Changeset 194216 in webkit
- Timestamp:
- Dec 17, 2015 2:33:08 AM (8 years ago)
- Location:
- trunk
- Files:
-
- 7 added
- 25 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r194209 r194216 1 2015-12-17 Yusuke Suzuki <utatane.tea@gmail.com> 2 3 [ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL 4 https://bugs.webkit.org/show_bug.cgi?id=152227 5 6 Reviewed by Saam Barati. 7 8 Make the test taking longer time. 9 10 * js/regress/script-tests/generator-function-create.js: 11 (test): 12 1 13 2015-12-16 Andy Estes <aestes@apple.com> 2 14 -
trunk/LayoutTests/js/regress/script-tests/generator-function-create.js
r194141 r194216 8 8 return gen; 9 9 } 10 noInline(createGeneratorFunction); 10 function test() 11 { 12 for (var i = 0; i < 500; ++i) 13 createGeneratorFunction(); 14 } 15 noInline(test); 16 11 17 for (var i = 0; i < 1e4; ++i) 12 createGeneratorFunction();18 test(); -
trunk/Source/JavaScriptCore/ChangeLog
r194208 r194216 1 2015-12-17 Yusuke Suzuki <utatane.tea@gmail.com> 2 3 [ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL 4 https://bugs.webkit.org/show_bug.cgi?id=152227 5 6 Reviewed by Saam Barati. 7 8 This patch introduces new_generator_func / new_generator_func_exp into DFG and FTL. 9 We add a new DFG Node, NewGeneratorFunction. It will construct a function with GeneratorFunction's structure. 10 The structure of GeneratorFunction is different from one of Function because GeneratorFunction has the different __proto__. 11 12 Instead of extending NewFunction / PhantomNewFunction, we just added new DFG nodes, NewGeneratorFunction and PhantomNewGeneratorFunction. 13 This is because NewGeneratorFunction will generate an object that has different class info from JSFunction (And if JSGeneratorFunction is extended, its size will become different from JSFunction). 14 So, rather than extending NewFunction with generator flag, just adding new DFG nodes seems cleaner. 15 16 Object allocation sinking phase will change NewGeneratorFunction to PhantomNewGeneratorFunction and defer or eliminate its actual materialization. 17 It is completely the same to NewFunction and PhantomNewFunction. 18 And when OSR exit occurs, we need to execute deferred NewGeneratorFunction since Baseline JIT does not consider it. 19 So in FTL operation, we should create JSGeneratorFunction if we see PhantomNewGeneratorFunction materialization. 20 21 * dfg/DFGAbstractInterpreterInlines.h: 22 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): 23 * dfg/DFGByteCodeParser.cpp: 24 (JSC::DFG::ByteCodeParser::parseBlock): 25 * dfg/DFGCapabilities.cpp: 26 (JSC::DFG::capabilityLevel): 27 * dfg/DFGClobberize.h: 28 (JSC::DFG::clobberize): 29 * dfg/DFGClobbersExitState.cpp: 30 (JSC::DFG::clobbersExitState): 31 * dfg/DFGDoesGC.cpp: 32 (JSC::DFG::doesGC): 33 * dfg/DFGFixupPhase.cpp: 34 (JSC::DFG::FixupPhase::fixupNode): 35 * dfg/DFGMayExit.cpp: 36 (JSC::DFG::mayExit): 37 * dfg/DFGNode.h: 38 (JSC::DFG::Node::convertToPhantomNewFunction): 39 (JSC::DFG::Node::convertToPhantomNewGeneratorFunction): 40 (JSC::DFG::Node::hasCellOperand): 41 (JSC::DFG::Node::isFunctionAllocation): 42 (JSC::DFG::Node::isPhantomFunctionAllocation): 43 (JSC::DFG::Node::isPhantomAllocation): 44 * dfg/DFGNodeType.h: 45 * dfg/DFGObjectAllocationSinkingPhase.cpp: 46 * dfg/DFGPredictionPropagationPhase.cpp: 47 (JSC::DFG::PredictionPropagationPhase::propagate): 48 * dfg/DFGSafeToExecute.h: 49 (JSC::DFG::safeToExecute): 50 * dfg/DFGSpeculativeJIT.cpp: 51 (JSC::DFG::SpeculativeJIT::compileNewFunction): 52 * dfg/DFGSpeculativeJIT32_64.cpp: 