Changeset 205507 in webkit
- Timestamp:
- Sep 6, 2016 2:35:24 PM (8 years ago)
- Location:
- trunk
- Files:
-
- 15 deleted
- 64 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r205504 r205507 1 2016-09-06 Commit Queue <commit-queue@webkit.org> 2 3 Unreviewed, rolling out r205504. 4 https://bugs.webkit.org/show_bug.cgi?id=161645 5 6 Broke the iOS device build (Requested by ryanhaddad on 7 #webkit). 8 9 Reverted changeset: 10 11 "Make JSMap and JSSet faster" 12 https://bugs.webkit.org/show_bug.cgi?id=160989 13 http://trac.webkit.org/changeset/205504 14 1 15 2016-09-06 Saam Barati <sbarati@apple.com> 2 16 -
trunk/Source/JavaScriptCore/CMakeLists.txt
r205504 r205507 673 673 runtime/GeneratorPrototype.cpp 674 674 runtime/GetterSetter.cpp 675 runtime/HashMapImpl.cpp676 675 runtime/Identifier.cpp 677 676 runtime/IndexingType.cpp … … 759 758 runtime/LiteralParser.cpp 760 759 runtime/Lookup.cpp 761 runtime/MapBase.cpp762 760 runtime/MapConstructor.cpp 763 761 runtime/MapIteratorPrototype.cpp -
trunk/Source/JavaScriptCore/ChangeLog
r205504 r205507 1 2016-09-06 Commit Queue <commit-queue@webkit.org> 2 3 Unreviewed, rolling out r205504. 4 https://bugs.webkit.org/show_bug.cgi?id=161645 5 6 Broke the iOS device build (Requested by ryanhaddad on 7 #webkit). 8 9 Reverted changeset: 10 11 "Make JSMap and JSSet faster" 12 https://bugs.webkit.org/show_bug.cgi?id=160989 13 http://trac.webkit.org/changeset/205504 14 1 15 2016-09-06 Saam Barati <sbarati@apple.com> 2 16 -
trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
r205504 r205507 1319 1319 792CB3491C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */; }; 1320 1320 792CB34A1C4EED5C00D13AF3 /* PCToCodeOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1321 795B19971D78BE3500262FA0 /* MapBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 795B19951D78BE3500262FA0 /* MapBase.cpp */; };1322 795B19981D78BE3500262FA0 /* MapBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 795B19961D78BE3500262FA0 /* MapBase.h */; settings = {ATTRIBUTES = (Private, ); }; };1323 1321 7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 796465681B952FF0003059EE /* GetPutInfo.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1324 1322 797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */; }; 1325 1323 797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1326 1324 799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1327 79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A0907D1D768465008B889B /* HashMapImpl.cpp */; };1328 79A090801D768465008B889B /* HashMapImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A0907E1D768465008B889B /* HashMapImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };1329 1325 79A228351D35D71E00D8E067 /* ArithProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A228331D35D71E00D8E067 /* ArithProfile.cpp */; }; 1330 1326 79A228361D35D71F00D8E067 /* ArithProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A228341D35D71E00D8E067 /* ArithProfile.h */; }; … … 3574 3570 792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PCToCodeOriginMap.cpp; sourceTree = "<group>"; }; 3575 3571 792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PCToCodeOriginMap.h; sourceTree = "<group>"; }; 3576 795B19951D78BE3500262FA0 /* MapBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapBase.cpp; sourceTree = "<group>"; };3577 795B19961D78BE3500262FA0 /* MapBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapBase.h; sourceTree = "<group>"; };3578 3572 796465681B952FF0003059EE /* GetPutInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetPutInfo.h; sourceTree = "<group>"; }; 3579 3573 797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalLexicalEnvironment.cpp; sourceTree = "<group>"; }; 3580 3574 797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalLexicalEnvironment.h; sourceTree = "<group>"; }; 3581 3575 799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PCToOriginMap.h; path = b3/B3PCToOriginMap.h; sourceTree = "<group>"; }; 3582 79A0907D1D768465008B889B /* HashMapImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HashMapImpl.cpp; sourceTree = "<group>"; };3583 79A0907E1D768465008B889B /* HashMapImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashMapImpl.h; sourceTree = "<group>"; };3584 3576 79A228331D35D71E00D8E067 /* ArithProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArithProfile.cpp; sourceTree = "<group>"; }; 3585 3577 79A228341D35D71E00D8E067 /* ArithProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArithProfile.h; sourceTree = "<group>"; }; … … 5834 5826 BC02E9B80E184545000F9297 /* GetterSetter.cpp */, 5835 5827 BC337BDE0E1AF0B80076918A /* GetterSetter.h */, 5836 79A0907D1D768465008B889B /* HashMapImpl.cpp */,5837 79A0907E1D768465008B889B /* HashMapImpl.h */,5838 5828 933A349D038AE80F008635CE /* Identifier.cpp */, 5839 5829 933A349A038AE7C6008635CE /* Identifier.h */, … … 6046 6036 F692A8680255597D01FF60F7 /* Lookup.cpp */, 6047 6037 F692A8690255597D01FF60F7 /* Lookup.h */, 6048 795B19951D78BE3500262FA0 /* MapBase.cpp */,6049 795B19961D78BE3500262FA0 /* MapBase.h */,6050 6038 A700873717CBE85300C3E643 /* MapConstructor.cpp */, 6051 6039 A700873817CBE85300C3E643 /* MapConstructor.h */, … … 7339 7327 1429D8DE0ED2205B00B89619 /* CallFrame.h in Headers */, 7340 7328 62EC9BB71B7EB07C00303AD1 /* CallFrameShuffleData.h in Headers */, 7341 795B19981D78BE3500262FA0 /* MapBase.h in Headers */,7342 7329 62D755D71B84FB4A001801FA /* CallFrameShuffler.h in Headers */, 7343 7330 0F0B83B114BCF71800885B4F /* CallLinkInfo.h in Headers */, … … 7507 7494 A7D89CF817A0B8CC00773AD8 /* DFGFlushFormat.h in Headers */, 7508 7495 0F2DD8151AB3D8BE00BBB8E8 /* DFGForAllKills.h in Headers */, 7509 79A090801D768465008B889B /* HashMapImpl.h in Headers */,7510 7496 0F69CC89193AC60A0045759E /* DFGFrozenValue.h in Headers */, 7511 7497 86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */, … … 9240 9226 0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */, 9241 9227 0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */, 9242 79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */,9243 9228 0FEA0A1E1708B00700BB722C /* FTLAbstractHeapRepository.cpp in Sources */, 9244 9229 0F93274D1C1F66AA00CF6564 /* GPRInfo.cpp in Sources */, … … 9285 9270 FE4BFF2B1AD476E700088F87 /* FunctionOverrides.cpp in Sources */, 9286 9271 147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */, 9287 795B19971D78BE3500262FA0 /* MapBase.cpp in Sources */,9288 9272 62D2D38F1ADF103F000206C1 /* FunctionRareData.cpp in Sources */, 9289 9273 2AACE63C18CA5A0300ED0191 /* GCActivityCallback.cpp in Sources */, -
trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
r205504 r205507 31 31 32 32 #include "DirectArguments.h" 33 #include "JSCInlines.h"34 33 #include "JSArray.h" 35 34 #include "JSFunction.h" 36 #include "JSMap.h" 37 #include "JSSet.h" 35 #include "JSCInlines.h" 38 36 #include "ScopedArguments.h" 39 37 #include "StringObject.h" … … 349 347 if (classInfo == RegExpObject::info()) 350 348 return SpecRegExpObject; 351 352 if (classInfo == JSMap::info())353 return SpecMapObject;354 355 if (classInfo == JSSet::info())356 return SpecSetObject;357 349 358 350 if (classInfo->isSubClassOf(JSFunction::info())) -
trunk/Source/JavaScriptCore/bytecode/SpeculatedType.h
r205504 r205507 40 40 typedef uint64_t SpeculatedType; 41 41 static const SpeculatedType SpecNone = 0; // We don't know anything yet. 42 static const SpeculatedType SpecFinalObject = 1u ll<< 0; // It's definitely a JSFinalObject.43 static const SpeculatedType SpecArray = 1u ll<< 1; // It's definitely a JSArray.44 static const SpeculatedType SpecFunction = 1u ll<< 2; // It's definitely a JSFunction.45 static const SpeculatedType SpecInt8Array = 1u ll<< 3; // It's definitely an Int8Array or one of its subclasses.46 static const SpeculatedType SpecInt16Array = 1u ll<< 4; // It's definitely an Int16Array or one of its subclasses.47 static const SpeculatedType SpecInt32Array = 1u ll<< 5; // It's definitely an Int32Array or one of its subclasses.48 static const SpeculatedType SpecUint8Array = 1u ll<< 6; // It's definitely an Uint8Array or one of its subclasses.49 static const SpeculatedType SpecUint8ClampedArray = 1u ll<< 7; // It's definitely an Uint8ClampedArray or one of its subclasses.50 static const SpeculatedType SpecUint16Array = 1u ll<< 8; // It's definitely an Uint16Array or one of its subclasses.51 static const SpeculatedType SpecUint32Array = 1u ll<< 9; // It's definitely an Uint32Array or one of its subclasses.52 static const SpeculatedType SpecFloat32Array = 1u ll<< 10; // It's definitely an Uint16Array or one of its subclasses.53 static const SpeculatedType SpecFloat64Array = 1u ll<< 11; // It's definitely an Uint16Array or one of its subclasses.42 static const SpeculatedType SpecFinalObject = 1u << 0; // It's definitely a JSFinalObject. 43 static const SpeculatedType SpecArray = 1u << 1; // It's definitely a JSArray. 44 static const SpeculatedType SpecFunction = 1u << 2; // It's definitely a JSFunction. 45 static const SpeculatedType SpecInt8Array = 1u << 3; // It's definitely an Int8Array or one of its subclasses. 46 static const SpeculatedType SpecInt16Array = 1u << 4; // It's definitely an Int16Array or one of its subclasses. 47 static const SpeculatedType SpecInt32Array = 1u << 5; // It's definitely an Int32Array or one of its subclasses. 48 static const SpeculatedType SpecUint8Array = 1u << 6; // It's definitely an Uint8Array or one of its subclasses. 49 static const SpeculatedType SpecUint8ClampedArray = 1u << 7; // It's definitely an Uint8ClampedArray or one of its subclasses. 50 static const SpeculatedType SpecUint16Array = 1u << 8; // It's definitely an Uint16Array or one of its subclasses. 51 static const SpeculatedType SpecUint32Array = 1u << 9; // It's definitely an Uint32Array or one of its subclasses. 52 static const SpeculatedType SpecFloat32Array = 1u << 10; // It's definitely an Uint16Array or one of its subclasses. 53 static const SpeculatedType SpecFloat64Array = 1u << 11; // It's definitely an Uint16Array or one of its subclasses. 54 54 static const SpeculatedType SpecTypedArrayView = SpecInt8Array | SpecInt16Array | SpecInt32Array | SpecUint8Array | SpecUint8ClampedArray | SpecUint16Array | SpecUint32Array | SpecFloat32Array | SpecFloat64Array; 55 static const SpeculatedType SpecDirectArguments = 1ull << 12; // It's definitely a DirectArguments object. 56 static const SpeculatedType SpecScopedArguments = 1ull << 13; // It's definitely a ScopedArguments object. 57 static const SpeculatedType SpecStringObject = 1ull << 14; // It's definitely a StringObject. 58 static const SpeculatedType SpecRegExpObject = 1ull << 15; // It's definitely a RegExpObject (and not any subclass of RegExpObject). 59 static const SpeculatedType SpecMapObject = 1ull << 16; // It's definitely Map object (can it be a subclass? FIXME). 60 static const SpeculatedType SpecSetObject = 1ull << 17; // It's definitely s Set object (can it be a subclass? FIXME). 61 static const SpeculatedType SpecObjectOther = 1ull << 18; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction. 