Changeset 190916 in webkit


Ignore:
Timestamp:
Oct 12, 2015 7:09:34 PM (9 years ago)
Author:
Yusuke Suzuki
Message:

Introduce Symbol type for property type inference
​https://bugs.webkit.org/show_bug.cgi?id=149622

Reviewed by Geoffrey Garen.

This patch introduces Symbol type into property type inference.
One of the use cases of ES6 Symbol is enum value. In this case,
we may hold different symbols as the same property of the same structure.
Current property type inference does not support Symbol type, so in the
above case, the property will be inferred as Top type.

  • bytecode/PutByIdFlags.h:
  • dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):

  • dfg/DFGInferredTypeCheck.cpp:

(JSC::DFG::insertInferredTypeCheck):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::checkInferredType):

  • jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::branchIfNotType):

  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/InferredType.cpp:

(JSC::InferredType::kindForFlags):
(JSC::InferredType::Descriptor::forValue):
(JSC::InferredType::Descriptor::putByIdFlags):
(JSC::InferredType::Descriptor::merge):
(WTF::printInternal):

  • runtime/InferredType.h:
  • tests/stress/prop-type-symbol-then-object.js: Added.

(foo):
(bar):
(toString):

  • tests/stress/prop-type-symbol-then-string.js: Added.

(foo):
(bar):

Location:
trunk/Source/JavaScriptCore
Files:
2 added
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r190905 r190916  
     12015-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        Introduce Symbol type for property type inference
     4        https://bugs.webkit.org/show_bug.cgi?id=149622
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        This patch introduces Symbol type into property type inference.
     9        One of the use cases of ES6 Symbol is enum value. In this case,
     10        we may hold different symbols as the same property of the same structure.
     11        Current property type inference does not support Symbol type, so in the
     12        above case, the property will be inferred as Top type.
     13
     14        * bytecode/PutByIdFlags.h:
     15        * dfg/DFGAbstractValue.cpp:
     16        (JSC::DFG::AbstractValue::set):
     17        * dfg/DFGInferredTypeCheck.cpp:
     18        (JSC::DFG::insertInferredTypeCheck):
     19        * ftl/FTLLowerDFGToLLVM.cpp:
     20        (JSC::FTL::DFG::LowerDFGToLLVM::checkInferredType):
     21        * jit/AssemblyHelpers.cpp:
     22        (JSC::AssemblyHelpers::branchIfNotType):
     23        * llint/LLIntData.cpp:
     24        (JSC::LLInt::Data::performAssertions):
     25        * llint/LowLevelInterpreter.asm:
     26        * llint/LowLevelInterpreter32_64.asm:
     27        * llint/LowLevelInterpreter64.asm:
     28        * runtime/InferredType.cpp:
     29        (JSC::InferredType::kindForFlags):
     30        (JSC::InferredType::Descriptor::forValue):
     31        (JSC::InferredType::Descriptor::putByIdFlags):
     32        (JSC::InferredType::Descriptor::merge):
     33        (WTF::printInternal):
     34        * runtime/InferredType.h:
     35        * tests/stress/prop-type-symbol-then-object.js: Added.
     36        (foo):
     37        (bar):
     38        (toString):
     39        * tests/stress/prop-type-symbol-then-string.js: Added.
     40        (foo):
     41        (bar):
     42
    1432015-10-12  Joseph Pecoraro  <pecoraro@apple.com>
    244

  • trunk/Source/JavaScriptCore/bytecode/PutByIdFlags.h

    r190076 r190916  
    6666    PutByIdSecondaryTypeNumber = 0x20,
    6767    PutByIdSecondaryTypeString = 0x28,
    68     PutByIdSecondaryTypeObject = 0x30,
    69     PutByIdSecondaryTypeObjectOrOther = 0x38,
    70     PutByIdSecondaryTypeTop = 0x40
     68    PutByIdSecondaryTypeSymbol = 0x30,
     69    PutByIdSecondaryTypeObject = 0x38,
     70    PutByIdSecondaryTypeObjectOrOther = 0x40,
     71    PutByIdSecondaryTypeTop = 0x48
    7172};
    7273

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp

    r190076 r190916  
    139139        set(graph, graph.m_vm.stringStructure.get());
    140140        return;
     141    case InferredType::Symbol:
     142        set(graph, graph.m_vm.symbolStructure.get());
     143        return;
    141144    case InferredType::ObjectWithStructure:
    142145        set(graph, descriptor.structure());

  • trunk/Source/JavaScriptCore/dfg/DFGInferredTypeCheck.cpp

    r190076 r190916  
    6464        return;
    6565
     66    case InferredType::Symbol:
     67        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, SymbolUse));
     68        return;
     69
    6670    case InferredType::ObjectWithStructure:
    6771        insertionSet.insertNode(

