheckIdent:
    111110    case RegExpExec:
    112111    case RegExpTest:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r188105 r188201  
    10131013            break;
    10141014        }
    1015 
    1016         case CheckIdent: {
    1017             UniquedStringImpl* uid = node->uidOperand();
    1018             if (uid->isSymbol())
    1019                 fixEdge<SymbolUse>(node->child1());
    1020             else
    1021                 fixEdge<StringIdentUse>(node->child1());
    1022             break;
    1023         }
    10241015           
    10251016        case Arrayify:
    … …  
    17701761        case StringUse:
    17711762        case KnownStringUse:
    1772         case SymbolUse:
    17731763        case StringObjectUse:
    17741764        case StringOrStringObjectUse:

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r188105 r188201  
    13291329    }
    13301330
    1331     bool hasUidOperand()
    1332     {
    1333         return op() == CheckIdent;
    1334     }
    1335 
    1336     UniquedStringImpl* uidOperand()
    1337     {
    1338         ASSERT(hasUidOperand());
    1339         return reinterpret_cast<UniquedStringImpl*>(m_opInfo);
    1340     }
    1341 
    13421331    bool hasTransition()
    13431332    {

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r188105 r188201  
    210210    macro(CheckBadCell, NodeMustGenerate) \
    211211    macro(CheckInBounds, NodeMustGenerate) \
    212     macro(CheckIdent, NodeMustGenerate) \
    213212    \
    214213    /* Optimizations for array mutation. */\

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r188105 r188201  
    650650        case CheckCell:
    651651        case CheckNotEmpty:
    652         case CheckIdent:
    653652        case CheckBadCell:
    654653        case PutStructure:

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r188105 r188201  
    6060        case StringIdentUse:
    6161        case StringUse:
    62         case SymbolUse:
    6362        case StringObjectUse:
    6463        case StringOrStringObjectUse:
    … …  
    190189    case CheckBadCell:
    191190    case CheckNotEmpty:
    192     case CheckIdent:
    193191    case RegExpExec:
    194192    case RegExpTest:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r188105 r188201  
    45774577}
    45784578
    4579 void SpeculativeJIT::compileCheckIdent(Node* node)
    4580 {
    4581     SpeculateCellOperand operand(this, node->child1());
    4582     UniquedStringImpl* uid = node->uidOperand();
    4583     if (uid->isSymbol()) {
    4584         speculateSymbol(node->child1(), operand.gpr());
    4585         speculationCheck(
    4586             BadIdent, JSValueSource(), nullptr,
    4587             m_jit.branchPtr(
    4588                 JITCompiler::NotEqual,
    4589                 JITCompiler::Address(operand.gpr(), Symbol::offsetOfPrivateName()),
    4590                 TrustedImmPtr(uid)));
    4591     } else {
    4592         speculateString(node->child1(), operand.gpr());
    4593         speculateStringIdent(node->child1(), operand.gpr());
    4594         speculationCheck(
    4595             BadIdent, JSValueSource(), nullptr,
    4596             m_jit.branchPtr(
    4597                 JITCompiler::NotEqual,
    4598                 JITCompiler::Address(operand.gpr(), JSString::offsetOfValue()),
    4599                 TrustedImmPtr(uid)));
    4600     }
    4601     noResult(node);
    4602 }
    4603 
    46044579void SpeculativeJIT::compileNewFunction(Node* node)
    46054580{
    … …  
    57575732}
    57585733
    5759 void SpeculativeJIT::speculateSymbol(Edge edge, GPRReg cell)
    5760 {
    5761     DFG_TYPE_CHECK(JSValueSource::unboxedCell(cell), edge, SpecSymbol, m_jit.branchIfNotSymbol(cell));
    5762 }
    5763 
    5764 void SpeculativeJIT::speculateSymbol(Edge edge)
    5765 {
    5766     if (!needsTypeCheck(edge, SpecSymbol))
    5767         return;
    5768 
    5769     SpeculateCellOperand operand(this, edge);
    5770     speculateSymbol(edge, operand.gpr());
    5771 }
    5772 
    57735734void SpeculativeJIT::speculateNotCell(Edge edge)
    57745735{
    … …  
    58815842    case StringUse:
    58825843        speculateString(edge);
    5883         break;
    5884     case SymbolUse:
    5885         speculateSymbol(edge);
    58865844        break;
    58875845    case StringObjectUse:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r188105 r188201  
    21922192
    21932193    void compileGetArrayLength(Node*);
    2194 
    2195     void compileCheckIdent(Node*);
    21962194   
    21972195    void compileValueRep(Node*);
    … …  
    24092407    void speculateStringObject(Edge);
    24102408    void speculateStringOrStringObject(Edge);
    2411     void speculateSymbol(Edge, GPRReg cell);
    2412     void speculateSymbol(Edge);
    24132409    void speculateNotCell(Edge);
    24142410    void speculateOther(Edge);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r188105 r188201  
    38213821    }
    38223822
    3823     case CheckIdent:
    3824         compileCheckIdent(node);
    3825         break;
    3826 
    38273823    case GetExecutable: {
    38283824        SpeculateCellOperand function(this, node->child1());

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r188105 r188201  
    38513851    }
    38523852
    3853     case CheckIdent:
    3854         compileCheckIdent(node);
    3855         break;
    3856 
    38573853    case GetExecutable: {
    38583854        SpeculateCellOperand function(this, node->child1());

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp

    r188105 r188201  
    9898        out.print("KnownString");
    9999        return;
    100     case SymbolUse:
    101         out.print("Symbol");
    102         return;
    103100    case StringObjectUse:
    104101        out.print("StringObject");

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.h

    r188105 r188201  
    5858    StringUse,
    5959    KnownStringUse,
    60     SymbolUse,
    6160    StringObjectUse,
    6261    StringOrStringObjectUse,
    … …  
    119118    case KnownStringUse:
    120119        return SpecString;
    121     case SymbolUse:
    122         return SpecSymbol;
    123120    case StringObjectUse:
    124121        return SpecStringObject;
    … …  
    200197    case StringUse:
    201198    case KnownStringUse:
    202     case SymbolUse:
    203199    case StringObjectUse:
    204200    case StringOrStringObjectUse:

