Changeset 96171 in webkit


Ignore:
Timestamp:
Sep 27, 2011 4:48:49 PM (13 years ago)
Author:
barraclough@apple.com
Message:

Bug fixes for GetById, PutById, and GetByOffset in JSVALUE32_64 DFG JIT
​https://bugs.webkit.org/show_bug.cgi?id=68755

Patch by Yuqiang Xian <​yuqiang.xian@intel.com> on 2011-09-27
Reviewed by Gavin Barraclough.

We need to load/store and repatch both tag and payload of a property
for GetById/PutById. Also reorder the loads of tag and payload for
GetByOffset as the result tag GPR could reuse the storage GPR.

  • bytecode/StructureStubInfo.h:
  • dfg/DFGJITCodeGenerator32_64.cpp:

(JSC::DFG::JITCodeGenerator::cachedGetById):
(JSC::DFG::JITCodeGenerator::cachedPutById):

  • dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::addPropertyAccess):
(JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):

  • dfg/DFGJITCompiler32_64.cpp:

(JSC::DFG::JITCompiler::link):

  • dfg/DFGRepatch.cpp:

(JSC::DFG::dfgRepatchByIdSelfAccess):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:
trunk/Source/JavaScriptCore
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r96169 r96171  
     12011-09-27  Yuqiang Xian  <yuqiang.xian@intel.com>
     2
     3        Bug fixes for GetById, PutById, and GetByOffset in JSVALUE32_64 DFG JIT
     4        https://bugs.webkit.org/show_bug.cgi?id=68755
     5
     6        Reviewed by Gavin Barraclough.
     7
     8        We need to load/store and repatch both tag and payload of a property
     9        for GetById/PutById. Also reorder the loads of tag and payload for
     10        GetByOffset as the result tag GPR could reuse the storage GPR.
     11
     12        * bytecode/StructureStubInfo.h:
     13        * dfg/DFGJITCodeGenerator32_64.cpp:
     14        (JSC::DFG::JITCodeGenerator::cachedGetById):
     15        (JSC::DFG::JITCodeGenerator::cachedPutById):
     16        * dfg/DFGJITCompiler.h:
     17        (JSC::DFG::JITCompiler::addPropertyAccess):
     18        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
     19        * dfg/DFGJITCompiler32_64.cpp:
     20        (JSC::DFG::JITCompiler::link):
     21        * dfg/DFGRepatch.cpp:
     22        (JSC::DFG::dfgRepatchByIdSelfAccess):
     23        * dfg/DFGSpeculativeJIT32_64.cpp:
     24        (JSC::DFG::SpeculativeJIT::compile):
     25
    1262011-09-24  Gavin Barraclough  <barraclough@apple.com>
    227

  • trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h

    r95902 r96171  
    148148            struct {
    149149                int16_t deltaCheckImmToCall;
     150#if USE(JSVALUE64)
    150151                int16_t deltaCallToLoadOrStore;
     152#elif USE(JSVALUE32_64)
     153                int16_t deltaCallToTagLoadOrStore;
     154                int16_t deltaCallToPayloadLoadOrStore;
     155#endif
    151156            } unset;
    152157            struct {

  • trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator32_64.cpp

    r95902 r96171  
    11761176   
    11771177    m_jit.loadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfPropertyStorage()), resultPayloadGPR);
    1178     JITCompiler::DataLabelCompact loadWithPatch = m_jit.loadPtrWithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, 0), resultPayloadGPR);
    1179     m_jit.move(TrustedImm32(JSValue::CellTag), resultTagGPR);
     1178    JITCompiler::DataLabelCompact tagLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
     1179    JITCompiler::DataLabelCompact payloadLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
    11801180   
    11811181    JITCompiler::Jump done = m_jit.jump();
    … …  
    12161216    int16_t checkImmToCall = safeCast<int16_t>(m_jit.differenceBetween(structureToCompare, functionCall));
    12171217    int16_t callToCheck = safeCast<int16_t>(m_jit.differenceBetween(functionCall, structureCheck));
    1218     int16_t callToLoad = safeCast<int16_t>(m_jit.differenceBetween(functionCall, loadWithPatch));
     1218    int16_t callToTagLoad = safeCast<int16_t>(m_jit.differenceBetween(functionCall, tagLoadWithPatch));
     1219    int16_t callToPayloadLoad = safeCast<int16_t>(m_jit.differenceBetween(functionCall, payloadLoadWithPatch));
    12191220    int16_t callToSlowCase = safeCast<int16_t>(m_jit.differenceBetween(functionCall, slowCase));
    12201221    int16_t callToDone = safeCast<int16_t>(m_jit.differenceBetween(functionCall, doneLabel));
    12211222   
    1222     m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToLoad, callToSlowCase, callToDone, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR), safeCast<int8_t>(resultPayloadGPR), safeCast<int8_t>(scratchGPR));
     1223    m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToTagLoad, callToPayloadLoad, callToSlowCase, callToDone, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR), safeCast<int8_t>(resultPayloadGPR), safeCast<int8_t>(scratchGPR));
    12231224   
    12241225    return functionCall;
    … …  
    13471348
    13481349    m_jit.loadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
    1349     JITCompiler::DataLabel32 storeWithPatch = m_jit.storePtrWithAddressOffsetPatch(valuePayloadGPR, JITCompiler::Address(scratchGPR, 0));
     1350    JITCompiler::DataLabel32 tagStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valueTagGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
     1351    JITCompiler::DataLabel32 payloadStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valuePayloadGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
    13501352
    13511353    JITCompiler::Jump done = m_jit.jump();
    … …  
    13851387    int16_t checkImmToCall = safeCast<int16_t>(m_jit.differenceBetween(structureToCompare, functionCall));
    13861388    int16_t callToCheck = safeCast<int16_t>(m_jit.differenceBetween(functionCall, structureCheck));
    1387     int16_t callToStore = safeCast<int16_t>(m_jit.differenceBetween(functionCall, storeWithPatch));
     1389    int16_t callToTagStore = safeCast<int16_t>(m_jit.differenceBetween(functionCall, tagStoreWithPatch));
     1390    int16_t callToPayloadStore = safeCast<int16_t>(m_jit.differenceBetween(functionCall, payloadStoreWithPatch));
    13881391    int16_t callToSlowCase = safeCast<int16_t>(m_jit.differenceBetween(functionCall, slowCase));
    13891392    int16_t callToDone = safeCast<int16_t>(m_jit.differenceBetween(functionCall, doneLabel));
    13901393
    1391     m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToStore, callToSlowCase, callToDone, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(valueTagGPR), safeCast<int8_t>(valuePayloadGPR), safeCast<int8_t>(scratchGPR));
     1394    m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToTagStore, callToPayloadStore, callToSlowCase, callToDone, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(valueTagGPR), safeCast<int8_t>(valuePayloadGPR), safeCast<int8_t>(scratchGPR));
    13921395}
    13931396

  • trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h

    r95930 r96171  
    373373    }
    374374#elif USE(JSVALUE32_64)
    375     void addPropertyAccess(JITCompiler::Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
    376     {
    377         m_propertyAccesses.append(PropertyAccessRecord(functionCall, deltaCheckImmToCall, deltaCallToStructCheck, deltaCallToLoadOrStore, deltaCallToSlowCase, deltaCallToDone,  baseGPR, valueTagGPR, valueGPR, scratchGPR));
     375    void addPropertyAccess(JITCompiler::Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToTagLoadOrStore, int16_t deltaCallToPayloadLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
     376    {
     377        m_propertyAccesses.append(PropertyAccessRecord(functionCall, deltaCheckImmToCall, deltaCallToStructCheck, deltaCallToTagLoadOrStore, deltaCallToPayloadLoadOrStore, deltaCallToSlowCase, deltaCallToDone,  baseGPR, valueTagGPR, valueGPR, scratchGPR));
    378378    }
    379379#endif
    … …  
    468468        PropertyAccessRecord(Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueGPR, int8_t scratchGPR)
    469469#elif USE(JSVALUE32_64)
    470         PropertyAccessRecord(Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
     470        PropertyAccessRecord(Call functionCall, int16_t deltaCheckImmToCall, int16_t deltaCallToStructCheck, int16_t deltaCallToTagLoadOrStore, int16_t deltaCallToPayloadLoadOrStore, int16_t deltaCallToSlowCase, int16_t deltaCallToDone, int8_t baseGPR, int8_t valueTagGPR, int8_t valueGPR, int8_t scratchGPR)
    471471#endif
    472472            : m_functionCall(functionCall)
    473473            , m_deltaCheckImmToCall(deltaCheckImmToCall)
    474474            , m_deltaCallToStructCheck(deltaCallToStructCheck)
     475#if USE(JSVALUE64)
    475476            , m_deltaCallToLoadOrStore(deltaCallToLoadOrStore)
     477#elif USE(JSVALUE32_64)
     478            , m_deltaCallToTagLoadOrStore(deltaCallToTagLoadOrStore)
     479            , m_deltaCallToPayloadLoadOrStore(deltaCallToPayloadLoadOrStore)
     480#endif
    476481            , m_deltaCallToSlowCase(deltaCallToSlowCase)
    477482            , m_deltaCallToDone(deltaCallToDone)
    … …  
    488493        int16_t m_deltaCheckImmToCall;
    489494        int16_t m_deltaCallToStructCheck;
     495#if USE(JSVALUE64)
    490496        int16_t m_deltaCallToLoadOrStore;
     497#elif USE(JSVALUE32_64)
     498        int16_t m_deltaCallToTagLoadOrStore;
     499        int16_t m_deltaCallToPayloadLoadOrStore;
     500#endif
    491501        int16_t m_deltaCallToSlowCase;
    492502        int16_t m_deltaCallToDone;

  • trunk/Source/JavaScriptCore/dfg/DFGJITCompiler32_64.cpp

    r95902 r96171  
    596596        info.u.unset.deltaCheckImmToCall = m_propertyAccesses[i].m_deltaCheckImmToCall;
    597597        info.deltaCallToStructCheck = m_propertyAccesses[i].m_deltaCallToStructCheck;
    598         info.u.unset.deltaCallToLoadOrStore = m_propertyAccesses[i].m_deltaCallToLoadOrStore;
     598        info.u.unset.deltaCallToTagLoadOrStore = m_propertyAccesses[i].m_deltaCallToTagLoadOrStore;
     599        info.u.unset.deltaCallToPayloadLoadOrStore = m_propertyAccesses[i].m_deltaCallToPayloadLoadOrStore;
    599600        info.deltaCallToSlowCase = m_propertyAccesses[i].m_deltaCallToSlowCase;
    600601        info.deltaCallToDone = m_propertyAccesses[i].m_deltaCallToDone;

  • trunk/Source/JavaScriptCore/dfg/DFGRepatch.cpp

    r95902 r96171  
    5151    // Patch the structure check & the offset of the load.
    5252    repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelPtrAtOffset(-(intptr_t)stubInfo.u.unset.deltaCheckImmToCall), structure);
     53#if USE(JSVALUE64)
    5354    if (compact)
    5455        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.u.unset.deltaCallToLoadOrStore), sizeof(JSValue) * offset);
    5556    else
    5657        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.u.unset.deltaCallToLoadOrStore), sizeof(JSValue) * offset);
     58#elif USE(JSVALUE32_64)
     59    if (compact) {
     60        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.u.unset.deltaCallToTagLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
     61        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.u.unset.deltaCallToPayloadLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     62    } else {
     63        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.u.unset.deltaCallToTagLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
     64        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.u.unset.deltaCallToPayloadLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     65    }
     66#endif
    5767}
    5868

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r95902 r96171  
    17501750        StorageAccessData& storageAccessData = m_jit.graph().m_storageAccessData[node.storageAccessDataIndex()];
    17511751       
     1752        m_jit.load32(JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
    17521753        m_jit.load32(JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
    1753         m_jit.load32(JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
    17541754       
    17551755        jsValueResult(resultTagGPR, resultPayloadGPR, m_compileIndex);
Note: See TracChangeset for help on using the changeset viewer.