Ignore:
Timestamp:
May 17, 2017, 9:59:38 PM (8 years ago)
Author:
Yusuke Suzuki
Message:

[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
https://bugs.webkit.org/show_bug.cgi?id=172098

Reviewed by Saam Barati.

JSTests:

  • stress/check-sub-class.js: Added.

(shouldBe):
(shouldThrow):
(calling):
(array.forEach):
(i.array.forEach):

Source/JavaScriptCore:

In this patch, we generalize CheckDOM to CheckSubClass.
It can accept any ClassInfo and perform ClassInfo check
in DFG / FTL. Now, we add a new function pointer to ClassInfo,
checkSubClassPatchpoint. It can create DOMJIT patchpoint
for that ClassInfo. It it natural that ClassInfo holds the
way to emit DOMJIT::Patchpoint to perform CheckSubClass
rather than having it in each DOMJIT getter / function
signature annotation.

One problem is that it enlarges the size of ClassInfo.
But this is the best place to put this function pointer.
By doing so, we can add a patchpoint for CheckSubClass
in an non-intrusive manner: WebCore can inject patchpoints
without interactive JSC.

We still have a way to reduce the size of ClassInfo if
we move ArrayBuffer related methods out to the other places.

This patch touches many files because we add a new function
pointer to ClassInfo. But they are basically mechanical change.

  • API/JSAPIWrapperObject.mm:
  • API/JSCallbackConstructor.cpp:
  • API/JSCallbackFunction.cpp:
  • API/JSCallbackObject.cpp:
  • API/ObjCCallbackFunction.mm:
  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/CodeBlock.cpp:
  • bytecode/DOMJITAccessCasePatchpointParams.h:

(JSC::DOMJITAccessCasePatchpointParams::DOMJITAccessCasePatchpointParams):

  • bytecode/EvalCodeBlock.cpp:
  • bytecode/FunctionCodeBlock.cpp:
  • bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::emitDOMJITGetter):

  • bytecode/ModuleProgramCodeBlock.cpp:
  • bytecode/ProgramCodeBlock.cpp:
  • bytecode/UnlinkedCodeBlock.cpp:
  • bytecode/UnlinkedEvalCodeBlock.cpp:
  • bytecode/UnlinkedFunctionCodeBlock.cpp:
  • bytecode/UnlinkedFunctionExecutable.cpp:
  • bytecode/UnlinkedModuleProgramCodeBlock.cpp:
  • bytecode/UnlinkedProgramCodeBlock.cpp:
  • debugger/DebuggerScope.cpp:
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleDOMJITGetter):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

  • dfg/DFGDOMJITPatchpointParams.h:

(JSC::DFG::DOMJITPatchpointParams::DOMJITPatchpointParams):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeCallDOM):
(JSC::DFG::FixupPhase::fixupCheckSubClass):
(JSC::DFG::FixupPhase::fixupCheckDOM): Deleted.

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

  • dfg/DFGNode.h:

(JSC::DFG::Node::hasClassInfo):
(JSC::DFG::Node::classInfo):
(JSC::DFG::Node::hasCheckDOMPatchpoint): Deleted.
(JSC::DFG::Node::checkDOMPatchpoint): Deleted.

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCheckSubClass):
(JSC::DFG::SpeculativeJIT::compileCheckDOM): Deleted.

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::vm):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):
In DFG, we rename CheckDOM to CheckSubClass. It just holds ClassInfo.
And ClassInfo knows how to perform CheckSubClass efficiently.
If ClassInfo does not have a way to perform CheckSubClass efficiently,
we just perform jsDynamicCast thing in ASM.

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • domjit/DOMJITGetterSetter.h:
  • domjit/DOMJITPatchpointParams.h:

(JSC::DOMJIT::PatchpointParams::PatchpointParams):
(JSC::DOMJIT::PatchpointParams::vm):

  • domjit/DOMJITSignature.h:

(JSC::DOMJIT::Signature::Signature):
(JSC::DOMJIT::Signature::checkDOM): Deleted.

  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLDOMJITPatchpointParams.h:

(JSC::FTL::DOMJITPatchpointParams::DOMJITPatchpointParams):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM): Deleted.

