Changeset 226261 in webkit


Ignore:
Timestamp:
Dec 22, 2017 1:07:35 AM (6 years ago)
Author:
Yusuke Suzuki
Message:

[DFG] Unify bunch of DFG 32bit code into 64bit code
​https://bugs.webkit.org/show_bug.cgi?id=181083

Reviewed by Mark Lam.

There are bunch of the completely same code in 32bit and 64bit DFG.
This is largely because of the old DFG code. At that time, we do not
have enough abstraction to describe them in one code. But now, we have
JSValueRegs, JSValueRegsTemporary etc. They allow DFG to write 32bit and
64bit handling in one code.

This patch unifies easy ones. This is nice since basically 32bit code is
a bit old and not maintained so much compared to 64bit. If we can drop
32bit specific code as much as possible, it would be nice. Furthermore,
we can find various mistakes in 32bit: For example, NewObject does not have
mutatorFence in 32bit while 64bit has it. This unification is a chance
to fix miscellaneous bugs in 32bit while reducing maintenance burden.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
(JSC::DFG::SpeculativeJIT::compileGetEnumerableLength):
(JSC::DFG::SpeculativeJIT::compileToIndexString):
(JSC::DFG::SpeculativeJIT::compilePutByIdWithThis):
(JSC::DFG::SpeculativeJIT::compileHasStructureProperty):
(JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
(JSC::DFG::SpeculativeJIT::compileGetEnumeratorPname):
(JSC::DFG::SpeculativeJIT::compileGetGetter):
(JSC::DFG::SpeculativeJIT::compileGetSetter):
(JSC::DFG::SpeculativeJIT::compileGetCallee):
(JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis):
(JSC::DFG::SpeculativeJIT::compileStrCat):
(JSC::DFG::SpeculativeJIT::compileNewArrayWithSize):
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
(JSC::DFG::SpeculativeJIT::compileCreateThis):
(JSC::DFG::SpeculativeJIT::compileNewObject):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r226260 r226261  
     12017-12-22  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [DFG] Unify bunch of DFG 32bit code into 64bit code
     4        https://bugs.webkit.org/show_bug.cgi?id=181083
     5
     6        Reviewed by Mark Lam.
     7
     8        There are bunch of the completely same code in 32bit and 64bit DFG.
     9        This is largely because of the old DFG code. At that time, we do not
     10        have enough abstraction to describe them in one code. But now, we have
     11        JSValueRegs, JSValueRegsTemporary etc. They allow DFG to write 32bit and
     12        64bit handling in one code.
     13
     14        This patch unifies easy ones. This is nice since basically 32bit code is
     15        a bit old and not maintained so much compared to 64bit. If we can drop
     16        32bit specific code as much as possible, it would be nice. Furthermore,
     17        we can find various mistakes in 32bit: For example, NewObject does not have
     18        mutatorFence in 32bit while 64bit has it. This unification is a chance
     19        to fix miscellaneous bugs in 32bit while reducing maintenance burden.
     20
     21        * dfg/DFGSpeculativeJIT.cpp:
     22        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
     23        (JSC::DFG::SpeculativeJIT::compileGetEnumerableLength):
     24        (JSC::DFG::SpeculativeJIT::compileToIndexString):
     25        (JSC::DFG::SpeculativeJIT::compilePutByIdWithThis):
     26        (JSC::DFG::SpeculativeJIT::compileHasStructureProperty):
     27        (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
     28        (JSC::DFG::SpeculativeJIT::compileGetEnumeratorPname):
     29        (JSC::DFG::SpeculativeJIT::compileGetGetter):
     30        (JSC::DFG::SpeculativeJIT::compileGetSetter):
     31        (JSC::DFG::SpeculativeJIT::compileGetCallee):
     32        (JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis):
     33        (JSC::DFG::SpeculativeJIT::compileStrCat):
     34        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize):
     35        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
     36        (JSC::DFG::SpeculativeJIT::compileCreateThis):
     37        (JSC::DFG::SpeculativeJIT::compileNewObject):
     38        * dfg/DFGSpeculativeJIT.h:
     39        (JSC::DFG::SpeculativeJIT::callOperation):
     40        * dfg/DFGSpeculativeJIT32_64.cpp:
     41        (JSC::DFG::SpeculativeJIT::compile):
     42        * dfg/DFGSpeculativeJIT64.cpp:
     43        (JSC::DFG::SpeculativeJIT::compile):
     44
    1452017-12-22  Yusuke Suzuki  <utatane.tea@gmail.com>
    246

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r226260 r226261  
    5656#include "JSGeneratorFunction.h"
    5757#include "JSLexicalEnvironment.h"
     58#include "JSPropertyNameEnumerator.h"
    5859#include "LinkBuffer.h"
    5960#include "RegExpConstructor.h"
    … …  
    89778978}
    89788979
    8979 void SpeculativeJIT::compileNewTypedArray(Node* node)
     8980void SpeculativeJIT::compileNewTypedArrayWithSize(Node* node)
    89808981{
    89818982    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
    … …  
    1089510896}
    1089610897
     10898void SpeculativeJIT::compileGetEnumerableLength(Node* node)
     10899{
     10900    SpeculateCellOperand enumerator(this, node->child1());
     10901    GPRFlushedCallResult result(this);
     10902    GPRReg resultGPR = result.gpr();
     10903
     10904    m_jit.load32(MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::indexedLengthOffset()), resultGPR);
     10905    int32Result(resultGPR, node);
     10906}
     10907
     10908void SpeculativeJIT::compileToIndexString(Node* node)
     10909{
     10910    SpeculateInt32Operand index(this, node->child1());
     10911    GPRReg indexGPR = index.gpr();
     10912
     10913    flushRegisters();
     10914    GPRFlushedCallResult result(this);
     10915    GPRReg resultGPR = result.gpr();
     10916    callOperation(operationToIndexString, resultGPR, indexGPR);
     10917    m_jit.exceptionCheck();
     10918    cellResult(resultGPR, node);
     10919}
     10920
     10921void SpeculativeJIT::compilePutByIdWithThis(Node* node)
     10922{
     10923    JSValueOperand base(this, node->child1());
     10924    JSValueRegs baseRegs = base.jsValueRegs();
     10925    JSValueOperand thisValue(this, node->child2());
     10926    JSValueRegs thisRegs = thisValue.jsValueRegs();
     10927    JSValueOperand value(this, node->child3());
     10928    JSValueRegs valueRegs = value.jsValueRegs();
     10929
     10930    flushRegisters();
     10931    callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByIdWithThisStrict : operationPutByIdWithThis,
     10932        NoResult, baseRegs, thisRegs, valueRegs, identifierUID(node->identifierNumber()));
     10933    m_jit.exceptionCheck();
     10934
     10935    noResult(node);
     10936}
     10937
     10938void SpeculativeJIT::compileHasStructureProperty(Node* node)
     10939{
     10940    JSValueOperand base(this, node->child1());
     10941    SpeculateCellOperand property(this, node->child2());
     10942    SpeculateCellOperand enumerator(this, node->child3());
     10943    JSValueRegsTemporary result(this);
     10944
     10945    JSValueRegs baseRegs = base.jsValueRegs();
     10946    GPRReg propertyGPR = property.gpr();
     10947    JSValueRegs resultRegs = result.regs();
     10948
     10949    CCallHelpers::JumpList wrongStructure;
     10950