  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r188105 r188201  
    8888    macro(Structure_globalObject, Structure::globalObjectOffset()) \
    8989    macro(Structure_prototype, Structure::prototypeOffset()) \
    90     macro(Structure_structureID, Structure::structureIDOffset()) \
    91     macro(Symbol_privateName, Symbol::offsetOfPrivateName())
     90    macro(Structure_structureID, Structure::structureIDOffset())
    9291
    9392#define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r188105 r188201  
    119119    case CheckBadCell:
    120120    case CheckNotEmpty:
    121     case CheckIdent:
    122121    case StringCharCodeAt:
    123122    case AllocatePropertyStorage:
    … …  
    417416                case StringObjectUse:
    418417                case StringOrStringObjectUse:
    419                 case SymbolUse:
    420418                case FinalObjectUse:
    421419                case NotCellUse:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

    r188105 r188201  
    533533            compileCheckBadCell();
    534534            break;
    535         case CheckIdent:
    536             compileCheckIdent();
    537             break;
    538535        case GetExecutable:
    539536            compileGetExecutable();
    … …  
    20312028    {
    20322029        speculate(TDZFailure, noValue(), nullptr, m_out.isZero64(lowJSValue(m_node->child1())));
    2033     }
    2034 
    2035     void compileCheckIdent()
    2036     {
    2037         UniquedStringImpl* uid = m_node->uidOperand();
    2038         if (uid->isSymbol()) {
    2039             LValue symbol = lowSymbol(m_node->child1());
    2040             LValue stringImpl = m_out.loadPtr(symbol, m_heaps.Symbol_privateName);
    2041             speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
    2042         } else {
    2043             LValue string = lowStringIdent(m_node->child1());
    2044             LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
    2045             speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
    2046         }
    20472030    }
    20482031
    … …  
    70387021        return stringImpl;
    70397022    }
    7040 
    7041     LValue lowSymbol(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
    7042     {
    7043         ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == SymbolUse);
    7044 
    7045         LValue result = lowCell(edge, mode);
    7046         speculateSymbol(edge, result);
    7047         return result;
    7048     }
    7049 
     7023   
    70507024    LValue lowNonNullObject(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
    70517025    {
    … …  
    74447418            speculateStringIdent(edge);
    74457419            break;
    7446         case SymbolUse:
    7447             speculateSymbol(edge);
    7448             break;
    74497420        case StringObjectUse:
    74507421            speculateStringObject(edge);
    … …  
    75437514            m_out.constInt32(vm().stringStructure->id()));
    75447515    }
    7545 
    7546     LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop)
    7547     {
    7548         if (LValue proven = isProvenValue(type & SpecCell, ~SpecSymbol))
    7549             return proven;
    7550         return m_out.notEqual(
    7551             m_out.load32(cell, m_heaps.JSCell_structureID),
    7552             m_out.constInt32(vm().symbolStructure->id()));
    7553     }
    7554 
     7516   
    75557517    LValue isArrayType(LValue cell, ArrayMode arrayMode)
    75567518    {
    … …  
    77757737            m_out.notEqual(structureID, weakStructureID(stringObjectStructure)));
    77767738    }
    7777 
    7778     void speculateSymbol(Edge edge, LValue cell)
    7779     {
    7780         FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecSymbol | ~SpecCell, isNotSymbol(cell));
    7781     }
    7782 
    7783     void speculateSymbol(Edge edge)
    7784     {
    7785         speculateSymbol(edge, lowCell(edge));
    7786     }
    7787 
     7739   
    77887740    void speculateNonNullObject(Edge edge, LValue cell)
    77897741    {

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r188105 r188201  
    658658        m_putByIds[i].finalize(patchBuffer);
    659659
    660     for (const auto& byValCompilationInfo : m_byValCompilationInfo) {
    661         PatchableJump patchableNotIndexJump = byValCompilationInfo.notIndexJump;
    662         CodeLocationJump notIndexJump = CodeLocationJump();
    663         if (Jump(patchableNotIndexJump).isSet())
    664             notIndexJump = CodeLocationJump(patchBuffer.locationOf(patchableNotIndexJump));
    665         CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(byValCompilationInfo.badTypeJump));
    666         CodeLocationLabel doneTarget = patchBuffer.locationOf(byValCompilationInfo.doneTarget);
    667         CodeLocationLabel slowPathTarget = patchBuffer.locationOf(byValCompilationInfo.slowPathTarget);
    668         CodeLocationCall returnAddress = patchBuffer.locationOf(byValCompilationInfo.returnAddress);
    669 
    670         *byValCompilationInfo.byValInfo = ByValInfo(
    671             byValCompilationInfo.bytecodeIndex,
    672             notIndexJump,
     660    m_codeBlock->setNumberOfByValInfos(m_byValCompilationInfo.size());
     661    for (unsigned i = 0; i < m_byValCompilationInfo.size(); ++i) {
     662        CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(m_byValCompilationInfo[i].badTypeJump));
     663        CodeLocationLabel doneTarget = patchBuffer.locationOf(m_byValCompilationInfo[i].doneTarget);
     664        CodeLocationLabel slowPathTarget = patchBuffer.locationOf(m_byValCompilationInfo[i].slowPathTarget);
     665        CodeLocationCall returnAddress = patchBuffer.locationOf(m_byValCompilationInfo[i].returnAddress);
     666       
     667        m_codeBlock->byValInfo(i) = ByValInfo(
     668            m_byValCompilationInfo[i].bytecodeIndex,
    673669            badTypeJump,
    674             byValCompilationInfo.arrayMode,
    675             byValCompilationInfo.arrayProfile,
     670            m_byValCompilationInfo[i].arrayMode,
    676671            differenceBetweenCodePtr(badTypeJump, doneTarget),
    677672            differenceBetweenCodePtr(returnAddress, slowPathTarget));