62 static const SpeculatedType SpecObject = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecMapObject | SpecSetObject | SpecObjectOther; // Bitmask used for testing for any kind of object prediction. 63 static const SpeculatedType SpecStringIdent = 1ull << 19; // It's definitely a JSString, and it's an identifier. 64 static const SpeculatedType SpecStringVar = 1ull << 20; // It's definitely a JSString, and it's not an identifier. 55 static const SpeculatedType SpecDirectArguments = 1u << 12; // It's definitely a DirectArguments object. 56 static const SpeculatedType SpecScopedArguments = 1u << 13; // It's definitely a ScopedArguments object. 57 static const SpeculatedType SpecStringObject = 1u << 14; // It's definitely a StringObject. 58 static const SpeculatedType SpecRegExpObject = 1u << 15; // It's definitely a RegExpObject (and not any subclass of RegExpObject). 59 static const SpeculatedType SpecObjectOther = 1u << 16; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction. 60 static const SpeculatedType SpecObject = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecObjectOther; // Bitmask used for testing for any kind of object prediction. 61 static const SpeculatedType SpecStringIdent = 1u << 17; // It's definitely a JSString, and it's an identifier. 62 static const SpeculatedType SpecStringVar = 1u << 18; // It's definitely a JSString, and it's not an identifier. 65 63 static const SpeculatedType SpecString = SpecStringIdent | SpecStringVar; // It's definitely a JSString. 66 static const SpeculatedType SpecSymbol = 1u ll << 21; // It's definitely a Symbol.67 static const SpeculatedType SpecCellOther = 1u ll << 22; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString or a Symbol. FIXME: This shouldn't be part of heap-top or bytecode-top. https://bugs.webkit.org/show_bug.cgi?id=13307864 static const SpeculatedType SpecSymbol = 1u << 19; // It's definitely a Symbol. 65 static const SpeculatedType SpecCellOther = 1u << 20; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString or a Symbol. FIXME: This shouldn't be part of heap-top or bytecode-top. https://bugs.webkit.org/show_bug.cgi?id=133078 68 66 static const SpeculatedType SpecCell = SpecObject | SpecString | SpecSymbol | SpecCellOther; // It's definitely a JSCell. 69 static const SpeculatedType SpecBoolInt32 = 1u ll << 23; // It's definitely an Int32 with value 0 or 1.70 static const SpeculatedType SpecNonBoolInt32 = 1u ll << 24; // It's definitely an Int32 with value other than 0 or 1.67 static const SpeculatedType SpecBoolInt32 = 1u << 21; // It's definitely an Int32 with value 0 or 1. 68 static const SpeculatedType SpecNonBoolInt32 = 1u << 22; // It's definitely an Int32 with value other than 0 or 1. 71 69 static const SpeculatedType SpecInt32Only = SpecBoolInt32 | SpecNonBoolInt32; // It's definitely an Int32. 72 static const SpeculatedType SpecInt52Only = 1u ll << 25; // It's definitely an Int52 and we intend it to unbox it. It's also definitely not an Int32.70 static const SpeculatedType SpecInt52Only = 1u << 23; // It's definitely an Int52 and we intend it to unbox it. It's also definitely not an Int32. 73 71 static const SpeculatedType SpecAnyInt = SpecInt32Only | SpecInt52Only; // It's something that we can do machine int arithmetic on. 74 static const SpeculatedType SpecAnyIntAsDouble = 1u ll << 26; // It's definitely an Int52 and it's inside a double.75 static const SpeculatedType SpecNonIntAsDouble = 1u ll << 27; // It's definitely not an Int52 but it's a real number and it's a double.72 static const SpeculatedType SpecAnyIntAsDouble = 1u << 24; // It's definitely an Int52 and it's inside a double. 73 static const SpeculatedType SpecNonIntAsDouble = 1u << 25; // It's definitely not an Int52 but it's a real number and it's a double. 76 74 static const SpeculatedType SpecDoubleReal = SpecNonIntAsDouble | SpecAnyIntAsDouble; // It's definitely a non-NaN double. 77 static const SpeculatedType SpecDoublePureNaN = 1u ll << 28; // It's definitely a NaN that is sae to tag (i.e. pure).78 static const SpeculatedType SpecDoubleImpureNaN = 1u ll << 29; // It's definitely a NaN that is unsafe to tag (i.e. impure).75 static const SpeculatedType SpecDoublePureNaN = 1u << 26; // It's definitely a NaN that is sae to tag (i.e. pure). 76 static const SpeculatedType SpecDoubleImpureNaN = 1u << 27; // It's definitely a NaN that is unsafe to tag (i.e. impure). 79 77 static const SpeculatedType SpecDoubleNaN = SpecDoublePureNaN | SpecDoubleImpureNaN; // It's definitely some kind of NaN. 80 78 static const SpeculatedType SpecBytecodeDouble = SpecDoubleReal | SpecDoublePureNaN; // It's either a non-NaN or a NaN double, but it's definitely not impure NaN. … … 84 82 static const SpeculatedType SpecBytecodeNumber = SpecInt32Only | SpecBytecodeDouble; // It's either an Int32 or a Double, and the Double cannot be an impure NaN. 85 83 static const SpeculatedType SpecFullNumber = SpecAnyInt | SpecFullDouble; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN. 86 static const SpeculatedType SpecBoolean = 1u ll << 30; // It's definitely a Boolean.87 static const SpeculatedType SpecOther = 1u ll << 31; // It's definitely either Null or Undefined.84 static const SpeculatedType SpecBoolean = 1u << 28; // It's definitely a Boolean. 85 static const SpeculatedType SpecOther = 1u << 29; // It's definitely either Null or Undefined. 88 86 static const SpeculatedType SpecMisc = SpecBoolean | SpecOther; // It's definitely either a boolean, Null, or Undefined. 89 87 static const SpeculatedType SpecHeapTop = SpecCell | SpecBytecodeNumber | SpecMisc; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. 90 88 static const SpeculatedType SpecPrimitive = SpecString | SpecSymbol | SpecBytecodeNumber | SpecMisc; // It's any non-Object JSValue. 91 static const SpeculatedType SpecEmpty = 1u ll << 32; // It's definitely an empty value marker.89 static const SpeculatedType SpecEmpty = 1u << 30; // It's definitely an empty value marker. 92 90 static const SpeculatedType SpecBytecodeTop = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local. 93 91 static const SpeculatedType SpecFullTop = SpecBytecodeTop | SpecFullNumber; // It can be anything that bytecode could see plus exotic encodings of numbers. -
trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
r205504 r205507 977 977 break; 978 978 } 979 980 case MapHash:981 forNode(node).setType(SpecInt32Only);982 break;983 984 case LoadFromJSMapBucket:985 forNode(node).makeHeapTop();986 break;987 988 case GetMapBucket:989 forNode(node).setType(m_graph, SpecCellOther);990 break;991 992 case IsNonEmptyMapBucket:993 forNode(node).setType(SpecBoolean);994 break;995 979 996 980 case IsEmpty: … … 2900 2884 { 2901 2885 Node* node = m_state.block()->at(indexInBlock); 2902 2886 2903 2887 startExecuting(); 2904 2888 executeEdges(node); -
trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
r205504 r205507 2539 2539 return true; 2540 2540 } 2541 2542 case JSMapGetIntrinsic: { 2543 if (argumentCountIncludingThis != 2) 2544 return false; 2545 2546 insertChecks(); 2547 Node* map = get(virtualRegisterForArgument(0, registerOffset)); 2548 Node* key = get(virtualRegisterForArgument(1, registerOffset)); 2549 Node* hash = addToGraph(MapHash, key); 2550 Node* bucket = addToGraph(GetMapBucket, Edge(map, MapObjectUse), Edge(key), Edge(hash)); 2551 Node* result = addToGraph(LoadFromJSMapBucket, OpInfo(), OpInfo(prediction), bucket); 2552 set(VirtualRegister(resultOperand), result); 2553 return true; 2554 } 2555 2556 case JSSetHasIntrinsic: 2557 case JSMapHasIntrinsic: { 2558 if (argumentCountIncludingThis != 2) 2559 return false; 2560 2561 insertChecks(); 2562 Node* mapOrSet = get(virtualRegisterForArgument(0, registerOffset)); 2563 Node* key = get(virtualRegisterForArgument(1, registerOffset)); 2564 Node* hash = addToGraph(MapHash, key); 2565 UseKind useKind = intrinsic == JSSetHasIntrinsic ? SetObjectUse : MapObjectUse; 2566 Node* bucket = addToGraph(GetMapBucket, OpInfo(0), Edge(mapOrSet, useKind), Edge(key), Edge(hash)); 2567 Node* result = addToGraph(IsNonEmptyMapBucket, bucket); 2568 set(VirtualRegister(resultOperand), result); 2569 return true; 2570 } 2571 2541 2572 2542 default: 2573 2543 return false; -
trunk/Source/JavaScriptCore/dfg/DFGClobberize.h
r205504 r205507 1244 1244 write(SideState); 1245 1245 return; 1246 1247 case MapHash:1248 def(PureValue(node));1249 return;1250 case GetMapBucket: {1251 read(MiscFields);1252 Edge& mapEdge = node->child1();1253 Edge& keyEdge = node->child2();1254 def(HeapLocation(MapBucketLoc, MiscFields, mapEdge, keyEdge), LazyNode(node));1255 return;1256 }1257 case LoadFromJSMapBucket: {1258 read(MiscFields);1259 Edge& bucketEdge = node->child1();1260 def(HeapLocation(JSMapGetLoc, MiscFields, bucketEdge), LazyNode(node));1261 return;1262 }1263 case IsNonEmptyMapBucket:1264 read(MiscFields);1265 def(HeapLocation(MapHasLoc, MiscFields, node->child1()), LazyNode(node));1266 return;1267 1246 1268 1247 case LastNodeType: -
trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
r205504 r205507 186 186 case CheckWatchdogTimer: 187 187 case StringFromCharCode: 188 case MapHash:189 case GetMapBucket:190 case LoadFromJSMapBucket:191 case IsNonEmptyMapBucket:192 188 case Unreachable: 193 189 case ExtractOSREntryLocal: -
trunk/Source/JavaScriptCore/dfg/DFGEdge.h
r205504 r205507 190 190 191 191 #if USE(JSVALUE64) 192 static constexpr uint32_t shift() { return 8; }192 static uint32_t shift() { return 7; } 193 193 194 194 static uintptr_t makeWord(Node* node, UseKind useKind, ProofStatus proofStatus, KillStatus killStatus) … … 198 198 ASSERT((shiftedValue >> shift()) == bitwise_cast<uintptr_t>(node)); 199 199 ASSERT(useKind >= 0 && useKind < LastUseKind); 200 static_assert((static_cast<uintptr_t>(LastUseKind) << 2) < (static_cast<uintptr_t>(1) << shift()), "We rely on this being true to not clobber the node pointer."); 201 uintptr_t result = shiftedValue | (static_cast<uintptr_t>(useKind) << 2) | (DFG::doesKill(killStatus) << 1) | static_cast<uintptr_t>(DFG::isProved(proofStatus)); 202 if (!ASSERT_DISABLED) { 203 union U { 204 U() { word = 0; } 205 uintptr_t word; 206 Edge edge; 207 } u; 208 u.word = result; 209 ASSERT(u.edge.useKindUnchecked() == useKind); 210 ASSERT(u.edge.node() == node); 211 ASSERT(u.edge.proofStatusUnchecked() == proofStatus); 212 ASSERT(u.edge.killStatusUnchecked() == killStatus); 213 } 214 return result; 200 ASSERT((static_cast<uintptr_t>(LastUseKind) << 2) <= (static_cast<uintptr_t>(2) << shift())); 201 return shiftedValue | (static_cast<uintptr_t>(useKind) << 2) | (DFG::doesKill(killStatus) << 1) | static_cast<uintptr_t>(DFG::isProved(proofStatus)); 215 202 } 216 203 -
trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
r205504 r205507 1545 1545 break; 1546 1546 } 1547 1548 case GetMapBucket:1549 if (node->child1().useKind() == MapObjectUse)1550 fixEdge<MapObjectUse>(node->child1());1551 else if (node->child1().useKind() == SetObjectUse)1552 fixEdge<SetObjectUse>(node->child1());1553 else1554 RELEASE_ASSERT_NOT_REACHED();1555 fixEdge<UntypedUse>(node->child2());1556 fixEdge<Int32Use>(node->child3());1557 break;1558 1559 case LoadFromJSMapBucket:1560 fixEdge<KnownCellUse>(node->child1());1561 break;1562 1563 case IsNonEmptyMapBucket:1564 fixEdge<KnownCellUse>(node->child1());1565 break;1566 1567 case MapHash:1568 fixEdge<UntypedUse>(node->child1());1569 break;1570 1547 1571 1548 #if !ASSERT_DISABLED -
trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp
r205504 r205507 144 144 out.print("RegExpObjectLastIndexLoc"); 145 145 return; 146 case MapBucketLoc:147 out.print("MapBucketLoc");148 return;149 case JSMapGetLoc:150 out.print("JSMapGetLoc");151 return;152 case MapHasLoc:153 out.print("MapHasLoc");154 return;155 146 } 156 147 -
trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h
r205504 r205507 59 59 TypedArrayByteOffsetLoc, 60 60 StackLoc, 61 StackPayloadLoc, 62 MapBucketLoc, 63 JSMapGetLoc, 64 MapHasLoc 61 StackPayloadLoc 65 62 }; 66 63 -
trunk/Source/JavaScriptCore/dfg/DFGNode.h
r205504 r205507 1422 1422 case StringReplaceRegExp: 1423 1423 case ToNumber: 1424 case LoadFromJSMapBucket:1425 1424 return true; 1426 1425 default: -
trunk/Source/JavaScriptCore/dfg/DFGNodeType.h
r205504 r205507 389 389 macro(GetEnumeratorStructurePname, NodeMustGenerate | NodeResultJS) \ 390 390 macro(GetEnumeratorGenericPname, NodeMustGenerate | NodeResultJS) \ 391 macro(ToIndexString, NodeResultJS) \ 392 /* Nodes for JSMap and JSSet */ \ 393 macro(MapHash, NodeResultInt32) \ 394 macro(GetMapBucket, NodeResultJS) \ 395 macro(LoadFromJSMapBucket, NodeResultJS) \ 396 macro(IsNonEmptyMapBucket, NodeResultBoolean) \ 391 macro(ToIndexString, NodeResultJS) 397 392 398 393 // This enum generates a monotonically increasing id for all Node types, -
trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp
r205504 r205507 51 51 #include "JSGenericTypedArrayViewConstructorInlines.h" 52 52 #include "JSLexicalEnvironment.h" 53 #include "JSMap.h"54 #include "JSSet.h"55 53 #include "ObjectConstructor.h" 56 54 #include "Repatch.h" … … 1818 1816 } 1819 1817 1820 int32_t JIT_OPERATION operationMapHash(ExecState* exec, EncodedJSValue input)1821 {1822 VM& vm = exec->vm();1823 NativeCallFrameTracer tracer(&vm, exec);1824 1825 return jsMapHash(exec, vm, normalizeMapKey(JSValue::decode(input)));1826 }1827 1828 JSCell* JIT_OPERATION operationJSMapFindBucket(ExecState* exec, JSCell* map, EncodedJSValue key, int32_t hash)1829 {1830 VM& vm = exec->vm();1831 NativeCallFrameTracer tracer(&vm, exec);1832 JSMap::BucketType** bucket = jsCast<JSMap*>(map)->findBucket(exec, normalizeMapKey(JSValue::decode(key)), hash);1833 if (!bucket)1834 return nullptr;1835 return *bucket;1836 }1837 1838 JSCell* JIT_OPERATION operationJSSetFindBucket(ExecState* exec, JSCell* map, EncodedJSValue key, int32_t hash)1839 {1840 VM& vm = exec->vm();1841 NativeCallFrameTracer tracer(&vm, exec);1842 JSSet::BucketType** bucket = jsCast<JSSet*>(map)->findBucket(exec, normalizeMapKey(JSValue::decode(key)), hash);1843 if (!bucket)1844 return nullptr;1845 return *bucket;1846 }1847 1848 1818 extern "C" void JIT_OPERATION triggerReoptimizationNow(CodeBlock* codeBlock, OSRExitBase* exit) 1849 1819 { -
trunk/Source/JavaScriptCore/dfg/DFGOperations.h
r205504 r205507 143 143 JSString* JIT_OPERATION operationSingleCharacterString(ExecState*, int32_t); 144 144 145 int32_t JIT_OPERATION operationMapHash(ExecState*, EncodedJSValue input);146 JSCell* JIT_OPERATION operationJSMapFindBucket(ExecState*, JSCell*, EncodedJSValue, int32_t);147 JSCell* JIT_OPERATION operationJSSetFindBucket(ExecState*, JSCell*, EncodedJSValue, int32_t);148 149 145 JSCell* JIT_OPERATION operationNewStringObject(ExecState*, JSString*, Structure*); 150 146 JSCell* JIT_OPERATION operationToStringOnCell(ExecState*, JSCell*); -
trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
r205504 r205507 709 709 case GetClosureVar: 710 710 case GetFromArguments: 711 case LoadFromJSMapBucket:712 711 case ToNumber: { 713 712 setPrediction(m_currentNode->getHeapPrediction()); … … 739 738 break; 740 739 } 741 742 case MapHash:743 setPrediction(SpecInt32Only);744 break;745 case GetMapBucket:746 setPrediction(SpecCellOther);747 break;748 case IsNonEmptyMapBucket:749 setPrediction(SpecBoolean);750 break;751 740 752 741 case GetRestLength: { -
trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
r205504 r205507 59 59 case FinalObjectUse: 60 60 case RegExpObjectUse: 61 case MapObjectUse:62 case SetObjectUse:63 61 case ObjectOrOtherUse: 64 62 case StringIdentUse: … … 358 356 case PutDynamicVar: 359 357 case ResolveScope: 360 case MapHash:361 case GetMapBucket:362 case LoadFromJSMapBucket:363 case IsNonEmptyMapBucket:364 358 return true; 365 359 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r205504 r205507 7408 7408 } 7409 7409 7410 void SpeculativeJIT::speculateMapObject(Edge edge, GPRReg cell)7411 {7412 speculateCellType(edge, cell, SpecMapObject, JSMapType);7413 }7414 7415 void SpeculativeJIT::speculateMapObject(Edge edge)7416 {7417 if (!needsTypeCheck(edge, SpecMapObject))7418 return;7419 7420 SpeculateCellOperand operand(this, edge);7421 speculateMapObject(edge, operand.gpr());7422 }7423 7424 void SpeculativeJIT::speculateSetObject(Edge edge, GPRReg cell)7425 {7426 speculateCellType(edge, cell, SpecSetObject, JSSetType);7427 }7428 7429 void SpeculativeJIT::speculateSetObject(Edge edge)7430 {7431 if (!needsTypeCheck(edge, SpecSetObject))7432 return;7433 7434 SpeculateCellOperand operand(this, edge);7435 speculateSetObject(edge, operand.gpr());7436 }7437 7438 7410 void SpeculativeJIT::speculateObjectOrOther(Edge edge) 7439 7411 { … … 7722 7694 case RegExpObjectUse: 7723 7695 speculateRegExpObject(edge); 7724 break;7725 case MapObjectUse:7726 speculateMapObject(edge);7727 break;7728 case SetObjectUse:7729 speculateSetObject(edge);7730 7696 break; 7731 7697 case ObjectOrOtherUse: -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
r205504 r205507 1312 1312 #if USE(JSVALUE64) 1313 1313 1314 JITCompiler::Call callOperation(C_JITOperation_ECJZ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)1315 {1316 m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);1317 return appendCallSetResult(operation, result);1318 }1319 1320 1314 JITCompiler::Call callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC) 1321 1315 { … … 1698 1692 } 1699 1693 1700 JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, GPRReg arg1)1701 {1702 m_jit.setupArgumentsWithExecState(arg1);1703 return appendCallSetResult(operation, result);1704 }1705 1706 1694 JITCompiler::Call callOperation(Z_JITOperation_EJZZ operation, GPRReg result, GPRReg arg1, unsigned arg2, unsigned arg3) 1707 1695 { … … 1751 1739 } 1752 1740 #else // USE(JSVALUE32_64) 1753 1754 JITCompiler::Call callOperation(C_JITOperation_ECJZ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2, GPRReg arg3)1755 {1756 m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), arg3);1757 return appendCallSetResult(operation, result);1758 }1759 1760 JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)1761 {1762 m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());1763 return appendCallSetResult(operation, result);1764 }1765 1741 1766 1742 JITCompiler::Call callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC) … … 2679 2655 void speculateRegExpObject(Edge, GPRReg cell); 2680 2656 void speculateRegExpObject(Edge); 2681 void speculateMapObject(Edge);2682 void speculateMapObject(Edge, GPRReg cell);2683 void speculateSetObject(Edge);2684 void speculateSetObject(Edge, GPRReg cell);2685 2657 void speculateObjectOrOther(Edge); 2686 2658 void speculateString(Edge edge, GPRReg cell); -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
r205504 r205507 38 38 #include "DirectArguments.h" 39 39 #include "GetterSetter.h" 40 #include "HashMapImpl.h"41 40 #include "JSEnvironmentRecord.h" 42 41 #include "JSLexicalEnvironment.h" … … 4721 4720 } 4722 4721 4723 case MapHash: {4724 JSValueOperand input(this, node->child1());4725 4726 JSValueRegs inputRegs = input.jsValueRegs();4727 4728 GPRFlushedCallResult result(this);4729 GPRReg resultGPR = result.gpr();4730 4731 flushRegisters();4732 callOperation(operationMapHash, resultGPR, inputRegs);4733 m_jit.exceptionCheck();4734 int32Result(resultGPR, node);4735 break;4736 }4737 4738 case GetMapBucket: {4739 SpeculateCellOperand map(this, node->child1());4740 JSValueOperand key(this, node->child2());4741 SpeculateInt32Operand hash(this, node->child3());4742 GPRFlushedCallResult result(this);4743 4744 GPRReg mapGPR = map.gpr();4745 JSValueRegs keyRegs = key.jsValueRegs();4746 GPRReg hashGPR = hash.gpr();4747 GPRReg resultGPR = result.gpr();4748 4749 if (node->child1().useKind() == MapObjectUse)4750 speculateMapObject(node->child1(), mapGPR);4751 else if (node->child1().useKind() == SetObjectUse)4752 speculateSetObject(node->child1(), mapGPR);4753 else4754 RELEASE_ASSERT_NOT_REACHED();4755 4756 flushRegisters();4757 if (node->child1().useKind() == MapObjectUse)4758 callOperation(operationJSMapFindBucket, resultGPR, mapGPR, keyRegs, hashGPR);4759 else4760 callOperation(operationJSSetFindBucket, resultGPR, mapGPR, keyRegs, hashGPR);4761 m_jit.exceptionCheck();4762 cellResult(resultGPR, node);4763 break;4764 }4765 4766 case LoadFromJSMapBucket: {4767 SpeculateCellOperand bucket(this, node->child1());4768 GPRTemporary resultPayload(this);4769 GPRTemporary resultTag(this);4770 4771 GPRReg bucketGPR = bucket.gpr();4772 GPRReg resultPayloadGPR = resultPayload.gpr();4773 GPRReg resultTagGPR = resultTag.gpr();4774 4775 auto notBucket = m_jit.branchTestPtr(MacroAssembler::Zero, bucketGPR);4776 m_jit.loadValue(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()), JSValueRegs(resultTagGPR, resultPayloadGPR));4777 auto done = m_jit.jump();4778 4779 notBucket.link(&m_jit);4780 m_jit.move(TrustedImm32(JSValue::UndefinedTag), resultTagGPR);4781 m_jit.move(TrustedImm32(0), resultPayloadGPR);4782 done.link(&m_jit);4783 jsValueResult(resultTagGPR, resultPayloadGPR, node);4784 break;4785 }4786 4787 case IsNonEmptyMapBucket: {4788 SpeculateCellOperand bucket(this, node->child1());4789 GPRTemporary result(this);4790 4791 GPRReg bucketGPR = bucket.gpr();4792 GPRReg resultGPR = result.gpr();4793 4794 m_jit.comparePtr(MacroAssembler::NotEqual, bucketGPR, TrustedImm32(0), resultGPR);4795 booleanResult(resultGPR, node);4796 break;4797 }4798 4799 4722 case Flush: 4800 4723 break; -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
