Changeset 223523 in webkit for trunk/Source/JavaScriptCore/dfg


Ignore:
Timestamp:
Oct 17, 2017, 5:02:01 AM (8 years ago)
Author:
Yusuke Suzuki
Message:

[JSC] proto getter should be fast
​https://bugs.webkit.org/show_bug.cgi?id=178067

Reviewed by Saam Barati.

JSTests:

  • stress/dfg-object-proto-accessor.js: Added.

(shouldBe):
(shouldThrow):
(target):

  • stress/dfg-object-proto-getter.js: Added.

(shouldBe):
(shouldThrow):
(target):

  • stress/dfg-object-prototype-of.js: Added.

(shouldBe):
(shouldThrow):
(target):

  • stress/dfg-reflect-get-prototype-of.js: Added.

(shouldBe):
(shouldThrow):
(target):

  • stress/object-get-prototype-of-filtered.js: Added.

(shouldBe):
(shouldThrow):
(target):
(i.Cocoa):

  • stress/object-get-prototype-of-mono-proto.js: Added.

(shouldBe):
(makePolyProtoObject.foo.C):
(makePolyProtoObject.foo):
(makePolyProtoObject):
(target):

  • stress/object-get-prototype-of-poly-mono-proto.js: Added.

(shouldBe):
(makePolyProtoObject.foo.C):
(makePolyProtoObject.foo):
(makePolyProtoObject):
(target):

  • stress/object-get-prototype-of-poly-proto.js: Added.

(shouldBe):
(makePolyProtoObject.foo.C):
(makePolyProtoObject.foo):
(makePolyProtoObject):
(target):

  • stress/object-proto-getter-filtered.js: Added.

(shouldBe):
(shouldThrow):
(target):
(i.Cocoa):

  • stress/object-proto-getter-poly-mono-proto.js: Added.

(shouldBe):
(makePolyProtoObject.foo.C):
(makePolyProtoObject.foo):
(makePolyProtoObject):
(target):

  • stress/object-proto-getter-poly-proto.js: Added.

(shouldBe):
(makePolyProtoObject.foo.C):
(makePolyProtoObject.foo):
(makePolyProtoObject):
(target):

  • stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
  • stress/string-proto.js: Added.

(shouldBe):
(target):

Source/JavaScriptCore:

In our ES6 class implementation, we access proto field to retrieve super constructor.
Currently, it is handled as an usual getter call to a generic function. And DFG just emits
Call node for this. It is inefficient since typically we know the prototype of the given
object when accessing object.__proto__ since we emit CheckStructure for this object.
If Structure has mono proto, we can immediately fold it to constant value. If it is poly proto,
we can still change this to efficient access to poly proto slot.

This patch implements GetPrototypeOf DFG node. This node efficiently accesses to prototype of
the given object. And in AI and ByteCodeParser phase, we attempt to fold it to constant.
ByteCodeParser's folding is a bit important since we have callee.__proto__ code to get super
constructor. If we can change this to constant, we can reify CallLinkInfo with this constant.
This paves the way to optimizing ArrayConstructor super calls[1], which is particularly important
for ARES-6 ML.

And we also optimize Reflect.getPrototypeOf and Object.getPrototypeOf with this GetPrototypeOf node.

Currently, proto access for poly proto object is not handled well in IC. But we add code handling
poly proto in GetPrototypeOf since Reflect.getPrototypeOf and Object.getPrototypeOf can use it.
Once IC starts handling poly proto & intrinsic getter well, this code will be used for that too.