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r188135 r188201  
    150150        ByValCompilationInfo() { }
    151151       
    152         ByValCompilationInfo(ByValInfo* byValInfo, unsigned bytecodeIndex, MacroAssembler::PatchableJump notIndexJump, MacroAssembler::PatchableJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, MacroAssembler::Label doneTarget)
    153             : byValInfo(byValInfo)
    154             , bytecodeIndex(bytecodeIndex)
    155             , notIndexJump(notIndexJump)
     152        ByValCompilationInfo(unsigned bytecodeIndex, MacroAssembler::PatchableJump badTypeJump, JITArrayMode arrayMode, MacroAssembler::Label doneTarget)
     153            : bytecodeIndex(bytecodeIndex)
    156154            , badTypeJump(badTypeJump)
    157155            , arrayMode(arrayMode)
    158             , arrayProfile(arrayProfile)
    159156            , doneTarget(doneTarget)
    160157        {
    161158        }
    162 
    163         ByValInfo* byValInfo;
     159       
    164160        unsigned bytecodeIndex;
    165         MacroAssembler::PatchableJump notIndexJump;
    166161        MacroAssembler::PatchableJump badTypeJump;
    167162        JITArrayMode arrayMode;
    168         ArrayProfile* arrayProfile;
    169163        MacroAssembler::Label doneTarget;
    170164        MacroAssembler::Label slowPathTarget;
    … …  
    211205        }
    212206
    213         static void compileGetByValWithCachedId(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, const Identifier& propertyName)
    214         {
    215             JIT jit(vm, codeBlock);
    216             jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
    217             jit.privateCompileGetByValWithCachedId(byValInfo, returnAddress, propertyName);
    218         }
    219 
    220207        static void compilePutByVal(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
    221208        {
    … …  
    260247       
    261248        void privateCompileGetByVal(ByValInfo*, ReturnAddressPtr, JITArrayMode);
    262         void privateCompileGetByValWithCachedId(ByValInfo*, ReturnAddressPtr, const Identifier&);
    263249        void privateCompilePutByVal(ByValInfo*, ReturnAddressPtr, JITArrayMode);
    264250
    … …  
    386372        JumpList emitIntTypedArrayPutByVal(Instruction*, PatchableJump& badType, TypedArrayType);
    387373        JumpList emitFloatTypedArrayPutByVal(Instruction*, PatchableJump& badType, TypedArrayType);
    388 
    389         JITGetByIdGenerator emitGetByValWithCachedId(Instruction*, const Identifier&, JumpList& doneCases, JumpList& slowCases);
    390 
     374       
    391375        enum FinalObjectMode { MayBeFinal, KnownNotFinal };
    392376
    … …  
    719703        MacroAssembler::Call callOperation(J_JITOperation_EJJ, int, GPRReg, GPRReg);
    720704        MacroAssembler::Call callOperation(J_JITOperation_EJJAp, int, GPRReg, GPRReg, ArrayProfile*);
    721         MacroAssembler::Call callOperation(J_JITOperation_EJJBy, int, GPRReg, GPRReg, ByValInfo*);
    722705        MacroAssembler::Call callOperation(C_JITOperation_EJsc, GPRReg);
    723706        MacroAssembler::Call callOperation(J_JITOperation_EJscC, int, GPRReg, JSCell*);
    … …  
    764747        MacroAssembler::Call callOperation(V_JITOperation_EJJJ, RegisterID, RegisterID, RegisterID);
    765748        MacroAssembler::Call callOperation(V_JITOperation_EJJJAp, RegisterID, RegisterID, RegisterID, ArrayProfile*);
    766         MacroAssembler::Call callOperation(V_JITOperation_EJJJBy, RegisterID, RegisterID, RegisterID, ByValInfo*);
    767749        MacroAssembler::Call callOperation(V_JITOperation_EJZJ, RegisterID, int32_t, RegisterID);
    768750        MacroAssembler::Call callOperation(V_JITOperation_EJZ, RegisterID, int32_t);
    … …  
    781763        MacroAssembler::Call callOperation(J_JITOperation_EJJ, int, GPRReg, GPRReg, GPRReg, GPRReg);
    782764        MacroAssembler::Call callOperation(J_JITOperation_EJJAp, int, GPRReg, GPRReg, GPRReg, GPRReg, ArrayProfile*);
    783         MacroAssembler::Call callOperation(J_JITOperation_EJJBy, int, GPRReg, GPRReg, GPRReg, GPRReg, ByValInfo*);
    784765        MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, GPRReg, size_t);
    785766        MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID, RegisterID);
    … …  
    789770        MacroAssembler::Call callOperation(V_JITOperation_EJJJ, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID);
    790771        MacroAssembler::Call callOperation(V_JITOperation_EJJJAp, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, ArrayProfile*);
    791         MacroAssembler::Call callOperation(V_JITOperation_EJJJBy, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, ByValInfo*);
    792772        MacroAssembler::Call callOperation(V_JITOperation_EJZ, RegisterID, RegisterID, int32_t);
    793773        MacroAssembler::Call callOperation(V_JITOperation_EJZJ, RegisterID, RegisterID, int32_t, RegisterID, RegisterID);

  • trunk/Source/JavaScriptCore/jit/JITInlines.h

    r188135 r188201  
    412412}
    413413
    414 ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJBy operation, RegisterID regOp1, RegisterID regOp2, RegisterID regOp3, ByValInfo* byValInfo)
    415 {
    416     setupArgumentsWithExecState(regOp1, regOp2, regOp3, TrustedImmPtr(byValInfo));
    417     return appendCallWithExceptionCheck(operation);
    418 }
    419 
    420414ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZJ operation, int dst, GPRReg arg)
    421415{
    … …  
    463457{
    464458    setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(arrayProfile));
    465     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
    466 }
    467 
    468 ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJBy operation, int dst, GPRReg arg1, GPRReg arg2, ByValInfo* byValInfo)
    469 {
    470     setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(byValInfo));
    471459    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
    472460}
    … …  
    613601}
    614602
    615 ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJBy operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload, ByValInfo* byValInfo)
    616 {
    617     setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag, TrustedImmPtr(byValInfo));
    618     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
    619 }
    620 
    621603ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_EJJ operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload)
    622604{
    … …  
    682664{
    683665    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, SH4_32BIT_DUMMY_ARG regOp2Payload, regOp2Tag, regOp3Payload, regOp3Tag, TrustedImmPtr(arrayProfile));
    684     return appendCallWithExceptionCheck(operation);
    685 }
    686 
    687 ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJBy operation, RegisterID regOp1Tag, RegisterID regOp1Payload, RegisterID regOp2Tag, RegisterID regOp2Payload, RegisterID regOp3Tag, RegisterID regOp3Payload, ByValInfo* byValInfo)
    688 {
    689     setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, SH4_32BIT_DUMMY_ARG regOp2Payload, regOp2Tag, regOp3Payload, regOp3Tag, TrustedImmPtr(byValInfo));
    690666    return appendCallWithExceptionCheck(operation);
    691667}