53 (JSC::DFG::SpeculativeJIT::compile): 54 * dfg/DFGSpeculativeJIT64.cpp: 55 (JSC::DFG::SpeculativeJIT::compile): 56 * dfg/DFGStoreBarrierInsertionPhase.cpp: 57 * dfg/DFGStructureRegistrationPhase.cpp: 58 (JSC::DFG::StructureRegistrationPhase::run): 59 * dfg/DFGValidate.cpp: 60 (JSC::DFG::Validate::validateCPS): 61 (JSC::DFG::Validate::validateSSA): 62 * ftl/FTLCapabilities.cpp: 63 (JSC::FTL::canCompile): 64 * ftl/FTLLowerDFGToLLVM.cpp: 65 (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): 66 (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction): 67 * ftl/FTLOperations.cpp: 68 (JSC::FTL::operationPopulateObjectInOSR): 69 (JSC::FTL::operationMaterializeObjectInOSR): 70 * tests/stress/generator-function-create-optimized.js: Added. 71 (shouldBe): 72 (g): 73 (test.return.gen): 74 (test): 75 (test2.gen): 76 (test2): 77 * tests/stress/generator-function-declaration-sinking-no-double-allocate.js: Added. 78 (shouldBe): 79 (GeneratorFunctionPrototype): 80 (call): 81 (f): 82 (sink): 83 * tests/stress/generator-function-declaration-sinking-osrexit.js: Added. 84 (shouldBe): 85 (GeneratorFunctionPrototype): 86 (g): 87 (f): 88 (sink): 89 * tests/stress/generator-function-declaration-sinking-put.js: Added. 90 (shouldBe): 91 (GeneratorFunctionPrototype): 92 (g): 93 (f): 94 (sink): 95 * tests/stress/generator-function-expression-sinking-no-double-allocate.js: Added. 96 (shouldBe): 97 (GeneratorFunctionPrototype): 98 (call): 99 (f): 100 (sink): 101 * tests/stress/generator-function-expression-sinking-osrexit.js: Added. 102 (shouldBe): 103 (GeneratorFunctionPrototype): 104 (g): 105 (sink): 106 * tests/stress/generator-function-expression-sinking-put.js: Added. 107 (shouldBe): 108 (GeneratorFunctionPrototype): 109 (g): 110 (sink): 111 1 112 2015-12-16 Michael Saboff <msaboff@apple.com> 2 113 -
trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
r194141 r194216 1715 1715 case PhantomNewObject: 1716 1716 case PhantomNewFunction: 1717 case PhantomNewGeneratorFunction: 1717 1718 case PhantomCreateActivation: 1718 1719 case PhantomDirectArguments: … … 1761 1762 m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->arrowFunctionStructure()); 1762 1763 break; 1763 1764 1765 case NewGeneratorFunction: 1766 forNode(node).set( 1767 m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->generatorFunctionStructure()); 1768 break; 1769 1764 1770 case NewFunction: 1765 1771 forNode(node).set( -
trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
r194141 r194216 4558 4558 } 4559 4559 4560 case op_new_func: { 4560 case op_new_func: 4561 case op_new_generator_func: { 4561 4562 FunctionExecutable* decl = m_inlineStackTop->m_profiledBlock->functionDecl(currentInstruction[3].u.operand); 4562 4563 FrozenValue* frozen = m_graph.freezeStrong(decl); 4563 set(VirtualRegister(currentInstruction[1].u.operand), 4564 addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand)))); 4564 NodeType op = (opcodeID == op_new_generator_func) ? NewGeneratorFunction : NewFunction; 4565 set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand)))); 4566 static_assert(OPCODE_LENGTH(op_new_func) == OPCODE_LENGTH(op_new_generator_func), "The length of op_new_func should eqaual to one of op_new_generator_func"); 4565 4567 NEXT_OPCODE(op_new_func); 4566 4568 } 4567 4569 4568 4570 case op_new_func_exp: 4571 case op_new_generator_func_exp: 4569 4572 case op_new_arrow_func_exp: { 4570 4573 FunctionExecutable* expr = m_inlineStackTop->m_profiledBlock->functionExpr(currentInstruction[3].u.operand); 