Changeset 223919 in webkit


Ignore:
Timestamp:
Oct 24, 2017 1:48:03 PM (6 years ago)
Author:
Yusuke Suzuki
Message:

[FTL] Support NewStringObject
https://bugs.webkit.org/show_bug.cgi?id=178737

Reviewed by Saam Barati.

JSTests:

  • stress/new-string-object.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

FTL should support NewStringObject and encourage use of NewStringObject in DFG pipeline.
After this change, we can convert CallObjectConstructor(String) to NewStringObject(String).

  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):

Location:
trunk
Files:
1 added
5 edited

Legend:

Unmodified
Added
Removed
  • trunk/JSTests/ChangeLog

    r223894 r223919  
     12017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [FTL] Support NewStringObject
     4        https://bugs.webkit.org/show_bug.cgi?id=178737
     5
     6        Reviewed by Saam Barati.
     7
     8        * stress/new-string-object.js: Added.
     9        (shouldBe):
     10        (test):
     11
    1122017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
    213
  • trunk/Source/JavaScriptCore/ChangeLog

    r223916 r223919  
     12017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [FTL] Support NewStringObject
     4        https://bugs.webkit.org/show_bug.cgi?id=178737
     5
     6        Reviewed by Saam Barati.
     7
     8        FTL should support NewStringObject and encourage use of NewStringObject in DFG pipeline.
     9        After this change, we can convert `CallObjectConstructor(String)` to `NewStringObject(String)`.
     10
     11        * ftl/FTLAbstractHeapRepository.h:
     12        * ftl/FTLCapabilities.cpp:
     13        (JSC::FTL::canCompile):
     14        * ftl/FTLLowerDFGToB3.cpp:
     15        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
     16        (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
     17
    1182017-10-24  Guillaume Emont  <guijemont@igalia.com>
    219
  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r222136 r223919  
    6767    macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
    6868    macro(JSCell_usefulBytes, JSCell::indexingTypeAndMiscOffset()) \
     69    macro(JSDestructibleObject_classInfo, JSDestructibleObject::classInfoOffset()) \
    6970    macro(JSFunction_executable, JSFunction::offsetOfExecutable()) \
    7071    macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r223594 r223919  
    7373    case GetButterflyWithoutCaging:
    7474    case NewObject:
     75    case NewStringObject:
    7576    case NewArray:
    7677    case NewArrayWithSpread:
  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r223738 r223919  
    801801            compileNewObject();
    802802            break;
     803        case NewStringObject:
     804            compileNewStringObject();
     805            break;
    803806        case NewArray:
    804807            compileNewArray();
     
    49034906        setJSValue(allocateObject(m_node->structure()));
    49044907        mutatorFence();
     4908    }
     4909
     4910    void compileNewStringObject()
     4911    {
     4912        RegisteredStructure structure = m_node->structure();
     4913        LValue string = lowString(m_node->child1());
     4914
     4915        LBasicBlock slowCase = m_out.newBlock();
     4916        LBasicBlock continuation = m_out.newBlock();
     4917
     4918        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowCase);
     4919
     4920        LValue fastResultValue = allocateObject<StringObject>(structure, m_out.intPtrZero, slowCase);
     4921        m_out.storePtr(m_out.constIntPtr(StringObject::info()), fastResultValue, m_heaps.JSDestructibleObject_classInfo);
     4922        m_out.store64(string, fastResultValue, m_heaps.JSWrapperObject_internalValue);
     4923        mutatorFence();
     4924        ValueFromBlock fastResult = m_out.anchor(fastResultValue);
     4925        m_out.jump(continuation);
     4926
     4927        m_out.appendTo(slowCase, continuation);
     4928        VM& vm = this->vm();
     4929        LValue slowResultValue = lazySlowPath(
     4930            [=, &vm] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
     4931                return createLazyCallGenerator(vm,
     4932                    operationNewStringObject, locations[0].directGPR(), locations[1].directGPR(),
     4933                    CCallHelpers::TrustedImmPtr(structure.get()));
     4934            },
     4935            string);
     4936        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
     4937        m_out.jump(continuation);
     4938
     4939        m_out.appendTo(continuation, lastNext);
     4940        setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
    49054941    }
    49064942   
Note: See TracChangeset for help on using the changeset viewer.