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r188136 r188201  
    10681068    int property = currentInstruction[3].u.operand;
    10691069    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    1070     ByValInfo* byValInfo = m_codeBlock->addByValInfo();
    10711070   
    10721071    emitGetVirtualRegisters(base, regT0, property, regT1);
    … …  
    11001099    emitPutVirtualRegister(dst);
    11011100   
    1102     m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
     1101    m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
    11031102}
    11041103
    … …  
    11081107    int base = currentInstruction[2].u.operand;
    11091108    int property = currentInstruction[3].u.operand;
    1110     ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
     1109    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    11111110   
    11121111    linkSlowCaseIfNotJSCell(iter, base); // base cell check
    … …  
    11191118    emitGetVirtualRegister(base, regT0);
    11201119    emitGetVirtualRegister(property, regT1);
    1121     Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT0, regT1, byValInfo);
     1120    Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT0, regT1, profile);
    11221121
    11231122    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r188136 r188201  
    10681068    int property = currentInstruction[3].u.operand;
    10691069    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    1070     ByValInfo* byValInfo = m_codeBlock->addByValInfo();
    10711070   
    10721071    emitLoadPayload(base, regT0);
    … …  
    11011100    emitStoreBool(dst, regT0);
    11021101   
    1103     m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
     1102    m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
    11041103}
    11051104
    … …  
    11091108    int base = currentInstruction[2].u.operand;
    11101109    int property = currentInstruction[3].u.operand;
    1111     ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
     1110    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    11121111   
    11131112    linkSlowCaseIfNotJSCell(iter, base); // base cell check
    … …  
    11201119    emitLoad(base, regT1, regT0);
    11211120    emitLoad(property, regT3, regT2);
    1122     Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT1, regT0, regT3, regT2, byValInfo);
     1121    Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT1, regT0, regT3, regT2, profile);
    11231122
    11241123    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;