     10951    wrongStructure.append(m_jit.branchIfNotCell(baseRegs));
     10952
     10953    m_jit.load32(MacroAssembler::Address(baseRegs.payloadGPR(), JSCell::structureIDOffset()), resultRegs.payloadGPR());
     10954    wrongStructure.append(m_jit.branch32(MacroAssembler::NotEqual,
     10955        resultRegs.payloadGPR(),
     10956        MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::cachedStructureIDOffset())));
     10957
     10958    moveTrueTo(resultRegs.payloadGPR());
     10959    MacroAssembler::Jump done = m_jit.jump();
     10960
     10961    done.link(&m_jit);
     10962
     10963    addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty, resultRegs, baseRegs, propertyGPR));
     10964    blessedBooleanResult(resultRegs.payloadGPR(), node);
     10965}
     10966
     10967void SpeculativeJIT::compileGetPropertyEnumerator(Node* node)
     10968{
     10969    if (node->child1().useKind() == CellUse) {
     10970        SpeculateCellOperand base(this, node->child1());
     10971        GPRReg baseGPR = base.gpr();
     10972
     10973        flushRegisters();
     10974        GPRFlushedCallResult result(this);
     10975        GPRReg resultGPR = result.gpr();
     10976        callOperation(operationGetPropertyEnumeratorCell, resultGPR, baseGPR);
     10977        m_jit.exceptionCheck();
     10978        cellResult(resultGPR, node);
     10979        return;
     10980    }
     10981
     10982    JSValueOperand base(this, node->child1());
     10983    JSValueRegs baseRegs = base.jsValueRegs();
     10984
     10985    flushRegisters();
     10986    GPRFlushedCallResult result(this);
     10987    GPRReg resultGPR = result.gpr();
     10988    callOperation(operationGetPropertyEnumerator, resultGPR, baseRegs);
     10989    m_jit.exceptionCheck();
     10990    cellResult(resultGPR, node);
     10991}
     10992
     10993void SpeculativeJIT::compileGetEnumeratorPname(Node* node)
     10994{
     10995    ASSERT(node->op() == GetEnumeratorStructurePname || node->op() == GetEnumeratorGenericPname);
     10996    SpeculateCellOperand enumerator(this, node->child1());
     10997    SpeculateStrictInt32Operand index(this, node->child2());
     10998    GPRTemporary scratch(this);
     10999    JSValueRegsTemporary result(this);
     11000
     11001    GPRReg enumeratorGPR = enumerator.gpr();
     11002    GPRReg indexGPR = index.gpr();
     11003    GPRReg scratchGPR = scratch.gpr();
     11004    JSValueRegs resultRegs = result.regs();
     11005
     11006    MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, indexGPR,
     11007        MacroAssembler::Address(enumeratorGPR, (node->op() == GetEnumeratorStructurePname)
     11008            ? JSPropertyNameEnumerator::endStructurePropertyIndexOffset()
     11009            : JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
     11010
     11011    m_jit.moveValue(jsNull(), resultRegs);
     11012
     11013    MacroAssembler::Jump done = m_jit.jump();
     11014    inBounds.link(&m_jit);
     11015
     11016    m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratchGPR);
     11017    m_jit.loadPtr(MacroAssembler::BaseIndex(scratchGPR, indexGPR, MacroAssembler::ScalePtr), resultRegs.payloadGPR());
     11018#if USE(JSVALUE32_64)
     11019    m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), resultRegs.tagGPR());
     11020#endif
     11021
     11022    done.link(&m_jit);
     11023    jsValueResult(resultRegs, node);
     11024}
     11025
     11026void SpeculativeJIT::compileGetGetter(Node* node)
     11027{
     11028    SpeculateCellOperand op1(this, node->child1());
     11029    GPRTemporary result(this, Reuse, op1);
     11030
     11031    GPRReg op1GPR = op1.gpr();
     11032    GPRReg resultGPR = result.gpr();
     11033
     11034    m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfGetter()), resultGPR);
     11035
     11036    cellResult(resultGPR, node);
     11037}
     11038
     11039void SpeculativeJIT::compileGetSetter(Node* node)
     11040{
     11041    SpeculateCellOperand op1(this, node->child1());
     11042    GPRTemporary result(this, Reuse, op1);
     11043
     11044    GPRReg op1GPR = op1.gpr();
     11045    GPRReg resultGPR = result.gpr();
     11046
     11047    m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfSetter()), resultGPR);
     11048
     11049    cellResult(resultGPR, node);
     11050}
     11051
     11052void SpeculativeJIT::compileGetCallee(Node* node)
     11053{
     11054    GPRTemporary result(this);
     11055    m_jit.loadPtr(JITCompiler::payloadFor(CallFrameSlot::callee), result.gpr());
     11056    cellResult(result.gpr(), node);
     11057}
     11058
     11059void SpeculativeJIT::compileGetArgumentCountIncludingThis(Node* node)
     11060{
     11061    GPRTemporary result(this);
     11062    m_jit.load32(JITCompiler::payloadFor(CallFrameSlot::argumentCount), result.gpr());
     11063    int32Result(result.gpr(), node);
     11064}
     11065
     11066void SpeculativeJIT::compileStrCat(Node* node)
     11067{
     11068    JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
     11069    JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
     11070    JSValueOperand op3(this, node->child3(), ManualOperandSpeculation);
     11071
     11072    JSValueRegs op1Regs = op1.jsValueRegs();
     11073    JSValueRegs op2Regs = op2.jsValueRegs();
     11074    JSValueRegs op3Regs;
     11075
     11076    if (node->child3())
     11077        op3Regs = op3.jsValueRegs();
     11078
     11079    flushRegisters();
     11080
     11081    GPRFlushedCallResult result(this);
     11082    if (node->child3())
     11083        callOperation(operationStrCat3, result.gpr(), op1Regs, op2Regs, op3Regs);
     11084    else
     11085        callOperation(operationStrCat2, result.gpr(), op1Regs, op2Regs);
     11086    m_jit.exceptionCheck();
     11087
     11088    cellResult(result.gpr(), node);
     11089}
     11090
     11091void SpeculativeJIT::compileNewArrayWithSize(Node* node)
     11092{
     11093    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
     11094    if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
     11095        SpeculateStrictInt32Operand size(this, node->child1());
     11096        GPRTemporary result(this);
     11097
     11098        GPRReg sizeGPR = size.gpr();
     11099        GPRReg resultGPR = result.gpr();
     11100
     11101        compileAllocateNewArrayWithSize(globalObject, resultGPR, sizeGPR, node->indexingType());
     11102        cellResult(resultGPR, node);
     11103        return;
     11104    }
     11105
     11106    SpeculateStrictInt32Operand size(this, node->child1());
     11107    GPRReg sizeGPR = size.gpr();
     11108    flushRegisters();
     11109    GPRFlushedCallResult result(this);
     11110    GPRReg resultGPR = result.gpr();
     11111    GPRReg structureGPR = selectScratchGPR(sizeGPR);
     11112    MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
     11113    m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
     11114    MacroAssembler::Jump done = m_jit.jump();
     11115    bigLength.link(&m_jit);
     11116    m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
     11117    done.link(&m_jit);
     11118    callOperation(operationNewArrayWithSize, resultGPR, structureGPR, sizeGPR, nullptr);
