Changeset 238861 in webkit

Timestamp:

Dec 4, 2018 10:55:27 AM (5 years ago)

Author:

Caio Lima

Message:

[ESNext][BigInt] Support logic operations
​https://bugs.webkit.org/show_bug.cgi?id=179903

Reviewed by Yusuke Suzuki.

JSTests:

• stress/big-int-branch-usage.js: Added.
• stress/big-int-logical-and.js: Added.
• stress/big-int-logical-not.js: Added.
• stress/big-int-logical-or.js: Added.

Source/JavaScriptCore:

We are introducing in this patch the ToBoolean support for JSBigInt.
With this change, we can implement the correct behavior of BigInt as
operand of logical opertions. During JIT genertion into DFG and FTL,
we are using JSBigInt::m_length to verify if the number is 0n or not,
following the same approach used by JSString. This is also safe in the case
of BigInt, because only 0n has m_length == 0.

We are not including BigInt speculation into Branch nodes in this
patch, but the plan is to implement it in further patches.

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::boolify):
(JSC::FTL::DFG::LowerDFGToB3::isBigInt):

• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitConvertValueToBoolean):
(JSC::AssemblyHelpers::branchIfValue):

• runtime/JSBigInt.cpp:

(JSC::JSBigInt::isZero const):
(JSC::JSBigInt::offsetOfLength):
(JSC::JSBigInt::toBoolean const):
(JSC::JSBigInt::isZero): Deleted.

• runtime/JSBigInt.h:
• runtime/JSCellInlines.h:

(JSC::JSCell::toBoolean const):
(JSC::JSCell::pureToBoolean const):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/big-int-branch-usage.js (added)
• JSTests/stress/big-int-logical-and.js (added)
• JSTests/stress/big-int-logical-not.js (added)
• JSTests/stress/big-int-logical-or.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (4 diffs)
• Source/JavaScriptCore/jit/AssemblyHelpers.cpp (modified) (5 diffs)
• Source/JavaScriptCore/runtime/JSBigInt.cpp (modified) (3 diffs)
• Source/JavaScriptCore/runtime/JSBigInt.h (modified) (4 diffs)
• Source/JavaScriptCore/runtime/JSCellInlines.h (modified) (3 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-12-04  Caio Lima  <ticaiolima@gmail.com>
+
+        [ESNext][BigInt] Support logic operations
+        https://bugs.webkit.org/show_bug.cgi?id=179903
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/big-int-branch-usage.js: Added.
+        * stress/big-int-logical-and.js: Added.
+        * stress/big-int-logical-not.js: Added.
+        * stress/big-int-logical-or.js: Added.
+
 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-12-04  Caio Lima  <ticaiolima@gmail.com>
+
+        [ESNext][BigInt] Support logic operations
+        https://bugs.webkit.org/show_bug.cgi?id=179903
+
+        Reviewed by Yusuke Suzuki.
+
+        We are introducing in this patch the ToBoolean support for JSBigInt.
+        With this change, we can implement the correct behavior of BigInt as
+        operand of logical opertions. During JIT genertion into DFG and FTL,
+        we are using JSBigInt::m_length to verify if the number is 0n or not,
+        following the same approach used by JSString. This is also safe in the case
+        of BigInt, because only 0n has m_length == 0.
+
+        We are not including BigInt speculation into Branch nodes in this
+        patch, but the plan is to implement it in further patches.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::boolify):
+        (JSC::FTL::DFG::LowerDFGToB3::isBigInt):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
+        (JSC::AssemblyHelpers::branchIfValue):
+        * runtime/JSBigInt.cpp:
+        (JSC::JSBigInt::isZero const):
+        (JSC::JSBigInt::offsetOfLength):
+        (JSC::JSBigInt::toBoolean const):
+        (JSC::JSBigInt::isZero): Deleted.
+        * runtime/JSBigInt.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::toBoolean const):
+        (JSC::JSCell::pureToBoolean const):
+
 2018-12-04  Devin Rousso  <drousso@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

@@ -86 +86 @@
     macro(JSString_length, JSString::offsetOfLength()) \
     macro(JSString_value, JSString::offsetOfValue()) \
+    macro(JSBigInt_length, JSBigInt::offsetOfLength()) \
     macro(JSSymbolTableObject_symbolTable, JSSymbolTableObject::offsetOfSymbolTable()) \
     macro(JSWrapperObject_internalValue, JSWrapperObject::internalValueOffset()) \

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -13579 +13579 @@
             // Implements the following control flow structure:
             // if (value is cell) {
-            //     if (value is string)
+            //     if (value is string or value is BigInt)
             //         result = !!value->length
             //     else {
@@ -13596 +13596 @@
             LBasicBlock stringCase = m_out.newBlock();
             LBasicBlock notStringCase = m_out.newBlock();
+            LBasicBlock bigIntCase = m_out.newBlock();
+            LBasicBlock notBigIntCase = m_out.newBlock();
             LBasicBlock notCellCase = m_out.newBlock();
             LBasicBlock int32Case = m_out.newBlock();
@@ -13617 +13619 @@
             results.append(m_out.anchor(nonEmptyString));
             m_out.jump(continuation);
-            
-            m_out.appendTo(notStringCase, notCellCase);
+
+            m_out.appendTo(notStringCase, bigIntCase);
+            m_out.branch(
+                isBigInt(value, provenType(edge) & SpecCell),
+                unsure(bigIntCase), unsure(notBigIntCase));
+
+            m_out.appendTo(bigIntCase, notBigIntCase);
+            LValue nonZeroBigInt = m_out.notZero32(
+                m_out.load32NonNegative(value, m_heaps.JSBigInt_length));
+            results.append(m_out.anchor(nonZeroBigInt));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notBigIntCase, notCellCase);
             LValue isTruthyObject;
             if (masqueradesAsUndefinedWatchpointIsStillValid())
@@ -15612 +15625 @@
     }
 