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

    r190896 r190916  
    58985898            return;
    58995899
     5900        case InferredType::Symbol:
     5901            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
     5902            speculate(BadType, jsValueValue(value), edge.node(), isNotSymbol(value, provenType(edge)));
     5903            return;
     5904
    59005905        case InferredType::ObjectWithStructure:
    59015906            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r190827 r190916  
    8787        break;
    8888
     89    case InferredType::Symbol:
     90        result.append(branchIfNotCell(regs, mode));
     91        result.append(branchIfNotSymbol(regs.payloadGPR()));
     92        break;
     93
    8994    case InferredType::ObjectWithStructure:
    9095        result.append(branchIfNotCell(regs, mode));

  • trunk/Source/JavaScriptCore/llint/LLIntData.cpp

    r189575 r190916  
    143143   
    144144    ASSERT(StringType == 6);
     145    ASSERT(SymbolType == 7);
    145146    ASSERT(ObjectType == 21);
    146147    ASSERT(FinalObjectType == 22);
    … …  
    154155    ASSERT(ModuleCode == 3);
    155156
     157    static_assert(PutByIdPrimaryTypeMask == 0x6, "LLInt assumes PutByIdPrimaryTypeMask is == 0x6");
     158    static_assert(PutByIdPrimaryTypeSecondary == 0x0, "LLInt assumes PutByIdPrimaryTypeSecondary is == 0x0");
     159    static_assert(PutByIdPrimaryTypeObjectWithStructure == 0x2, "LLInt assumes PutByIdPrimaryTypeObjectWithStructure is == 0x2");
     160    static_assert(PutByIdPrimaryTypeObjectWithStructureOrOther == 0x4, "LLInt assumes PutByIdPrimaryTypeObjectWithStructureOrOther is == 0x4");
     161    static_assert(PutByIdSecondaryTypeMask == -0x8, "LLInt assumes PutByIdSecondaryTypeMask is == -0x8");
     162    static_assert(PutByIdSecondaryTypeBottom == 0x0, "LLInt assumes PutByIdSecondaryTypeBottom is == 0x0");
     163    static_assert(PutByIdSecondaryTypeBoolean == 0x8, "LLInt assumes PutByIdSecondaryTypeBoolean is == 0x8");
     164    static_assert(PutByIdSecondaryTypeOther == 0x10, "LLInt assumes PutByIdSecondaryTypeOther is == 0x10");
     165    static_assert(PutByIdSecondaryTypeInt32 == 0x18, "LLInt assumes PutByIdSecondaryTypeInt32 is == 0x18");
     166    static_assert(PutByIdSecondaryTypeNumber == 0x20, "LLInt assumes PutByIdSecondaryTypeNumber is == 0x20");
     167    static_assert(PutByIdSecondaryTypeString == 0x28, "LLInt assumes PutByIdSecondaryTypeString is == 0x28");
     168    static_assert(PutByIdSecondaryTypeSymbol == 0x30, "LLInt assumes PutByIdSecondaryTypeSymbol is == 0x30");
     169    static_assert(PutByIdSecondaryTypeObject == 0x38, "LLInt assumes PutByIdSecondaryTypeObject is == 0x38");
     170    static_assert(PutByIdSecondaryTypeObjectOrOther == 0x40, "LLInt assumes PutByIdSecondaryTypeObjectOrOther is == 0x40");
     171    static_assert(PutByIdSecondaryTypeTop == 0x48, "LLInt assumes PutByIdSecondaryTypeTop is == 0x48");
     172
    156173    static_assert(GlobalProperty == 0, "LLInt assumes GlobalProperty ResultType is == 0");
    157174    static_assert(GlobalVar == 1, "LLInt assumes GlobalVar ResultType is == 1");

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r190896 r190916  
    217217const PutByIdSecondaryTypeNumber = 0x20
    218218const PutByIdSecondaryTypeString = 0x28
    219 const PutByIdSecondaryTypeObject = 0x30
    220 const PutByIdSecondaryTypeObjectOrOther = 0x38
    221 const PutByIdSecondaryTypeTop = 0x40
     219const PutByIdSecondaryTypeSymbol = 0x30
     220const PutByIdSecondaryTypeObject = 0x38
     221const PutByIdSecondaryTypeObjectOrOther = 0x40
     222const PutByIdSecondaryTypeTop = 0x48
    222223
    223224const CopyBarrierSpaceBits = 3
    … …  
    327328# Type constants.
    328329const StringType = 6
     330const SymbolType = 7
    329331const ObjectType = 21
    330332const FinalObjectType = 22