     11119    m_jit.exceptionCheck();
     11120    cellResult(resultGPR, node);
     11121}
     11122
     11123void SpeculativeJIT::compileNewTypedArray(Node* node)
     11124{
     11125    switch (node->child1().useKind()) {
     11126    case Int32Use:
     11127        compileNewTypedArrayWithSize(node);
     11128        break;
     11129    case UntypedUse: {
     11130        JSValueOperand argument(this, node->child1());
     11131        JSValueRegs argumentRegs = argument.jsValueRegs();
     11132
     11133        flushRegisters();
     11134
     11135        GPRFlushedCallResult result(this);
     11136        GPRReg resultGPR = result.gpr();
     11137
     11138        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
     11139        callOperation(
     11140            operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
     11141            resultGPR, m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
     11142        m_jit.exceptionCheck();
     11143
     11144        cellResult(resultGPR, node);
     11145        break;
     11146    }
     11147    default:
     11148        RELEASE_ASSERT_NOT_REACHED();
     11149        break;
     11150    }
     11151}
     11152
     11153void SpeculativeJIT::compileCreateThis(Node* node)
     11154{
     11155    // Note that there is not so much profit to speculate here. The only things we
     11156    // speculate on are (1) that it's a cell, since that eliminates cell checks
     11157    // later if the proto is reused, and (2) if we have a FinalObject prediction
     11158    // then we speculate because we want to get recompiled if it isn't (since
     11159    // otherwise we'd start taking slow path a lot).
     11160
     11161    SpeculateCellOperand callee(this, node->child1());
     11162    GPRTemporary result(this);
     11163    GPRTemporary allocator(this);
     11164    GPRTemporary structure(this);
     11165    GPRTemporary scratch(this);
     11166
     11167    GPRReg calleeGPR = callee.gpr();
     11168    GPRReg resultGPR = result.gpr();
     11169    GPRReg allocatorGPR = allocator.gpr();
     11170    GPRReg structureGPR = structure.gpr();
     11171    GPRReg scratchGPR = scratch.gpr();
     11172    // Rare data is only used to access the allocator & structure
     11173    // We can avoid using an additional GPR this way
     11174    GPRReg rareDataGPR = structureGPR;
     11175    GPRReg inlineCapacityGPR = rareDataGPR;
     11176
     11177    MacroAssembler::JumpList slowPath;
     11178
     11179    slowPath.append(m_jit.branch8(JITCompiler::NotEqual,
     11180        JITCompiler::Address(calleeGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
     11181    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
     11182    slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
     11183    m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
     11184    m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
     11185
     11186    slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, allocatorGPR));
     11187
     11188    auto butterfly = TrustedImmPtr(nullptr);
     11189    auto mask = TrustedImm32(0);
     11190    emitAllocateJSObject(resultGPR, nullptr, allocatorGPR, structureGPR, butterfly, mask, scratchGPR, slowPath);
     11191
     11192    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
     11193    m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), inlineCapacityGPR);
     11194    m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);
     11195    m_jit.mutatorFence(*m_jit.vm());
     11196
     11197    addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR, node->inlineCapacity()));
     11198
     11199    cellResult(resultGPR, node);
     11200}
     11201
     11202void SpeculativeJIT::compileNewObject(Node* node)
     11203{
     11204    GPRTemporary result(this);
     11205    GPRTemporary allocator(this);
     11206    GPRTemporary scratch(this);
     11207
     11208    GPRReg resultGPR = result.gpr();
     11209    GPRReg allocatorGPR = allocator.gpr();
     11210    GPRReg scratchGPR = scratch.gpr();
     11211
     11212    MacroAssembler::JumpList slowPath;
     11213
     11214    RegisteredStructure structure = node->structure();
     11215    size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
     11216    MarkedAllocator* allocatorPtr = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
     11217
     11218    m_jit.move(TrustedImmPtr(allocatorPtr), allocatorGPR);
     11219    auto butterfly = TrustedImmPtr(nullptr);
     11220    auto mask = TrustedImm32(0);
     11221    emitAllocateJSObject(resultGPR, allocatorPtr, allocatorGPR, TrustedImmPtr(structure), butterfly, mask, scratchGPR, slowPath);
     11222    m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
     11223    m_jit.mutatorFence(*m_jit.vm());
     11224
     11225    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, structure));
     11226
     11227    cellResult(resultGPR, node);
     11228}
     11229
    1089711230void SpeculativeJIT::compileSetAdd(Node* node)
    1089811231{

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r226260 r226261  
    14641464        return appendCallSetResult(operation, result);
    14651465    }
    1466     JITCompiler::Call callOperation(V_JITOperation_EJJJI operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, UniquedStringImpl* uid)
    1467     {
    1468         m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, TrustedImmPtr(uid));
     1466    JITCompiler::Call callOperation(V_JITOperation_EJJJI operation, JSValueRegs arg1, JSValueRegs arg2, JSValueRegs arg3, UniquedStringImpl* uid)
     1467    {
     1468        m_jit.setupArgumentsWithExecState(arg1.payloadGPR(), arg2.payloadGPR(), arg3.payloadGPR(), TrustedImmPtr(uid));
    14691469        return appendCall(operation);
    14701470    }
    … …  
    16411641        return appendCallSetResult(operation, result);
    16421642    }
    1643     JITCompiler::Call callOperation(J_JITOperation_EJZ operation, JSValueRegs result, JSValueRegs arg1, GPRReg arg2)
     1643    JITCompiler::Call callOperation(J_JITOperation_EJC operation, GPRReg result, JSValueRegs arg1, GPRReg arg2)
     1644    {
     1645        m_jit.setupArgumentsWithExecState(arg1.payloadGPR(), arg2);
     1646        return appendCallSetResult(operation, result);
     1647    }
     1648    JITCompiler::Call callOperation(J_JITOperation_EJC operation, JSValueRegs result, JSValueRegs arg1, GPRReg arg2)
    16441649    {
    16451650        m_jit.setupArgumentsWithExecState(arg1.payloadGPR(), arg2);
    16461651        return appendCallSetResult(operation, result.payloadGPR());
    16471652    }
     1653    JITCompiler::Call callOperation(J_JITOperation_EJZ operation, JSValueRegs result, JSValueRegs arg1, GPRReg arg2)
     1654    {
     1655        m_jit.setupArgumentsWithExecState(arg1.payloadGPR(), arg2);
     1656        return appendCallSetResult(operation, result.payloadGPR());
     1657    }
    16481658    JITCompiler::Call callOperation(J_JITOperation_EJZ operation, GPRReg result, JSValueRegs arg1, GPRReg arg2)
    16491659    {
    … …  
    17041714    }
    17051715
    1706     JITCompiler::Call callOperation(P_JITOperation_EStJ operation, GPRReg result, RegisteredStructure structure, GPRReg arg2)
    1707     {
