Changeset 259645 in webkit


Ignore:
Timestamp:
Apr 7, 2020 10:39:24 AM (4 years ago)
Author:
ysuzuki@apple.com
Message:

[JSC] JSWrapperObject should use JSInternalFieldObjectImpl
​https://bugs.webkit.org/show_bug.cgi?id=210019

Reviewed by Mark Lam.

JSWrapperObject's mechanism can be basically implemented by using JSInternalFieldObjectImpl.
We should leverage JSInternalFieldObjectImpl to implement JSWrapperObject since it can pave
the way to implementing Object-Allocation-Sinking and faster access to value etc. in DFG without
duplicating code.

We also noticed that we are storing classInfo to JSWrapperObject when allocating StringObject in
DFG and FTL while JSWrapperObject is no longer inheriting JSDestructibleObject! But it turned out
that this is safe since the subsequent JSWrapperObject::internalValue setting can overwrite it.
We remove this wrong store.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewStringObject):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject): Deleted.

  • ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):

  • jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.

  • runtime/BigIntObject.h:
  • runtime/BooleanObject.h:
  • runtime/JSDestructibleObject.h:

(JSC::JSDestructibleObject::classInfo const):
(JSC::JSDestructibleObject::classInfoOffset): Deleted.

  • runtime/JSWrapperObject.cpp:

(JSC::JSWrapperObject::visitChildren):

  • runtime/JSWrapperObject.h:

(JSC::JSWrapperObject::internalValueOffset):
(JSC::JSWrapperObject::internalValue const):
(JSC::JSWrapperObject::setInternalValue):
(JSC::JSWrapperObject::createStructure): Deleted.

  • runtime/NumberObject.h:
  • runtime/StringObject.h:
  • runtime/SymbolObject.h:
Location:
trunk/Source/JavaScriptCore
Files:
15 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r259638 r259645  
     12020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] JSWrapperObject should use JSInternalFieldObjectImpl
     4        https://bugs.webkit.org/show_bug.cgi?id=210019
     5
     6        Reviewed by Mark Lam.
     7
     8        JSWrapperObject's mechanism can be basically implemented by using JSInternalFieldObjectImpl.
     9        We should leverage JSInternalFieldObjectImpl to implement JSWrapperObject since it can pave
     10        the way to implementing Object-Allocation-Sinking and faster access to value etc. in DFG without
     11        duplicating code.
     12
     13        We also noticed that we are storing classInfo to JSWrapperObject when allocating StringObject in
     14        DFG and FTL while JSWrapperObject is no longer inheriting JSDestructibleObject! But it turned out
     15        that this is safe since the subsequent JSWrapperObject::internalValue setting can overwrite it.
     16        We remove this wrong store.
     17
     18        * dfg/DFGSpeculativeJIT.cpp:
     19        (JSC::DFG::SpeculativeJIT::compileNewStringObject):
     20        * dfg/DFGSpeculativeJIT.h:
     21        (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject): Deleted.
     22        * ftl/FTLAbstractHeapRepository.cpp:
     23        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
     24        * ftl/FTLAbstractHeapRepository.h:
     25        * ftl/FTLLowerDFGToB3.cpp:
     26        (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
     27        (JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):
     28        * jit/AssemblyHelpers.h:
     29        (JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.
     30        * runtime/BigIntObject.h:
     31        * runtime/BooleanObject.h:
     32        * runtime/JSDestructibleObject.h:
     33        (JSC::JSDestructibleObject::classInfo const):
     34        (JSC::JSDestructibleObject::classInfoOffset): Deleted.
     35        * runtime/JSWrapperObject.cpp:
     36        (JSC::JSWrapperObject::visitChildren):
     37        * runtime/JSWrapperObject.h:
     38        (JSC::JSWrapperObject::internalValueOffset):
     39        (JSC::JSWrapperObject::internalValue const):
     40        (JSC::JSWrapperObject::setInternalValue):
     41        (JSC::JSWrapperObject::createStructure): Deleted.
     42        * runtime/NumberObject.h:
     43        * runtime/StringObject.h:
     44        * runtime/SymbolObject.h:
     45
    1462020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
    247

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r259463 r259645  
    98629862        slowPath);
    98639863   
    9864     m_jit.storePtr(
    9865         TrustedImmPtr(StringObject::info()),
    9866         JITCompiler::Address(resultGPR, JSDestructibleObject::classInfoOffset()));
    98679864#if USE(JSVALUE64)
    98689865    m_jit.store64(