+    LValue isBigInt(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, SpecBigInt))
+            return proven;
+        return m_out.equal(
+            m_out.load32(cell, m_heaps.JSCell_structureID),
+            m_out.constInt32(vm().bigIntStructure->id()));
+    }
+
     LValue isArrayTypeForArrayify(LValue cell, ArrayMode arrayMode)
     {

trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

@@ -759 +759 @@
     // Implements the following control flow structure:
     // if (value is cell) {
-    //     if (value is string)
+    //     if (value is string or value is BigInt)
     //         result = !!value->length
     //     else {
@@ -782 +782 @@
 
     isCellButNotString.link(this);
+    auto isCellButNotBigIntOrString = branchIfNotBigInt(value.payloadGPR());
+    load32(Address(value.payloadGPR(), JSBigInt::offsetOfLength()), result);
+    compare32(invert ? Equal : NotEqual, result, TrustedImm32(0), result);
+    done.append(jump());
+
+    isCellButNotBigIntOrString.link(this);
     if (shouldCheckMasqueradesAsUndefined) {
         ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);
@@ -832 +838 @@
     // Implements the following control flow structure:
     // if (value is cell) {
-    //     if (value is string)
+    //     if (value is string or value is BigInt)
     //         result = !!value->length
     //     else {
@@ -853 +859 @@
     truthy.append(branchTest32(invert ? Zero : NonZero, Address(value.payloadGPR(), JSString::offsetOfLength())));
     done.append(jump());
+    isCellButNotString.link(this);
+    auto isCellButNotBigIntOrString = branchIfNotBigInt(value.payloadGPR());
+    truthy.append(branchTest32(invert ? Zero : NonZero, Address(value.payloadGPR(), JSBigInt::offsetOfLength())));
+    done.append(jump());
 
     if (shouldCheckMasqueradesAsUndefined) {
-        isCellButNotString.link(this);
+        isCellButNotBigIntOrString.link(this);
         ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);
         JumpList isNotMasqueradesAsUndefined;
@@ -875 +885 @@
     } else {
         if (invert)
-            done.append(isCellButNotString);
+            done.append(isCellButNotBigIntOrString);
         else
-            truthy.append(isCellButNotString);
+            truthy.append(isCellButNotBigIntOrString);
     }
 

trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp

@@ -233 +233 @@
 }
 
-inline bool JSBigInt::isZero()
-{
-    ASSERT(length() || !sign());
-    return length() == 0;
-}
-
 // Multiplies {this} with {factor} and adds {summand} to the result.
 void JSBigInt::inplaceMultiplyAdd(Digit factor, Digit summand)
@@ -1701 +1695 @@
 }
 
+size_t JSBigInt::offsetOfLength()
+{
+    return OBJECT_OFFSETOF(JSBigInt, m_length);
+}
+
 template <typename CharType>
 JSBigInt* JSBigInt::parseInt(ExecState* exec, CharType*  data, unsigned length, ErrorParseMode errorParseMode)
@@ -1819 +1818 @@
     dataStorage()[n] = value;
 }
+
 JSObject* JSBigInt::toObject(ExecState* exec, JSGlobalObject* globalObject) const
 {

trunk/Source/JavaScriptCore/runtime/JSBigInt.h

@@ -29 +29 @@
 #include "ExceptionHelpers.h"
 #include "JSObject.h"
-#include "ParseInt.h"
 #include <wtf/CagedPtr.h>
 #include <wtf/text/StringBuilder.h>
@@ -59 +58 @@
     static JSBigInt* createFrom(VM&, int64_t value);
     static JSBigInt* createFrom(VM&, bool value);
+
+    static size_t offsetOfLength();
 
     DECLARE_EXPORT_INFO;
@@ -105 +106 @@
 
     JSObject* toObject(ExecState*, JSGlobalObject*) const;
+    inline bool toBoolean() const { return !isZero(); }
 
     static JSBigInt* multiply(ExecState*, JSBigInt* x, JSBigInt* y);
@@ -195 +197 @@
     static String toStringGeneric(ExecState*, JSBigInt*, unsigned radix);
 
-    bool isZero();
+    inline bool isZero() const
+    {
+        ASSERT(length() || !sign());
+        return length() == 0;
+    }
 
     template <typename CharType>

trunk/Source/JavaScriptCore/runtime/JSCellInlines.h

@@ -34 +34 @@
 #include "Handle.h"
 #include "IsoSubspaceInlines.h"
+#include "JSBigInt.h"
 #include "JSCast.h"
 #include "JSDestructibleObject.h"
@@ -340 +341 @@
     if (isString())
         return static_cast<const JSString*>(this)->toBoolean();
+    if (isBigInt())
+        return static_cast<const JSBigInt*>(this)->toBoolean();
     return !structure(exec->vm())->masqueradesAsUndefined(exec->lexicalGlobalObject());
 }
@@ -347 +350 @@
     if (isString())
         return static_cast<const JSString*>(this)->toBoolean() ? TrueTriState : FalseTriState;
+    if (isBigInt())
+        return static_cast<const JSBigInt*>(this)->toBoolean() ? TrueTriState : FalseTriState;
     if (isSymbol())
         return TrueTriState;