    1708         m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), arg2);
     1716    JITCompiler::Call callOperation(P_JITOperation_EStJ operation, GPRReg result, RegisteredStructure structure, JSValueRegs arg2)
     1717    {
     1718        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), arg2.payloadGPR());
    17091719        return appendCallSetResult(operation, result);
    17101720    }
    … …  
    17471757        return appendCallSetResult(operation, result);
    17481758    }
    1749     JITCompiler::Call callOperation(C_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
    1750     {
    1751         m_jit.setupArgumentsWithExecState(arg1, arg2);
     1759    JITCompiler::Call callOperation(C_JITOperation_EJJ operation, GPRReg result, JSValueRegs arg1, JSValueRegs arg2)
     1760    {
     1761        m_jit.setupArgumentsWithExecState(arg1.payloadGPR(), arg2.payloadGPR());
    17521762        return appendCallSetResult(operation, result);
    17531763    }
    … …  
    17571767        return appendCallSetResult(operation, result);
    17581768    }
    1759     JITCompiler::Call callOperation(C_JITOperation_EJJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
    1760     {
    1761         m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
     1769    JITCompiler::Call callOperation(C_JITOperation_EJJJ operation, GPRReg result, JSValueRegs arg1, JSValueRegs arg2, JSValueRegs arg3)
     1770    {
     1771        m_jit.setupArgumentsWithExecState(arg1.payloadGPR(), arg2.payloadGPR(), arg3.payloadGPR());
    17621772        return appendCallSetResult(operation, result);
    17631773    }
    … …  
    28982908    void compileNewStringObject(Node*);
    28992909   
    2900     void compileNewTypedArray(Node*);
     2910    void compileNewTypedArrayWithSize(Node*);
    29012911   
    29022912    void compileInt32Compare(Node*, MacroAssembler::RelationalCondition);
    … …  
    30683078    void compileThrow(Node*);
    30693079    void compileThrowStaticError(Node*);
     3080    void compileGetEnumerableLength(Node*);
     3081    void compileToIndexString(Node*);
     3082    void compilePutByIdWithThis(Node*);
     3083    void compileHasStructureProperty(Node*);
     3084    void compileGetPropertyEnumerator(Node*);
     3085    void compileGetEnumeratorPname(Node*);
     3086    void compileGetGetter(Node*);
     3087    void compileGetSetter(Node*);
     3088    void compileGetCallee(Node*);
     3089    void compileGetArgumentCountIncludingThis(Node*);
     3090    void compileStrCat(Node*);
     3091    void compileNewArrayWithSize(Node*);
     3092    void compileNewTypedArray(Node*);
     3093    void compileCreateThis(Node*);
     3094    void compileNewObject(Node*);
    30703095
    30713096    void moveTrueTo(GPRReg);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r226208 r226261  
    23292329
    23302330    case StrCat: {
    2331         JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
    2332         JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
    2333         JSValueOperand op3(this, node->child3(), ManualOperandSpeculation);
    2334        
    2335         JSValueRegs op1Regs = op1.jsValueRegs();
    2336         JSValueRegs op2Regs = op2.jsValueRegs();
    2337         JSValueRegs op3Regs;
    2338 
    2339         if (node->child3())
    2340             op3Regs = op3.jsValueRegs();
    2341        
    2342         flushRegisters();
    2343 
    2344         GPRFlushedCallResult result(this);
    2345         if (node->child3())
    2346             callOperation(operationStrCat3, result.gpr(), op1Regs, op2Regs, op3Regs);
    2347         else
    2348             callOperation(operationStrCat2, result.gpr(), op1Regs, op2Regs);
    2349         m_jit.exceptionCheck();
    2350        
    2351         cellResult(result.gpr(), node);
     2331        compileStrCat(node);
    23522332        break;
    23532333    }
    … …  
    38983878
    38993879    case NewArrayWithSize: {
    3900         JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
    3901         if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
    3902             SpeculateStrictInt32Operand size(this, node->child1());
    3903             GPRTemporary result(this);
    3904 
    3905             GPRReg sizeGPR = size.gpr();
    3906             GPRReg resultGPR = result.gpr();
    3907 
    3908             compileAllocateNewArrayWithSize(globalObject, resultGPR, sizeGPR, node->indexingType());
    3909             cellResult(resultGPR, node);
    3910             break;
    3911         }
    3912        
    3913         SpeculateStrictInt32Operand size(this, node->child1());
    3914         GPRReg sizeGPR = size.gpr();
    3915         flushRegisters();
    3916         GPRFlushedCallResult result(this);
    3917         GPRReg resultGPR = result.gpr();
    3918         GPRReg structureGPR = selectScratchGPR(sizeGPR);
    3919         MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
    3920         m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
    3921         MacroAssembler::Jump done = m_jit.jump();
    3922         bigLength.link(&m_jit);
    3923         m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
    3924         done.link(&m_jit);
    3925         callOperation(operationNewArrayWithSize, resultGPR, structureGPR, sizeGPR, nullptr);
    3926         m_jit.exceptionCheck();
    3927         cellResult(resultGPR, node);
     3880        compileNewArrayWithSize(node);
    39283881        break;
    39293882    }
    … …  
    39733926       
    39743927    case NewTypedArray: {
    3975         switch (node->child1().useKind()) {
    3976         case Int32Use:
    3977             compileNewTypedArray(node);
    3978             break;
    3979         case UntypedUse: {
    3980             JSValueOperand argument(this, node->child1());
    3981             JSValueRegs argumentRegs = argument.jsValueRegs();
    3982            
    3983             flushRegisters();
    3984            
    3985             GPRFlushedCallResult result(this);
    3986             GPRReg resultGPR = result.gpr();
    3987            
    3988             JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
    3989             callOperation(
    3990                 operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
    3991                 resultGPR, m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
    3992             m_jit.exceptionCheck();
    3993            
    3994             cellResult(resultGPR, node);
    3995             break;
    3996         }
    3997         default:
    3998             RELEASE_ASSERT_NOT_REACHED();
    3999             break;
    4000         }
     3928        compileNewTypedArray(node);
    40013929        break;
    40023930    }
    … …  
    40473975
    40483976    case CreateThis: {
    4049         // Note that there is not so much profit to speculate here. The only things we
    4050         // speculate on are (1) that it's a cell, since that eliminates cell checks
    4051         // later if the proto is reused, and (2) if we have a FinalObject prediction
    4052         // then we speculate because we want to get recompiled if it isn't (since
    4053         // otherwise we'd start taking slow path a lot).