r205504 r205507 40 40 #include "JSEnvironmentRecord.h" 41 41 #include "JSLexicalEnvironment.h" 42 #include "JSMap.h"43 42 #include "JSPropertyNameEnumerator.h" 44 #include "JSSet.h"45 43 #include "ObjectPrototype.h" 46 44 #include "SetupVarargsFrame.h" … … 4618 4616 } 4619 4617 4620 case MapHash: {4621 JSValueOperand input(this, node->child1());4622 GPRTemporary temp(this);4623 GPRTemporary result(this);4624 4625 GPRReg inputGPR = input.gpr();4626 GPRReg resultGPR = result.gpr();4627 GPRReg tempGPR = temp.gpr();4628 4629 MacroAssembler::JumpList straightHash;4630 MacroAssembler::JumpList done;4631 auto isNotCell = m_jit.branchIfNotCell(inputGPR);4632 MacroAssembler::JumpList slowPath;4633 straightHash.append(m_jit.branch8(MacroAssembler::NotEqual, MacroAssembler::Address(inputGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));4634 m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR);4635 slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));4636 m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR);4637 m_jit.urshift64(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR);4638 slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR));4639 done.append(m_jit.jump());4640 4641 isNotCell.link(&m_jit);4642 straightHash.append(m_jit.branchIfNotNumber(inputGPR));4643 straightHash.append(m_jit.branchIfInt32(JSValueRegs(inputGPR)));4644 slowPath.append(m_jit.jump());4645 4646 straightHash.link(&m_jit);4647 m_jit.move(inputGPR, resultGPR);4648 m_jit.wangsInt64Hash(resultGPR, tempGPR);4649 done.append(m_jit.jump());4650 4651 slowPath.link(&m_jit);4652 silentSpillAllRegisters(resultGPR);4653 callOperation(operationMapHash, resultGPR, inputGPR);4654 silentFillAllRegisters(resultGPR);4655 m_jit.exceptionCheck();4656 4657 done.link(&m_jit);4658 int32Result(resultGPR, node);4659 break;4660 }4661 case GetMapBucket: {4662 SpeculateCellOperand map(this, node->child1());4663 JSValueOperand key(this, node->child2());4664 SpeculateInt32Operand hash(this, node->child3());4665 GPRTemporary mask(this);4666 GPRTemporary index(this);4667 GPRTemporary buffer(this);4668 GPRTemporary bucket(this);4669 GPRTemporary result(this);4670 4671 GPRReg hashGPR = hash.gpr();4672 GPRReg mapGPR = map.gpr();4673 GPRReg maskGPR = mask.gpr();4674 GPRReg indexGPR = index.gpr();4675 GPRReg bufferGPR = buffer.gpr();4676 GPRReg bucketGPR = bucket.gpr();4677 GPRReg keyGPR = key.gpr();4678 GPRReg resultGPR = result.gpr();4679 4680 if (node->child1().useKind() == MapObjectUse)4681 speculateMapObject(node->child1(), mapGPR);4682 else if (node->child1().useKind() == SetObjectUse)4683 speculateSetObject(node->child1(), mapGPR);4684 else4685 RELEASE_ASSERT_NOT_REACHED();4686 4687 m_jit.loadPtr(MacroAssembler::Address(mapGPR, node->child1().useKind() == MapObjectUse ? JSMap::offsetOfHashMapImpl() : JSSet::offsetOfHashMapImpl()), bufferGPR);4688 m_jit.load32(MacroAssembler::Address(bufferGPR, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfCapacity()), maskGPR);4689 m_jit.loadPtr(MacroAssembler::Address(bufferGPR, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfBuffer()), bufferGPR);4690 m_jit.sub32(TrustedImm32(1), maskGPR);4691 m_jit.move(hashGPR, indexGPR);4692 4693 MacroAssembler::Label loop = m_jit.label();4694 MacroAssembler::JumpList done;4695 MacroAssembler::JumpList slowPathCases;4696 MacroAssembler::JumpList loopAround;4697 4698 m_jit.and32(maskGPR, indexGPR);4699 m_jit.loadPtr(MacroAssembler::BaseIndex(bufferGPR, indexGPR, MacroAssembler::TimesEight), bucketGPR);4700 m_jit.move(bucketGPR, resultGPR);4701 auto notPresentInTable = m_jit.branchPtr(MacroAssembler::Equal,4702 bucketGPR, TrustedImmPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::emptyValue()));4703 loopAround.append(m_jit.branchPtr(MacroAssembler::Equal,4704 bucketGPR, TrustedImmPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::deletedValue())));4705 4706 m_jit.load64(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKey>::offsetOfKey()), bucketGPR);4707 4708 // Perform Object.is()4709 done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR)); // They're definitely the same value, we found the bucket we were looking for!4710 auto oneIsntCell = m_jit.branchIfNotCell(JSValueRegs(bucketGPR));4711 // first is a cell here.4712 loopAround.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR)));4713 // Both are cells here.4714 loopAround.append(m_jit.branch8(JITCompiler::NotEqual,4715 JITCompiler::Address(bucketGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));4716 // The first is a string here.4717 slowPathCases.append(m_jit.branch8(JITCompiler::Equal,4718 JITCompiler::Address(keyGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));4719 // The first is a string, but the second is not, we continue to loop around.4720 loopAround.append(m_jit.jump());4721 4722 oneIsntCell.link(&m_jit);4723 // We've already done a 64-bit compare at this point, so if one is not a number, they're definitely not equal.4724 loopAround.append(m_jit.branchIfNotNumber(bucketGPR));4725 loopAround.append(m_jit.branchIfNotNumber(keyGPR));4726 // Both are definitely numbers. If we see a double, we go to the slow path.4727 slowPathCases.append(m_jit.branchIfNotInt32(bucketGPR));4728 slowPathCases.append(m_jit.branchIfNotInt32(keyGPR));4729 4730 loopAround.link(&m_jit);4731 m_jit.add32(TrustedImm32(1), indexGPR);4732 m_jit.jump().linkTo(loop, &m_jit);4733 4734 slowPathCases.link(&m_jit);4735 silentSpillAllRegisters(indexGPR);4736 if (node->child1().useKind() == MapObjectUse)4737 callOperation(operationJSMapFindBucket, resultGPR, mapGPR, keyGPR, hashGPR);4738 else4739 callOperation(operationJSSetFindBucket, resultGPR, mapGPR, keyGPR, hashGPR);4740 silentFillAllRegisters(indexGPR);4741 m_jit.exceptionCheck();4742 done.append(m_jit.jump());4743 4744 notPresentInTable.link(&m_jit);4745 m_jit.move(TrustedImmPtr(nullptr), resultGPR);4746 done.link(&m_jit);4747 cellResult(resultGPR, node);4748 break;4749 }4750 4751 case LoadFromJSMapBucket: {4752 SpeculateCellOperand bucket(this, node->child1());4753 GPRTemporary result(this);4754 4755 GPRReg bucketGPR = bucket.gpr();4756 GPRReg resultGPR = result.gpr();4757 4758 auto notBucket = m_jit.branchTestPtr(MacroAssembler::Zero, bucketGPR);4759 m_jit.load64(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()), resultGPR);4760 auto done = m_jit.jump();4761 4762 notBucket.link(&m_jit);4763 m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), resultGPR);4764 done.link(&m_jit);4765 jsValueResult(resultGPR, node);4766 break;4767 }4768 4769 case IsNonEmptyMapBucket: {4770 SpeculateCellOperand bucket(this, node->child1());4771 GPRTemporary result(this);4772 4773 GPRReg bucketGPR = bucket.gpr();4774 GPRReg resultGPR = result.gpr();4775 4776 m_jit.comparePtr(MacroAssembler::NotEqual, bucketGPR, TrustedImm32(0), resultGPR);4777 m_jit.or32(TrustedImm32(ValueFalse), resultGPR);4778 jsValueResult(resultGPR, node, DataFormatJSBoolean);4779 break;4780 }4781 4782 4618 case IsObject: { 4783 4619 JSValueOperand value(this, node->child1()); -
trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp
r205504 r205507 95 95 out.print("RegExpObject"); 96 96 return; 97 case MapObjectUse:98 out.print("MapObjectUse");99 return;100 case SetObjectUse:101 out.print("SetObjectUse");102 return;103 97 case ObjectOrOtherUse: 104 98 out.print("ObjectOrOther"); -
trunk/Source/JavaScriptCore/dfg/DFGUseKind.h
r205504 r205507 64 64 KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects). 65 65 SymbolUse, 66 MapObjectUse,67 SetObjectUse,68 66 StringObjectUse, 69 67 StringOrStringObjectUse, … … 137 135 case SymbolUse: 138 136 return SpecSymbol; 139 case MapObjectUse:140 return SpecMapObject;141 case SetObjectUse:142 return SpecSetObject;143 137 case StringObjectUse: 144 138 return SpecStringObject; … … 228 222 case StringObjectUse: 229 223 case StringOrStringObjectUse: 230 case MapObjectUse:231 case SetObjectUse:232 224 return true; 233 225 default: -
trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
r205504 r205507 33 33 #include "FTLAbstractHeap.h" 34 34 #include "IndexingType.h" 35 #include "JSMap.h"36 #include "JSSet.h"37 35 38 36 namespace JSC { namespace FTL { … … 104 102 macro(Structure_globalObject, Structure::globalObjectOffset()) \ 105 103 macro(Structure_prototype, Structure::prototypeOffset()) \ 106 macro(Structure_structureID, Structure::structureIDOffset()) \ 107 macro(JSMap_hashMapImpl, JSMap::offsetOfHashMapImpl()) \ 108 macro(JSSet_hashMapImpl, JSSet::offsetOfHashMapImpl()) \ 109 macro(HashMapImpl_capacity, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfCapacity()) \ 110 macro(HashMapImpl_buffer, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfBuffer()) \ 111 macro(HashMapBucket_value, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()) \ 112 macro(HashMapBucket_key, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfKey()) \ 104 macro(Structure_structureID, Structure::structureIDOffset()) 113 105 114 106 #define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \ -
trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
r205504 r205507 182 182 case In: 183 183 case IsJSArray: 184 case MapHash:185 case GetMapBucket:186 case LoadFromJSMapBucket:187 case IsNonEmptyMapBucket:188 184 case IsEmpty: 189 185 case IsUndefined: … … 430 426 case StringOrStringObjectUse: 431 427 case SymbolUse: 432 case MapObjectUse:433 case SetObjectUse:434 428 case FinalObjectUse: 435 429 case RegExpObjectUse: -
trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
r205504 r205507 71 71 #include "JSGeneratorFunction.h" 72 72 #include "JSLexicalEnvironment.h" 73 #include "JSMap.h"74 73 #include "OperandsInlines.h" 75 74 #include "ScopedArguments.h" … … 899 898 case IsJSArray: 900 899 compileIsJSArray(); 901 break;902 case MapHash:903 compileMapHash();904 break;905 case GetMapBucket:906 compileGetMapBucket();907 break;908 case LoadFromJSMapBucket:909 compileLoadFromJSMapBucket();910 break;911 case IsNonEmptyMapBucket:912 compileIsNonEmptyMapBucket();913 900 break; 914 901 case IsObject: … … 6301 6288 m_out.appendTo(continuation, lastNext); 6302 6289 setBoolean(m_out.phi(Int32, notCellResult, cellResult)); 6303 }6304 6305 void compileMapHash()6306 {6307 LValue value = lowJSValue(m_node->child1());6308 6309 LBasicBlock isCellCase = m_out.newBlock();6310 LBasicBlock notCell = m_out.newBlock();6311 LBasicBlock slowCase = m_out.newBlock();6312 LBasicBlock straightHash = m_out.newBlock();6313 LBasicBlock isNumberCase = m_out.newBlock();6314 LBasicBlock isStringCase = m_out.newBlock();6315 LBasicBlock nonEmptyStringCase = m_out.newBlock();6316 LBasicBlock continuation = m_out.newBlock();6317 6318 m_out.branch(6319 isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(notCell));6320 6321 LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);6322 LValue isString = m_out.equal(m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType), m_out.constInt32(StringType));6323 m_out.branch(6324 isString, unsure(isStringCase), unsure(straightHash));6325 6326 m_out.appendTo(isStringCase, nonEmptyStringCase);6327 LValue stringImpl = m_out.loadPtr(value, m_heaps.JSString_value);6328 m_out.branch(6329 m_out.equal(stringImpl, m_out.constIntPtr(0)), rarely(slowCase), usually(nonEmptyStringCase));6330 6331 m_out.appendTo(nonEmptyStringCase, notCell);6332 LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));6333 ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash);6334 m_out.branch(m_out.equal(hash, m_out.constInt32(0)),6335 rarely(slowCase), usually(continuation));6336 6337 m_out.appendTo(notCell, isNumberCase);6338 m_out.branch(6339 isNumber(value), unsure(isNumberCase), unsure(straightHash));6340 6341 m_out.appendTo(isNumberCase, straightHash);6342 m_out.branch(6343 isInt32(value), unsure(straightHash), unsure(slowCase));6344 6345 m_out.appendTo(straightHash, slowCase);6346 // key += ~(key << 32);6347 LValue key = value;6348 LValue temp = key;6349 temp = m_out.shl(temp, m_out.constInt32(32));6350 temp = m_out.bitNot(temp);6351 key = m_out.add(key, temp);6352 // key ^= (key >> 22);6353 temp = key;6354 temp = m_out.lShr(temp, m_out.constInt32(22));6355 key = m_out.bitXor(key, temp);6356 // key += ~(key << 13);6357 temp = key;6358 temp = m_out.shl(temp, m_out.constInt32(13));6359 temp = m_out.bitNot(temp);6360 key = m_out.add(key, temp);6361 // key ^= (key >> 8);6362 temp = key;6363 temp = m_out.lShr(temp, m_out.constInt32(8));6364 key = m_out.bitXor(key, temp);6365 // key += (key << 3);6366 temp = key;6367 temp = m_out.shl(temp, m_out.constInt32(3));6368 key = m_out.add(key, temp);6369 // key ^= (key >> 15);6370 temp = key;6371 temp = m_out.lShr(temp, m_out.constInt32(15));6372 key = m_out.bitXor(key, temp);6373 // key += ~(key << 27);6374 temp = key;6375 temp = m_out.shl(temp, m_out.constInt32(27));6376 temp = m_out.bitNot(temp);6377 key = m_out.add(key, temp);6378 // key ^= (key >> 31);6379 temp = key;6380 temp = m_out.lShr(temp, m_out.constInt32(31));6381 key = m_out.bitXor(key, temp);6382 key = m_out.castToInt32(key);6383 6384 ValueFromBlock fastResult = m_out.anchor(key);6385 m_out.jump(continuation);6386 6387 m_out.appendTo(slowCase, continuation);6388 ValueFromBlock slowResult = m_out.anchor(6389 vmCall(Int32, m_out.operation(operationMapHash), m_callFrame, value));6390 m_out.jump(continuation);6391 6392 m_out.appendTo(continuation, lastNext);6393 setInt32(m_out.phi(Int32, fastResult, slowResult, nonEmptyStringHashResult));6394 }6395 6396 void compileGetMapBucket()6397 {6398 LBasicBlock loopStart = m_out.newBlock();6399 LBasicBlock loopAround = m_out.newBlock();6400 LBasicBlock slowPath = m_out.newBlock();6401 LBasicBlock notPresentInTable = m_out.newBlock();6402 LBasicBlock notEmptyValue = m_out.newBlock();6403 LBasicBlock notDeletedValue = m_out.newBlock();6404 LBasicBlock notBitEqual = m_out.newBlock();6405 LBasicBlock bucketKeyNotCell = m_out.newBlock();6406 LBasicBlock bucketKeyIsCell = m_out.newBlock();6407 LBasicBlock bothAreCells = m_out.newBlock();6408 LBasicBlock bucketKeyIsString = m_out.newBlock();6409 LBasicBlock bucketKeyIsNumber = m_out.newBlock();6410 LBasicBlock bothAreNumbers = m_out.newBlock();6411 LBasicBlock bucketKeyIsInt32 = m_out.newBlock();6412 LBasicBlock continuation = m_out.newBlock();6413 6414 LBasicBlock lastNext = m_out.insertNewBlocksBefore(loopStart);6415 6416 LValue map;6417 if (m_node->child1().useKind() == MapObjectUse)6418 map = lowMapObject(m_node->child1());6419 else if (m_node->child1().useKind() == SetObjectUse)6420 map = lowSetObject(m_node->child1());6421 else6422 RELEASE_ASSERT_NOT_REACHED();6423 6424 LValue key = lowJSValue(m_node->child2());6425 LValue hash = lowInt32(m_node->child3());6426 6427 LValue hashMapImpl = m_out.loadPtr(map, m_node->child1().useKind() == MapObjectUse ? m_heaps.JSMap_hashMapImpl : m_heaps.JSSet_hashMapImpl);6428 LValue buffer = m_out.loadPtr(hashMapImpl, m_heaps.HashMapImpl_buffer);6429 LValue mask = m_out.sub(m_out.load32(hashMapImpl, m_heaps.HashMapImpl_capacity), m_out.int32One);6430 6431 ValueFromBlock indexStart = m_out.anchor(hash);6432 m_out.jump(loopStart);6433 6434 m_out.appendTo(loopStart, notEmptyValue);6435 LValue unmaskedIndex = m_out.phi(Int32, indexStart);6436 LValue index = m_out.bitAnd(mask, unmaskedIndex);6437 LValue hashMapBucket = m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), buffer, m_out.zeroExt(index, Int64), ScaleEight));6438 ValueFromBlock bucketResult = m_out.anchor(hashMapBucket);6439 m_out.branch(m_out.equal(hashMapBucket, m_out.constIntPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::emptyValue())),6440 unsure(notPresentInTable), unsure(notEmptyValue));6441 6442 m_out.appendTo(notEmptyValue, notDeletedValue);6443 m_out.branch(m_out.equal(hashMapBucket, m_out.constIntPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::deletedValue())),6444 unsure(loopAround), unsure(notDeletedValue));6445 6446 m_out.appendTo(notDeletedValue, notBitEqual);6447 LValue bucketKey = m_out.load64(hashMapBucket, m_heaps.HashMapBucket_key);6448 // Perform Object.is()6449 m_out.branch(m_out.equal(key, bucketKey),6450 unsure(continuation), unsure(notBitEqual));6451 6452 m_out.appendTo(notBitEqual, bucketKeyIsCell);6453 m_out.branch(isCell(bucketKey),6454 unsure(bucketKeyIsCell), unsure(bucketKeyNotCell));6455 6456 m_out.appendTo(bucketKeyIsCell, bothAreCells);6457 m_out.branch(isCell(key),6458 unsure(bothAreCells), unsure(loopAround));6459 6460 m_out.appendTo(bothAreCells, bucketKeyIsString);6461 m_out.branch(isString(bucketKey),6462 unsure(bucketKeyIsString), unsure(loopAround));6463 6464 m_out.appendTo(bucketKeyIsString, bucketKeyNotCell);6465 m_out.branch(isString(key),6466 unsure(slowPath), unsure(loopAround));6467 6468 m_out.appendTo(bucketKeyNotCell, bucketKeyIsNumber);6469 m_out.branch(isNotNumber(bucketKey),6470 unsure(loopAround), unsure(bucketKeyIsNumber));6471 6472 m_out.appendTo(bucketKeyIsNumber, bothAreNumbers);6473 m_out.branch(isNotNumber(key),6474 unsure(loopAround), unsure(bothAreNumbers));6475 6476 m_out.appendTo(bothAreNumbers, bucketKeyIsInt32);6477 m_out.branch(isNotInt32(bucketKey),6478 unsure(slowPath), unsure(bucketKeyIsInt32));6479 6480 m_out.appendTo(bucketKeyIsInt32, loopAround);6481 m_out.branch(isNotInt32(key),6482 unsure(slowPath), unsure(loopAround));6483 6484 m_out.appendTo(loopAround, slowPath);6485 m_out.addIncomingToPhi(unmaskedIndex, m_out.anchor(m_out.add(index, m_out.int32One)));6486 m_out.jump(loopStart);6487 6488 m_out.appendTo(slowPath, notPresentInTable);6489 ValueFromBlock slowPathResult = m_out.anchor(vmCall(pointerType(),6490 m_out.operation(m_node->child1().useKind() == MapObjectUse ? operationJSMapFindBucket : operationJSSetFindBucket), m_callFrame, map, key, hash));6491 m_out.jump(continuation);6492 6493 m_out.appendTo(notPresentInTable, continuation);6494 ValueFromBlock notPresentResult = m_out.anchor(m_out.constIntPtr(0));6495 m_out.jump(continuation);6496 6497 m_out.appendTo(continuation, lastNext);6498 setMapBucket(m_out.phi(pointerType(), bucketResult, slowPathResult, notPresentResult));6499 }6500 6501 void compileLoadFromJSMapBucket()6502 {6503 LValue mapBucket = lowMapBucket(m_node->child1());6504 6505 LBasicBlock continuation = m_out.newBlock();6506 LBasicBlock hasBucket = m_out.newBlock();6507 6508 ValueFromBlock noBucketResult = m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined())));6509 6510 m_out.branch(m_out.equal(mapBucket, m_out.constIntPtr(0)),6511 unsure(continuation), unsure(hasBucket));6512 6513 LBasicBlock lastNext = m_out.appendTo(hasBucket, continuation);6514 ValueFromBlock bucketResult = m_out.anchor(m_out.load64(mapBucket, m_heaps.HashMapBucket_value));6515 m_out.jump(continuation);6516 6517 m_out.appendTo(continuation, lastNext);6518 setJSValue(m_out.phi(Int64, noBucketResult, bucketResult));6519 }6520 6521 void compileIsNonEmptyMapBucket()6522 {6523 LValue bucket = lowMapBucket(m_node->child1());6524 LValue result = m_out.notEqual(bucket, m_out.constIntPtr(0));6525 setBoolean(result);6526 6290 } 6527 6291 … … 10216 9980 return result; 10217 9981 } 10218 10219 LValue lowMapObject(Edge edge)10220 {10221 LValue result = lowCell(edge);10222 speculateMapObject(edge, result);10223 return result;10224 }10225 10226 LValue lowSetObject(Edge edge)10227 {10228 LValue result = lowCell(edge);10229 speculateSetObject(edge, result);10230 return result;10231 }10232 9982 10233 9983 LValue lowString(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation) … … 10353 10103 return result; 10354 10104 } 10355 10356 LValue lowMapBucket(Edge edge)10357 {10358 LoweredNodeValue value = m_mapBucketValues.get(edge.node());10359 if (isValid(value))10360 return value.value();10361 10362 LValue result = lowCell(edge);10363 setStorage(edge.node(), result);10364 return result;10365 }10366 10105 10367 10106 LValue strictInt52ToInt32(Edge edge, LValue value) … … 10666 10405 case RegExpObjectUse: 10667 10406 speculateRegExpObject(edge); 10668 break;10669 case MapObjectUse:10670 speculateMapObject(edge);10671 break;10672 case SetObjectUse:10673 speculateSetObject(edge);10674 10407 break; 10675 10408 case StringUse: … … 11001 10734 speculateRegExpObject(edge, lowCell(edge)); 11002 10735 } 11003 11004 void speculateMapObject(Edge edge, LValue cell)11005 {11006 FTL_TYPE_CHECK(11007 jsValueValue(cell), edge, SpecMapObject, isNotType(cell, JSMapType));11008 }11009 11010 void speculateMapObject(Edge edge)11011 {11012 speculateMapObject(edge, lowCell(edge));11013 }11014 11015 void speculateSetObject(Edge edge, LValue cell)11016 {11017 FTL_TYPE_CHECK(11018 jsValueValue(cell), edge, SpecSetObject, isNotType(cell, JSSetType));11019 }11020 11021 void speculateSetObject(Edge edge)11022 {11023 speculateSetObject(edge, lowCell(edge));11024 }11025 10736 11026 10737 void speculateString(Edge edge, LValue cell) … … 11791 11502 m_storageValues.set(node, LoweredNodeValue(value, m_highBlock)); 11792 11503 } 11793 void setMapBucket(Node* node, LValue value)11794 {11795 m_mapBucketValues.set(node, LoweredNodeValue(value, m_highBlock));11796 }11797 11504 void setDouble(Node* node, LValue value) 11798 11505 { … … 11827 11534 { 11828 11535 setStorage(m_node, value); 11829 }11830 void setMapBucket(LValue value)11831 {11832 setMapBucket(m_node, value);11833 11536 } 11834 11537 void setDouble(LValue value) … … 12015 11718 HashMap<Node*, LoweredNodeValue> m_booleanValues; 12016 11719 HashMap<Node*, LoweredNodeValue> m_storageValues; 12017 HashMap<Node*, LoweredNodeValue> m_mapBucketValues;12018 11720 HashMap<Node*, LoweredNodeValue> m_doubleValues; 12019 11721 -
trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
r205504 r205507 627 627 } 628 628 629 #if USE(JSVALUE64)630 void AssemblyHelpers::wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch)631 {632 GPRReg input = inputAndResult;633 // key += ~(key << 32);634 move(input, scratch);635 lshift64(TrustedImm32(32), scratch);636 not64(scratch);637 add64(scratch, input);638 // key ^= (key >> 22);639 move(input, scratch);640 urshift64(TrustedImm32(22), scratch);641 xor64(scratch, input);642 // key += ~(key << 13);643 move(input, scratch);644 lshift64(TrustedImm32(13), scratch);645 not64(scratch);646 add64(scratch, input);647 // key ^= (key >> 8);648 move(input, scratch);649 urshift64(TrustedImm32(8), scratch);650 xor64(scratch, input);651 // key += (key << 3);652 move(input, scratch);653 lshift64(TrustedImm32(3), scratch);654 add64(scratch, input);655 // key ^= (key >> 15);656 move(input, scratch);657 urshift64(TrustedImm32(15), scratch);658 xor64(scratch, input);659 // key += ~(key << 27);660 move(input, scratch);661 lshift64(TrustedImm32(27), scratch);662 not64(scratch);663 add64(scratch, input);664 // key ^= (key >> 31);665 move(input, scratch);666 urshift64(TrustedImm32(31), scratch);667 xor64(scratch, input);668 669 // return static_cast<unsigned>(result)670 void* mask = bitwise_cast<void*>(static_cast<uintptr_t>(UINT_MAX));671 and64(TrustedImmPtr(mask), inputAndResult);672 }673 #endif // USE(JSVALUE64)674 675 629 } // namespace JSC 676 630 -
trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h