4571 4574 FrozenValue* frozen = m_graph.freezeStrong(expr); 4572 set(VirtualRegister(currentInstruction[1].u.operand),4573 addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));4574 4575 if (opcodeID == op_new_func_exp ) {4575 NodeType op = (opcodeID == op_new_generator_func_exp) ? NewGeneratorFunction : NewFunction; 4576 set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand)))); 4577 4578 if (opcodeID == op_new_func_exp || opcodeID == op_new_generator_func_exp) { 4576 4579 // Curly braces are necessary 4580 static_assert(OPCODE_LENGTH(op_new_func_exp) == OPCODE_LENGTH(op_new_generator_func_exp), "The length of op_new_func_exp should eqaual to one of op_new_generator_func_exp"); 4577 4581 NEXT_OPCODE(op_new_func_exp); 4578 4582 } else { -
trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
r194141 r194216 216 216 case op_new_func: 217 217 case op_new_func_exp: 218 case op_new_generator_func: 219 case op_new_generator_func_exp: 218 220 case op_new_arrow_func_exp: 219 221 case op_create_lexical_environment: -
trunk/Source/JavaScriptCore/dfg/DFGClobberize.h
r194141 r194216 1026 1026 case MaterializeNewObject: 1027 1027 case PhantomNewFunction: 1028 case PhantomNewGeneratorFunction: 1028 1029 case PhantomCreateActivation: 1029 1030 case MaterializeCreateActivation: … … 1034 1035 case NewArrowFunction: 1035 1036 case NewFunction: 1037 case NewGeneratorFunction: 1036 1038 if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid()) 1037 1039 write(Watchpoint_fire); -
trunk/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
r194141 r194216 62 62 case MaterializeNewObject: 63 63 case PhantomNewFunction: 64 case PhantomNewGeneratorFunction: 64 65 case PhantomCreateActivation: 65 66 case MaterializeCreateActivation: … … 78 79 case NewArrowFunction: 79 80 case NewFunction: 81 case NewGeneratorFunction: 80 82 // Like above, but with the JSFunction allocation caveat. 81 83 return node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid(); -
trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
r194141 r194216 214 214 case PhantomNewObject: 215 215 case PhantomNewFunction: 216 case PhantomNewGeneratorFunction: 216 217 case PhantomCreateActivation: 217 218 case PhantomDirectArguments: … … 248 249 case NewArrowFunction: 249 250 case NewFunction: 251 case NewGeneratorFunction: 250 252 case NewTypedArray: 251 253 case ThrowReferenceError: -
trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
r194141 r194216 1247 1247 case PhantomNewObject: 1248 1248 case PhantomNewFunction: 1249 case PhantomNewGeneratorFunction: 1249 1250 case PhantomCreateActivation: 1250 1251 case PhantomDirectArguments: … … 1388 1389 case CreateScopedArguments: 1389 1390 case CreateActivation: 1390 case NewFunction: { 1391 case NewFunction: 1392 case NewGeneratorFunction: { 1391 1393 fixEdge<CellUse>(node->child1()); 1392 1394 break; -
trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp
r194141 r194216 144 144 case NewFunction: 145 145 case NewArrowFunction: 146 case NewGeneratorFunction: 146 147 case NewStringObject: 147 148 case CreateActivation: -
trunk/Source/JavaScriptCore/dfg/DFGNode.h