  • trunk/Source/JavaScriptCore/jit/JITOperations.cpp

    r188136 r188201  
    479479}
    480480
    481 static void putByVal(CallFrame* callFrame, JSValue baseValue, JSValue subscript, JSValue value, ByValInfo* byValInfo)
     481static void putByVal(CallFrame* callFrame, JSValue baseValue, JSValue subscript, JSValue value, ArrayProfile* arrayProfile)
    482482{
    483483    VM& vm = callFrame->vm();
    … …  
    489489                object->setIndexQuickly(callFrame->vm(), i, value);
    490490            else {
    491                 byValInfo->arrayProfile->setOutOfBounds();
     491                arrayProfile->setOutOfBounds();
    492492                object->methodTable(vm)->putByIndex(object, callFrame, i, value, callFrame->codeBlock()->isStrictMode());
    493493            }
    … …  
    503503}
    504504
    505 static void directPutByVal(CallFrame* callFrame, JSObject* baseObject, JSValue subscript, JSValue value, ByValInfo* byValInfo)
     505static void directPutByVal(CallFrame* callFrame, JSObject* baseObject, JSValue subscript, JSValue value, ArrayProfile* arrayProfile)
    506506{
    507507    bool isStrictMode = callFrame->codeBlock()->isStrictMode();
    … …  
    515515        }
    516516
    517         byValInfo->arrayProfile->setOutOfBounds();
     517        arrayProfile->setOutOfBounds();
    518518        baseObject->putDirectIndex(callFrame, index, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
    519519        return;
    … …  
    541541    }
    542542}
    543 void JIT_OPERATION operationPutByVal(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
     543void JIT_OPERATION operationPutByVal(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
    544544{
    545545    VM& vm = exec->vm();
    … …  
    555555        bool didOptimize = false;
    556556
    557         ASSERT(exec->locationAsBytecodeOffset());
    558         ASSERT(!byValInfo->stubRoutine);
     557        unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
     558        ASSERT(bytecodeOffset);
     559        ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
     560        ASSERT(!byValInfo.stubRoutine);
    559561
    560562        Structure* structure = object->structure(vm);
    … …  
    562564            // Attempt to optimize.
    563565            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
    564             if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
     566            if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo.arrayMode) {
    565567                CodeBlock* codeBlock = exec->codeBlock();
    566568                ConcurrentJITLocker locker(codeBlock->m_lock);
    567                 byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
    568 
    569                 JIT::compilePutByVal(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
     569                arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
     570
     571                JIT::compilePutByVal(&vm, exec->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
    570572                didOptimize = true;
    571573            }
    … …  
    578580            // where we see non-index-intercepting objects, this gives 10 iterations worth of
    579581            // opportunity for us to observe that the get_by_val may be polymorphic.
    580             if (++byValInfo->slowPathCount >= 10
     582            if (++byValInfo.slowPathCount >= 10
    581583                || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
    582584                // Don't ever try to optimize.
    … …  
    586588    }
    587589
    588     putByVal(exec, baseValue, subscript, value, byValInfo);
    589 }
    590 
    591 void JIT_OPERATION operationDirectPutByVal(ExecState* callFrame, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
     590    putByVal(exec, baseValue, subscript, value, arrayProfile);
     591}
     592
     593void JIT_OPERATION operationDirectPutByVal(ExecState* callFrame, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
    592594{
    593595    VM& vm = callFrame->vm();
    … …  
    602604        // See if it's worth optimizing at all.
    603605        bool didOptimize = false;
    604 
    605         ASSERT(callFrame->locationAsBytecodeOffset());
    606         ASSERT(!byValInfo->stubRoutine);
     606       
     607        unsigned bytecodeOffset = callFrame->locationAsBytecodeOffset();
     608        ASSERT(bytecodeOffset);
     609        ByValInfo& byValInfo = callFrame->codeBlock()->getByValInfo(bytecodeOffset - 1);
     610        ASSERT(!byValInfo.stubRoutine);
    607611
    608612        Structure* structure = object->structure(vm);
    … …  
    610614            // Attempt to optimize.
    611615            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
    612             if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
     616            if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo.arrayMode) {
    613617                CodeBlock* codeBlock = callFrame->codeBlock();
    614618                ConcurrentJITLocker locker(codeBlock->m_lock);
    615                 byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
    616 
    617                 JIT::compileDirectPutByVal(&vm, callFrame->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
     619                arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
     620
     621                JIT::compileDirectPutByVal(&vm, callFrame->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
    618622                didOptimize = true;
    619623            }
    … …  
    626630            // where we see non-index-intercepting objects, this gives 10 iterations worth of
    627631            // opportunity for us to observe that the get_by_val may be polymorphic.
    628             if (++byValInfo->slowPathCount >= 10
     632            if (++byValInfo.slowPathCount >= 10
    629633                || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
    630634                // Don't ever try to optimize.
    … …  
    633637        }
    634638    }
    635     directPutByVal(callFrame, object, subscript, value, byValInfo);
    636 }
    637 
    638 void JIT_OPERATION operationPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
     639    directPutByVal(callFrame, object, subscript, value, arrayProfile);
     640}
     641
     642void JIT_OPERATION operationPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
    639643{
    640644    VM& vm = exec->vm();
    … …  
    645649    JSValue value = JSValue::decode(encodedValue);
    646650
    647     putByVal(exec, baseValue, subscript, value, byValInfo);
    648 }
    649 
    650 
    651 void JIT_OPERATION operationDirectPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
     651    putByVal(exec, baseValue, subscript, value, arrayProfile);
     652}
     653
     654
     655void JIT_OPERATION operationDirectPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
    652656{
    653657    VM& vm = exec->vm();
    … …  
    658662    JSValue value = JSValue::decode(encodedValue);
    659663    RELEASE_ASSERT(baseValue.isObject());
    660     directPutByVal(exec, asObject(baseValue), subscript, value, byValInfo);
     664    directPutByVal(exec, asObject(baseValue), subscript, value, arrayProfile);
    661665}
    662666
    … …  
    14111415}
    14121416
    1413 static JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
     1417static JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript, ArrayProfile* arrayProfile, ReturnAddressPtr returnAddress)
    14141418{
    14151419    if (LIKELY(baseValue.isCell() && subscript.isString())) {
    … …  
    14181422        if (JSCell::canUseFastGetOwnProperty(structure)) {
    14191423            if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
    1420                 if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get())) {
    1421                     ASSERT(exec->locationAsBytecodeOffset());
    1422                     if (byValInfo->stubInfo && byValInfo->cachedId.impl() != existingAtomicString)
    1423                         byValInfo->tookSlowPath = true;
     1424                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
    14241425                    return result;
    1425                 }
    14261426            }
    14271427        }
    … …  
    14291429
    14301430    if (subscript.isUInt32()) {
    1431         ASSERT(exec->locationAsBytecodeOffset());
    1432         byValInfo->tookSlowPath = true;
    1433 
    14341431        uint32_t i = subscript.asUInt32();
    14351432        if (isJSString(baseValue)) {
    … …  
    14381435                return asString(baseValue)->getIndex(exec, i);
    14391436            }
    1440             byValInfo->arrayProfile->setOutOfBounds();
     1437            arrayProfile->setOutOfBounds();
    14411438        } else if (baseValue.isObject()) {
    14421439            JSObject* object = asObject(baseValue);
    … …  
    14451442
    14461443            if (!canAccessArgumentIndexQuickly(*object, i))
    1447                 byValInfo->arrayProfile->setOutOfBounds();
     1444                arrayProfile->setOutOfBounds();
    14481445        }
    14491446
    … …  
    14571454    if (exec->hadException())
    14581455        return jsUndefined();
    1459 
    1460     ASSERT(exec->locationAsBytecodeOffset());
    1461     if (byValInfo->stubInfo && byValInfo->cachedId != property)
    1462         byValInfo->tookSlowPath = true;
    1463 
    14641456    return baseValue.get(exec, property);
    14651457}
    … …  
    14671459extern "C" {
    14681460   
    1469 EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
     1461EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
    14701462{
    14711463    VM& vm = exec->vm();
    … …  
    14741466    JSValue subscript = JSValue::decode(encodedSubscript);
    14751467
    1476     JSValue result = getByVal(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS));
     1468    JSValue result = getByVal(exec, baseValue, subscript, arrayProfile, ReturnAddressPtr(OUR_RETURN_ADDRESS));
    14771469    return JSValue::encode(result);
    14781470}
    14791471
    1480 EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
     1472EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
    14811473{
    14821474    VM& vm = exec->vm();
    … …  
    14841476    JSValue baseValue = JSValue::decode(encodedBase);
    14851477    JSValue subscript = JSValue::decode(encodedSubscript);
    1486 
     1478   
    14871479    if (baseValue.isObject() && subscript.isInt32()) {
    14881480        // See if it's worth optimizing this at all.
    … …  
    14901482        bool didOptimize = false;
    14911483
    1492         ASSERT(exec->locationAsBytecodeOffset());
    1493         ASSERT(!byValInfo->stubRoutine);
    1494 
     1484        unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
     1485        ASSERT(bytecodeOffset);
     1486        ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
     1487        ASSERT(!byValInfo.stubRoutine);
     1488       
    14951489        if (hasOptimizableIndexing(object->structure(vm))) {
    14961490            // Attempt to optimize.
    14971491            Structure* structure = object->structure(vm);
    14981492            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
    1499             if (arrayMode != byValInfo->arrayMode) {
     1493            if (arrayMode != byValInfo.arrayMode) {
    15001494                // If we reached this case, we got an interesting array mode we did not expect when we compiled.
    15011495                // Let's update the profile to do better next time.
    15021496                CodeBlock* codeBlock = exec->codeBlock();
    15031497                ConcurrentJITLocker locker(codeBlock->m_lock);
    1504                 byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
    1505 
    1506                 JIT::compileGetByVal(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
     1498                arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
     1499
     1500                JIT::compileGetByVal(&vm, exec->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
    15071501                didOptimize = true;
    15081502            }
    15091503        }
    1510 
     1504       
    15111505        if (!didOptimize) {
    15121506            // If we take slow path more than 10 times without patching then make sure we
    … …  
    15151509            // where we see non-index-intercepting objects, this gives 10 iterations worth of
    15161510            // opportunity for us to observe that the get_by_val may be polymorphic.
    1517             if (++byValInfo->slowPathCount >= 10
     1511            if (++byValInfo.slowPathCount >= 10
    15181512                || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
    15191513                // Don't ever try to optimize.
    … …  
    15221516        }
    15231517    }
    1524 
    1525     if (baseValue.isObject() && (subscript.isSymbol() || subscript.isString())) {
    1526         const Identifier propertyName = subscript.toPropertyKey(exec);
    1527 
    1528         if (!subscript.isString() || !parseIndex(propertyName)) {
    1529             ASSERT(exec->locationAsBytecodeOffset());
    1530             ASSERT(!byValInfo->stubRoutine);
    1531             JIT::compileGetByValWithCachedId(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), propertyName);
    1532         }
    1533 
    1534         PropertySlot slot(baseValue);
    1535         bool hasResult = baseValue.getPropertySlot(exec, propertyName, slot);
    1536         return JSValue::encode(hasResult ? slot.getValue(exec, propertyName) : jsUndefined());
    1537     }
    1538 
    1539     JSValue result = getByVal(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS));
     1518   
     1519    JSValue result = getByVal(exec, baseValue, subscript, arrayProfile, ReturnAddressPtr(OUR_RETURN_ADDRESS));
    15401520    return JSValue::encode(result);
    15411521}
    1542 
    1543 EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
     1522   
     1523EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
    15441524{
    15451525    VM& vm = exec->vm();
    … …  
    15541534    bool didOptimize = false;
    15551535
    1556     ASSERT(exec->locationAsBytecodeOffset());
    1557     ASSERT(!byValInfo->stubRoutine);
     1536    unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
     1537    ASSERT(bytecodeOffset);
     1538    ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
     1539    ASSERT(!byValInfo.stubRoutine);
    15581540   
    15591541    if (hasOptimizableIndexing(object->structure(vm))) {
    15601542        // Attempt to optimize.
    15611543        JITArrayMode arrayMode = jitArrayModeForStructure(object->structure(vm));
    1562         if (arrayMode != byValInfo->arrayMode) {
    1563             JIT::compileHasIndexedProperty(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
     1544        if (arrayMode != byValInfo.arrayMode) {
     1545            JIT::compileHasIndexedProperty(&vm, exec->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
    15641546            didOptimize = true;
    15651547        }
    … …  
    15721554        // where we see non-index-intercepting objects, this gives 10 iterations worth of
    15731555        // opportunity for us to observe that the get_by_val may be polymorphic.
    1574         if (++byValInfo->slowPathCount >= 10
     1556        if (++byValInfo.slowPathCount >= 10
    15751557            || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
    15761558            // Don't ever try to optimize.
    1577             ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationHasIndexedPropertyGeneric));
     1559            ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationHasIndexedPropertyGeneric)); 
    15781560        }
    15791561    }
    … …  
    15841566
    15851567    if (!canAccessArgumentIndexQuickly(*object, index))
    1586         byValInfo->arrayProfile->setOutOfBounds();
     1568        arrayProfile->setOutOfBounds();
    15871569    return JSValue::encode(jsBoolean(object->hasProperty(exec, index)));
    15881570}
    15891571   
    1590 EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
     1572EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
    15911573{
    15921574    VM& vm = exec->vm();
    … …  
    16041586
    16051587    if (!canAccessArgumentIndexQuickly(*object, index))
    1606         byValInfo->arrayProfile->setOutOfBounds();
     1588        arrayProfile->setOutOfBounds();
    16071589    return JSValue::encode(jsBoolean(object->hasProperty(exec, subscript.asUInt32())));
    16081590}
    16091591   
    1610 EncodedJSValue JIT_OPERATION operationGetByValString(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
     1592EncodedJSValue JIT_OPERATION operationGetByValString(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)
    16111593{
    16121594    VM& vm = exec->vm();
    … …  
    16231605            result = baseValue.get(exec, i);
    16241606            if (!isJSString(baseValue)) {
    1625                 ASSERT(exec->locationAsBytecodeOffset());
    1626                 ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(byValInfo->stubRoutine ? operationGetByValGeneric : operationGetByValOptimize));
     1607                unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
     1608                ASSERT(bytecodeOffset);
     1609                ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
     1610                ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(byValInfo.stubRoutine ? operationGetByValGeneric : operationGetByValOptimize));
    16271611            }
    16281612        }