This patch improves SixSpeed super.es6 by 3.42x.

baseline patched

super.es6 123.6666+-3.9917 36.1684+-1.0351 definitely 3.4192x faster

[1]: ​https://bugs.webkit.org/show_bug.cgi?id=178064

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
(JSC::DFG::ByteCodeParser::handleGetById):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupGetPrototypeOf):

  • dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

  • dfg/DFGHeapLocation.h:
  • dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::shouldSpeculateFunction):

  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:
  • dfg/DFGOperations.h:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculateFunction):
(JSC::DFG::SpeculativeJIT::speculateFinalObject):
(JSC::DFG::SpeculativeJIT::compileGetPrototypeOf):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetPrototypeOf):
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):

  • jit/IntrinsicEmitter.cpp:

(JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter):
(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):

  • runtime/Intrinsic.cpp:

(JSC::intrinsicName):

  • runtime/Intrinsic.h:
  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

  • runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):

  • runtime/JSGlobalObjectFunctions.h:
  • runtime/ObjectConstructor.cpp:
  • runtime/ReflectObject.cpp:

LayoutTests:

  • js/object-literal-shorthand-construction-expected.txt:
  • js/script-tests/object-literal-shorthand-construction.js:

(set 2):
(get 1):

  • js/script-tests/sloppy-getter-setter-global-object.js:
  • js/sloppy-getter-setter-global-object-expected.txt:
Location:
trunk/Source/JavaScriptCore/dfg
Files:
17 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r223318 r223523  
    27412741        break;
    27422742    }
     2743
     2744    case GetPrototypeOf: {
     2745        AbstractValue& value = forNode(node->child1());
     2746        if ((value.m_type && !(value.m_type & ~SpecObject)) && value.m_structure.isFinite()) {
     2747            bool canFold = !value.m_structure.isClear();
     2748            JSValue prototype;
     2749            value.m_structure.forEach([&] (RegisteredStructure structure) {
     2750                auto getPrototypeMethod = structure->classInfo()->methodTable.getPrototype;
     2751                MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
     2752                if (getPrototypeMethod != defaultGetPrototype) {
     2753                    canFold = false;
     2754                    return;
     2755                }
     2756
     2757                if (structure->hasPolyProto()) {
     2758                    canFold = false;
     2759                    return;
     2760                }
     2761                if (!prototype)
     2762                    prototype = structure->storedPrototype();
     2763                else if (prototype != structure->storedPrototype())
     2764                    canFold = false;
     2765            });
     2766
     2767            if (prototype && canFold) {
     2768                setConstant(node, *m_graph.freeze(prototype));
     2769                break;
     2770            }
     2771        }
     2772
     2773        switch (node->child1().useKind()) {
     2774        case ArrayUse:
     2775        case FunctionUse:
     2776        case FinalObjectUse:
     2777            break;
     2778        default:
     2779            clobberWorld(node->origin.semantic, clobberLimit);
     2780            break;
     2781        }
     2782        forNode(node).setType(m_graph, SpecObject | SpecOther);
     2783        break;
     2784    }
    27432785       
    27442786    case GetByOffset: {

