Changeset 223919 in webkit for trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

Timestamp:

Oct 24, 2017, 1:48:03 PM (8 years ago)

Author:

Yusuke Suzuki

Message:

[FTL] Support NewStringObject
​https://bugs.webkit.org/show_bug.cgi?id=178737

Reviewed by Saam Barati.

JSTests:

• stress/new-string-object.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

FTL should support NewStringObject and encourage use of NewStringObject in DFG pipeline.
After this change, we can convert CallObjectConstructor(String) to NewStringObject(String).

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):

File:

• trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -801 +801 @@
             compileNewObject();
             break;
+        case NewStringObject:
+            compileNewStringObject();
+            break;
         case NewArray:
             compileNewArray();
@@ -4903 +4906 @@
         setJSValue(allocateObject(m_node->structure()));
         mutatorFence();
+    }
+
+    void compileNewStringObject()
+    {
+        RegisteredStructure structure = m_node->structure();
+        LValue string = lowString(m_node->child1());
+
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowCase);
+
+        LValue fastResultValue = allocateObject<StringObject>(structure, m_out.intPtrZero, slowCase);
+        m_out.storePtr(m_out.constIntPtr(StringObject::info()), fastResultValue, m_heaps.JSDestructibleObject_classInfo);
+        m_out.store64(string, fastResultValue, m_heaps.JSWrapperObject_internalValue);
+        mutatorFence();
+        ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowCase, continuation);
+        VM& vm = this->vm();
+        LValue slowResultValue = lazySlowPath(
+            [=, &vm] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(vm,
+                    operationNewStringObject, locations[0].directGPR(), locations[1].directGPR(),
+                    CCallHelpers::TrustedImmPtr(structure.get()));
+            },
+            string);
+        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
     }