  • trunk/Source/JavaScriptCore/jit/JITOperations.h

    r188136 r188201  
    5959    Aap: ArrayAllocationProfile*
    6060    Ap: ArrayProfile*
    61     By: ByValInfo*
    6261    C: JSCell*
    6362    Cb: CodeBlock*
    … …  
    115114typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
    116115typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, ArrayProfile*);
    117 typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, ByValInfo*);
    118116typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJssZ)(ExecState*, JSString*, int32_t);
    119117typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJP)(ExecState*, EncodedJSValue, void*);
    … …  
    198196typedef void JIT_OPERATION (*V_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
    199197typedef void JIT_OPERATION (*V_JITOperation_EJJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*);
    200 typedef void JIT_OPERATION (*V_JITOperation_EJJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*);
    201198typedef void JIT_OPERATION (*V_JITOperation_EJPP)(ExecState*, EncodedJSValue, void*, void*);
    202199typedef void JIT_OPERATION (*V_JITOperation_EJZJ)(ExecState*, EncodedJSValue, int32_t, EncodedJSValue);
    … …  
    263260void JIT_OPERATION operationPutByIdDirectNonStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
    264261void JIT_OPERATION operationReallocateStorageAndFinishPut(ExecState*, JSObject*, Structure*, PropertyOffset, EncodedJSValue) WTF_INTERNAL;
    265 void JIT_OPERATION operationPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
    266 void JIT_OPERATION operationDirectPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
    267 void JIT_OPERATION operationPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
    268 void JIT_OPERATION operationDirectPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
     262void JIT_OPERATION operationPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
     263void JIT_OPERATION operationDirectPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
     264void JIT_OPERATION operationPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
     265void JIT_OPERATION operationDirectPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
    269266EncodedJSValue JIT_OPERATION operationCallEval(ExecState*, ExecState*) WTF_INTERNAL;
    270267char* JIT_OPERATION operationLinkCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
    … …  
    313310void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
    314311EncodedJSValue JIT_OPERATION operationCheckHasInstance(ExecState*, EncodedJSValue, EncodedJSValue baseVal) WTF_INTERNAL;
    315 EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
    316 EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
    317 EncodedJSValue JIT_OPERATION operationGetByValString(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
    318 EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
    319 EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
     312EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
     313EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
     314EncodedJSValue JIT_OPERATION operationGetByValString(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript) WTF_INTERNAL;
     315EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
     316EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
    320317EncodedJSValue JIT_OPERATION operationDeleteById(ExecState*, EncodedJSValue base, const Identifier*) WTF_INTERNAL;
    321318JSCell* JIT_OPERATION operationGetPNames(ExecState*, JSObject*) WTF_INTERNAL;