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r259320 r259645  
    15261526    }
    15271527
    1528     template<typename ClassType>
    1529     void emitAllocateDestructibleObject(GPRReg resultGPR, RegisteredStructure structure,
    1530         GPRReg scratchGPR1, GPRReg scratchGPR2, MacroAssembler::JumpList& slowPath)
    1531     {
    1532         m_jit.emitAllocateDestructibleObject<ClassType>(vm(), resultGPR, structure.get(), scratchGPR1, scratchGPR2, slowPath);
    1533     }
    1534 
    15351528    void emitAllocateRawObject(GPRReg resultGPR, RegisteredStructure, GPRReg storageGPR, unsigned numElements, unsigned vectorLength);
    15361529   

  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp

    r251826 r259645  
    7272
    7373    , JSString_value(JSRopeString_fiber0)
     74    , JSWrapperObject_internalValue(const_cast<AbstractHeap&>(JSInternalFieldObjectImpl_internalFields[static_cast<unsigned>(JSWrapperObject::Field::WrappedValue)]))
    7475
    7576    , absolute(&root, "absolute")

  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r259463 r259645  
    9898    macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
    9999    macro(JSCell_usefulBytes, JSCell::indexingTypeAndMiscOffset()) \
    100     macro(JSDestructibleObject_classInfo, JSDestructibleObject::classInfoOffset()) \
    101100    macro(JSFunction_executableOrRareData, JSFunction::offsetOfExecutableOrRareData()) \
    102101    macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
    … …  
    120119    macro(JSScope_next, JSScope::offsetOfNext()) \
    121120    macro(JSSymbolTableObject_symbolTable, JSSymbolTableObject::offsetOfSymbolTable()) \
    122     macro(JSWrapperObject_internalValue, JSWrapperObject::internalValueOffset()) \
    123121    macro(RegExpObject_regExpAndLastIndexIsNotWritableFlag, RegExpObject::offsetOfRegExpAndLastIndexIsNotWritableFlag()) \
    124122    macro(RegExpObject_lastIndex, RegExpObject::offsetOfLastIndex()) \
    … …  
    215213
    216214    AbstractHeap& JSString_value;
     215    AbstractHeap& JSWrapperObject_internalValue;
    217216
    218217    AbsoluteAbstractHeap absolute;

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r259583 r259645  
    63996399    void compileNewStringObject()
    64006400    {
     6401        // FIXME: We should handle this as JSInternalFieldObject allocation.
     6402        // https://bugs.webkit.org/show_bug.cgi?id=209453
    64016403        RegisteredStructure structure = m_node->structure();
    64026404        LValue string = lowString(m_node->child1());
    … …  
    64086410
    64096411        LValue fastResultValue = allocateObject<StringObject>(structure, m_out.intPtrZero, slowCase);
    6410         m_out.storePtr(m_out.constIntPtr(StringObject::info()), fastResultValue, m_heaps.JSDestructibleObject_classInfo);
    64116412        m_out.store64(string, fastResultValue, m_heaps.JSWrapperObject_internalValue);
    64126413        mutatorFence();
    … …  
    74067407        switch (m_node->child1().useKind()) {
    74077408        case StringObjectUse: {
     7409            // FIXME: We should convert this to GetInternalField(0).
     7410            // https://bugs.webkit.org/show_bug.cgi?id=209453
    74087411            LValue cell = lowCell(m_node->child1());
    74097412            speculateStringObjectForCell(m_node->child1(), cell);

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

    r259463 r259645  
    18721872    void emitConvertValueToBoolean(VM&, JSValueRegs, GPRReg result, GPRReg scratchIfShouldCheckMasqueradesAsUndefined, FPRReg, FPRReg, bool shouldCheckMasqueradesAsUndefined, JSGlobalObject*, bool negateResult = false);
    18731873   
    1874     template<typename ClassType>
    1875     void emitAllocateDestructibleObject(VM& vm, GPRReg resultGPR, Structure* structure, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
    1876     {
    1877         auto butterfly = TrustedImmPtr(nullptr);
    1878         emitAllocateJSObject<ClassType>(vm, resultGPR, TrustedImmPtr(structure), butterfly, scratchGPR1, scratchGPR2, slowPath);
    1879         storePtr(TrustedImmPtr(structure->classInfo()), Address(resultGPR, JSDestructibleObject::classInfoOffset()));
    1880     }
    1881    
    18821874    void emitInitializeInlineStorage(GPRReg baseGPR, unsigned inlineCapacity)
    18831875    {