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r190569 r190916  
    14041404    bilt t1, PutByIdSecondaryTypeString, .opPutByIdTypeCheckLessThanString
    14051405
    1406     # We are one of the following: String, Object, ObjectOrOther, Top
     1406    # We are one of the following: String, Symbol, Object, ObjectOrOther, Top
    14071407    bilt t1, PutByIdSecondaryTypeObjectOrOther, .opPutByIdTypeCheckLessThanObjectOrOther
    14081408
    … …  
    14181418
    14191419.opPutByIdTypeCheckLessThanObjectOrOther:
    1420     # We are either String or Object.
     1420    # We are either String, Symbol or Object.
    14211421    bineq t2, CellTag, .opPutByIdSlow
    14221422    bieq t1, PutByIdSecondaryTypeObject, .opPutByIdTypeCheckObject
     1423    bieq t1, PutByIdSecondaryTypeSymbol, .opPutByIdTypeCheckSymbol
    14231424    bbeq JSCell::m_type[t3], StringType, .opPutByIdDoneCheckingTypes
    14241425    jmp .opPutByIdSlow
    14251426.opPutByIdTypeCheckObject:
    14261427    bbaeq JSCell::m_type[t3], ObjectType, .opPutByIdDoneCheckingTypes
     1428    jmp .opPutByIdSlow
     1429.opPutByIdTypeCheckSymbol:
     1430    bbeq JSCell::m_type[t3], SymbolType, .opPutByIdDoneCheckingTypes
    14271431    jmp .opPutByIdSlow
    14281432

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r190896 r190916  
    12881288    bplt t1, PutByIdSecondaryTypeString, .opPutByIdTypeCheckLessThanString
    12891289
    1290     # We are one of the following: String, Object, ObjectOrOther, Top
     1290    # We are one of the following: String, Symbol, Object, ObjectOrOther, Top
    12911291    bplt t1, PutByIdSecondaryTypeObjectOrOther, .opPutByIdTypeCheckLessThanObjectOrOther
    12921292
    … …  
    13021302
    13031303.opPutByIdTypeCheckLessThanObjectOrOther:
    1304     # We are either String or Object.
     1304    # We are either String, Symbol or Object.
    13051305    btqnz t3, tagMask, .opPutByIdSlow
    13061306    bpeq t1, PutByIdSecondaryTypeObject, .opPutByIdTypeCheckObject
     1307    bpeq t1, PutByIdSecondaryTypeSymbol, .opPutByIdTypeCheckSymbol
    13071308    bbeq JSCell::m_type[t3], StringType, .opPutByIdDoneCheckingTypes
    13081309    jmp .opPutByIdSlow
    13091310.opPutByIdTypeCheckObject:
    13101311    bbaeq JSCell::m_type[t3], ObjectType, .opPutByIdDoneCheckingTypes
     1312    jmp .opPutByIdSlow
     1313.opPutByIdTypeCheckSymbol:
     1314    bbeq JSCell::m_type[t3], SymbolType, .opPutByIdDoneCheckingTypes
    13111315    jmp .opPutByIdSlow
    13121316

  • trunk/Source/JavaScriptCore/runtime/InferredType.cpp

    r190076 r190916  
    112112        case PutByIdSecondaryTypeString:
    113113            return String;
     114        case PutByIdSecondaryTypeSymbol:
     115            return Symbol;
    114116        case PutByIdSecondaryTypeObject:
    115117            return Object;
    … …  
    146148        if (cell->isString())
    147149            return String;
     150        if (cell->isSymbol())
     151            return Symbol;
    148152        if (cell->isObject()) {
    149153            if (cell->structure()->transitionWatchpointSetIsStillValid())
    … …  
    181185    case String:
    182186        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeString);
     187    case Symbol:
     188        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeSymbol);
    183189    case Object:
    184190        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeObject);
    … …  
    212218    case Boolean:
    213219    case String:
     220    case Symbol:
    214221        *this = Top;
    215222        return;
    … …  
    542549        out.print("String");
    543550        return;
     551    case InferredType::Symbol:
     552        out.print("Symbol");
     553        return;
    544554    case InferredType::ObjectWithStructure:
    545555        out.print("ObjectWithStructure");

  • trunk/Source/JavaScriptCore/runtime/InferredType.h

    r190076 r190916  
    6161        Number,
    6262        String,
     63        Symbol,
    6364        ObjectWithStructure,
    6465        ObjectWithStructureOrOther,
    … …  
    126127            case String:
    127128                return value.isString();
     129            case Symbol:
     130                return value.isSymbol();
    128131            case ObjectWithStructure:
    129132                return value.isCell() && value.asCell()->structure() == m_structure;
Note: See TracChangeset for help on using the changeset viewer.