r194141 r194216 586 586 void convertToPhantomNewFunction() 587 587 { 588 ASSERT(m_op == NewFunction || m_op == NewArrowFunction );588 ASSERT(m_op == NewFunction || m_op == NewArrowFunction || m_op == NewGeneratorFunction); 589 589 m_op = PhantomNewFunction; 590 m_flags |= NodeMustGenerate; 591 m_opInfo = 0; 592 m_opInfo2 = 0; 593 children = AdjacencyList(); 594 } 595 596 void convertToPhantomNewGeneratorFunction() 597 { 598 ASSERT(m_op == NewGeneratorFunction); 599 m_op = PhantomNewGeneratorFunction; 590 600 m_flags |= NodeMustGenerate; 591 601 m_opInfo = 0; … … 1357 1367 case NewFunction: 1358 1368 case NewArrowFunction: 1369 case NewGeneratorFunction: 1359 1370 case CreateActivation: 1360 1371 case MaterializeCreateActivation: … … 1575 1586 case NewArrowFunction: 1576 1587 case NewFunction: 1588 case NewGeneratorFunction: 1577 1589 return true; 1578 1590 default: … … 1585 1597 switch (op()) { 1586 1598 case PhantomNewFunction: 1599 case PhantomNewGeneratorFunction: 1587 1600 return true; 1588 1601 default: … … 1598 1611 case PhantomClonedArguments: 1599 1612 case PhantomNewFunction: 1613 case PhantomNewGeneratorFunction: 1600 1614 case PhantomCreateActivation: 1601 1615 return true; -
trunk/Source/JavaScriptCore/dfg/DFGNodeType.h
r194141 r194216 273 273 macro(MaterializeNewObject, NodeResultJS | NodeHasVarArgs) \ 274 274 macro(PhantomNewFunction, NodeResultJS | NodeMustGenerate) \ 275 macro(PhantomNewGeneratorFunction, NodeResultJS | NodeMustGenerate) \ 275 276 macro(PhantomCreateActivation, NodeResultJS | NodeMustGenerate) \ 276 277 macro(MaterializeCreateActivation, NodeResultJS | NodeHasVarArgs) \ … … 313 314 \ 314 315 macro(NewArrowFunction, NodeResultJS) \ 316 macro(NewGeneratorFunction, NodeResultJS) \ 315 317 \ 316 318 /* These aren't terminals but always exit */ \ -
trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
r194141 r194216 140 140 // replace any use of those pointers by the corresponding 141 141 // materialization 142 enum class Kind { Escaped, Object, Activation, Function, NewArrowFunction };142 enum class Kind { Escaped, Object, Activation, Function, ArrowFunction, GeneratorFunction }; 143 143 144 144 explicit Allocation(Node* identifier = nullptr, Kind kind = Kind::Escaped) … … 234 234 bool isFunctionAllocation() const 235 235 { 236 return m_kind == Kind::Function || m_kind == Kind::NewArrowFunction; 237 } 238 239 bool isArrowFunctionAllocation() const 240 { 241 return m_kind == Kind::NewArrowFunction; 236 return m_kind == Kind::Function || m_kind == Kind::ArrowFunction || m_kind == Kind::GeneratorFunction; 242 237 } 243 238 … … 275 270 break; 276 271 277 case Kind::NewArrowFunction: 278 out.print("NewArrowFunction"); 272 case Kind::ArrowFunction: 273 out.print("ArrowFunction"); 274 break; 275 276 case Kind::GeneratorFunction: 277 out.print("GeneratorFunction"); 279 278 break; 280 279 … … 838 837 839 838 case NewFunction: 840 case NewArrowFunction: { 839 case NewArrowFunction: 840 case NewGeneratorFunction: { 841 841 if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid()) { 842 842 m_heap.escape(node->child1().node()); … … 844 844 } 845 845 846 target = &m_heap.newAllocation(node, Allocation::Kind::Function); 846 if (node->op() == NewGeneratorFunction) 847 target = &m_heap.newAllocation(node, Allocation::Kind::GeneratorFunction); 848 else if (node->op() == NewArrowFunction) 849 target = &m_heap.newAllocation(node, Allocation::Kind::ArrowFunction); 850 else 851 target = &m_heap.newAllocation(node, Allocation::Kind::Function); 847 852 writes.add(FunctionExecutablePLoc, LazyNode(node->cellOperand())); 848 853 writes.add(FunctionActivationPLoc, LazyNode(node->child1().node())); … … 1447 1452 } 1448 1453 1449 case Allocation::Kind::NewArrowFunction: 1454 case Allocation::Kind::ArrowFunction: 1455 case Allocation::Kind::GeneratorFunction: 1450 1456 case Allocation::Kind::Function: { 1451 1457 FrozenValue* executable = allocation.identifier()->cellOperand(); 1452 1458 1453 NodeType nodeType = allocation.kind() == Allocation::Kind::NewArrowFunction ? NewArrowFunction : NewFunction; 1459 NodeType nodeType = 1460 allocation.kind() == Allocation::Kind::ArrowFunction ? NewArrowFunction : 1461 allocation.kind() == Allocation::Kind::GeneratorFunction ? NewGeneratorFunction : NewFunction; 1454 1462 1455 1463 return m_graph.addNode( … … 1784 1792 case NewFunction: 1785 1793 node->convertToPhantomNewFunction(); 1794 break; 1795 1796 case NewGeneratorFunction: 1797 node->convertToPhantomNewGeneratorFunction(); 1786 1798 break; 1787 1799 … … 2034 2046 2035 2047 case NewFunction: 2036 case NewArrowFunction: { 2048 case NewArrowFunction: 2049 case NewGeneratorFunction: { 2037 2050 Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee); 2038 2051 ASSERT(locations.size() == 2); -
trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
r194141 r194216 210 210 case GetCallee: 211 211 case NewArrowFunction: 212 case NewFunction: { 212 case NewFunction: 213 case NewGeneratorFunction: { 213 214 changed |= setPrediction(SpecFunction); 214 215 break; … … 592 593 case PhantomNewObject: 593 594 case PhantomNewFunction: 595 case PhantomNewGeneratorFunction: 594 596 case PhantomCreateActivation: 595 597 case PhantomDirectArguments: -
trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
r194141 r194216 269 269 case NewArrowFunction: 270 270 case NewFunction: 271 case NewGeneratorFunction: 271 272 case Jump: 272 273 case Branch: … … 315 316 case PhantomNewObject: 316 317 case PhantomNewFunction: 318 case PhantomNewGeneratorFunction: 317 319 case PhantomCreateActivation: 318 320 case PutHint: -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r194141 r194216 51 51 #include "JSCInlines.h" 52 52 #include "JSEnvironmentRecord.h" 53 #include "JSGeneratorFunction.h" 53 54 #include "JSLexicalEnvironment.h" 54 55 #include "LinkBuffer.h" … … 5373 5374 { 5374 5375 NodeType nodeType = node->op(); 5375 ASSERT(nodeType == NewFunction || nodeType == NewArrowFunction );5376 ASSERT(nodeType == NewFunction || nodeType == NewArrowFunction || nodeType == NewGeneratorFunction); 5376 5377 5377 5378 SpeculateCellOperand scope(this, node->child1()); … … 5411 5412 callOperation(operationNewArrowFunction, resultGPR, scopeGPR, executable, thisValueTagGPR, thisValuePayloadGPR); 5412 5413 #endif 5414 else if (nodeType == NewGeneratorFunction) 5415 callOperation(operationNewGeneratorFunction, resultGPR, scopeGPR, executable); 5413 5416 else 5414 5417 callOperation(operationNewFunction, resultGPR, scopeGPR, executable); … … 5418 5421 } 5419 5422 5420 Structure* structure = nodeType == NewArrowFunction 5421 ? m_jit.graph().globalObjectFor(node->origin.semantic)->arrowFunctionStructure() 5422 : m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure(); 5423 Structure* structure = 5424 nodeType == NewArrowFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->arrowFunctionStructure() : 5425 nodeType == NewGeneratorFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->generatorFunctionStructure() : 5426 m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure(); 5423 5427 5424 5428 GPRTemporary result(this); … … 5436 5440 5437 5441 addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable)); 5442 } 5443 5444 if (nodeType == NewGeneratorFunction) { 5445 compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable, JSGeneratorFunction::offsetOfScopeChain(), JSGeneratorFunction::offsetOfExecutable(), JSGeneratorFunction::offsetOfRareData()); 5446 5447 addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable)); 5438 5448 } 5439 5449 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