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r223318 r223523  
    239239    bool handleDOMJITCall(Node* callee, int resultOperand, const DOMJIT::Signature*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks);
    240240    template<typename ChecksFunctor>
    241     bool handleIntrinsicGetter(int resultOperand, const GetByIdVariant& intrinsicVariant, Node* thisNode, const ChecksFunctor& insertChecks);
     241    bool handleIntrinsicGetter(int resultOperand, SpeculatedType prediction, const GetByIdVariant& intrinsicVariant, Node* thisNode, const ChecksFunctor& insertChecks);
    242242    template<typename ChecksFunctor>
    243243    bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);
    … …  
    26002600    }
    26012601
     2602    case ObjectGetPrototypeOfIntrinsic: {
     2603        if (argumentCountIncludingThis != 2)
     2604            return false;
     2605
     2606        insertChecks();
     2607        set(VirtualRegister(resultOperand), addToGraph(GetPrototypeOf, OpInfo(0), OpInfo(prediction), get(virtualRegisterForArgument(1, registerOffset))));
     2608        return true;
     2609    }
     2610
     2611    case ReflectGetPrototypeOfIntrinsic: {
     2612        if (argumentCountIncludingThis != 2)
     2613            return false;
     2614
     2615        insertChecks();
     2616        set(VirtualRegister(resultOperand), addToGraph(GetPrototypeOf, OpInfo(0), OpInfo(prediction), Edge(get(virtualRegisterForArgument(1, registerOffset)), ObjectUse)));
     2617        return true;
     2618    }
     2619
    26022620    case IsTypedArrayViewIntrinsic: {
    26032621        ASSERT(argumentCountIncludingThis == 2);
    … …  
    29472965
    29482966template<typename ChecksFunctor>
    2949 bool ByteCodeParser::handleIntrinsicGetter(int resultOperand, const GetByIdVariant& variant, Node* thisNode, const ChecksFunctor& insertChecks)
     2967bool ByteCodeParser::handleIntrinsicGetter(int resultOperand, SpeculatedType prediction, const GetByIdVariant& variant, Node* thisNode, const ChecksFunctor& insertChecks)
    29502968{
    29512969    switch (variant.intrinsic()) {
    … …  
    30113029        set(VirtualRegister(resultOperand), addToGraph(GetTypedArrayByteOffset, OpInfo(ArrayMode(arrayType).asWord()), thisNode));
    30123030
     3031        return true;
     3032    }
     3033
     3034    case UnderscoreProtoIntrinsic: {
     3035        insertChecks();
     3036
     3037        bool canFold = !variant.structureSet().isEmpty();
     3038        JSValue prototype;
     3039        variant.structureSet().forEach([&] (Structure* structure) {
     3040            auto getPrototypeMethod = structure->classInfo()->methodTable.getPrototype;
     3041            MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
     3042            if (getPrototypeMethod != defaultGetPrototype) {
     3043                canFold = false;
     3044                return;
     3045            }
     3046
     3047            if (structure->hasPolyProto()) {
     3048                canFold = false;
     3049                return;
     3050            }
     3051            if (!prototype)
     3052                prototype = structure->storedPrototype();
     3053            else if (prototype != structure->storedPrototype())
     3054                canFold = false;
     3055        });
     3056
     3057        // OK, only one prototype is found. We perform constant folding here.
     3058        // This information is important for super's constructor call to get new.target constant.
     3059        if (prototype && canFold) {
     3060            set(VirtualRegister(resultOperand), weakJSConstant(prototype));
     3061            return true;
     3062        }
     3063
     3064        set(VirtualRegister(resultOperand), addToGraph(GetPrototypeOf, OpInfo(0), OpInfo(prediction), thisNode));
    30133065        return true;
    30143066    }
    … …  
    37973849    Node* getter = addToGraph(GetGetter, loadedValue);
    37983850
    3799     if (handleIntrinsicGetter(destinationOperand, variant, base,
     3851    if (handleIntrinsicGetter(destinationOperand, prediction, variant, base,
    38003852            [&] () {
    38013853                addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter);

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r223318 r223523  
    11151115        def(HeapLocation(TypedArrayByteOffsetLoc, MiscFields, node->child1()), LazyNode(node));
    11161116        return;
     1117
     1118    case GetPrototypeOf: {
     1119        switch (node->child1().useKind()) {
     1120        case ArrayUse:
     1121        case FunctionUse:
     1122        case FinalObjectUse:
     1123            read(JSCell_structureID);
     1124            read(JSObject_butterfly);
     1125            read(NamedProperties); // Poly proto could load prototype from its slot.
     1126            def(HeapLocation(PrototypeLoc, NamedProperties, node->child1()), LazyNode(node));
     1127            return;
     1128        default:
     1129            read(World);
     1130            write(Heap);
     1131            return;
     1132        }
     1133    }
    11171134       
    11181135    case GetByOffset:

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r223318 r223523  
    239239    case StringCharCodeAt:
    240240    case GetTypedArrayByteOffset:
     241    case GetPrototypeOf:
    241242    case PutByValDirect:
    242243    case PutByVal:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r223318 r223523  
    16011601            fixEdge<Int32Use>(node->child1());
    16021602            fixEdge<Int32Use>(node->child2());
     1603            break;
     1604        }
     1605
     1606        case GetPrototypeOf: {
     1607            fixupGetPrototypeOf(node);
    16031608            break;
    16041609        }
    … …  
    23032308    }
    23042309
     2310    void fixupGetPrototypeOf(Node* node)
     2311    {
     2312        // Reflect.getPrototypeOf only accepts Objects. For Reflect.getPrototypeOf, ByteCodeParser attaches ObjectUse edge filter before fixup phase.
     2313        if (node->child1().useKind() != ObjectUse) {
     2314            if (node->child1()->shouldSpeculateString()) {
     2315                insertCheck<StringUse>(node->child1().node());
     2316                m_graph.convertToConstant(node, m_graph.freeze(m_graph.globalObjectFor(node->origin.semantic)->stringPrototype()));
     2317                return;
     2318            }
     2319            if (node->child1()->shouldSpeculateInt32()) {
     2320                insertCheck<Int32Use>(node->child1().node());
     2321                m_graph.convertToConstant(node, m_graph.freeze(m_graph.globalObjectFor(node->origin.semantic)->numberPrototype()));
     2322                return;
     2323            }
     2324            if (enableInt52() && node->child1()->shouldSpeculateAnyInt()) {
     2325                insertCheck<Int52RepUse>(node->child1().node());
     2326                m_graph.convertToConstant(node, m_graph.freeze(m_graph.globalObjectFor(node->origin.semantic)->numberPrototype()));
     2327                return;
     2328            }
     2329            if (node->child1()->shouldSpeculateNumber()) {
     2330                insertCheck<NumberUse>(node->child1().node());
     2331                m_graph.convertToConstant(node, m_graph.freeze(m_graph.globalObjectFor(node->origin.semantic)->numberPrototype()));
     2332                return;
     2333            }
     2334            if (node->child1()->shouldSpeculateSymbol()) {
     2335                insertCheck<SymbolUse>(node->child1().node());
     2336                m_graph.convertToConstant(node, m_graph.freeze(m_graph.globalObjectFor(node->origin.semantic)->symbolPrototype()));
     2337                return;
     2338            }
     2339            if (node->child1()->shouldSpeculateBoolean()) {
     2340                insertCheck<BooleanUse>(node->child1().node());
     2341                m_graph.convertToConstant(node, m_graph.freeze(m_graph.globalObjectFor(node->origin.semantic)->booleanPrototype()));
     2342                return;
     2343            }
     2344        }
     2345
     2346        if (node->child1()->shouldSpeculateFinalObject()) {
     2347            fixEdge<FinalObjectUse>(node->child1());
     2348            node->clearFlags(NodeMustGenerate);
     2349            return;
     2350        }
     2351        if (node->child1()->shouldSpeculateArray()) {
     2352            fixEdge<ArrayUse>(node->child1());
     2353            node->clearFlags(NodeMustGenerate);
     2354            return;
     2355        }
     2356        if (node->child1()->shouldSpeculateFunction()) {
     2357            fixEdge<FunctionUse>(node->child1());
     2358            node->clearFlags(NodeMustGenerate);
     2359            return;
     2360        }
     2361    }
     2362
    23052363    void fixupToThis(Node* node)
    23062364    {

  • trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp

    r221959 r223523  
    152152        out.print("TypedArrayByteOffsetLoc");
    153153        return;
     154
     155    case PrototypeLoc:
     156        out.print("PrototypeLoc");
     157        return;
    154158       
    155159    case StructureLoc:

  • trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h

    r221959 r223523  
    6161    StructureLoc,
    6262    TypedArrayByteOffsetLoc,
     63    PrototypeLoc,
    6364    StackLoc,
    6465    StackPayloadLoc,

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r222384 r223523  
    15491549        case GetByIdFlush:
    15501550        case GetByIdWithThis:
     1551        case GetPrototypeOf:
    15511552        case TryGetById:
    15521553        case GetByVal:
    … …  
    23122313    }
    23132314
     2315    bool shouldSpeculateFunction()
     2316    {
     2317        return isFunctionSpeculation(prediction());
     2318    }
     2319
    23142320    bool shouldSpeculateProxyObject()
    23152321    {

