Changeset 205675 in webkit for trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

Timestamp:

Sep 8, 2016, 4:19:38 PM (9 years ago)

Author:

[email protected]

Message:

We should inline operationConvertJSValueToBoolean into JIT code
​https://bugs.webkit.org/show_bug.cgi?id=161729

Reviewed by Filip Pizlo.

JSTests:

• stress/value-to-boolean.js: Added.

(assert):
(test1):
(test2):
(test3):

Source/JavaScriptCore:

This patch introduces an AssemblyHelpers emitter function
that replaces operationConvertJSValueToBoolean. This operation
was showing up when I was doing performance analysis for the
speedometer benchmark. I saw that it was spending about 1% of
its time in this function. Hopefully this patch can help us speedup
up speedometer by a little bit.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitConvertValueToBoolean):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.

• jit/JIT.cpp:

(JSC::JIT::privateCompileSlowCases):

• jit/JIT.h:
• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emitSlow_op_jfalse): Deleted.
(JSC::JIT::emitSlow_op_jtrue): Deleted.

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emitSlow_op_jfalse): Deleted.
(JSC::JIT::emitSlow_op_jtrue): Deleted.

• jit/JITOperations.cpp:
• jit/JITOperations.h:

File:

• trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

@@ -673 +673 @@
 #endif // USE(JSVALUE64)
 
+void AssemblyHelpers::emitConvertValueToBoolean(JSValueRegs value, GPRReg result, GPRReg scratch, FPRReg valueAsFPR, FPRReg tempFPR, bool shouldCheckMasqueradesAsUndefined, JSGlobalObject* globalObject, bool negateResult)
+{
+    // Implements the following control flow structure:
+    // if (value is boolean) {
+    //     result = value === true
+    // } else if (value is integer) {
+    //     result = value !== 0
+    // } else if (value is double) {
+    //     result = value !== 0.0 && !isNaN(value);
+    // } else if (value is cell) {
+    //     if (value is string) {
+    //          result = value.length() !== 0;
+    //     } else {
+    //          do crazy things for masquerades as undefined
+    //     }
+    // } else {
+    //     result = false;
+    // }
+    //
+    // if (negateResult)
+    //     result = !result;
+
+    JumpList done;
+    auto notBoolean = branchIfNotBoolean(value, result);
+#if USE(JSVALUE64)
+    compare32(negateResult ? NotEqual : Equal, value.gpr(), TrustedImm32(ValueTrue), result);
+#else
+    compare32(negateResult ? Equal : NotEqual, value.payloadGPR(), TrustedImm32(0), result);
+#endif
+    done.append(jump());
+
+    notBoolean.link(this);
+#if USE(JSVALUE64)
+    auto isNotNumber = branchIfNotNumber(value.gpr());
+#else
+    ASSERT(scratch != InvalidGPRReg);
+    auto isNotNumber = branchIfNotNumber(value, scratch);
+#endif
+    auto isDouble = branchIfNotInt32(value);
+
+    // It's an int32.
+    compare32(negateResult ? Equal : NotEqual, value.payloadGPR(), TrustedImm32(0), result);
+    done.append(jump());
+
+    isDouble.link(this);
+#if USE(JSVALUE64)
+    unboxDouble(value.gpr(), result, valueAsFPR);
+#else
+    unboxDouble(value, valueAsFPR, tempFPR);
+#endif
+    auto isZeroOrNaN = branchDoubleZeroOrNaN(valueAsFPR, tempFPR);
+    move(negateResult ? TrustedImm32(0) : TrustedImm32(1), result);
+    done.append(jump());
+    isZeroOrNaN.link(this);
+    move(negateResult ? TrustedImm32(1) : TrustedImm32(0), result);
+    done.append(jump());
+
+    isNotNumber.link(this);
+    auto isNotCellAndIsNotNumberAndIsNotBoolean = branchIfNotCell(value);
+    auto isCellButNotString = branch8(NotEqual,
+        Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()), TrustedImm32(StringType));
+    load32(Address(value.payloadGPR(), JSString::offsetOfLength()), result);
+    compare32(negateResult ? Equal : NotEqual, result, TrustedImm32(0), result);
+    done.append(jump());
+
+    isCellButNotString.link(this);
+    if (shouldCheckMasqueradesAsUndefined) {
+        ASSERT(scratch != InvalidGPRReg);
+        JumpList isNotMasqueradesAsUndefined;
+        isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));
+        emitLoadStructure(value.payloadGPR(), result, scratch);
+        move(TrustedImmPtr(globalObject), scratch);
+        isNotMasqueradesAsUndefined.append(branchPtr(NotEqual, Address(result, Structure::globalObjectOffset()), scratch));
+        // We act like we are "undefined" here.
+        move(negateResult ? TrustedImm32(1) : TrustedImm32(0), result);
+        done.append(jump());
+        isNotMasqueradesAsUndefined.link(this);
+    }
+    move(negateResult ? TrustedImm32(0) : TrustedImm32(1), result);
+    done.append(jump());
+
+    // null or undefined.
+    isNotCellAndIsNotNumberAndIsNotBoolean.link(this); 
+    move(negateResult ? TrustedImm32(1) : TrustedImm32(0), result);
+
+    done.link(this);
+}
+
 } // namespace JSC