  • trunk/Source/JavaScriptCore/runtime/BigIntObject.h

    r253247 r259645  
    6161    JS_EXPORT_PRIVATE BigIntObject(VM&, Structure*);
    6262};
     63static_assert(sizeof(BigIntObject) == sizeof(JSWrapperObject));
    6364
    6465} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/BooleanObject.h

    r253247 r259645  
    5353    }
    5454};
     55static_assert(sizeof(BooleanObject) == sizeof(JSWrapperObject));
    5556
    5657} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSDestructibleObject.h

    r258059 r259645  
    3939   
    4040    const ClassInfo* classInfo() const { return m_classInfo; }
    41    
    42     static ptrdiff_t classInfoOffset() { return OBJECT_OFFSETOF(JSDestructibleObject, m_classInfo); }
    4341
    4442protected:

  • trunk/Source/JavaScriptCore/runtime/JSWrapperObject.cpp

    r209897 r259645  
    2424
    2525#include "JSCInlines.h"
     26#include "JSInternalFieldObjectImplInlines.h"
    2627
    2728namespace JSC {
    … …  
    3132void JSWrapperObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
    3233{
    33     JSWrapperObject* thisObject = jsCast<JSWrapperObject*>(cell);
     34    auto* thisObject = jsCast<JSWrapperObject*>(cell);
    3435    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
    35     JSObject::visitChildren(thisObject, visitor);
    36     visitor.append(thisObject->m_internalValue);
     36    Base::visitChildren(thisObject, visitor);
    3737}
    3838

  • trunk/Source/JavaScriptCore/runtime/JSWrapperObject.h

    r253588 r259645  
    2222#pragma once
    2323
    24 #include "JSObject.h"
     24#include "JSInternalFieldObjectImpl.h"
    2525
    2626namespace JSC {
    … …  
    2828// This class is used as a base for classes such as String,
    2929// Number, Boolean and Symbol which are wrappers for primitive types.
    30 class JSWrapperObject : public JSNonFinalObject {
     30class JSWrapperObject : public JSInternalFieldObjectImpl<1> {
    3131public:
    32     using Base = JSNonFinalObject;
     32    using Base = JSInternalFieldObjectImpl<1>;
    3333
    3434    template<typename, SubspaceAccess>
    … …  
    4444    }
    4545
     46    enum class Field : uint32_t {
     47        WrappedValue = 0,
     48    };
     49    static_assert(numberOfInternalFields == 1);
     50
    4651    JSValue internalValue() const;
    4752    void setInternalValue(VM&, JSValue);
    4853
    49     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    50     {
    51         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
    52     }
    53 
    54     static ptrdiff_t internalValueOffset() { return OBJECT_OFFSETOF(JSWrapperObject, m_internalValue); }
     54    static ptrdiff_t internalValueOffset() { return offsetOfInternalField(static_cast<unsigned>(Field::WrappedValue)); }
    5555    static ptrdiff_t internalValueCellOffset()
    5656    {
    … …  
    6666
    6767    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
    68 
    69 private:
    70     WriteBarrier<Unknown> m_internalValue;
    7168};
    7269
    … …  
    7875inline JSValue JSWrapperObject::internalValue() const
    7976{
    80     return m_internalValue.get();
     77    return internalField(static_cast<unsigned>(Field::WrappedValue)).get();
    8178}
    8279
    … …  
    8582    ASSERT(value);
    8683    ASSERT(!value.isObject());
    87     m_internalValue.set(vm, this, value);
     84    internalField(static_cast<unsigned>(Field::WrappedValue)).set(vm, this, value);
    8885}
    8986

  • trunk/Source/JavaScriptCore/runtime/NumberObject.h

    r253247 r259645  
    5353    }
    5454};
     55static_assert(sizeof(NumberObject) == sizeof(JSWrapperObject));
    5556
    5657JS_EXPORT_PRIVATE NumberObject* constructNumber(JSGlobalObject*, JSValue);

  • trunk/Source/JavaScriptCore/runtime/StringObject.h

    r257399 r259645  
    7777    JS_EXPORT_PRIVATE StringObject(VM&, Structure*);
    7878};
     79static_assert(sizeof(StringObject) == sizeof(JSWrapperObject));
    7980
    8081JS_EXPORT_PRIVATE StringObject* constructString(VM&, JSGlobalObject*, JSValue);

  • trunk/Source/JavaScriptCore/runtime/SymbolObject.h

    r253247 r259645  
    6969    JS_EXPORT_PRIVATE SymbolObject(VM&, Structure*);
    7070};
     71static_assert(sizeof(SymbolObject) == sizeof(JSWrapperObject));
    7172
    7273} // namespace JSC
Note: See TracChangeset for help on using the changeset viewer.