Changeset 267624 in webkit

Timestamp:

Sep 26, 2020 12:52:14 PM (4 years ago)

Author:

ysuzuki@apple.com

Message:

Unreviewed, follow-up after r267373 to resolve post-commit review comments
​https://bugs.webkit.org/show_bug.cgi?id=216667

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
(JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):

• runtime/HashMapImpl.h:

(JSC::jsMapHash):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)
• dfg/DFGConstantFoldingPhase.cpp (modified) (1 diff)
• dfg/DFGOperations.cpp (modified) (2 diffs)
• dfg/DFGOperations.h (modified) (2 diffs)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT64.cpp (modified) (7 diffs)
• ftl/FTLLowerDFGToB3.cpp (modified) (4 diffs)
• runtime/HashMapImpl.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Unreviewed, follow-up after r267373 to resolve post-commit review comments
+        https://bugs.webkit.org/show_bug.cgi?id=216667
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
+        * runtime/HashMapImpl.h:
+        (JSC::jsMapHash):
+
 2020-09-25  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -1382 +1382 @@
         }
 
-        SpeculatedType typeMaybeNormalized = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
-        if (!(forNode(node->child1()).m_type & typeMaybeNormalized)) {
+        SpeculatedType typesNeedingNormalization = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
+        if (!(forNode(node->child1()).m_type & typesNeedingNormalization)) {
             m_state.setShouldTryConstantFolding(true);
             forNode(node) = forNode(node->child1());

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -910 +910 @@
 
             case NormalizeMapKey: {
-                SpeculatedType typeMaybeNormalized = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
-                if (m_state.forNode(node->child1()).m_type & typeMaybeNormalized)
+                SpeculatedType typesNeedingNormalization = (SpecFullNumber & ~SpecInt32Only) | SpecHeapBigInt;
+                if (m_state.forNode(node->child1()).m_type & typesNeedingNormalization)
                     break;
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -3213 +3213 @@
 }
 
-EncodedJSValue JIT_OPERATION operationNormalizeMapKey(VM* vmPointer, EncodedJSValue input)
-{
-    VM& vm = *vmPointer;
-    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
-    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
-    return JSValue::encode(normalizeMapKey(JSValue::decode(input)));
+EncodedJSValue JIT_OPERATION operationNormalizeMapKeyHeapBigInt(VM* vmPointer, JSBigInt* input)
+{
+    VM& vm = *vmPointer;
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    return JSValue::encode(normalizeMapKey(input));
 }
 
@@ -3228 +3228 @@
 
     return toUCPUStrictInt32(jsMapHash(globalObject, vm, JSValue::decode(input)));
+}
+
+UCPUStrictInt32 JIT_OPERATION operationMapHashHeapBigInt(VM* vmPointer, JSBigInt* input)
+{
+    VM& vm = *vmPointer;
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+
+    return toUCPUStrictInt32(jsMapHash(input));
 }
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.h

@@ -35 +35 @@
 
 class DateInstance;
+class JSBigInt;
 
 namespace DFG {
@@ -244 +245 @@
 char* JIT_OPERATION operationDoubleToStringWithValidRadix(JSGlobalObject*, double, int32_t);
 
-EncodedJSValue JIT_OPERATION operationNormalizeMapKey(VM*, EncodedJSValue input) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNormalizeMapKeyHeapBigInt(VM*, JSBigInt*) WTF_INTERNAL;
 UCPUStrictInt32 JIT_OPERATION operationMapHash(JSGlobalObject*, EncodedJSValue input);
+UCPUStrictInt32 JIT_OPERATION operationMapHashHeapBigInt(VM*, JSBigInt*);
 JSCell* JIT_OPERATION operationJSMapFindBucket(JSGlobalObject*, JSCell*, EncodedJSValue, int32_t);
 JSCell* JIT_OPERATION operationJSSetFindBucket(JSGlobalObject*, JSCell*, EncodedJSValue, int32_t);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -12583 +12583 @@
     passThroughCases.link(&m_jit);
     m_jit.moveValueRegs(keyRegs, resultRegs);
-    addSlowPathGenerator(slowPathCall(slowPath, this, operationNormalizeMapKey, resultRegs, &vm(), keyRegs));
+    addSlowPathGenerator(slowPathCall(slowPath, this, operationNormalizeMapKeyHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultRegs, &vm(), keyRegs.payloadGPR()));
 
     doneCases.link(&m_jit);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -4473 +4473 @@
             GPRFlushedCallResult result(this);
             GPRReg resultGPR = result.gpr();
-            callOperation(operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputGPR);
-            m_jit.exceptionCheck();
+            callOperation(operationMapHashHeapBigInt, resultGPR, &vm(), inputGPR);
             strictInt32Result(resultGPR, node);
             break;
@@ -4503 +4502 @@
                 m_jit.move(inputGPR, resultGPR);
                 m_jit.wangsInt64Hash(resultGPR, tempGPR);
-                addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputGPR));
+                addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHashHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultGPR, &vm(), inputGPR));
                 done.append(m_jit.jump());
                 isString.link(&m_jit);
@@ -4557 +4556 @@
         m_jit.move(inputGPR, resultGPR);
         m_jit.wangsInt64Hash(resultGPR, tempGPR);
-        addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputGPR));
+        addSlowPathGenerator(slowPathCall(isHeapBigInt, this, operationMapHashHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultGPR, &vm(), inputGPR));
         done.append(m_jit.jump());
 