  • inspector/JSInjectedScriptHost.cpp:
  • inspector/JSInjectedScriptHostPrototype.cpp:
  • inspector/JSJavaScriptCallFrame.cpp:
  • inspector/JSJavaScriptCallFramePrototype.cpp:
  • jsc.cpp:

(WTF::DOMJITNode::checkSubClassPatchpoint):
(WTF::DOMJITFunctionObject::checkSubClassPatchpoint):
(WTF::DOMJITFunctionObject::finishCreation):
(WTF::DOMJITCheckSubClassObject::DOMJITCheckSubClassObject):
(WTF::DOMJITCheckSubClassObject::createStructure):
(WTF::DOMJITCheckSubClassObject::create):
(WTF::DOMJITCheckSubClassObject::safeFunction):
(WTF::DOMJITCheckSubClassObject::unsafeFunction):
(WTF::DOMJITCheckSubClassObject::finishCreation):
(GlobalObject::finishCreation):
(functionCreateDOMJITCheckSubClassObject):
(WTF::DOMJITNode::checkDOMJITNode): Deleted.
(WTF::DOMJITFunctionObject::checkDOMJITNode): Deleted.

  • runtime/AbstractModuleRecord.cpp:
  • runtime/ArrayBufferNeuteringWatchpoint.cpp:
  • runtime/ArrayConstructor.cpp:
  • runtime/ArrayIteratorPrototype.cpp:
  • runtime/ArrayPrototype.cpp:
  • runtime/AsyncFunctionConstructor.cpp:
  • runtime/AsyncFunctionPrototype.cpp:
  • runtime/AtomicsObject.cpp:
  • runtime/BooleanConstructor.cpp:
  • runtime/BooleanObject.cpp:
  • runtime/BooleanPrototype.cpp:
  • runtime/ClassInfo.cpp: Copied from Source/JavaScriptCore/tools/JSDollarVM.cpp.

(JSC::ClassInfo::dump):

  • runtime/ClassInfo.h:

(JSC::ClassInfo::offsetOfParentClass):

  • runtime/ClonedArguments.cpp:
  • runtime/ConsoleObject.cpp:
  • runtime/CustomGetterSetter.cpp:
  • runtime/DateConstructor.cpp:
  • runtime/DateInstance.cpp:
  • runtime/DatePrototype.cpp:
  • runtime/DirectArguments.cpp:
  • runtime/Error.cpp:
  • runtime/ErrorConstructor.cpp:
  • runtime/ErrorInstance.cpp:
  • runtime/ErrorPrototype.cpp:
  • runtime/EvalExecutable.cpp:
  • runtime/Exception.cpp:
  • runtime/ExceptionHelpers.cpp:
  • runtime/ExecutableBase.cpp:
  • runtime/FunctionConstructor.cpp:
  • runtime/FunctionExecutable.cpp:
  • runtime/FunctionPrototype.cpp:
  • runtime/FunctionRareData.cpp:
  • runtime/GeneratorFunctionConstructor.cpp:
  • runtime/GeneratorFunctionPrototype.cpp:
  • runtime/GeneratorPrototype.cpp:
  • runtime/GetterSetter.cpp:
  • runtime/HashMapImpl.cpp:
  • runtime/HashMapImpl.h:
  • runtime/InferredType.cpp:

(JSC::InferredType::create):