r194141 r194216 4409 4409 case NewFunction: 4410 4410 case NewArrowFunction: 4411 case NewGeneratorFunction: 4411 4412 compileNewFunction(node); 4412 4413 break; … … 4803 4804 case PhantomNewObject: 4804 4805 case PhantomNewFunction: 4806 case PhantomNewGeneratorFunction: 4805 4807 case PhantomCreateActivation: 4806 4808 case PutHint: -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
r194141 r194216 4398 4398 case NewFunction: 4399 4399 case NewArrowFunction: 4400 case NewGeneratorFunction: 4400 4401 compileNewFunction(node); 4401 4402 break; … … 4853 4854 case PhantomNewObject: 4854 4855 case PhantomNewFunction: 4856 case PhantomNewGeneratorFunction: 4855 4857 case PhantomCreateActivation: 4856 4858 case GetMyArgumentByVal: -
trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
r194141 r194216 307 307 case NewArrowFunction: 308 308 case NewFunction: 309 case NewGeneratorFunction: 309 310 // Nodes that allocate get to set their epoch because for those nodes we know 310 311 // that they will be the newest object in the heap. -
trunk/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp
r194141 r194216 147 147 registerStructure(m_graph.globalObjectFor(node->origin.semantic)->functionStructure()); 148 148 break; 149 case NewGeneratorFunction: 150 registerStructure(m_graph.globalObjectFor(node->origin.semantic)->generatorFunctionStructure()); 151 break; 149 152 150 153 default: -
trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp
r190220 r194216 456 456 case PhantomNewObject: 457 457 case PhantomNewFunction: 458 case PhantomNewGeneratorFunction: 458 459 case PhantomCreateActivation: 459 460 case GetMyArgumentByVal: … … 564 565 case PhantomNewObject: 565 566 case PhantomNewFunction: 567 case PhantomNewGeneratorFunction: 566 568 case PhantomCreateActivation: 567 569 case PhantomDirectArguments: -
trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
r194141 r194216 112 112 case NewArrowFunction: 113 113 case NewFunction: 114 case NewGeneratorFunction: 114 115 case GetClosureVar: 115 116 case PutClosureVar: … … 195 196 case PhantomNewObject: 196 197 case PhantomNewFunction: 198 case PhantomNewGeneratorFunction: 197 199 case PhantomCreateActivation: 198 200 case PutHint: -
trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
r194185 r194216 53 53 #include "JSArrowFunction.h" 54 54 #include "JSCInlines.h" 55 #include "JSGeneratorFunction.h" 55 56 #include "JSLexicalEnvironment.h" 56 57 #include "OperandsInlines.h" … … 755 756 case NewFunction: 756 757 case NewArrowFunction: 758 case NewGeneratorFunction: 757 759 compileNewFunction(); 758 760 break; … … 1012 1014 case PhantomNewObject: 1013 1015 case PhantomNewFunction: 1016 case PhantomNewGeneratorFunction: 1014 1017 case PhantomCreateActivation: 1015 1018 case PhantomDirectArguments: … … 3561 3564 void compileNewFunction() 3562 3565 { 3563 ASSERT(m_node->op() == NewFunction || m_node->op() == NewArrowFunction); 3564 3566 ASSERT(m_node->op() == NewFunction || m_node->op() == NewArrowFunction || m_node->op() == NewGeneratorFunction); 3565 3567 bool isArrowFunction = m_node->op() == NewArrowFunction; 3568 bool isGeneratorFunction = m_node->op() == NewGeneratorFunction; 3566 3569 3567 3570 LValue scope = lowCell(m_node->child1()); … … 3570 3573 FunctionExecutable* executable = m_node->castOperand<FunctionExecutable*>(); 