    4054        
    4055         SpeculateCellOperand callee(this, node->child1());
    4056         GPRTemporary result(this);
    4057         GPRTemporary allocator(this);
    4058         GPRTemporary structure(this);
    4059         GPRTemporary scratch(this);
    4060        
    4061         GPRReg calleeGPR = callee.gpr();
    4062         GPRReg resultGPR = result.gpr();
    4063         GPRReg allocatorGPR = allocator.gpr();
    4064         GPRReg structureGPR = structure.gpr();
    4065         GPRReg scratchGPR = scratch.gpr();
    4066         // Rare data is only used to access the allocator & structure
    4067         // We can avoid using an additional GPR this way
    4068         GPRReg rareDataGPR = structureGPR;
    4069         GPRReg inlineCapacityGPR = rareDataGPR;
    4070        
    4071         MacroAssembler::JumpList slowPath;
    4072 
    4073         slowPath.append(m_jit.branch8(JITCompiler::NotEqual,
    4074             JITCompiler::Address(calleeGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
    4075         m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
    4076         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
    4077         m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
    4078         m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
    4079         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, allocatorGPR));
    4080         auto butterfly = TrustedImmPtr(nullptr);
    4081         auto mask = TrustedImm32(0);
    4082         emitAllocateJSObject(resultGPR, nullptr, allocatorGPR, structureGPR, butterfly, mask, scratchGPR, slowPath);
    4083 
    4084         m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
    4085         m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), inlineCapacityGPR);
    4086         m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);
    4087 
    4088         addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR, node->inlineCapacity()));
    4089        
    4090         cellResult(resultGPR, node);
     3977        compileCreateThis(node);
    40913978        break;
    40923979    }
    40933980
    40943981    case NewObject: {
    4095         GPRTemporary result(this);
    4096         GPRTemporary allocator(this);
    4097         GPRTemporary scratch(this);
    4098        
    4099         GPRReg resultGPR = result.gpr();
    4100         GPRReg allocatorGPR = allocator.gpr();
    4101         GPRReg scratchGPR = scratch.gpr();
    4102        
    4103         MacroAssembler::JumpList slowPath;
    4104        
    4105         RegisteredStructure structure = node->structure();
    4106         size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
    4107         MarkedAllocator* allocatorPtr = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
    4108 
    4109         m_jit.move(TrustedImmPtr(allocatorPtr), allocatorGPR);
    4110         auto butterfly = TrustedImmPtr(nullptr);
    4111         auto mask = TrustedImm32(0);
    4112         emitAllocateJSObject(resultGPR, allocatorPtr, allocatorGPR, TrustedImmPtr(structure), butterfly, mask, scratchGPR, slowPath);
    4113         m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
    4114 
    4115         addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, structure));
    4116        
    4117         cellResult(resultGPR, node);
     3982        compileNewObject(node);
    41183983        break;
    41193984    }
    41203985
    41213986    case GetCallee: {
    4122         GPRTemporary result(this);
    4123         m_jit.loadPtr(JITCompiler::payloadFor(CallFrameSlot::callee), result.gpr());
    4124         cellResult(result.gpr(), node);
     3987        compileGetCallee(node);
    41253988        break;
    41263989    }
    41273990       
    41283991    case GetArgumentCountIncludingThis: {
    4129         GPRTemporary result(this);
    4130         m_jit.load32(JITCompiler::payloadFor(CallFrameSlot::argumentCount), result.gpr());
    4131         int32Result(result.gpr(), node);
     3992        compileGetArgumentCountIncludingThis(node);
    41323993        break;
    41333994    }
    … …  
    44624323       
    44634324    case GetGetter: {
    4464         SpeculateCellOperand op1(this, node->child1());
    4465         GPRTemporary result(this, Reuse, op1);
    4466        
    4467         GPRReg op1GPR = op1.gpr();
    4468         GPRReg resultGPR = result.gpr();
    4469        
    4470         m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfGetter()), resultGPR);
    4471        
    4472         cellResult(resultGPR, node);
     4325        compileGetGetter(node);
    44734326        break;
    44744327    }
    44754328       
    44764329    case GetSetter: {
    4477         SpeculateCellOperand op1(this, node->child1());
    4478         GPRTemporary result(this, Reuse, op1);
    4479        
    4480         GPRReg op1GPR = op1.gpr();
    4481         GPRReg resultGPR = result.gpr();
    4482        
    4483         m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfSetter()), resultGPR);
    4484        
    4485         cellResult(resultGPR, node);
     4330        compileGetSetter(node);
    44864331        break;
    44874332    }
    … …  
    45564401
    45574402    case PutByIdWithThis: {
    4558         JSValueOperand base(this, node->child1());
    4559         JSValueRegs baseRegs = base.jsValueRegs();
    4560         JSValueOperand thisValue(this, node->child2());
    4561         JSValueRegs thisRegs = thisValue.jsValueRegs();
    4562         JSValueOperand value(this, node->child3());
    4563         JSValueRegs valueRegs = value.jsValueRegs();
    4564 
    4565         flushRegisters();
    4566         callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByIdWithThisStrict : operationPutByIdWithThis,
    4567             NoResult, baseRegs, thisRegs, valueRegs, identifierUID(node->identifierNumber()));
    4568         m_jit.exceptionCheck();
    4569 
    4570         noResult(node);
     4403        compilePutByIdWithThis(node);
    45714404        break;
    45724405    }
    … …  
    51544987
    51554988    case GetEnumerableLength: {
    5156         SpeculateCellOperand enumerator(this, node->child1());
    5157         GPRFlushedCallResult result(this);
    5158         GPRReg resultGPR = result.gpr();
    5159 
    5160         m_jit.load32(MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::indexedLengthOffset()), resultGPR);
    5161         int32Result(resultGPR, node);
     4989        compileGetEnumerableLength(node);
    51624990        break;
    51634991    }
    … …  
    51785006    }
    51795007    case HasStructureProperty: {
    5180         JSValueOperand base(this, node->child1());
    5181         SpeculateCellOperand property(this, node->child2());
    5182         SpeculateCellOperand enumerator(this, node->child3());
    5183         GPRTemporary resultPayload(this);