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r223318 r223523  
    252252    macro(CheckSubClass, NodeMustGenerate) \
    253253    macro(ParseInt, NodeMustGenerate | NodeResultJS) \
     254    macro(GetPrototypeOf, NodeMustGenerate | NodeResultJS) \
    254255    \
    255256    /* Atomics object functions. */\

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r223125 r223523  
    5353#include "JSFixedArray.h"
    5454#include "JSGenericTypedArrayViewConstructorInlines.h"
     55#include "JSGlobalObjectFunctions.h"
    5556#include "JSLexicalEnvironment.h"
    5657#include "JSMap.h"
    … …  
    25192520}
    25202521
     2522EncodedJSValue JIT_OPERATION operationGetPrototypeOfObject(ExecState* exec, JSObject* thisObject)
     2523{
     2524    VM& vm = exec->vm();
     2525    NativeCallFrameTracer tracer(&vm, exec);
     2526    return JSValue::encode(thisObject->getPrototype(vm, exec));
     2527}
     2528
     2529EncodedJSValue JIT_OPERATION operationGetPrototypeOf(ExecState* exec, EncodedJSValue encodedValue)
     2530{
     2531    VM& vm = exec->vm();
     2532    NativeCallFrameTracer tracer(&vm, exec);
     2533    auto scope = DECLARE_THROW_SCOPE(vm);
     2534
     2535    JSValue thisValue = JSValue::decode(encodedValue).toThis(exec, StrictMode);
     2536    if (thisValue.isUndefinedOrNull())
     2537        return throwVMError(exec, scope, createNotAnObjectError(exec, thisValue));
     2538
     2539    JSObject* thisObject = jsDynamicCast<JSObject*>(vm, thisValue);
     2540    if (!thisObject) {
     2541        JSObject* prototype = thisValue.synthesizePrototype(exec);
     2542        EXCEPTION_ASSERT(!!scope.exception() == !prototype);
     2543        if (UNLIKELY(!prototype))
     2544            return JSValue::encode(JSValue());
     2545        return JSValue::encode(prototype);
     2546    }
     2547
     2548    scope.release();
     2549    return JSValue::encode(thisObject->getPrototype(vm, exec));
     2550}
     2551
    25212552void JIT_OPERATION operationThrowDFG(ExecState* exec, EncodedJSValue valueToThrow)
    25222553{

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r223047 r223523  
    7878EncodedJSValue JIT_OPERATION operationGetByIdWithThis(ExecState*, EncodedJSValue, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
    7979EncodedJSValue JIT_OPERATION operationGetByValWithThis(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
     80EncodedJSValue JIT_OPERATION operationGetPrototypeOf(ExecState*, EncodedJSValue) WTF_INTERNAL;
     81EncodedJSValue JIT_OPERATION operationGetPrototypeOfObject(ExecState*, JSObject*) WTF_INTERNAL;
    8082char* JIT_OPERATION operationNewArray(ExecState*, Structure*, void*, size_t) WTF_INTERNAL;
    8183char* JIT_OPERATION operationNewArrayBuffer(ExecState*, Structure*, size_t, size_t) WTF_INTERNAL;

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r223318 r223523  
    724724        case CallDOMGetter:
    725725        case GetDynamicVar:
    726         case WeakMapGet: {
     726        case WeakMapGet:
     727        case GetPrototypeOf: {
    727728            setPrediction(m_currentNode->getHeapPrediction());
    728729            break;