  • runtime/InferredTypeTable.cpp:
  • runtime/InferredValue.cpp:
  • runtime/InspectorInstrumentationObject.cpp:
  • runtime/InternalFunction.cpp:
  • runtime/IntlCollator.cpp:
  • runtime/IntlCollatorConstructor.cpp:
  • runtime/IntlCollatorPrototype.cpp:
  • runtime/IntlDateTimeFormat.cpp:
  • runtime/IntlDateTimeFormatConstructor.cpp:
  • runtime/IntlDateTimeFormatPrototype.cpp:
  • runtime/IntlNumberFormat.cpp:
  • runtime/IntlNumberFormatConstructor.cpp:
  • runtime/IntlNumberFormatPrototype.cpp:
  • runtime/IntlObject.cpp:
  • runtime/IteratorPrototype.cpp:
  • runtime/JSAPIValueWrapper.cpp:
  • runtime/JSArray.cpp:
  • runtime/JSArrayBuffer.cpp:
  • runtime/JSArrayBufferConstructor.cpp:
  • runtime/JSArrayBufferPrototype.cpp:
  • runtime/JSArrayBufferView.cpp:
  • runtime/JSAsyncFunction.cpp:
  • runtime/JSBoundFunction.cpp:
  • runtime/JSCallee.cpp:
  • runtime/JSCustomGetterSetterFunction.cpp:
  • runtime/JSDataView.cpp:
  • runtime/JSDataViewPrototype.cpp:
  • runtime/JSEnvironmentRecord.cpp:
  • runtime/JSFixedArray.cpp:
  • runtime/JSFunction.cpp:
  • runtime/JSGeneratorFunction.cpp:
  • runtime/JSGlobalLexicalEnvironment.cpp:
  • runtime/JSGlobalObject.cpp:
  • runtime/JSInternalPromise.cpp:
  • runtime/JSInternalPromiseConstructor.cpp:
  • runtime/JSInternalPromiseDeferred.cpp:
  • runtime/JSInternalPromisePrototype.cpp:
  • runtime/JSLexicalEnvironment.cpp:
  • runtime/JSMap.cpp:
  • runtime/JSMapIterator.cpp:
  • runtime/JSModuleEnvironment.cpp:
  • runtime/JSModuleLoader.cpp:
  • runtime/JSModuleNamespaceObject.cpp:
  • runtime/JSModuleRecord.cpp:
  • runtime/JSNativeStdFunction.cpp:
  • runtime/JSONObject.cpp:
  • runtime/JSObject.cpp:
  • runtime/JSPromise.cpp:
  • runtime/JSPromiseConstructor.cpp:
  • runtime/JSPromiseDeferred.cpp:
  • runtime/JSPromisePrototype.cpp:
  • runtime/JSPropertyNameEnumerator.cpp:
  • runtime/JSPropertyNameIterator.cpp:
  • runtime/JSProxy.cpp:
  • runtime/JSScriptFetcher.cpp:
  • runtime/JSSet.cpp:
  • runtime/JSSetIterator.cpp:
  • runtime/JSSourceCode.cpp:
  • runtime/JSString.cpp:
  • runtime/JSStringIterator.cpp:
  • runtime/JSSymbolTableObject.cpp:
  • runtime/JSTemplateRegistryKey.cpp:
  • runtime/JSTypedArrayConstructors.cpp:
  • runtime/JSTypedArrayPrototypes.cpp:
  • runtime/JSTypedArrayViewConstructor.cpp:
  • runtime/JSTypedArrays.cpp:
  • runtime/JSWeakMap.cpp:
  • runtime/JSWeakSet.cpp:
  • runtime/JSWithScope.cpp:
  • runtime/MapConstructor.cpp:
  • runtime/MapIteratorPrototype.cpp:
  • runtime/MapPrototype.cpp:
  • runtime/MathObject.cpp:
  • runtime/ModuleLoaderPrototype.cpp:
  • runtime/ModuleProgramExecutable.cpp:
  • runtime/NativeErrorConstructor.cpp:
  • runtime/NativeExecutable.cpp:
  • runtime/NativeStdFunctionCell.cpp:
  • runtime/NullGetterFunction.cpp:
  • runtime/NullSetterFunction.cpp:
  • runtime/NumberConstructor.cpp:
  • runtime/NumberObject.cpp:
  • runtime/NumberPrototype.cpp:
  • runtime/ObjectConstructor.cpp:
  • runtime/ObjectPrototype.cpp:
  • runtime/ProgramExecutable.cpp:
  • runtime/PropertyTable.cpp:
  • runtime/ProxyConstructor.cpp:
  • runtime/ProxyObject.cpp:
  • runtime/ProxyRevoke.cpp:
  • runtime/ReflectObject.cpp:
  • runtime/RegExp.cpp:
  • runtime/RegExpConstructor.cpp:
  • runtime/RegExpObject.cpp:
  • runtime/RegExpPrototype.cpp:
  • runtime/ScopedArguments.cpp:
  • runtime/ScopedArgumentsTable.cpp:
  • runtime/ScriptExecutable.cpp:
  • runtime/SetConstructor.cpp:
  • runtime/SetIteratorPrototype.cpp:
  • runtime/SetPrototype.cpp:
  • runtime/SparseArrayValueMap.cpp:
  • runtime/StrictEvalActivation.cpp:
  • runtime/StringConstructor.cpp:
  • runtime/StringIteratorPrototype.cpp:
  • runtime/StringObject.cpp:
  • runtime/StringPrototype.cpp:
  • runtime/Structure.cpp:
  • runtime/StructureChain.cpp:
  • runtime/StructureRareData.cpp:
  • runtime/Symbol.cpp:
  • runtime/SymbolConstructor.cpp:
  • runtime/SymbolObject.cpp:
  • runtime/SymbolPrototype.cpp:
  • runtime/SymbolTable.cpp:
  • runtime/WeakMapConstructor.cpp:
  • runtime/WeakMapData.cpp:
  • runtime/WeakMapPrototype.cpp:
  • runtime/WeakSetConstructor.cpp:
  • runtime/WeakSetPrototype.cpp:
  • testRegExp.cpp:
  • tools/JSDollarVM.cpp:
  • tools/JSDollarVMPrototype.cpp:
  • wasm/JSWebAssembly.cpp:
  • wasm/js/JSWebAssemblyCodeBlock.cpp:
  • wasm/js/JSWebAssemblyCompileError.cpp:
  • wasm/js/JSWebAssemblyInstance.cpp:
  • wasm/js/JSWebAssemblyLinkError.cpp:
  • wasm/js/JSWebAssemblyMemory.cpp:
  • wasm/js/JSWebAssemblyModule.cpp:
  • wasm/js/JSWebAssemblyRuntimeError.cpp:
  • wasm/js/JSWebAssemblyTable.cpp:
  • wasm/js/WebAssemblyCompileErrorConstructor.cpp:
  • wasm/js/WebAssemblyCompileErrorPrototype.cpp:
  • wasm/js/WebAssemblyFunction.cpp:
  • wasm/js/WebAssemblyInstanceConstructor.cpp:
  • wasm/js/WebAssemblyInstancePrototype.cpp:
  • wasm/js/WebAssemblyLinkErrorConstructor.cpp:
  • wasm/js/WebAssemblyLinkErrorPrototype.cpp:
  • wasm/js/WebAssemblyMemoryConstructor.cpp:
  • wasm/js/WebAssemblyMemoryPrototype.cpp:
  • wasm/js/WebAssemblyModuleConstructor.cpp:
  • wasm/js/WebAssemblyModulePrototype.cpp:
  • wasm/js/WebAssemblyModuleRecord.cpp:
  • wasm/js/WebAssemblyPrototype.cpp:
  • wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
  • wasm/js/WebAssemblyRuntimeErrorPrototype.cpp:
  • wasm/js/WebAssemblyTableConstructor.cpp:
  • wasm/js/WebAssemblyTablePrototype.cpp:
  • wasm/js/WebAssemblyToJSCallee.cpp:
  • wasm/js/WebAssemblyWrapperFunction.cpp:

Source/WebCore:

Add DOMJIT interface IDL attribute. Which allows us to define checkSubClassPatchpoint function
for that ClassInfo. And we move CheckSubClass patchpoint implementation to ClassInfo's member.

  • CMakeLists.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • bindings/js/JSDOMGlobalObject.cpp:
  • bindings/js/JSDOMWindowBase.cpp:
  • bindings/js/JSDOMWindowProperties.cpp:
  • bindings/js/JSDOMWindowShell.cpp:
  • bindings/js/JSReadableStreamPrivateConstructors.cpp:
  • bindings/js/JSWorkerGlobalScopeBase.cpp:
  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):
(GenerateImplementationIterableFunctions):
(GenerateConstructorHelperMethods):

  • bindings/scripts/IDLAttributes.json:
  • bindings/scripts/test/JS/JSInterfaceName.cpp:
  • bindings/scripts/test/JS/JSMapLike.cpp:
  • bindings/scripts/test/JS/JSReadOnlyMapLike.cpp:
  • bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
  • bindings/scripts/test/JS/JSTestCEReactions.cpp:
  • bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
  • bindings/scripts/test/JS/JSTestCallbackInterface.cpp:
  • bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
  • bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
  • bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
  • bindings/scripts/test/JS/JSTestDOMJIT.cpp:
  • bindings/scripts/test/JS/JSTestDOMJIT.h:
  • bindings/scripts/test/JS/JSTestEventConstructor.cpp:
  • bindings/scripts/test/JS/JSTestEventTarget.cpp:
  • bindings/scripts/test/JS/JSTestException.cpp:
  • bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
  • bindings/scripts/test/JS/JSTestGlobalObject.cpp:
  • bindings/scripts/test/JS/JSTestInterface.cpp:
  • bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:
  • bindings/scripts/test/JS/JSTestIterable.cpp:
  • bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
  • bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
  • bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
  • bindings/scripts/test/JS/JSTestNode.cpp:
  • bindings/scripts/test/JS/JSTestObj.cpp:
  • bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
  • bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
  • bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
  • bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:
  • bindings/scripts/test/JS/JSTestSerialization.cpp:
  • bindings/scripts/test/JS/JSTestSerializationInherit.cpp:
  • bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp:
  • bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
  • bindings/scripts/test/JS/JSTestTypedefs.cpp:
  • bridge/c/CRuntimeObject.cpp:
  • bridge/c/c_instance.cpp:
  • bridge/objc/ObjCRuntimeObject.mm:
  • bridge/objc/objc_instance.mm:
  • bridge/objc/objc_runtime.mm:
  • bridge/runtime_array.cpp:
  • bridge/runtime_method.cpp:
  • bridge/runtime_object.cpp:
  • dom/Document.idl:
  • dom/DocumentFragment.idl:
  • dom/Element.idl:
  • dom/Event.idl:
  • dom/Node.idl:
  • domjit/JSDocumentDOMJIT.cpp:

(WebCore::JSDocument::checkSubClassPatchpoint):
(WebCore::DocumentDocumentElementDOMJIT::checkDOM): Deleted.
(WebCore::DocumentBodyDOMJIT::checkDOM): Deleted.

  • domjit/JSDocumentFragmentDOMJIT.cpp: Copied from Source/JavaScriptCore/runtime/JSMap.cpp.

(WebCore::JSDocumentFragment::checkSubClassPatchpoint):

  • domjit/JSElementDOMJIT.cpp: Copied from Source/JavaScriptCore/tools/JSDollarVM.cpp.

(WebCore::JSElement::checkSubClassPatchpoint):

  • domjit/JSEventDOMJIT.cpp: Copied from Source/JavaScriptCore/tools/JSDollarVM.cpp.

(WebCore::JSEvent::checkSubClassPatchpoint):

  • domjit/JSNodeDOMJIT.cpp:

(WebCore::JSNode::checkSubClassPatchpoint):
(WebCore::NodeFirstChildDOMJIT::checkDOM): Deleted.
(WebCore::NodeLastChildDOMJIT::checkDOM): Deleted.
(WebCore::NodeNextSiblingDOMJIT::checkDOM): Deleted.
(WebCore::NodePreviousSiblingDOMJIT::checkDOM): Deleted.
(WebCore::NodeParentNodeDOMJIT::checkDOM): Deleted.
(WebCore::NodeNodeTypeDOMJIT::checkDOM): Deleted.
(WebCore::NodeOwnerDocumentDOMJIT::checkDOM): Deleted.

Source/WebKit/mac:

  • Plugins/Hosted/ProxyInstance.mm:
  • Plugins/Hosted/ProxyRuntimeObject.mm:

Source/WebKit2:

  • WebProcess/Plugins/Netscape/JSNPMethod.cpp:
  • WebProcess/Plugins/Netscape/JSNPObject.cpp:
File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/jsc.cpp

    r216699 r217031  
    590590
    591591#if ENABLE(JIT)
    592     static Ref<DOMJIT::Patchpoint> checkDOMJITNode()
     592    static RefPtr<DOMJIT::Patchpoint> checkSubClassPatchpoint()
    593593    {
    594594        Ref<DOMJIT::Patchpoint> patchpoint = DOMJIT::Patchpoint::create();
     
    601601            return failureCases;
    602602        });
    603         return patchpoint;
     603        return WTFMove(patchpoint);
    604604    }
    605605#endif
     
    654654
    655655#if ENABLE(JIT)
    656         Ref<DOMJIT::Patchpoint> checkDOM() override
    657         {
    658             return DOMJITNode::checkDOMJITNode();
    659         }
    660 
    661656        static EncodedJSValue JIT_OPERATION slowCall(ExecState* exec, void* pointer)
    662657        {
     
    739734
    740735#if ENABLE(JIT)
    741         Ref<DOMJIT::Patchpoint> checkDOM() override
    742         {
    743             return DOMJITNode::checkDOMJITNode();
    744         }
    745 
    746736        static EncodedJSValue JIT_OPERATION slowCall(ExecState* exec, void* pointer)
    747737        {
     
    857847    }
    858848
    859 #if ENABLE(JIT)
    860849    static EncodedJSValue JIT_OPERATION unsafeFunction(ExecState* exec, DOMJITNode* node)
    861850    {
     