r205504 r205507 62 62 } 63 63 } 64 64 65 65 CodeBlock* codeBlock() { return m_codeBlock; } 66 66 VM* vm() { return m_vm; } … … 1529 1529 storePtr(TrustedImmPtr(structure->classInfo()), Address(resultGPR, JSDestructibleObject::classInfoOffset())); 1530 1530 } 1531 1532 #if USE(JSVALUE64)1533 void wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch);1534 #endif1535 1531 1536 1532 protected: -
trunk/Source/JavaScriptCore/jit/JITOperations.h
r205504 r205507 206 206 typedef JSCell* (JIT_OPERATION *C_JITOperation_EZ)(ExecState*, int32_t); 207 207 typedef JSCell* (JIT_OPERATION *C_JITOperation_EJscI)(ExecState*, JSScope*, UniquedStringImpl*); 208 typedef JSCell* (JIT_OPERATION *C_JITOperation_ECJZ)(ExecState*, JSCell*, EncodedJSValue, int32_t);209 208 typedef double (JIT_OPERATION *D_JITOperation_D)(double); 210 209 typedef double (JIT_OPERATION *D_JITOperation_G)(JSGlobalObject*); -
trunk/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
r205504 r205507 38 38 ModuleAnalyzer::ModuleAnalyzer(ExecState* exec, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables) 39 39 : m_vm(&exec->vm()) 40 , m_moduleRecord(exec->vm(), JSModuleRecord::create(exec , exec->vm(), exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables))40 , m_moduleRecord(exec->vm(), JSModuleRecord::create(exec->vm(), exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables)) 41 41 { 42 42 } -
trunk/Source/JavaScriptCore/runtime/Intrinsic.h
r205504 r205507 63 63 IsTypedArrayViewIntrinsic, 64 64 BoundThisNoArgsFunctionCallIntrinsic, 65 JSMapGetIntrinsic,66 JSMapHasIntrinsic,67 JSSetHasIntrinsic,68 65 69 66 // Getter intrinsics. -
trunk/Source/JavaScriptCore/runtime/JSCJSValue.h
r205504 r205507 607 607 bool isThisValueAltered(const PutPropertySlot&, JSObject* baseObject); 608 608 609 // See section 7.2.9: https://tc39.github.io/ecma262/#sec-samevalue610 bool sameValue(ExecState*, JSValue a, JSValue b);611 612 609 } // namespace JSC 613 610 -
trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
r205504 r205507 1059 1059 } 1060 1060 1061 // See section 7.2.9: https://tc39.github.io/ecma262/#sec-samevalue1062 ALWAYS_INLINE bool sameValue(ExecState* exec, JSValue a, JSValue b)1063 {1064 if (!a.isNumber())1065 return JSValue::strictEqual(exec, a, b);1066 if (!b.isNumber())1067 return false;1068 double x = a.asNumber();1069 double y = b.asNumber();1070 bool xIsNaN = std::isnan(x);1071 bool yIsNaN = std::isnan(y);1072 if (xIsNaN || yIsNaN)1073 return xIsNaN && yIsNaN;1074 return bitwise_cast<uint64_t>(x) == bitwise_cast<uint64_t>(y);1075 }1076 1077 1061 } // namespace JSC 1078 1062 -
trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
r205504 r205507 642 642 643 643 m_moduleLoaderStructure.set(vm, this, JSModuleLoader::createStructure(vm, this, m_moduleLoaderPrototype.get())); 644 m_moduleLoader.set(vm, this, JSModuleLoader::create( globalExec(),vm, this, m_moduleLoaderStructure.get()));644 m_moduleLoader.set(vm, this, JSModuleLoader::create(vm, this, m_moduleLoaderStructure.get())); 645 645 if (Options::exposeInternalModuleLoader()) 646 646 putDirectWithoutTransition(vm, vm.propertyNames->Loader, m_moduleLoader.get(), DontEnum); -
trunk/Source/JavaScriptCore/runtime/JSMap.cpp
r205504 r205507 1 1 /* 2 * Copyright (C) 2013 , 2016Apple Inc. All rights reserved.2 * Copyright (C) 2013 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 27 27 #include "JSMap.h" 28 28 29 #include "JSCInlines.h" 29 #include "CopiedBlockInlines.h" 30 #include "JSCJSValueInlines.h" 31 #include "JSMapIterator.h" 32 #include "MapDataInlines.h" 33 #include "SlotVisitorInlines.h" 34 #include "StructureInlines.h" 30 35 31 36 namespace JSC { 32 37 33 38 const ClassInfo JSMap::s_info = { "Map", &Base::s_info, 0, CREATE_METHOD_TABLE(JSMap) }; 39 40 void JSMap::destroy(JSCell* cell) 41 { 42 JSMap* thisObject = jsCast<JSMap*>(cell); 43 thisObject->JSMap::~JSMap(); 44 } 45 46 size_t JSMap::estimatedSize(JSCell* cell) 47 { 48 JSMap* thisObject = jsCast<JSMap*>(cell); 49 size_t mapDataSize = thisObject->m_mapData.capacityInBytes(); 50 return Base::estimatedSize(cell) + mapDataSize; 51 } 34 52 35 53 String JSMap::toStringName(const JSObject*, ExecState*) … … 38 56 } 39 57 58 void JSMap::visitChildren(JSCell* cell, SlotVisitor& visitor) 59 { 60 Base::visitChildren(cell, visitor); 61 jsCast<JSMap*>(cell)->m_mapData.visitChildren(cell, visitor); 40 62 } 63 64 void JSMap::copyBackingStore(JSCell* cell, CopyVisitor& visitor, CopyToken token) 65 { 66 Base::copyBackingStore(cell, visitor, token); 67 jsCast<JSMap*>(cell)->m_mapData.copyBackingStore(visitor, token); 68 } 69 70 bool JSMap::has(ExecState* exec, JSValue key) 71 { 72 return m_mapData.contains(exec, key); 73 } 74 75 size_t JSMap::size(ExecState* exec) 76 { 77 return m_mapData.size(exec); 78 } 79 80 JSValue JSMap::get(ExecState* exec, JSValue key) 81 { 82 JSValue result = m_mapData.get(exec, key); 83 if (!result) 84 return jsUndefined(); 85 return result; 86 } 87 88 void JSMap::set(ExecState* exec, JSValue key, JSValue value) 89 { 90 m_mapData.set(exec, this, key, value); 91 } 92 93 void JSMap::clear(ExecState*) 94 { 95 m_mapData.clear(); 96 } 97 98 bool JSMap::remove(ExecState* exec, JSValue key) 99 { 100 return m_mapData.remove(exec, key); 101 } 102 103 } -
trunk/Source/JavaScriptCore/runtime/JSMap.h
r205504 r205507 1 1 /* 2 * Copyright (C) 2013 , 2016Apple Inc. All rights reserved.2 * Copyright (C) 2013 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 27 27 #define JSMap_h 28 28 29 #include "JSDestructibleObject.h" 29 30 #include "JSObject.h" 30 #include "Map Base.h"31 #include "MapData.h" 31 32 32 33 namespace JSC { … … 34 35 class JSMapIterator; 35 36 36 class JSMap : public MapBase<HashMapBucket<HashMapBucketDataKeyValue>> { 37 typedef MapBase<HashMapBucket<HashMapBucketDataKeyValue>> Base; 37 class JSMap : public JSDestructibleObject { 38 38 public: 39 typedef JSDestructibleObject Base; 40 39 41 friend class JSMapIterator; 42 43 // Our marking functions expect Entry to maintain this layout, and have all 44 // fields be WriteBarrier<Unknown> 45 class Entry { 46 private: 47 WriteBarrier<Unknown> m_key; 48 WriteBarrier<Unknown> m_value; 49 50 public: 51 const WriteBarrier<Unknown>& key() const 52 { 53 return m_key; 54 } 55 56 const WriteBarrier<Unknown>& value() const 57 { 58 return m_value; 59 } 60 61 void visitChildren(SlotVisitor& visitor) 62 { 63 visitor.append(&m_key); 64 visitor.append(&m_value); 65 } 66 67 void setKey(VM& vm, const JSCell* owner, JSValue key) 68 { 69 m_key.set(vm, owner, key); 70 } 71 72 void setKeyWithoutWriteBarrier(JSValue key) 73 { 74 m_key.setWithoutWriteBarrier(key); 75 } 76 77 void setValue(VM& vm, const JSCell* owner, JSValue value) 78 { 79 m_value.set(vm, owner, value); 80 } 81 82 void clear() 83 { 84 m_key.clear(); 85 m_value.clear(); 86 } 87 }; 88 89 typedef MapDataImpl<Entry, JSMapIterator> MapData; 40 90 41 91 DECLARE_EXPORT_INFO; … … 43 93 static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 44 94 { 45 return Structure::create(vm, globalObject, prototype, TypeInfo( JSMapType, StructureFlags), info());95 return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 46 96 } 47 97 48 static JSMap* create( ExecState* exec,VM& vm, Structure* structure)98 static JSMap* create(VM& vm, Structure* structure) 49 99 { 50 100 JSMap* instance = new (NotNull, allocateCell<JSMap>(vm.heap)) JSMap(vm, structure); 51 instance->finishCreation( exec,vm);101 instance->finishCreation(vm); 52 102 return instance; 53 103 } 54 104 55 ALWAYS_INLINE JSValue get(ExecState* exec, JSValue key)105 static JSMap* create(ExecState* exec, Structure* structure) 56 106 { 57 return m_map->get(exec, key);107 return create(exec->vm(), structure); 58 108 } 59 109 60 ALWAYS_INLINE void set(ExecState* exec, JSValue key, JSValue value) 61 { 62 m_map->add(exec, key, value); 63 } 110 bool has(ExecState*, JSValue); 111 size_t size(ExecState*); 112 JSValue get(ExecState*, JSValue); 113 JS_EXPORT_PRIVATE void set(ExecState*, JSValue key, JSValue value); 114 void clear(ExecState*); 115 bool remove(ExecState*, JSValue); 64 116 65 117 private: 66 118 JSMap(VM& vm, Structure* structure) 67 119 : Base(vm, structure) 120 , m_mapData(vm, this) 68 121 { 69 122 } 70 123 124 static void destroy(JSCell*); 125 static size_t estimatedSize(JSCell*); 126 static void visitChildren(JSCell*, SlotVisitor&); 127 static void copyBackingStore(JSCell*, CopyVisitor&, CopyToken); 71 128 static String toStringName(const JSObject*, ExecState*); 129 130 MapData m_mapData; 72 131 }; 73 132 -
trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp
r205504 r205507 39 39 Base::finishCreation(vm); 40 40 m_map.set(vm, this, iteratedObject); 41 setIterator(vm, m_map->impl()->head());42 41 } 43 42 … … 48 47 Base::visitChildren(thisObject, visitor); 49 48 visitor.append(&thisObject->m_map); 50 visitor.append(&thisObject->m_iter);51 49 } 52 50 … … 62 60 JSMapIterator* JSMapIterator::clone(ExecState* exec) 63 61 { 64 VM& vm = exec->vm(); 65 auto clone = JSMapIterator::create(vm, exec->callee()->globalObject()->mapIteratorStructure(), m_map.get(), m_kind); 66 clone->setIterator(vm, m_iter.get()); 62 auto clone = JSMapIterator::create(exec->vm(), exec->callee()->globalObject()->mapIteratorStructure(), m_map.get(), m_kind); 63 clone->m_iterator = m_iterator; 67 64 return clone; 68 65 } -
trunk/Source/JavaScriptCore/runtime/JSMapIterator.h
r205504 r205507 1 1 /* 2 * Copyright (C) 2013 , 2016Apple, Inc. All rights reserved.2 * Copyright (C) 2013 Apple, Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 35 35 36 36 class JSMapIterator : public JSNonFinalObject { 37 typedef HashMapBucket<HashMapBucketDataKeyValue> HashMapBucketType;38 37 public: 39 38 typedef JSNonFinalObject Base; … … 53 52 } 54 53 55 ALWAYS_INLINE HashMapBucketType* advanceIter(ExecState* exec)54 bool next(CallFrame* callFrame, JSValue& value) 56 55 { 57 HashMapBucketType* prev = m_iter.get(); 58 if (!prev) 59 return nullptr; 60 HashMapBucketType* bucket = m_iter->next(); 61 while (bucket && bucket->deleted()) { 62 prev = bucket; 63 bucket = bucket->next(); 64 } 65 if (!bucket) { 66 setIterator(exec->vm(), nullptr); 67 return nullptr; 68 } 69 setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next(). 70 return bucket; 71 } 72 bool next(ExecState* exec, JSValue& value) 73 { 74 HashMapBucketType* bucket = advanceIter(exec); 75 if (!bucket) 56 WTF::KeyValuePair<JSValue, JSValue> pair; 57 if (!m_iterator.next(pair)) 76 58 return false; 77 59 78 60 if (m_kind == IterateValue) 79 value = bucket->value();61 value = pair.value; 80 62 else if (m_kind == IterateKey) 81 value = bucket->key();63 value = pair.key; 82 64 else 83 value = createPair( exec, bucket->key(), bucket->value());65 value = createPair(callFrame, pair.key, pair.value); 84 66 return true; 85 67 } 86 68 87 bool nextKeyValue( ExecState* exec,JSValue& key, JSValue& value)69 bool nextKeyValue(JSValue& key, JSValue& value) 88 70 { 89 HashMapBucketType* bucket = advanceIter(exec);90 if (! bucket)71 WTF::KeyValuePair<JSValue, JSValue> pair; 72 if (!m_iterator.next(pair)) 91 73 return false; 92 74 93 key = bucket->key();94 value = bucket->value();75 key = pair.key; 76 value = pair.value; 95 77 return true; 78 } 79 80 void finish() 81 { 82 m_iterator.finish(); 96 83 } 97 84 … … 100 87 JSMapIterator* clone(ExecState*); 101 88 89 JSMap::MapData::IteratorData* iteratorData() 90 { 91 return &m_iterator; 92 } 93 102 94 private: 103 JSMapIterator(VM& vm, Structure* structure, JSMap* , IterationKind kind)95 JSMapIterator(VM& vm, Structure* structure, JSMap* iteratedObject, IterationKind kind) 104 96 : Base(vm, structure) 97 , m_iterator(iteratedObject->m_mapData.createIteratorData(this)) 105 98 , m_kind(kind) 106 { }107 108 void setIterator(VM& vm, HashMapBucketType* bucket)109 99 { 110 m_iter.setMayBeNull(vm, this, bucket);111 100 } 112 101 … … 116 105 117 106 WriteBarrier<JSMap> m_map; 118 WriteBarrier<HashMapBucketType> m_iter;107 JSMap::MapData::IteratorData m_iterator; 119 108 IterationKind m_kind; 120 109 }; -
trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp
r205504 r205507 56 56 } 57 57 58 void JSModuleLoader::finishCreation( ExecState* exec,VM& vm, JSGlobalObject* globalObject)58 void JSModuleLoader::finishCreation(VM& vm, JSGlobalObject* globalObject) 59 59 { 60 60 Base::finishCreation(vm); 61 61 ASSERT(inherits(info())); 62 auto scope = DECLARE_THROW_SCOPE(vm); 63 JSMap* map = JSMap::create(exec, vm, globalObject->mapStructure()); 64 RELEASE_ASSERT(!scope.exception()); 65 putDirect(vm, Identifier::fromString(&vm, "registry"), map); 62 putDirect(vm, Identifier::fromString(&vm, "registry"), JSMap::create(vm, globalObject->mapStructure())); 66 63 } 67 64 -
trunk/Source/JavaScriptCore/runtime/JSModuleLoader.h
r205504 r205507 48 48 }; 49 49 50 static JSModuleLoader* create( ExecState* exec,VM& vm, JSGlobalObject* globalObject, Structure* structure)50 static JSModuleLoader* create(VM& vm, JSGlobalObject* globalObject, Structure* structure) 51 51 { 52 52 JSModuleLoader* object = new (NotNull, allocateCell<JSModuleLoader>(vm.heap)) JSModuleLoader(vm, structure); 53 object->finishCreation( exec,vm, globalObject);53 object->finishCreation(vm, globalObject); 54 54 return object; 55 55 } … … 78 78 79 79 protected: 80 void finishCreation( ExecState*,VM&, JSGlobalObject*);80 void finishCreation(VM&, JSGlobalObject*); 81 81 }; 82 82 -
trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
r205504 r205507 45 45 } 46 46 47 void JSModuleRecord::finishCreation( ExecState* exec,VM& vm)47 void JSModuleRecord::finishCreation(VM& vm) 48 48 { 49 49 Base::finishCreation(vm); … … 52 52 putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("evaluated")), jsBoolean(false)); 53 53 54 auto scope = DECLARE_THROW_SCOPE(vm); 55 JSMap* map = JSMap::create(exec, vm, globalObject()->mapStructure()); 56 RELEASE_ASSERT(!scope.exception()); 57 m_dependenciesMap.set(vm, this, map); 54 m_dependenciesMap.set(vm, this, JSMap::create(vm, globalObject()->mapStructure())); 58 55 putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("dependenciesMap")), m_dependenciesMap.get()); 59 56 } -
trunk/Source/JavaScriptCore/runtime/JSModuleRecord.h
r205504 r205507 88 88 } 89 89 90 static JSModuleRecord* create( ExecState* exec,VM& vm, Structure* structure, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)90 static JSModuleRecord* create(VM& vm, Structure* structure, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables) 91 91 { 92 92 JSModuleRecord* instance = new (NotNull, allocateCell<JSModuleRecord>(vm.heap)) JSModuleRecord(vm, structure, moduleKey, sourceCode, declaredVariables, lexicalVariables); 93 instance->finishCreation( exec,vm);93 instance->finishCreation(vm); 94 94 return instance; 95 95 } … … 153 153 } 154 154 155 void finishCreation( ExecState*,VM&);155 void finishCreation(VM&); 156 156 157 157 JSModuleNamespaceObject* getModuleNamespace(ExecState*); -
trunk/Source/JavaScriptCore/runtime/JSSet.cpp
r205504 r205507 1 1 /* 2 * Copyright (C) 2013 , 2016Apple Inc. All rights reserved.2 * Copyright (C) 2013 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 27 27 #include "JSSet.h" 28 28 29 #include "JSCInlines.h" 29 #include "CopiedBlockInlines.h" 30 #include "JSCJSValueInlines.h" 31 #include "JSSetIterator.h" 32 #include "MapDataInlines.h" 33 #include "SlotVisitorInlines.h" 34 #include "StructureInlines.h" 30 35 31 36 namespace JSC { 32 37 33 38 const ClassInfo JSSet::s_info = { "Set", &Base::s_info, 0, CREATE_METHOD_TABLE(JSSet) }; 39 40 void JSSet::destroy(JSCell* cell) 41 { 42 JSSet* thisObject = jsCast<JSSet*>(cell); 43 thisObject->JSSet::~JSSet(); 44 } 34 45 35 46 String JSSet::toStringName(const JSObject*, ExecState*) … … 38 49 } 39 50 51 size_t JSSet::estimatedSize(JSCell* cell) 52 { 53 JSSet* thisObject = jsCast<JSSet*>(cell); 54 size_t setDataSize = thisObject->m_setData.capacityInBytes(); 55 return Base::estimatedSize(cell) + setDataSize; 40 56 } 57 58 void JSSet::visitChildren(JSCell* cell, SlotVisitor& visitor) 59 { 60 Base::visitChildren(cell, visitor); 61 jsCast<JSSet*>(cell)->m_setData.visitChildren(cell, visitor); 62 } 63 64 void JSSet::copyBackingStore(JSCell* cell, CopyVisitor& visitor, CopyToken token) 65 { 66 Base::copyBackingStore(cell, visitor, token); 67 jsCast<JSSet*>(cell)->m_setData.copyBackingStore(visitor, token); 68 } 69 70 bool JSSet::has(ExecState* exec, JSValue value) 71 { 72 return m_setData.contains(exec, value); 73 } 74 75 size_t JSSet::size(ExecState* exec) 76 { 77 return m_setData.size(exec); 78 } 79 80 void JSSet::add(ExecState* exec, JSValue value) 81 { 82 m_setData.set(exec, this, value, value); 83 } 84 85 void JSSet::clear(ExecState*) 86 { 87 m_setData.clear(); 88 } 89 90 bool JSSet::remove(ExecState* exec, JSValue value) 91 { 92 return m_setData.remove(exec, value); 93 } 94 95 } -
trunk/Source/JavaScriptCore/runtime/JSSet.h
r205504 r205507 1 1 /* 2 * Copyright (C) 2013 , 2016Apple Inc. All rights reserved.2 * Copyright (C) 2013 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 27 27 #define JSSet_h 28 28 29 #include "JSDestructibleObject.h" 29 30 #include "JSObject.h" 30 #include "Map Base.h"31 #include "MapData.h" 31 32 32 33 namespace JSC { … … 34 35 class JSSetIterator; 35 36 36 class JSSet : public MapBase<HashMapBucket<HashMapBucketDataKey>> { 37 typedef MapBase<HashMapBucket<HashMapBucketDataKey>> Base; 37 class JSSet : public JSDestructibleObject { 38 38 public: 39 typedef JSDestructibleObject Base; 39 40 40 41 friend class JSSetIterator; 42 43 // Our marking functions expect Entry to maintain this layout, and have all 44 // fields be WriteBarrier<Unknown> 45 class Entry { 46 private: 47 WriteBarrier<Unknown> m_key; 48 49 public: 50 const WriteBarrier<Unknown>& key() const 51 { 52 return m_key; 53 } 54 55 const WriteBarrier<Unknown>& value() const 56 { 57 return m_key; 58 } 59 60 void visitChildren(SlotVisitor& visitor) 61 { 62 visitor.append(&m_key); 63 } 64 65 void setKey(VM& vm, const JSCell* owner, JSValue key) 66 { 67 m_key.set(vm, owner, key); 68 } 69 70 void setKeyWithoutWriteBarrier(JSValue key) 71 { 72 m_key.setWithoutWriteBarrier(key); 73 } 74 75 void setValue(VM&, const JSCell*, JSValue) 76 { 77 } 78 79 void clear() 80 { 81 m_key.clear(); 82 } 83 }; 84 85 typedef MapDataImpl<Entry, JSSetIterator> SetData; 41 86 42 87 DECLARE_EXPORT_INFO; … … 44 89 static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 45 90 { 46 return Structure::create(vm, globalObject, prototype, TypeInfo( JSSetType, StructureFlags), info());91 return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 47 92 } 48 93 49 static JSSet* create( ExecState* exec,VM& vm, Structure* structure)94 static JSSet* create(VM& vm, Structure* structure) 50 95 { 51 96 JSSet* instance = new (NotNull, allocateCell<JSSet>(vm.heap)) JSSet(vm, structure); 52 instance->finishCreation( exec,vm);97 instance->finishCreation(vm); 53 98 return instance; 54 99 } 55 100 56 ALWAYS_INLINE void add(ExecState* exec, JSValue key)101 static JSSet* create(ExecState* exec, Structure* structure) 57 102 { 58 m_map->add(exec, key);103 return create(exec->vm(), structure); 59 104 } 105 106 bool has(ExecState*, JSValue); 107 size_t size(ExecState*); 108 JS_EXPORT_PRIVATE void add(ExecState*, JSValue); 109 void clear(ExecState*); 110 bool remove(ExecState*, JSValue); 60 111 61 112 private: 62 113 JSSet(VM& vm, Structure* structure) 63 114 : Base(vm, structure) 115 , m_setData(vm, this) 64 116 { 65 117 } 66 118 119 static void destroy(JSCell*); 120 static size_t estimatedSize(JSCell*); 121 static void visitChildren(JSCell*, SlotVisitor&); 122 static void copyBackingStore(JSCell*, CopyVisitor&, CopyToken); 67 123 static String toStringName(const JSObject*, ExecState*); 124 125 SetData m_setData; 68 126 }; 69 127 -
trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp
r205504 r205507 39 39 Base::finishCreation(vm); 40 40 m_set.set(vm, this, iteratedObject); 41 setIterator(vm, m_set->impl()->head());42 41 } 43 42 … … 48 47 Base::visitChildren(thisObject, visitor); 49 48 visitor.append(&thisObject->m_set); 50 visitor.append(&thisObject->m_iter);51 49 } 52 50 … … 62 60 JSSetIterator* JSSetIterator::clone(ExecState* exec) 63 61 { 64 VM& vm = exec->vm(); 65 auto clone = JSSetIterator::create(vm, exec->callee()->globalObject()->setIteratorStructure(), m_set.get(), m_kind); 66 clone->setIterator(vm, m_iter.get()); 62 auto clone = JSSetIterator::create(exec->vm(), exec->callee()->globalObject()->setIteratorStructure(), m_set.get(), m_kind); 63 clone->m_iterator = m_iterator; 67 64 return clone; 68 65 } -
trunk/Source/JavaScriptCore/runtime/JSSetIterator.h
r205504 r205507 1 1 /* 2 * Copyright (C) 2013 , 2016Apple, Inc. All rights reserved.2 * Copyright (C) 2013 Apple, Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 36 36 37 37 class JSSetIterator : public JSNonFinalObject { 38 typedef HashMapBucket<HashMapBucketDataKey> HashMapBucketType;39 38 public: 40 39 typedef JSNonFinalObject Base; … … 54 53 } 55 54 56 ALWAYS_INLINE HashMapBucketType* advanceIter(ExecState* exec)55 bool next(CallFrame* callFrame, JSValue& value) 57 56 { 58 HashMapBucketType* prev = m_iter.get(); 59 if (!prev) 60 return nullptr; 61 HashMapBucketType* bucket = m_iter->next(); 62 while (bucket && bucket->deleted()) { 63 prev = bucket; 64 bucket = bucket->next(); 65 } 66 if (!bucket) { 67 setIterator(exec->vm(), nullptr); 68 return nullptr; 69 } 70 setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next(). 71 return bucket; 57 WTF::KeyValuePair<JSValue, JSValue> pair; 58 if (!m_iterator.next(pair)) 59 return false; 60 if (m_kind == IterateValue || m_kind == IterateKey) 61 value = pair.key; 62 else 63 value = createPair(callFrame, pair.key, pair.key); 64 return true; 72 65 } 73 66 74 bool next(ExecState* exec, JSValue& value)67 void finish() 75 68 { 76 HashMapBucketType* bucket = advanceIter(exec); 77 if (!bucket) 78 return false; 79 80 if (m_kind == IterateValue || m_kind == IterateKey) 81 value = bucket->key(); 82 else 83 value = createPair(exec, bucket->key(), bucket->key()); 84 return true; 69 m_iterator.finish(); 85 70 } 86 71 … … 89 74 JSSetIterator* clone(ExecState*); 90 75 76 JSSet::SetData::IteratorData* iteratorData() 77 { 78 return &m_iterator; 79 } 80 91 81 private: 92 JSSetIterator(VM& vm, Structure* structure, JSSet* , IterationKind kind)82 JSSetIterator(VM& vm, Structure* structure, JSSet* iteratedObject, IterationKind kind) 93 83 : Base(vm, structure) 84 , m_iterator(iteratedObject->m_setData.createIteratorData(this)) 94 85 , m_kind(kind) 95 86 { 96 }97 98 void setIterator(VM& vm, HashMapBucketType* bucket)99 {100 m_iter.setMayBeNull(vm, this, bucket);101 87 } 102 88 … … 106 92 107 93 WriteBarrier<JSSet> m_set; 108 WriteBarrier<HashMapBucketType> m_iter;94 JSSet::SetData::IteratorData m_iterator; 109 95 IterationKind m_kind; 110 96 }; -