@@ -4649 +4648 @@
             loopAround.append(m_jit.branchIfNotCell(JSValueRegs(bucketGPR)));
 
-            auto isBucketString = m_jit.branchIfString(bucketGPR);
+            auto bucketIsString = m_jit.branchIfString(bucketGPR);
             loopAround.append(m_jit.branchIfNotHeapBigInt(bucketGPR));
 
@@ -4657 +4656 @@
 
             // bucket is String.
-            isBucketString.link(&m_jit);
+            bucketIsString.link(&m_jit);
             loopAround.append(m_jit.branchIfNotString(keyGPR));
             slowPathCases.append(m_jit.jump());
@@ -4683 +4682 @@
             loopAround.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR)));
             // Both are cells here.
-            auto isBucketString = m_jit.branchIfString(bucketGPR);
+            auto bucketIsString = m_jit.branchIfString(bucketGPR);
             // bucket is not String.
             loopAround.append(m_jit.branchIfNotHeapBigInt(bucketGPR));
@@ -4690 +4689 @@
             loopAround.append(m_jit.jump());
             // bucket is String.
-            isBucketString.link(&m_jit);
+            bucketIsString.link(&m_jit);
             loopAround.append(m_jit.branchIfNotString(keyGPR));
             slowPathCases.append(m_jit.jump());

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -11298 +11298 @@
         case HeapBigIntUse: {
             LValue key = lowHeapBigInt(m_node->child1());
-            setInt32(m_out.castToInt32(vmCall(Int64, operationMapHash, weakPointer(globalObject), key)));
+            setInt32(m_out.castToInt32(vmCall(Int64, operationMapHashHeapBigInt, m_vmValue, key)));
             return;
         }
@@ -11306 +11306 @@
             LBasicBlock notString = m_out.newBlock();
             LBasicBlock isHeapBigIntCase = m_out.newBlock();
-            LBasicBlock notStringHeapBigIntCase = m_out.newBlock();
+            LBasicBlock notStringNorHeapBigIntCase = m_out.newBlock();
             LBasicBlock continuation = m_out.newBlock();
 
@@ -11319 +11319 @@
 
             m_out.appendTo(notString, isHeapBigIntCase);
-            m_out.branch(isHeapBigInt(value, (provenType(m_node->child1()) & ~SpecString)), unsure(isHeapBigIntCase), unsure(notStringHeapBigIntCase));
-
-            m_out.appendTo(isHeapBigIntCase, notStringHeapBigIntCase);
-            ValueFromBlock heapBigIntResult = m_out.anchor(m_out.castToInt32(vmCall(Int64, operationMapHash, weakPointer(globalObject), value)));
+            m_out.branch(isHeapBigInt(value, (provenType(m_node->child1()) & ~SpecString)), unsure(isHeapBigIntCase), unsure(notStringNorHeapBigIntCase));
+
+            m_out.appendTo(isHeapBigIntCase, notStringNorHeapBigIntCase);
+            ValueFromBlock heapBigIntResult = m_out.anchor(m_out.castToInt32(vmCall(Int64, operationMapHashHeapBigInt, m_vmValue, value)));
             m_out.jump(continuation);
 
-            m_out.appendTo(notStringHeapBigIntCase, continuation);
+            m_out.appendTo(notStringNorHeapBigIntCase, continuation);
             ValueFromBlock notStringResult = m_out.anchor(wangsInt64Hash(value));
             m_out.jump(continuation);
@@ -11411 +11411 @@
 
         m_out.appendTo(isHeapBigIntCase, notCellCase);
-        ValueFromBlock bigIntResult = m_out.anchor(vmCall(Int64, operationNormalizeMapKey, m_vmValue, key));
+        ValueFromBlock bigIntResult = m_out.anchor(vmCall(Int64, operationNormalizeMapKeyHeapBigInt, m_vmValue, key));
         m_out.jump(continuation);
 

trunk/Source/JavaScriptCore/runtime/HashMapImpl.h

@@ -280 +280 @@
 }
 
+ALWAYS_INLINE uint32_t jsMapHash(JSBigInt* bigInt)
+{
+    return bigInt->hash();
+}
+
 ALWAYS_INLINE uint32_t jsMapHash(JSGlobalObject* globalObject, VM& vm, JSValue value)
 {
@@ -292 +297 @@
 
     if (value.isHeapBigInt())
-        return value.asHeapBigInt()->hash();
+        return jsMapHash(value.asHeapBigInt());
 
     return wangsInt64Hash(JSValue::encode(value));