    864853    }
    865854
    866     static Ref<DOMJIT::Patchpoint> checkDOMJITNode()
     855#if ENABLE(JIT)
     856    static RefPtr<DOMJIT::Patchpoint> checkSubClassPatchpoint()
    867857    {
    868858        static const double value = 42.0;
     
    879869            return failureCases;
    880870        });
    881         return patchpoint;
     871        return WTFMove(patchpoint);
    882872    }
    883873#endif
     
    887877};
    888878
     879static const DOMJIT::Signature DOMJITFunctionObjectSignature((uintptr_t)DOMJITFunctionObject::unsafeFunction, DOMJITFunctionObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
     880
     881void DOMJITFunctionObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
     882{
     883    Base::finishCreation(vm);
     884    putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, &DOMJITFunctionObjectSignature, ReadOnly);
     885}
     886
     887class DOMJITCheckSubClassObject : public DOMJITNode {
     888public:
     889    DOMJITCheckSubClassObject(VM& vm, Structure* structure)
     890        : Base(vm, structure)
     891    {
     892    }
     893
     894    DECLARE_INFO;
     895    typedef DOMJITNode Base;
     896    static const unsigned StructureFlags = Base::StructureFlags;
     897
     898
     899    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     900    {
     901        return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());
     902    }
     903
     904    static DOMJITCheckSubClassObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     905    {
     906        DOMJITCheckSubClassObject* object = new (NotNull, allocateCell<DOMJITCheckSubClassObject>(vm.heap, sizeof(DOMJITCheckSubClassObject))) DOMJITCheckSubClassObject(vm, structure);
     907        object->finishCreation(vm, globalObject);
     908        return object;
     909    }
     910
     911    static EncodedJSValue JSC_HOST_CALL safeFunction(ExecState* exec)
     912    {
     913        VM& vm = exec->vm();
     914        auto scope = DECLARE_THROW_SCOPE(vm);
     915
     916        auto* thisObject = jsDynamicCast<DOMJITCheckSubClassObject*>(vm, exec->thisValue());
     917        if (!thisObject)
     918            return throwVMTypeError(exec, scope);
     919        return JSValue::encode(jsNumber(thisObject->value()));
     920    }
     921
     922    static EncodedJSValue JIT_OPERATION unsafeFunction(ExecState* exec, DOMJITNode* node)
     923    {
     924        NativeCallFrameTracer tracer(&exec->vm(), exec);
     925        return JSValue::encode(jsNumber(node->value()));
     926    }
     927
     928private:
     929    void finishCreation(VM&, JSGlobalObject*);
     930};
     931
     932static const DOMJIT::Signature DOMJITCheckSubClassObjectSignature((uintptr_t)DOMJITCheckSubClassObject::unsafeFunction, DOMJITCheckSubClassObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
     933
     934void DOMJITCheckSubClassObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
     935{
     936    Base::finishCreation(vm);
     937    putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, &DOMJITCheckSubClassObjectSignature, ReadOnly);
     938}
     939
     940const ClassInfo Element::s_info = { "Element", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(Element) };
     941const ClassInfo Masquerader::s_info = { "Masquerader", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(Masquerader) };
     942const ClassInfo Root::s_info = { "Root", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(Root) };
     943const ClassInfo ImpureGetter::s_info = { "ImpureGetter", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(ImpureGetter) };
     944const ClassInfo CustomGetter::s_info = { "CustomGetter", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(CustomGetter) };
    889945#if ENABLE(JIT)
    890 static const DOMJIT::Signature DOMJITFunctionObjectSignature((uintptr_t)DOMJITFunctionObject::unsafeFunction, DOMJITFunctionObject::checkDOMJITNode, DOMJITFunctionObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
    891 #endif
    892 
    893 void DOMJITFunctionObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
    894 {
    895     Base::finishCreation(vm);
     946const ClassInfo DOMJITNode::s_info = { "DOMJITNode", &Base::s_info, nullptr, &DOMJITNode::checkSubClassPatchpoint, CREATE_METHOD_TABLE(DOMJITNode) };
     947#else
     948const ClassInfo DOMJITNode::s_info = { "DOMJITNode", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(DOMJITNode) };
     949#endif
     950const ClassInfo DOMJITGetter::s_info = { "DOMJITGetter", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(DOMJITGetter) };
     951const ClassInfo DOMJITGetterComplex::s_info = { "DOMJITGetterComplex", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(DOMJITGetterComplex) };
    896952#if ENABLE(JIT)
    897     putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, &DOMJITFunctionObjectSignature, ReadOnly);
     953const ClassInfo DOMJITFunctionObject::s_info = { "DOMJITFunctionObject", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(DOMJITFunctionObject) };
    898954#else
    899     putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, nullptr, ReadOnly);
    900 #endif
    901 }
    902 
    903 
    904 const ClassInfo Element::s_info = { "Element", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Element) };
    905 const ClassInfo Masquerader::s_info = { "Masquerader", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Masquerader) };
    906 const ClassInfo Root::s_info = { "Root", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Root) };
    907 const ClassInfo ImpureGetter::s_info = { "ImpureGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(ImpureGetter) };
    908 const ClassInfo CustomGetter::s_info = { "CustomGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(CustomGetter) };
    909 const ClassInfo DOMJITNode::s_info = { "DOMJITNode", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITNode) };
    910 const ClassInfo DOMJITGetter::s_info = { "DOMJITGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITGetter) };
    911 const ClassInfo DOMJITGetterComplex::s_info = { "DOMJITGetterComplex", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITGetterComplex) };
    912 const ClassInfo DOMJITFunctionObject::s_info = { "DOMJITFunctionObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITFunctionObject) };
    913 const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &Base::s_info, nullptr, CREATE_METHOD_TABLE(RuntimeArray) };
    914 const ClassInfo SimpleObject::s_info = { "SimpleObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(SimpleObject) };
     955const ClassInfo DOMJITFunctionObject::s_info = { "DOMJITFunctionObject", &Base::s_info, nullptr, &DOMJITFunctionObject::checkSubClassPatchpoint, CREATE_METHOD_TABLE(DOMJITFunctionObject) };
     956#endif
     957const ClassInfo DOMJITCheckSubClassObject::s_info = { "DOMJITCheckSubClassObject", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(DOMJITCheckSubClassObject) };
     958const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(RuntimeArray) };
     959const ClassInfo SimpleObject::s_info = { "SimpleObject", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(SimpleObject) };
    915960static unsigned asyncTestPasses { 0 };
    916961static unsigned asyncTestExpectedPasses { 0 };
     
