Changeset 105107 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h

Timestamp:

Jan 16, 2012, 4:53:40 PM (13 years ago)

Author:

[email protected]

Message:

DFG should be able to do JS and custom getter caching
​https://bugs.webkit.org/show_bug.cgi?id=76361
<rdar://problem/10698060>

Source/JavaScriptCore:

Reviewed by Geoff Garen.

Added the ability to cache JS getter calls and custom getter calls in the DFG.
Most of this is pretty mundane, since the old JIT supported this functionality
as well. But a couple interesting things had to happen:

• There are now two variants of GetById: GetById, which works as before, and GetByIdFlush, which flushes registers prior to doing the GetById. Only GetByIdFlush can be used for caching getters. We detect which GetById style to use by looking at the inline caches of the old JIT.

• Exception handling for getter calls planted in stubs uses a separate lookup handler routine, which uses the CodeOrigin stored in the StructureStubInfo.

This is a 40% speed-up in the Dromaeo DOM Traversal average. It removes all of
the DFG regressions we saw in Dromaeo. This is neutral on SunSpider, V8, and
Kraken.

• bytecode/StructureStubInfo.h:
• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGAssemblyHelpers.h:

(JSC::DFG::AssemblyHelpers::emitExceptionCheck):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::willNeedFlush):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCCallHelpers.h:

(JSC::DFG::CCallHelpers::setupResults):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGJITCompiler.h:

(JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
(JSC::DFG::JITCompiler::addExceptionCheck):

• dfg/DFGNode.h:

(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::hasHeapPrediction):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateNodePredictions):

• dfg/DFGRepatch.cpp:

(JSC::DFG::tryCacheGetByID):
(JSC::DFG::tryBuildGetByIDList):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Geoff Garen.

• fast/js/dfg-custom-getter-expected.txt: Added.
• fast/js/dfg-custom-getter-throw-expected.txt: Added.
• fast/js/dfg-custom-getter-throw-inlined-expected.txt: Added.
• fast/js/dfg-custom-getter-throw-inlined.html: Added.
• fast/js/dfg-custom-getter-throw.html: Added.
• fast/js/dfg-custom-getter.html: Added.
• fast/js/dfg-getter-expected.txt: Added.
• fast/js/dfg-getter-throw-expected.txt: Added.
• fast/js/dfg-getter-throw.html: Added.
• fast/js/dfg-getter.html: Added.
• fast/js/script-tests/dfg-custom-getter-throw-inlined.js: Added.

(foo):
(baz):
(bar):

• fast/js/script-tests/dfg-custom-getter-throw.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-custom-getter.js: Added.

(foo):

• fast/js/script-tests/dfg-getter-throw.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-getter.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h

@@ -247 +247 @@
     }
 #endif
+    
+    enum ExceptionCheckKind { NormalExceptionCheck, InvertedExceptionCheck };
+    Jump emitExceptionCheck(ExceptionCheckKind kind = NormalExceptionCheck)
+    {
+#if USE(JSVALUE64)
+        return branchTestPtr(kind == NormalExceptionCheck ? NonZero : Zero, AbsoluteAddress(&globalData()->exception));
+#elif USE(JSVALUE32_64)
+        return branch32(kind == NormalExceptionCheck ? NotEqual : Equal, AbsoluteAddress(reinterpret_cast<char*>(&globalData()->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
+#endif
+    }
 
 #if ENABLE(SAMPLING_COUNTERS)