trunk/Source/JavaScriptCore/runtime/JSType.h
r205504 r205507 83 83 RegExpObjectType, 84 84 ProxyObjectType, 85 JSMapType,86 JSSetType,87 85 88 LastJSCObjectType = JSSetType,86 LastJSCObjectType = ProxyObjectType, 89 87 }; 90 88 -
trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp
r205504 r205507 62 62 JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject(); 63 63 Structure* mapStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->mapStructure()); 64 if ( UNLIKELY(scope.exception()))64 if (exec->hadException()) 65 65 return JSValue::encode(JSValue()); 66 JSMap* map = JSMap::create(exec, vm, mapStructure); 67 if (UNLIKELY(scope.exception())) 68 return JSValue::encode(JSValue()); 66 JSMap* map = JSMap::create(exec, mapStructure); 69 67 JSValue iterable = exec->argument(0); 70 68 if (iterable.isUndefinedOrNull()) -
trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp
r205504 r205507 59 59 if (iterator->next(callFrame, result)) 60 60 return JSValue::encode(createIteratorResultObject(callFrame, result, false)); 61 iterator->finish(); 61 62 return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true)); 62 63 } -
trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp
r205504 r205507 69 69 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, mapProtoFuncClear, DontEnum, 0); 70 70 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, mapProtoFuncDelete, DontEnum, 1); 71 JSC_NATIVE_ INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1, JSMapGetIntrinsic);72 JSC_NATIVE_ INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1, JSMapHasIntrinsic);71 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1); 72 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1); 73 73 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, mapProtoFuncSet, DontEnum, 2); 74 74 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), mapProtoFuncKeys, DontEnum, 0); 75 75 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().valuesPublicName(), mapProtoFuncValues, DontEnum, 0); 76 76 77 JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, DontEnum, 1, JSMapGetIntrinsic); 77 // Private get / set operations. 78 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, DontEnum, 1); 78 79 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().setPrivateName(), mapProtoFuncSet, DontEnum, 2); 79 80 … … 91 92 auto scope = DECLARE_THROW_SCOPE(vm); 92 93 93 if ( UNLIKELY(!thisValue.isCell())) {94 if (!thisValue.isObject()) { 94 95 throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue)); 95 96 return nullptr; 96 97 } 97 98 if (LIKELY(thisValue.asCell()->type() == JSMapType)) 99 return jsCast<JSMap*>(thisValue); 100 throwTypeError(callFrame, scope, ASCIILiteral("Map operation called on non-Map object")); 101 return nullptr; 102 } 103 104 EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec) 105 { 106 JSValue value = exec->uncheckedArgument(0); 107 return JSValue::encode(jsBoolean(value.isCell() && value.asCell()->type() == JSMapType)); 98 JSMap* map = jsDynamicCast<JSMap*>(thisValue); 99 if (!map) { 100 throwTypeError(callFrame, scope, ASCIILiteral("Map operation called on non-Map object")); 101 return nullptr; 102 } 103 return map; 108 104 } 109 105 … … 192 188 } 193 189 190 EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec) 191 { 192 return JSValue::encode(jsBoolean(jsDynamicCast<JSMap*>(exec->uncheckedArgument(0)))); 193 } 194 194 195 EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState* exec) 195 196 { … … 204 205 JSMapIterator* iterator = jsCast<JSMapIterator*>(exec->thisValue()); 205 206 JSValue key, value; 206 if (iterator->nextKeyValue( exec,key, value)) {207 if (iterator->nextKeyValue(key, value)) { 207 208 JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0)); 208 209 resultArray->putDirectIndex(exec, 0, key); … … 210 211 return JSValue::encode(jsBoolean(false)); 211 212 } 213 iterator->finish(); 212 214 return JSValue::encode(jsBoolean(true)); 213 215 } -
trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
r205504 r205507 192 192 } 193 193 194 // See ES5.1 9.12 195 bool sameValue(ExecState* exec, JSValue a, JSValue b) 196 { 197 if (!a.isNumber()) 198 return JSValue::strictEqual(exec, a, b); 199 if (!b.isNumber()) 200 return false; 201 double x = a.asNumber(); 202 double y = b.asNumber(); 203 bool xIsNaN = std::isnan(x); 204 bool yIsNaN = std::isnan(y); 205 if (xIsNaN || yIsNaN) 206 return xIsNaN && yIsNaN; 207 return bitwise_cast<uint64_t>(x) == bitwise_cast<uint64_t>(y); 208 } 209 194 210 bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const 195 211 { -
trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.h
r205504 r205507 32 32 33 33 class GetterSetter; 34 35 // See ES5.1 9.12 36 bool sameValue(ExecState*, JSValue, JSValue); 34 37 35 38 class PropertyDescriptor { -
trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp
r205504 r205507 63 63 JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject(); 64 64 Structure* setStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->setStructure()); 65 if ( UNLIKELY(scope.exception()))65 if (exec->hadException()) 66 66 return JSValue::encode(JSValue()); 67 JSSet* set = JSSet::create(exec, vm, setStructure); 68 if (UNLIKELY(scope.exception())) 69 return JSValue::encode(JSValue()); 67 JSSet* set = JSSet::create(exec, setStructure); 70 68 JSValue iterable = exec->argument(0); 71 69 if (iterable.isUndefinedOrNull()) -
trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp
r205504 r205507 59 59 if (iterator->next(callFrame, result)) 60 60 return JSValue::encode(createIteratorResultObject(callFrame, result, false)); 61 iterator->finish(); 61 62 return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true)); 62 63 } -
trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp
r205504 r205507 69 69 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, setProtoFuncClear, DontEnum, 0); 70 70 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, setProtoFuncDelete, DontEnum, 1); 71 JSC_NATIVE_ INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, DontEnum, 1, JSSetHasIntrinsic);71 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, DontEnum, 1); 72 72 JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), setProtoFuncEntries, DontEnum, 0); 73 73 … … 86 86 auto scope = DECLARE_THROW_SCOPE(vm); 87 87 88 if ( UNLIKELY(!thisValue.isCell())) {88 if (!thisValue.isObject()) { 89 89 throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue)); 90 90 return nullptr; 91 91 } 92 if (LIKELY(thisValue.asCell()->type() == JSSetType)) 93 return jsCast<JSSet*>(thisValue); 94 throwTypeError(callFrame, scope, ASCIILiteral("Set operation called on non-Set object")); 95 return nullptr; 92 JSSet* set = jsDynamicCast<JSSet*>(thisValue); 93 if (!set) { 94 throwTypeError(callFrame, scope, ASCIILiteral("Set operation called on non-Set object")); 95 return nullptr; 96 } 97 return set; 96 98 } 97 99 … … 183 185 return JSValue::encode(jsBoolean(false)); 184 186 } 187 iterator->finish(); 185 188 return JSValue::encode(jsBoolean(true)); 186 189 } -
trunk/Source/JavaScriptCore/runtime/VM.cpp
r205504 r205507 66 66 #include "JSLexicalEnvironment.h" 67 67 #include "JSLock.h" 68 #include "JSMap.h"69 68 #include "JSPromiseDeferred.h" 70 69 #include "JSPropertyNameEnumerator.h" … … 255 254 webAssemblyCodeBlockStructure.set(*this, WebAssemblyCodeBlock::createStructure(*this, 0, jsNull())); 256 255 #endif 257 hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));258 hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));259 hashMapImplSetStructure.set(*this, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::createStructure(*this, 0, jsNull()));260 hashMapImplMapStructure.set(*this, HashMapImpl<HashMapBucket<HashMapBucketDataKeyValue>>::createStructure(*this, 0, jsNull()));261 256 262 257 iterationTerminator.set(*this, JSFinalObject::create(*this, JSFinalObject::createStructure(*this, 0, jsNull(), 1))); -
trunk/Source/JavaScriptCore/runtime/VM.h
r205504 r205507 335 335 Strong<Structure> functionCodeBlockStructure; 336 336 Strong<Structure> webAssemblyCodeBlockStructure; 337 Strong<Structure> hashMapBucketSetStructure;338 Strong<Structure> hashMapBucketMapStructure;339 Strong<Structure> hashMapImplSetStructure;340 Strong<Structure> hashMapImplMapStructure;341 337 342 338 Strong<JSCell> iterationTerminator; -
trunk/Source/WTF/ChangeLog
r205504 r205507 1 2016-09-06 Commit Queue <commit-queue@webkit.org> 2 3 Unreviewed, rolling out r205504. 4 https://bugs.webkit.org/show_bug.cgi?id=161645 5 6 Broke the iOS device build (Requested by ryanhaddad on 7 #webkit). 8 9 Reverted changeset: 10 11 "Make JSMap and JSSet faster" 12 https://bugs.webkit.org/show_bug.cgi?id=160989 13 http://trac.webkit.org/changeset/205504 14 1 15 2016-09-06 Saam Barati <sbarati@apple.com> 2 16 -
trunk/Source/WTF/wtf/text/StringImpl.h
r205504 r205507 149 149 150 150 // The bottom 6 bits in the hash are flags. 151 public:152 151 static const unsigned s_flagCount = 6; 153 private:154 152 static const unsigned s_flagMask = (1u << s_flagCount) - 1; 155 153 COMPILE_ASSERT(s_flagCount <= StringHasher::flagCount, StringHasher_reserves_enough_bits_for_StringImpl_flags); -
trunk/Source/WebCore/ChangeLog
r205506 r205507 1 2016-09-06 Commit Queue <commit-queue@webkit.org> 2 3 Unreviewed, rolling out r205504. 4 https://bugs.webkit.org/show_bug.cgi?id=161645 5 6 Broke the iOS device build (Requested by ryanhaddad on 7 #webkit). 8 9 Reverted changeset: 10 11 "Make JSMap and JSSet faster" 12 https://bugs.webkit.org/show_bug.cgi?id=160989 13 http://trac.webkit.org/changeset/205504 14 1 15 2016-09-06 Zalan Bujtas <zalan@apple.com> 2 16 -
trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp
r205504 r205507 1369 1369 JSMapIterator* iterator = mapIteratorStack.last(); 1370 1370 JSValue key, value; 1371 if (!iterator->nextKeyValue( m_exec,key, value)) {1371 if (!iterator->nextKeyValue(key, value)) { 1372 1372 mapIteratorStack.removeLast(); 1373 1373 JSObject* object = inputObjectStack.last(); … … 2546 2546 if (outputObjectStack.size() > maximumFilterRecursion) 2547 2547 return std::make_pair(JSValue(), StackOverflowError); 2548 JSMap* map = JSMap::create(m_exec, m_exec->vm(), m_globalObject->mapStructure()); 2549 if (UNLIKELY(m_exec->hadException())) 2550 goto error; 2548 JSMap* map = JSMap::create(m_exec->vm(), m_globalObject->mapStructure()); 2551 2549 m_gcBuffer.append(map); 2552 2550 outputObjectStack.append(map); … … 2577 2575 if (outputObjectStack.size() > maximumFilterRecursion) 2578 2576 return std::make_pair(JSValue(), StackOverflowError); 2579 JSSet* set = JSSet::create(m_exec, m_exec->vm(), m_globalObject->setStructure()); 2580 if (UNLIKELY(m_exec->hadException())) 2581 goto error; 2577 JSSet* set = JSSet::create(m_exec->vm(), m_globalObject->setStructure()); 2582 2578 m_gcBuffer.append(set); 2583 2579 outputObjectStack.append(set);
Note: See TracChangeset
for help on using the changeset viewer.