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r223318 r223523  
    402402    case ForwardVarargs:
    403403    case CreateRest:
     404    case GetPrototypeOf:
    404405    case StringReplace:
    405406    case StringReplaceRegExp:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r223318 r223523  
    91879187}
    91889188
     9189void SpeculativeJIT::speculateFunction(Edge edge, GPRReg cell)
     9190{
     9191    speculateCellType(edge, cell, SpecFunction, JSFunctionType);
     9192}
     9193
    91899194void SpeculativeJIT::speculateFunction(Edge edge)
    91909195{
    … …  
    91939198   
    91949199    SpeculateCellOperand operand(this, edge);
    9195     speculateCellType(edge, operand.gpr(), SpecFunction, JSFunctionType);
     9200    speculateFunction(edge, operand.gpr());
     9201}
     9202
     9203void SpeculativeJIT::speculateFinalObject(Edge edge, GPRReg cell)
     9204{
     9205    speculateCellType(edge, cell, SpecFinalObject, FinalObjectType);
    91969206}
    91979207
    … …  
    92029212   
    92039213    SpeculateCellOperand operand(this, edge);
    9204     speculateCellType(edge, operand.gpr(), SpecFinalObject, FinalObjectType);
     9214    speculateFinalObject(edge, operand.gpr());
    92059215}
    92069216
    … …  
    1076810778}
    1076910779
     10780void SpeculativeJIT::compileGetPrototypeOf(Node* node)
     10781{
     10782    switch (node->child1().useKind()) {
     10783    case ArrayUse:
     10784    case FunctionUse:
     10785    case FinalObjectUse: {
     10786        SpeculateCellOperand object(this, node->child1());
     10787        GPRTemporary temp(this);
     10788        GPRTemporary temp2(this);
     10789
     10790        GPRReg objectGPR = object.gpr();
     10791        GPRReg tempGPR = temp.gpr();
     10792        GPRReg temp2GPR = temp2.gpr();
     10793
     10794        switch (node->child1().useKind()) {
     10795        case ArrayUse:
     10796            speculateArray(node->child1(), objectGPR);
     10797            break;
     10798        case FunctionUse:
     10799            speculateFunction(node->child1(), objectGPR);
     10800            break;
     10801        case FinalObjectUse:
     10802            speculateFinalObject(node->child1(), objectGPR);
     10803            break;
     10804        default:
     10805            RELEASE_ASSERT_NOT_REACHED();
     10806            break;
     10807        }
     10808
     10809        m_jit.emitLoadStructure(*m_jit.vm(), objectGPR, tempGPR, temp2GPR);
     10810
     10811        AbstractValue& value = m_state.forNode(node->child1());
     10812        if ((value.m_type && !(value.m_type & ~SpecObject)) && value.m_structure.isFinite()) {
     10813            bool hasPolyProto = false;
     10814            bool hasMonoProto = false;
     10815            value.m_structure.forEach([&] (RegisteredStructure structure) {
     10816                if (structure->hasPolyProto())
     10817                    hasPolyProto = true;
     10818                else
     10819                    hasMonoProto = true;
     10820            });
     10821
     10822            if (hasMonoProto && !hasPolyProto) {
     10823#if USE(JSVALUE64)
     10824                m_jit.load64(MacroAssembler::Address(tempGPR, Structure::prototypeOffset()), tempGPR);
     10825                jsValueResult(tempGPR, node);
     10826#else
     10827                m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + TagOffset), temp2GPR);
     10828                m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + PayloadOffset), tempGPR);
     10829                jsValueResult(temp2GPR, tempGPR, node);
     10830#endif
     10831                return;
     10832            }
     10833
     10834            if (hasPolyProto && !hasMonoProto) {
     10835#if USE(JSVALUE64)
     10836                m_jit.load64(MacroAssembler::Address(tempGPR, Structure::prototypeOffset()), tempGPR);
     10837                m_jit.zeroExtend32ToPtr(tempGPR, tempGPR);
     10838                m_jit.load64(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage()), tempGPR);
     10839                jsValueResult(tempGPR, node);
     10840#else
     10841                m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + PayloadOffset), tempGPR);
     10842                m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + TagOffset), temp2GPR);
     10843                m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + PayloadOffset), tempGPR);
     10844                jsValueResult(temp2GPR, tempGPR, node);
     10845#endif
     10846                return;
     10847            }
     10848        }
     10849
     10850#if USE(JSVALUE64)
     10851        m_jit.load64(MacroAssembler::Address(tempGPR, Structure::prototypeOffset()), tempGPR);
     10852        auto isMonoProto = m_jit.branchIfNotInt32(JSValueRegs(tempGPR));
     10853        m_jit.zeroExtend32ToPtr(tempGPR, tempGPR);
     10854        m_jit.load64(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage()), tempGPR);
     10855        isMonoProto.link(&m_jit);
     10856        jsValueResult(tempGPR, node);
     10857#else
     10858        m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + TagOffset), temp2GPR);
     10859        m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + PayloadOffset), tempGPR);
     10860        auto isMonoProto = m_jit.branch32(CCallHelpers::NotEqual, temp2GPR, TrustedImm32(JSValue::Int32Tag));
     10861        m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + TagOffset), temp2GPR);
     10862        m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + PayloadOffset), tempGPR);
     10863        isMonoProto.link(&m_jit);
     10864        jsValueResult(temp2GPR, tempGPR, node);
     10865#endif
     10866        return;
     10867    }
     10868    case ObjectUse: {
     10869        SpeculateCellOperand value(this, node->child1());
     10870        JSValueRegsTemporary result(this);
     10871
     10872        GPRReg valueGPR = value.gpr();
     10873        JSValueRegs resultRegs = result.regs();
     10874
     10875        speculateObject(node->child1(), valueGPR);
     10876
     10877        flushRegisters();
     10878        callOperation(operationGetPrototypeOfObject, resultRegs, valueGPR);
     10879        m_jit.exceptionCheck();
     10880        jsValueResult(resultRegs, node);
     10881        return;
     10882    }
     10883    default: {
     10884        JSValueOperand value(this, node->child1());
     10885        JSValueRegsTemporary result(this);
     10886
     10887        JSValueRegs valueRegs = value.jsValueRegs();
     10888        JSValueRegs resultRegs = result.regs();
     10889
     10890        flushRegisters();
     10891        callOperation(operationGetPrototypeOf, resultRegs, valueRegs);
     10892        m_jit.exceptionCheck();
     10893        jsValueResult(resultRegs, node);
     10894        return;
     10895    }
     10896    }
     10897}
     10898
    1077010899} } // namespace JSC::DFG
    1077110900