    5184         GPRTemporary resultTag(this);
    5185 
    5186         GPRReg baseTagGPR = base.tagGPR();
    5187         GPRReg basePayloadGPR = base.payloadGPR();
    5188         GPRReg propertyGPR = property.gpr();
    5189         GPRReg resultPayloadGPR = resultPayload.gpr();
    5190         GPRReg resultTagGPR = resultTag.gpr();
    5191 
    5192         m_jit.load32(MacroAssembler::Address(basePayloadGPR, JSCell::structureIDOffset()), resultTagGPR);
    5193         MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual,
    5194             resultTagGPR,
    5195             MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::cachedStructureIDOffset()));
    5196 
    5197         moveTrueTo(resultPayloadGPR);
    5198         MacroAssembler::Jump done = m_jit.jump();
    5199 
    5200         done.link(&m_jit);
    5201 
    5202         addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty,
    5203             JSValueRegs(resultTagGPR, resultPayloadGPR), JSValueRegs(baseTagGPR, basePayloadGPR), propertyGPR));
    5204         booleanResult(resultPayloadGPR, node);
     5008        compileHasStructureProperty(node);
    52055009        break;
    52065010    }
    … …  
    53595163    }
    53605164    case GetPropertyEnumerator: {
    5361         if (node->child1().useKind() == CellUse) {
    5362             SpeculateCellOperand base(this, node->child1());
    5363             GPRFlushedCallResult result(this);
    5364             GPRReg resultGPR = result.gpr();
    5365 
    5366             flushRegisters();
    5367             callOperation(operationGetPropertyEnumeratorCell, resultGPR, base.gpr());
    5368             m_jit.exceptionCheck();
    5369             cellResult(resultGPR, node);
    5370         } else {
    5371             JSValueOperand base(this, node->child1());
    5372             GPRFlushedCallResult result(this);
    5373             GPRReg resultGPR = result.gpr();
    5374 
    5375             flushRegisters();
    5376             callOperation(operationGetPropertyEnumerator, resultGPR, base.jsValueRegs());
    5377             m_jit.exceptionCheck();
    5378             cellResult(resultGPR, node);
    5379         }
     5165        compileGetPropertyEnumerator(node);
    53805166        break;
    53815167    }
    53825168    case GetEnumeratorStructurePname:
    53835169    case GetEnumeratorGenericPname: {
    5384         SpeculateCellOperand enumerator(this, node->child1());
    5385         SpeculateInt32Operand index(this, node->child2());
    5386         GPRTemporary scratch(this);
    5387         GPRTemporary resultPayload(this);
    5388         GPRTemporary resultTag(this);
    5389 
    5390         GPRReg enumeratorGPR = enumerator.gpr();
    5391         GPRReg indexGPR = index.gpr();
    5392         GPRReg scratchGPR = scratch.gpr();
    5393         GPRReg resultTagGPR = resultTag.gpr();
    5394         GPRReg resultPayloadGPR = resultPayload.gpr();
    5395 
    5396         MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, indexGPR,
    5397             MacroAssembler::Address(enumeratorGPR, (op == GetEnumeratorStructurePname)
    5398                 ? JSPropertyNameEnumerator::endStructurePropertyIndexOffset()
    5399                 : JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
    5400 
    5401         m_jit.move(MacroAssembler::TrustedImm32(JSValue::NullTag), resultTagGPR);
    5402         m_jit.move(MacroAssembler::TrustedImm32(0), resultPayloadGPR);
    5403 
    5404         MacroAssembler::Jump done = m_jit.jump();
    5405         inBounds.link(&m_jit);
    5406 
    5407         m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratchGPR);
    5408         m_jit.loadPtr(MacroAssembler::BaseIndex(scratchGPR, indexGPR, MacroAssembler::ScalePtr), resultPayloadGPR);
    5409         m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), resultTagGPR);
    5410 
    5411         done.link(&m_jit);
    5412         jsValueResult(resultTagGPR, resultPayloadGPR, node);
     5170        compileGetEnumeratorPname(node);
    54135171        break;
    54145172    }
    54155173    case ToIndexString: {
    5416         SpeculateInt32Operand index(this, node->child1());
    5417         GPRFlushedCallResult result(this);
    5418         GPRReg resultGPR = result.gpr();
    5419 
    5420         flushRegisters();
    5421         callOperation(operationToIndexString, resultGPR, index.gpr());
    5422         m_jit.exceptionCheck();
    5423         cellResult(resultGPR, node);
     5174        compileToIndexString(node);
    54245175        break;
    54255176    }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r226208 r226261  
    24752475
    24762476    case StrCat: {
    2477         JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
    2478         JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
    2479         JSValueOperand op3(this, node->child3(), ManualOperandSpeculation);
    2480        
    2481         GPRReg op1GPR = op1.gpr();
    2482         GPRReg op2GPR = op2.gpr();
    2483         GPRReg op3GPR;
    2484         if (node->child3())
    2485             op3GPR = op3.gpr();
    2486         else
    2487             op3GPR = InvalidGPRReg;
    2488        
    2489         flushRegisters();
    2490 
    2491         GPRFlushedCallResult result(this);
    2492         if (node->child3())
    2493             callOperation(operationStrCat3, result.gpr(), op1GPR, op2GPR, op3GPR);
    2494         else
    2495             callOperation(operationStrCat2, result.gpr(), op1GPR, op2GPR);
    2496         m_jit.exceptionCheck();
    2497        
    2498         cellResult(result.gpr(), node);
     2477        compileStrCat(node);
    24992478        break;
    25002479    }
    … …  
    41184097       
    41194098    case NewArrayWithSize: {
    4120         JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
    4121         if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
    4122             SpeculateStrictInt32Operand size(this, node->child1());
    4123             GPRTemporary result(this);
    4124             GPRReg sizeGPR = size.gpr();
    4125             GPRReg resultGPR = result.gpr();
    4126             compileAllocateNewArrayWithSize(globalObject, resultGPR, sizeGPR, node->indexingType());
    4127             cellResult(resultGPR, node);
    4128             break;
    4129         }
    4130        
    4131         SpeculateStrictInt32Operand size(this, node->child1());
    4132         GPRReg sizeGPR = size.gpr();
    4133         flushRegisters();
    4134         GPRFlushedCallResult result(this);
    4135         GPRReg resultGPR = result.gpr();
    4136         GPRReg structureGPR = selectScratchGPR(sizeGPR);
    4137         MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
    4138         m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
    4139         MacroAssembler::Jump done = m_jit.jump();
