Changeset 194216 in webkit for trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

Timestamp:

Dec 17, 2015, 2:33:08 AM (10 years ago)

Author:

Yusuke Suzuki

Message:

[ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL
​https://bugs.webkit.org/show_bug.cgi?id=152227

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch introduces new_generator_func / new_generator_func_exp into DFG and FTL.
We add a new DFG Node, NewGeneratorFunction. It will construct a function with GeneratorFunction's structure.
The structure of GeneratorFunction is different from one of Function because GeneratorFunction has the different proto.

Instead of extending NewFunction / PhantomNewFunction, we just added new DFG nodes, NewGeneratorFunction and PhantomNewGeneratorFunction.
This is because NewGeneratorFunction will generate an object that has different class info from JSFunction (And if JSGeneratorFunction is extended, its size will become different from JSFunction).
So, rather than extending NewFunction with generator flag, just adding new DFG nodes seems cleaner.

Object allocation sinking phase will change NewGeneratorFunction to PhantomNewGeneratorFunction and defer or eliminate its actual materialization.
It is completely the same to NewFunction and PhantomNewFunction.
And when OSR exit occurs, we need to execute deferred NewGeneratorFunction since Baseline JIT does not consider it.
So in FTL operation, we should create JSGeneratorFunction if we see PhantomNewGeneratorFunction materialization.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGMayExit.cpp:

(JSC::DFG::mayExit):

• dfg/DFGNode.h:

(JSC::DFG::Node::convertToPhantomNewFunction):
(JSC::DFG::Node::convertToPhantomNewGeneratorFunction):
(JSC::DFG::Node::hasCellOperand):
(JSC::DFG::Node::isFunctionAllocation):
(JSC::DFG::Node::isPhantomFunctionAllocation):
(JSC::DFG::Node::isPhantomAllocation):

• dfg/DFGNodeType.h:
• dfg/DFGObjectAllocationSinkingPhase.cpp:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewFunction):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStoreBarrierInsertionPhase.cpp:
• dfg/DFGStructureRegistrationPhase.cpp:

(JSC::DFG::StructureRegistrationPhase::run):

• dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validateCPS):
(JSC::DFG::Validate::validateSSA):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):

• ftl/FTLOperations.cpp:

(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):

• tests/stress/generator-function-create-optimized.js: Added.

(shouldBe):
(g):
(test.return.gen):
(test):
(test2.gen):
(test2):

• tests/stress/generator-function-declaration-sinking-no-double-allocate.js: Added.

(shouldBe):
(GeneratorFunctionPrototype):
(call):
(f):
(sink):

• tests/stress/generator-function-declaration-sinking-osrexit.js: Added.

(shouldBe):
(GeneratorFunctionPrototype):
(g):
(f):
(sink):

• tests/stress/generator-function-declaration-sinking-put.js: Added.

(shouldBe):
(GeneratorFunctionPrototype):
(g):
(f):
(sink):

• tests/stress/generator-function-expression-sinking-no-double-allocate.js: Added.

(shouldBe):
(GeneratorFunctionPrototype):
(call):
(f):
(sink):

• tests/stress/generator-function-expression-sinking-osrexit.js: Added.

(shouldBe):
(GeneratorFunctionPrototype):
(g):
(sink):

• tests/stress/generator-function-expression-sinking-put.js: Added.

(shouldBe):
(GeneratorFunctionPrototype):
(g):
(sink):

LayoutTests:

Make the test taking longer time.

• js/regress/script-tests/generator-function-create.js:

(test):

File:

• trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

@@ -35 +35 @@
 #include "InlineCallFrame.h"
 #include "JSCInlines.h"
+#include "JSGeneratorFunction.h"
 #include "JSLexicalEnvironment.h"
 
@@ -93 +94 @@
 
     case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
     case PhantomDirectArguments:
     case PhantomClonedArguments:
@@ -161 +163 @@
     }
 
-    case PhantomNewFunction: {
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction: {
         // Figure out what the executable and activation are
         FunctionExecutable* executable = nullptr;
@@ -174 +177 @@
         RELEASE_ASSERT(executable && activation);
 
-        
-        JSFunction* result = JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
-
-        return result;
+        if (materialization->type() == PhantomNewFunction)
+            return JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
+        ASSERT(materialization->type() == PhantomNewGeneratorFunction);
+        return JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
     }