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r188135 r188201  
    9999    int property = currentInstruction[3].u.operand;
    100100    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    101     ByValInfo* byValInfo = m_codeBlock->addByValInfo();
    102 
     101   
    103102    emitGetVirtualRegisters(base, regT0, property, regT1);
    104 
    105     emitJumpSlowCaseIfNotJSCell(regT0, base);
    106 
    107     PatchableJump notIndex = emitPatchableJumpIfNotImmediateInteger(regT1);
    108     addSlowCase(notIndex);
     103    emitJumpSlowCaseIfNotImmediateInteger(regT1);
    109104
    110105    // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
    … …  
    116111    zeroExtend32ToPtr(regT1, regT1);
    117112
     113    emitJumpSlowCaseIfNotJSCell(regT0, base);
    118114    emitArrayProfilingSiteWithCell(regT0, regT2, profile);
    119115    and32(TrustedImm32(IndexingShapeMask), regT2);
    … …  
    154150    emitValueProfilingSite();
    155151    emitPutVirtualRegister(dst);
    156 
    157     m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done));
     152   
     153    m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
    158154}
    159155
    … …  
    200196}
    201197
    202 JITGetByIdGenerator JIT::emitGetByValWithCachedId(Instruction* currentInstruction, const Identifier& propertyName, JumpList& doneCases, JumpList& slowCases)
    203 {
    204     // base: regT0
    205     // property: regT1
    206     // scratch: regT3
    207 
    208     int dst = currentInstruction[1].u.operand;
    209 
    210     slowCases.append(emitJumpIfNotJSCell(regT1));
    211     if (propertyName.isSymbol()) {
    212         slowCases.append(branchStructure(NotEqual, Address(regT1, JSCell::structureIDOffset()), m_vm->symbolStructure.get()));
    213         loadPtr(Address(regT1, Symbol::offsetOfPrivateName()), regT3);
    214     } else {
    215         slowCases.append(branchStructure(NotEqual, Address(regT1, JSCell::structureIDOffset()), m_vm->stringStructure.get()));
    216         loadPtr(Address(regT1, JSString::offsetOfValue()), regT3);
    217         slowCases.append(branchTestPtr(Zero, regT3));
    218         slowCases.append(branchTest32(Zero, Address(regT3, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtomic())));
    219     }
    220     slowCases.append(branchPtr(NotEqual, regT3, TrustedImmPtr(propertyName.impl())));
    221 
    222     JITGetByIdGenerator gen(
    223         m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
    224         JSValueRegs(regT0), JSValueRegs(regT0), DontSpill);
    225     gen.generateFastPath(*this);
    226 
    227     doneCases.append(jump());
    228 
    229     Label coldPathBegin = label();
    230     gen.slowPathJump().link(this);
    231 
    232     Call call = callOperation(WithProfile, operationGetByIdOptimize, dst, gen.stubInfo(), regT0, propertyName.impl());
    233     gen.reportSlowPathCall(coldPathBegin, call);
    234     doneCases.append(jump());
    235 
    236     return gen;
    237 }
    238 
    239198void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    240199{
    … …  
    242201    int base = currentInstruction[2].u.operand;
    243202    int property = currentInstruction[3].u.operand;
    244     ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
    245    
     203    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
     204   
     205    linkSlowCase(iter); // property int32 check
    246206    linkSlowCaseIfNotJSCell(iter, base); // base cell check
    247     linkSlowCase(iter); // property int32 check
    248207    Jump nonCell = jump();
    249208    linkSlowCase(iter); // base array check
    … …  
    266225    emitGetVirtualRegister(base, regT0);
    267226    emitGetVirtualRegister(property, regT1);
    268     Call call = callOperation(operationGetByValOptimize, dst, regT0, regT1, byValInfo);
     227    Call call = callOperation(operationGetByValOptimize, dst, regT0, regT1, profile);
    269228
    270229    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
    … …  
    305264    int property = currentInstruction[2].u.operand;
    306265    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    307     ByValInfo* byValInfo = m_codeBlock->addByValInfo();
    308266
    309267    emitGetVirtualRegisters(base, regT0, property, regT1);
    … …  
    342300    Label done = label();
    343301   
    344     m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
     302    m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
     303
    345304}
    346305
    … …  
    441400    int value = currentInstruction[3].u.operand;
    442401    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    443     ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
    444402
    445403    linkSlowCase(iter); // property int32 check
    … …  
    467425    emitGetVirtualRegister(value, regT2);
    468426    bool isDirect = m_interpreter->getOpcodeID(currentInstruction->u.opcode) == op_put_by_val_direct;
    469     Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT0, regT1, regT2, byValInfo);
     427    Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT0, regT1, regT2, profile);
    470428
    471429    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
    … …  
    1039997    RepatchBuffer repatchBuffer(m_codeBlock);
    1040998    repatchBuffer.relink(byValInfo->badTypeJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
    1041     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(operationGetByValGeneric));
    1042 }
    1043 
    1044 void JIT::privateCompileGetByValWithCachedId(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, const Identifier& propertyName)
    1045 {
    1046     Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
    1047 
    1048     JumpList doneCases;
    1049     JumpList slowCases;
    1050 
    1051     JITGetByIdGenerator gen = emitGetByValWithCachedId(currentInstruction, propertyName, doneCases, slowCases);
    1052 
    1053     ConcurrentJITLocker locker(m_codeBlock->m_lock);
    1054     LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
    1055     patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
    1056     patchBuffer.link(doneCases, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
    1057     for (const auto& callSite : m_calls) {
    1058         if (callSite.to)
    1059             patchBuffer.link(callSite.from, FunctionPtr(callSite.to));
    1060     }
    1061     gen.finalize(patchBuffer);
    1062 
    1063     byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    1064         m_codeBlock, patchBuffer,
    1065         ("Baseline get_by_val with cached property name '%s' stub for %s, return point %p", propertyName.impl()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.value()));
    1066     byValInfo->cachedId = propertyName;
    1067     byValInfo->stubInfo = gen.stubInfo();
    1068 
    1069     RepatchBuffer repatchBuffer(m_codeBlock);
    1070     repatchBuffer.relink(byValInfo->notIndexJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
    1071999    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(operationGetByValGeneric));
    10721000}