    4140         bigLength.link(&m_jit);
    4141         m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
    4142         done.link(&m_jit);
    4143         callOperation(operationNewArrayWithSize, resultGPR, structureGPR, sizeGPR, nullptr);
    4144         m_jit.exceptionCheck();
    4145         cellResult(resultGPR, node);
     4099        compileNewArrayWithSize(node);
    41464100        break;
    41474101    }
    … …  
    41904144       
    41914145    case NewTypedArray: {
    4192         switch (node->child1().useKind()) {
    4193         case Int32Use:
    4194             compileNewTypedArray(node);
    4195             break;
    4196         case UntypedUse: {
    4197             JSValueOperand argument(this, node->child1());
    4198             GPRReg argumentGPR = argument.gpr();
    4199            
    4200             flushRegisters();
    4201            
    4202             GPRFlushedCallResult result(this);
    4203             GPRReg resultGPR = result.gpr();
    4204            
    4205             JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
    4206             callOperation(
    4207                 operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
    4208                 resultGPR, m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())),
    4209                 argumentGPR);
    4210             m_jit.exceptionCheck();
    4211            
    4212             cellResult(resultGPR, node);
    4213             break;
    4214         }
    4215         default:
    4216             DFG_CRASH(m_jit.graph(), node, "Bad use kind");
    4217             break;
    4218         }
     4146        compileNewTypedArray(node);
    42194147        break;
    42204148    }
    … …  
    42594187
    42604188    case CreateThis: {
    4261         // Note that there is not so much profit to speculate here. The only things we
    4262         // speculate on are (1) that it's a cell, since that eliminates cell checks
    4263         // later if the proto is reused, and (2) if we have a FinalObject prediction
    4264         // then we speculate because we want to get recompiled if it isn't (since
    4265         // otherwise we'd start taking slow path a lot).
    4266        
    4267         SpeculateCellOperand callee(this, node->child1());
    4268         GPRTemporary result(this);
    4269         GPRTemporary allocator(this);
    4270         GPRTemporary structure(this);
    4271         GPRTemporary scratch(this);
    4272        
    4273         GPRReg calleeGPR = callee.gpr();
    4274         GPRReg resultGPR = result.gpr();
    4275         GPRReg allocatorGPR = allocator.gpr();
    4276         GPRReg structureGPR = structure.gpr();
    4277         GPRReg scratchGPR = scratch.gpr();
    4278         // Rare data is only used to access the allocator & structure
    4279         // We can avoid using an additional GPR this way
    4280         GPRReg rareDataGPR = structureGPR;
    4281         GPRReg inlineCapacityGPR = rareDataGPR;
    4282 
    4283         MacroAssembler::JumpList slowPath;
    4284 
    4285         slowPath.append(m_jit.branch8(JITCompiler::NotEqual,
    4286             JITCompiler::Address(calleeGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
    4287         m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
    4288         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
    4289         m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
    4290         m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
    4291 
    4292         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, allocatorGPR));
    4293 
    4294         auto butterfly = TrustedImmPtr(nullptr);
    4295         auto mask = TrustedImm32(0);
    4296         emitAllocateJSObject(resultGPR, nullptr, allocatorGPR, structureGPR, butterfly, mask, scratchGPR, slowPath);
    4297        
    4298         m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
    4299         m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), inlineCapacityGPR);
    4300         m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);
    4301         m_jit.mutatorFence(*m_jit.vm());
    4302 
    4303         addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR, node->inlineCapacity()));
    4304        
    4305         cellResult(resultGPR, node);
     4189        compileCreateThis(node);
    43064190        break;
    43074191    }
    43084192       
    43094193    case NewObject: {
    4310         GPRTemporary result(this);
    4311         GPRTemporary allocator(this);
    4312         GPRTemporary scratch(this);
    4313        
    4314         GPRReg resultGPR = result.gpr();
    4315         GPRReg allocatorGPR = allocator.gpr();
    4316         GPRReg scratchGPR = scratch.gpr();
    4317        
    4318         MacroAssembler::JumpList slowPath;
    4319 
    4320         RegisteredStructure structure = node->structure();
    4321         size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
    4322         MarkedAllocator* allocatorPtr = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
    4323 
    4324         m_jit.move(TrustedImmPtr(allocatorPtr), allocatorGPR);
    4325         auto butterfly = TrustedImmPtr(nullptr);
    4326         auto mask = TrustedImm32(0);
    4327         emitAllocateJSObject(resultGPR, allocatorPtr, allocatorGPR, TrustedImmPtr(structure), butterfly, mask, scratchGPR, slowPath);
    4328         m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
    4329         m_jit.mutatorFence(*m_jit.vm());
    4330 
    4331         addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, structure));
    4332        
    4333         cellResult(resultGPR, node);
     4194        compileNewObject(node);
    43344195        break;
    43354196    }
    43364197
    43374198    case GetCallee: {
    4338         GPRTemporary result(this);
    4339         m_jit.loadPtr(JITCompiler::addressFor(CallFrameSlot::callee), result.gpr());
    4340         cellResult(result.gpr(), node);
     4199        compileGetCallee(node);
    43414200        break;
    43424201    }
    43434202       
    43444203    case GetArgumentCountIncludingThis: {
    4345         GPRTemporary result(this);
    4346         m_jit.load32(JITCompiler::payloadFor(CallFrameSlot::argumentCount), result.gpr());
    4347         int32Result(result.gpr(), node);
     4204        compileGetArgumentCountIncludingThis(node);
    43484205        break;
    43494206    }
    … …  
    46654522       
    46664523    case GetGetter: {
    4667         SpeculateCellOperand op1(this, node->child1());
    4668         GPRTemporary result(this, Reuse, op1);
    4669        
    4670         GPRReg op1GPR = op1.gpr();
    4671         GPRReg resultGPR = result.gpr();
    4672        
    4673         m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfGetter()), resultGPR);
    4674        
    4675         cellResult(resultGPR, node);
