Changeset 131276 in webkit for trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

Timestamp:

Oct 14, 2012, 3:05:16 PM (13 years ago)

Author:

[email protected]

Message:

IndexingType should not have a bit for each type
​https://bugs.webkit.org/show_bug.cgi?id=98997

Reviewed by Oliver Hunt.

Somewhat incidentally, the introduction of butterflies led to each indexing
type being represented by a unique bit. This is superficially nice since it
allows you to test if a structure corresponds to a particular indexing type
by saying !!(structure->indexingType() & TheType). But the downside is that
given the 8 bits we have for the m_indexingType field, that leaves only a
small number of possible indexing types if we have one per bit.

This changeset changes the indexing type to be:

Bit #1: Tells you if you're an array.

Bits #2 - #5: 16 possible indexing types, including the blank type for

objects that don't have indexed properties.

Bits #6-8: Auxiliary bits that we could use for other things. Currently we

just use one of those bits, for MayHaveIndexedAccessors.

This is performance-neutral, and is primarily intended to give us more
breathing room for introducing new inferred array modes.

• assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::JumpList::jumps):

• assembler/MacroAssembler.h:

(MacroAssembler):
(JSC::MacroAssembler::patchableBranch32):

• assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::patchableBranch32):
(MacroAssemblerARMv7):

• dfg/DFGArrayMode.cpp:

(JSC::DFG::modeAlreadyChecked):

• dfg/DFGRepatch.cpp:

(JSC::DFG::tryCacheGetByID):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculationCheck):
(JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
(JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
(DFG):
(JSC::DFG::SpeculativeJIT::checkArray):
(JSC::DFG::SpeculativeJIT::arrayify):

• dfg/DFGSpeculativeJIT.h:

(SpeculativeJIT):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• jit/JITInlineMethods.h:

(JSC::JIT::emitAllocateJSArray):
(JSC::JIT::chooseArrayMode):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitContiguousGetByVal):
(JSC::JIT::emitArrayStorageGetByVal):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::privateCompilePatchGetArrayLength):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitContiguousGetByVal):
(JSC::JIT::emitArrayStorageGetByVal):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::privateCompilePatchGetArrayLength):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/IndexingType.h:

(JSC):
(JSC::hasIndexedProperties):
(JSC::hasContiguous):
(JSC::hasFastArrayStorage):
(JSC::hasArrayStorage):
(JSC::shouldUseSlowPut):

• runtime/JSGlobalObject.cpp:

(JSC):

• runtime/StructureTransitionTable.h:

(JSC::newIndexingType):

File:

• trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (modified) (5 diffs)

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -1019 +1019 @@
     arrayProfile(t2, t1, t0)
     btiz t2, IsArray, .opGetArrayLengthSlow
-    btiz t2, (HasContiguous | HasArrayStorage | HasSlowPutArrayStorage), .opGetArrayLengthSlow
+    btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
     loadis 8[PB, PC, 8], t1
     loadp 64[PB, PC, 8], t2
@@ -1151 +1151 @@
     sxi2p t1, t1
     loadp JSObject::m_butterfly[t0], t3
-    btiz t2, HasContiguous, .opGetByValNotContiguous
+    andi IndexingShapeMask, t2
+    bineq t2, ContiguousShape, .opGetByValNotContiguous
 
     biaeq t1, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t3], .opGetByValSlow
@@ -1160 +1161 @@
 
 .opGetByValNotContiguous:
-    btiz t2, HasArrayStorage | HasSlowPutArrayStorage, .opGetByValSlow
+    subi ArrayStorageShape, t2
+    bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValSlow
     biaeq t1, -sizeof IndexingHeader + IndexingHeader::m_vectorLength[t3], .opGetByValSlow
     loadis 8[PB, PC, 8], t0
@@ -1245 +1247 @@
     sxi2p t3, t3
     loadp JSObject::m_butterfly[t1], t0
-    btiz t2, HasContiguous, .opPutByValNotContiguous
+    andi IndexingShapeMask, t2
+    bineq t2, ContiguousShape, .opPutByValNotContiguous
     
     biaeq t3, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], .opPutByValContiguousOutOfBounds
@@ -1266 +1269 @@
 
 .opPutByValNotContiguous:
-    btiz t2, HasArrayStorage, .opPutByValSlow
+    bineq t2, ArrayStorageShape, .opPutByValSlow
     biaeq t3, -sizeof IndexingHeader + IndexingHeader::m_vectorLength[t0], .opPutByValSlow
     btpz ArrayStorage::m_vector[t0, t3, 8], .opPutByValArrayStorageEmpty