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp

    r188105 r188201  
    150150    int property = currentInstruction[3].u.operand;
    151151    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    152     ByValInfo* byValInfo = m_codeBlock->addByValInfo();
    153152   
    154153    emitLoad2(base, regT1, regT0, property, regT3, regT2);
    155154   
     155    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
    156156    emitJumpSlowCaseIfNotJSCell(base, regT1);
    157     PatchableJump notIndex = patchableBranch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag));
    158     addSlowCase(notIndex);
    159157    emitArrayProfilingSiteWithCell(regT0, regT1, profile);
    160158    and32(TrustedImm32(IndexingShapeMask), regT1);
    … …  
    195193    emitStore(dst, regT1, regT0);
    196194   
    197     m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done));
     195    m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
    198196}
    199197
    … …  
    239237    return slowCases;
    240238}
    241 
    242 JITGetByIdGenerator JIT::emitGetByValWithCachedId(Instruction* currentInstruction, const Identifier& propertyName, JumpList& doneCases, JumpList& slowCases)
    243 {
    244     int dst = currentInstruction[1].u.operand;
    245 
    246     // base: tag(regT1), payload(regT0)
    247     // property: tag(regT3), payload(regT2)
    248     // scratch: regT4
    249 
    250     slowCases.append(emitJumpIfNotJSCell(regT3));
    251     if (propertyName.isSymbol()) {
    252         slowCases.append(branchStructure(NotEqual, Address(regT2, JSCell::structureIDOffset()), m_vm->symbolStructure.get()));
    253         loadPtr(Address(regT2, Symbol::offsetOfPrivateName()), regT4);
    254     } else {
    255         slowCases.append(branchStructure(NotEqual, Address(regT2, JSCell::structureIDOffset()), m_vm->stringStructure.get()));
    256         loadPtr(Address(regT2, JSString::offsetOfValue()), regT4);
    257         slowCases.append(branchTestPtr(Zero, regT4));
    258         slowCases.append(branchTest32(Zero, Address(regT4, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtomic())));
    259     }
    260     slowCases.append(branchPtr(NotEqual, regT4, TrustedImmPtr(propertyName.impl())));
    261 
    262     JITGetByIdGenerator gen(
    263         m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
    264         JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), DontSpill);
    265     gen.generateFastPath(*this);
    266 
    267     doneCases.append(jump());
    268 
    269     Label coldPathBegin = label();
    270     gen.slowPathJump().link(this);
    271 
    272     Call call = callOperation(WithProfile, operationGetByIdOptimize, dst, gen.stubInfo(), regT1, regT0, propertyName.impl());
    273     gen.reportSlowPathCall(coldPathBegin, call);
    274     doneCases.append(jump());
    275 
    276     return gen;
    277 }
    278 
     239   
    279240void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    280241{
    … …  
    282243    int base = currentInstruction[2].u.operand;
    283244    int property = currentInstruction[3].u.operand;
    284     ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
    285 
     245    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
     246   
     247    linkSlowCase(iter); // property int32 check
    286248    linkSlowCaseIfNotJSCell(iter, base); // base cell check
    287     linkSlowCase(iter); // property int32 check
    288249
    289250    Jump nonCell = jump();
    … …  
    305266    emitLoad(base, regT1, regT0);
    306267    emitLoad(property, regT3, regT2);
    307     Call call = callOperation(operationGetByValOptimize, dst, regT1, regT0, regT3, regT2, byValInfo);
     268    Call call = callOperation(operationGetByValOptimize, dst, regT1, regT0, regT3, regT2, profile);
    308269
    309270    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
    … …  
    319280    int property = currentInstruction[2].u.operand;
    320281    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    321     ByValInfo* byValInfo = m_codeBlock->addByValInfo();
    322282   
    323283    emitLoad2(base, regT1, regT0, property, regT3, regT2);
    … …  
    355315    Label done = label();
    356316   
    357     m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
     317    m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
    358318}
    359319
    … …  
    460420    int value = currentInstruction[3].u.operand;
    461421    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
    462     ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
    463422   
    464423    linkSlowCase(iter); // property int32 check
    … …  
    500459    addCallArgument(regT1);
    501460    addCallArgument(regT0);
    502     addCallArgument(TrustedImmPtr(byValInfo));
     461    addCallArgument(TrustedImmPtr(profile));
    503462    Call call = appendCallWithExceptionCheck(isDirect ? operationDirectPutByVal : operationPutByVal);
    504463#else
    … …  
    508467    emitLoad(property, regT3, regT0);
    509468    emitLoad(value, regT5, regT4);
    510     Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT2, regT1, regT3, regT0, regT5, regT4, byValInfo);
     469    Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT2, regT1, regT3, regT0, regT5, regT4, profile);
    511470#endif
    512471

  • trunk/Source/JavaScriptCore/runtime/Symbol.h

    r188105 r188201  
    8080    double toNumber(ExecState*) const;
    8181
    82     static size_t offsetOfPrivateName() { return OBJECT_OFFSETOF(Symbol, m_privateName); }
    83 
    8482protected:
    8583    static void destroy(JSCell*);
Note: See TracChangeset for help on using the changeset viewer.