    10041049static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterComplexObject(ExecState*);
    10051050static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITFunctionObject(ExecState*);
     1051static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITCheckSubClassObject(ExecState*);
    10061052static EncodedJSValue JSC_HOST_CALL functionCreateBuiltin(ExecState*);
    10071053static EncodedJSValue JSC_HOST_CALL functionCreateGlobalObject(ExecState*);
     
    13191365        addFunction(vm, "createDOMJITGetterComplexObject", functionCreateDOMJITGetterComplexObject, 0);
    13201366        addFunction(vm, "createDOMJITFunctionObject", functionCreateDOMJITFunctionObject, 0);
     1367        addFunction(vm, "createDOMJITCheckSubClassObject", functionCreateDOMJITCheckSubClassObject, 0);
    13211368        addFunction(vm, "createBuiltin", functionCreateBuiltin, 2);
    13221369        addFunction(vm, "createGlobalObject", functionCreateGlobalObject, 0);
     
    14271474};
    14281475
    1429 const ClassInfo GlobalObject::s_info = { "global", &JSGlobalObject::s_info, nullptr, CREATE_METHOD_TABLE(GlobalObject) };
     1476const ClassInfo GlobalObject::s_info = { "global", &JSGlobalObject::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(GlobalObject) };
    14301477const GlobalObjectMethodTable GlobalObject::s_globalObjectMethodTable = {
    14311478    &supportsRichSourceInfo,
     
    20022049}
    20032050
     2051EncodedJSValue JSC_HOST_CALL functionCreateDOMJITCheckSubClassObject(ExecState* exec)
     2052{
     2053    JSLockHolder lock(exec);
     2054    Structure* structure = DOMJITCheckSubClassObject::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
     2055    DOMJITCheckSubClassObject* result = DOMJITCheckSubClassObject::create(exec->vm(), exec->lexicalGlobalObject(), structure);
     2056    return JSValue::encode(result);
     2057}
     2058
    20042059EncodedJSValue JSC_HOST_CALL functionSetImpureGetterDelegate(ExecState* exec)
    20052060{
Note: See TracChangeset for help on using the changeset viewer.