3571 3574 if (executable->singletonFunction()->isStillValid()) { 3572 LValue callResult = isArrowFunction 3573 ? vmCall(m_out.int64, m_out.operation(operationNewArrowFunction), m_callFrame, scope, weakPointer(executable), thisValue) 3574 : vmCall(m_out.int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable)); 3575 LValue callResult = 3576 isArrowFunction ? vmCall(m_out.int64, m_out.operation(operationNewArrowFunction), m_callFrame, scope, weakPointer(executable), thisValue) : 3577 isGeneratorFunction ? vmCall(m_out.int64, m_out.operation(operationNewGeneratorFunction), m_callFrame, scope, weakPointer(executable)) : 3578 vmCall(m_out.int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable)); 3575 3579 setJSValue(callResult); 3576 3580 return; 3577 3581 } 3578 3582 3579 Structure* structure = isArrowFunction 3580 ? m_graph.globalObjectFor(m_node->origin.semantic)->arrowFunctionStructure() 3581 : m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure(); 3583 Structure* structure = 3584 isArrowFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->arrowFunctionStructure() : 3585 isGeneratorFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->generatorFunctionStructure() : 3586 m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure(); 3582 3587 3583 3588 LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("NewFunction slow path")); … … 3586 3591 LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath); 3587 3592 3588 LValue fastObject = isArrowFunction 3589 ? allocateObject<JSArrowFunction>(structure, m_out.intPtrZero, slowPath) 3590 : allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath); 3593 LValue fastObject = 3594 isArrowFunction ? allocateObject<JSArrowFunction>(structure, m_out.intPtrZero, slowPath) : 3595 isGeneratorFunction ? allocateObject<JSGeneratorFunction>(structure, m_out.intPtrZero, slowPath) : 3596 allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath); 3591 3597 3592 3598 … … 3617 3623 locations[0].directGPR(), locations[1].directGPR(), 3618 3624 CCallHelpers::TrustedImmPtr(executable), locations[2].directGPR()); 3625 } 3626 if (isGeneratorFunction) { 3627 return createLazyCallGenerator( 3628 operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, 3629 locations[0].directGPR(), locations[1].directGPR(), 3630 CCallHelpers::TrustedImmPtr(executable)); 3619 3631 } 3620 3632 return createLazyCallGenerator( -
trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp
r193766 r194216 35 35 #include "InlineCallFrame.h" 36 36 #include "JSCInlines.h" 37 #include "JSGeneratorFunction.h" 37 38 #include "JSLexicalEnvironment.h" 38 39 … … 93 94 94 95 case PhantomNewFunction: 96 case PhantomNewGeneratorFunction: 95 97 case PhantomDirectArguments: 96 98 case PhantomClonedArguments: … … 161 163 } 162 164 163 case PhantomNewFunction: { 165 case PhantomNewFunction: 166 case PhantomNewGeneratorFunction: { 164 167 // Figure out what the executable and activation are 165 168 FunctionExecutable* executable = nullptr; … … 174 177 RELEASE_ASSERT(executable && activation); 175 178 176 177 JSFunction* result =JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);178 179 return result;179 if (materialization->type() == PhantomNewFunction) 180 return JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation); 181 ASSERT(materialization->type() == PhantomNewGeneratorFunction); 182 return JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation); 180 183 } 181 184
Note: See TracChangeset
for help on using the changeset viewer.