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r223318 r223523  
    988988        return appendCallSetResult(operation, result);
    989989    }
     990    JITCompiler::Call callOperation(J_JITOperation_EO operation, JSValueRegs result, GPRReg object)
     991    {
     992        m_jit.setupArgumentsWithExecState(object);
     993        return appendCallSetResult(operation, result);
     994    }
    990995    JITCompiler::Call callOperation(P_JITOperation_EPS operation, GPRReg result, GPRReg old, size_t size)
    991996    {
    … …  
    28362841    void compileLoadKeyFromMapBucket(Node*);
    28372842    void compileLoadValueFromMapBucket(Node*);
     2843    void compileGetPrototypeOf(Node*);
    28382844   
    28392845#if USE(JSVALUE32_64)
    … …  
    30853091    void speculateArray(Edge, GPRReg cell);
    30863092    void speculateArray(Edge);
     3093    void speculateFunction(Edge, GPRReg cell);
    30873094    void speculateFunction(Edge);
     3095    void speculateFinalObject(Edge, GPRReg cell);
    30883096    void speculateFinalObject(Edge);
    30893097    void speculateRegExpObject(Edge, GPRReg cell);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r223318 r223523  
    44334433    case GetTypedArrayByteOffset: {
    44344434        compileGetTypedArrayByteOffset(node);
     4435        break;
     4436    }
     4437
     4438    case GetPrototypeOf: {
     4439        compileGetPrototypeOf(node);
    44354440        break;
    44364441    }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r223318 r223523  
    46514651        break;
    46524652    }
     4653
     4654    case GetPrototypeOf: {
     4655        compileGetPrototypeOf(node);
     4656        break;
     4657    }
    46534658       
    46544659    case GetByOffset:
Note: See TracChangeset for help on using the changeset viewer.