     4524        compileGetGetter(node);
    46764525        break;
    46774526    }
    46784527       
    46794528    case GetSetter: {
    4680         SpeculateCellOperand op1(this, node->child1());
    4681         GPRTemporary result(this, Reuse, op1);
    4682        
    4683         GPRReg op1GPR = op1.gpr();
    4684         GPRReg resultGPR = result.gpr();
    4685        
    4686         m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfSetter()), resultGPR);
    4687        
    4688         cellResult(resultGPR, node);
     4529        compileGetSetter(node);
    46894530        break;
    46904531    }
    … …  
    47394580
    47404581    case PutByIdWithThis: {
    4741         JSValueOperand base(this, node->child1());
    4742         GPRReg baseGPR = base.gpr();
    4743         JSValueOperand thisValue(this, node->child2());
    4744         GPRReg thisValueGPR = thisValue.gpr();
    4745         JSValueOperand value(this, node->child3());
    4746         GPRReg valueGPR = value.gpr();
    4747 
    4748         flushRegisters();
    4749         callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByIdWithThisStrict : operationPutByIdWithThis, NoResult, baseGPR, thisValueGPR, valueGPR, identifierUID(node->identifierNumber()));
    4750         m_jit.exceptionCheck();
    4751 
    4752         noResult(node);
     4582        compilePutByIdWithThis(node);
    47534583        break;
    47544584    }
    … …  
    56195449       
    56205450    case GetEnumerableLength: {
    5621         SpeculateCellOperand enumerator(this, node->child1());
    5622         GPRFlushedCallResult result(this);
    5623         GPRReg resultGPR = result.gpr();
    5624 
    5625         m_jit.load32(MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::indexedLengthOffset()), resultGPR);
    5626         int32Result(resultGPR, node);
     5451        compileGetEnumerableLength(node);
    56275452        break;
    56285453    }
    … …  
    56305455        JSValueOperand base(this, node->child1());
    56315456        SpeculateCellOperand property(this, node->child2());
     5457
     5458        JSValueRegs baseRegs = base.jsValueRegs();
     5459        GPRReg propertyGPR = property.gpr();
     5460
     5461        flushRegisters();
    56325462        GPRFlushedCallResult result(this);
    56335463        GPRReg resultGPR = result.gpr();
    5634 
    5635         flushRegisters();
    5636         callOperation(operationHasGenericProperty, resultGPR, base.gpr(), property.gpr());
     5464        callOperation(operationHasGenericProperty, resultGPR, baseRegs, propertyGPR);
    56375465        m_jit.exceptionCheck();
    56385466        jsValueResult(resultGPR, node, DataFormatJSBoolean);
    … …  
    56405468    }
    56415469    case HasStructureProperty: {
    5642         JSValueOperand base(this, node->child1());
    5643         SpeculateCellOperand property(this, node->child2());
    5644         SpeculateCellOperand enumerator(this, node->child3());
    5645         GPRTemporary result(this);
    5646 
    5647         GPRReg baseGPR = base.gpr();
    5648         GPRReg propertyGPR = property.gpr();
    5649         GPRReg resultGPR = result.gpr();
    5650 
    5651         m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), resultGPR);
    5652         MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual,
    5653             resultGPR,
    5654             MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::cachedStructureIDOffset()));
    5655 
    5656         moveTrueTo(resultGPR);
    5657         MacroAssembler::Jump done = m_jit.jump();
    5658 
    5659         done.link(&m_jit);
    5660 
    5661         addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty, resultGPR, baseGPR, propertyGPR));
    5662         jsValueResult(resultGPR, node, DataFormatJSBoolean);
     5470        compileHasStructureProperty(node);
    56635471        break;
    56645472    }
    … …  
    58035611    }
    58045612    case GetPropertyEnumerator: {
    5805         JSValueOperand base(this, node->child1(), ManualOperandSpeculation);
    5806         GPRFlushedCallResult result(this);
    5807         GPRReg resultGPR = result.gpr();
    5808         GPRReg baseGPR = base.gpr();
    5809 
    5810         if (node->child1().useKind() == CellUse)
    5811             speculateCell(node->child1());
    5812 
    5813         flushRegisters();
    5814         if (node->child1().useKind() == CellUse)
    5815             callOperation(operationGetPropertyEnumeratorCell, resultGPR, baseGPR);
    5816         else
    5817             callOperation(operationGetPropertyEnumerator, resultGPR, baseGPR);
    5818         m_jit.exceptionCheck();
    5819         cellResult(resultGPR, node);
     5613        compileGetPropertyEnumerator(node);
    58205614        break;
    58215615    }
    58225616    case GetEnumeratorStructurePname:
    58235617    case GetEnumeratorGenericPname: {
    5824         SpeculateCellOperand enumerator(this, node->child1());
    5825         SpeculateStrictInt32Operand index(this, node->child2());
    5826         GPRTemporary scratch1(this);
    5827         GPRTemporary result(this);
    5828 
    5829         GPRReg enumeratorGPR = enumerator.gpr();
    5830         GPRReg indexGPR = index.gpr();
    5831         GPRReg scratch1GPR = scratch1.gpr();
    5832         GPRReg resultGPR = result.gpr();
    5833 
    5834         MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, indexGPR,
    5835             MacroAssembler::Address(enumeratorGPR, (op == GetEnumeratorStructurePname)
    5836                 ? JSPropertyNameEnumerator::endStructurePropertyIndexOffset()
    5837                 : JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
    5838 
    5839         m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsNull())), resultGPR);
    5840 
    5841         MacroAssembler::Jump done = m_jit.jump();
    5842         inBounds.link(&m_jit);
    5843 
    5844         m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratch1GPR);
    5845         m_jit.load64(MacroAssembler::BaseIndex(scratch1GPR, indexGPR, MacroAssembler::TimesEight), resultGPR);
    5846 
    5847         done.link(&m_jit);
    5848         jsValueResult(resultGPR, node);
     5618        compileGetEnumeratorPname(node);
    58495619        break;
    58505620    }
    58515621    case ToIndexString: {
    5852         SpeculateInt32Operand index(this, node->child1());
    5853         GPRFlushedCallResult result(this);
    5854         GPRReg resultGPR = result.gpr();
    5855 
    5856         flushRegisters();
    5857         callOperation(operationToIndexString, resultGPR, index.gpr());
    5858         m_jit.exceptionCheck();
    5859         cellResult(resultGPR, node);
     5622        compileToIndexString(node);
    58605623        break;
    58615624    }
Note: See TracChangeset for help on using the changeset viewer.