Changeset 96993 in webkit

Timestamp:

Oct 7, 2011 5:06:51 PM (13 years ago)

Author:

oliver@apple.com

Message:

Support some string intrinsics in the DFG JIT
​https://bugs.webkit.org/show_bug.cgi?id=69678

Reviewed by Gavin Barraclough.

Add support for charAt and charCodeAt intrinsics in the DFG.

• create_hash_table:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsic):

• dfg/DFGIntrinsic.h:
• dfg/DFGNode.h:
• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateNodePredictions):
(JSC::DFG::Propagator::performNodeCSE):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• create_hash_table (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (1 diff)
• dfg/DFGIntrinsic.h (modified) (1 diff)
• dfg/DFGNode.h (modified) (1 diff)
• dfg/DFGPropagator.cpp (modified) (3 diffs)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT.h (modified) (1 diff)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Support some string intrinsics in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69678
+
+        Reviewed by Gavin Barraclough.
+
+        Add support for charAt and charCodeAt intrinsics in the DFG.
+
+        * create_hash_table:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGIntrinsic.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-10-07  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/create_hash_table

@@ -281 +281 @@
         if ($key eq "charCodeAt") {
             $thunkGenerator = "charCodeAtThunkGenerator";
+            $intrinsic = "DFG::CharCodeAtIntrinsic";
         }
         if ($key eq "charAt") {
             $thunkGenerator = "charAtThunkGenerator";
+            $intrinsic = "DFG::CharAtIntrinsic";
         }
         if ($key eq "fromCharCode") {

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -741 +741 @@
         return true;
     }
-        
+
+    case CharCodeAtIntrinsic: {
+        if (firstArg + 1 != lastArg)
+            return false;
+
+        NodeIndex charCode = addToGraph(StringCharCodeAt, get(firstArg), getToInt32(firstArg + 1));
+        if (usesResult)
+            set(resultOperand, charCode);
+        return true;
+    }
+
+    case CharAtIntrinsic: {
+        if (firstArg + 1 != lastArg)
+            return false;
+        
+        NodeIndex charCode = addToGraph(StringCharAt, get(firstArg), getToInt32(firstArg + 1));
+        if (usesResult)
+            set(resultOperand, charCode);
+        return true;
+    }
+
     default:
         ASSERT(intrinsic == NoIntrinsic);

trunk/Source/JavaScriptCore/dfg/DFGIntrinsic.h

@@ -36 +36 @@
     SqrtIntrinsic,
     ArrayPushIntrinsic,
-    ArrayPopIntrinsic
+    ArrayPopIntrinsic,
+    CharCodeAtIntrinsic,
+    CharAtIntrinsic
 };
 

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -348 +348 @@
     macro(ArrayPop, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     \
+    /* Optimizations for string access */ \
+    macro(StringCharCodeAt, NodeResultInt32) \
+    macro(StringCharAt, NodeResultJS) \
+    \
     /* Nodes for comparison operations. */\
     macro(CompareLess, NodeResultBoolean | NodeMustGenerate | NodeMightClobber) \

trunk/Source/JavaScriptCore/dfg/DFGPropagator.cpp

@@ -343 +343 @@
             break;
         }
-            
+
+        case StringCharCodeAt: {
+            changed |= mergePrediction(PredictInt32);
+        }
+
         case ArithMod: {
             PredictedType left = m_graph[node.child1()].prediction();
@@ -535 +539 @@
             break;
         }
-            
+        
+        case StringCharAt:
         case StrCat: {
             changed |= setPrediction(PredictString);
@@ -1271 +1276 @@
         case GetCallee:
         case GetStringLength:
+        case StringCharAt:
+        case StringCharCodeAt:
             setReplacement(pureCSE(node));
             break;

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -529 +529 @@
 }
 
+void SpeculativeJIT::compileGetCharCodeAt(Node& node)
+{
+    ASSERT(node.child3() == NoNode);
+    SpeculateCellOperand string(this, node.child1());
+    SpeculateStrictInt32Operand index(this, node.child2());
+    
+    GPRReg stringReg = string.gpr();
+    GPRReg indexReg = index.gpr();
+    
+    if (!isKnownString(node.child1()))
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(stringReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsStringVPtr)));
+    
+    // unsigned comparison so we can filter out negative indices and indices that are too large
+    speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, indexReg, MacroAssembler::Address(stringReg, JSString::offsetOfLength())));
+    
+    // Speculate that we're not accessing a rope
+    speculationCheck(m_jit.branchTest32(MacroAssembler::NonZero, MacroAssembler::Address(stringReg, JSString::offsetOfFiberCount())));
+    
+    GPRTemporary scratch(this);
+    GPRReg scratchReg = scratch.gpr();
+    
+    // Load the character into scratchReg
+    m_jit.loadPtr(MacroAssembler::Address(stringReg, JSString::offsetOfValue()), scratchReg);
+    m_jit.loadPtr(MacroAssembler::Address(scratchReg, StringImpl::dataOffset()), scratchReg);
+    m_jit.load16(MacroAssembler::BaseIndex(scratchReg, indexReg, MacroAssembler::TimesTwo, 0), scratchReg);
+
+    integerResult(scratchReg, m_compileIndex);
+}
+
 void SpeculativeJIT::compileGetByValOnString(Node& node)
 {

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -457 +457 @@
     void emitBranch(Node&);
     
+    void compileGetCharCodeAt(Node&);
     void compileGetByValOnString(Node&);
     

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -1252 +1252 @@
         break;
 
+    case StringCharCodeAt: {
+        compileGetCharCodeAt(node);
+        break;
+    }
+
+    case StringCharAt: {
+        // Relies on StringCharAt node having same basic layout as GetByVal
+        compileGetByValOnString(node);
+        break;
+    }
+
     case GetByVal: {
         if (at(node.child1()).prediction() == PredictString) {

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -1372 +1372 @@
         break;
 
+    case StringCharCodeAt: {
+        compileGetCharCodeAt(node);
+        break;
+    }
+
+    case StringCharAt: {
+        // Relies on StringCharAt node having same basic layout as GetByVal
+        compileGetByValOnString(node);
+        break;
+    }
+
     case GetByVal: {
         if (at(node.child1()).prediction() == PredictString) {