Changeset 227434 in webkit for trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

Timestamp:

Jan 23, 2018, 12:39:34 PM (7 years ago)

Author:

[email protected]

Message:

Re-arrange TypedArray JSTypes to match the order of the TypedArrayType enum list.
​https://bugs.webkit.org/show_bug.cgi?id=181976
<rdar://problem/36766936>

Reviewed by Filip Pizlo.

1. The order of TypedArray JSTypes now matches the order the TypedArrayType enum list. I also added static asserts in TypedArrayType.h to enforce this.

Also redefined FOR_EACH_TYPED_ARRAY_TYPE() in terms of

2. Define 4 new values:
   1. FirstTypedArrayType
   2. LastTypedArrayType
   3. NumberOfTypedArrayTypesExcludingDataView
   4. NumberOfTypedArrayTypes

Use these everywhere where we iterate or bisect the TypedArray JSTypes.

3. Removed NUMBER_OF_TYPED_ARRAY_TYPES, and use NumberOfTypedArrayTypes instead.

4. Simplify the code that converts between TypedArrayType and JSType.

Changed typedArrayTypeForType() to be the mirror image of typeForTypedArrayType().
Previously, typedArrayTypeForType() converts DataViewType to NotTypedArray
instead of TypeDataView. Now, it converts to TypeDataView.

This does not result in any change of behavior because typedArrayTypeForType()
is only called in Structure::hasIndexingHeader(), and its result is passed to
isTypedView(), which handles TypeDataView correctly.

5. Also fixed a bug in SpeculativeJIT::compileGetTypedArrayByteOffset(). If the vector is null, we can skip the rest of the checks. While the current code does not result in incorrect behavior, it is inefficient, and communicates wrong information to the reader i.e. implying that there's something in the dataGPR when there's not. The dataGPR should also be null in this case.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::isTypedArrayView):

• ftl/FTLOSRExit.cpp:
• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::visitChildren):

• runtime/JSType.h:
• runtime/TypedArrayType.cpp:

(JSC::typeForTypedArrayType): Deleted.

• runtime/TypedArrayType.h:

(JSC::typedArrayTypeForType):
(JSC::typeForTypedArrayType):

File:

• trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (modified) (3 diffs)

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -1539 +1539 @@
     loadb JSCell::m_type[t0], t2
     subi FirstArrayType, t2
-    bia t2, LastArrayType - FirstArrayType, .opGetByValSlow
+    biaeq t2, NumberOfTypedArrayTypesExcludingDataView, .opGetByValSlow
     
     # Sweet, now we know that we have a typed array. Do some basic things now.
@@ -1545 +1545 @@
     biaeq t1, JSArrayBufferView::m_length[t0], .opGetByValSlow
     
-    # Now bisect through the various types. Note that we can treat Uint8ArrayType and
-    # Uint8ClampedArrayType the same.
-    bia t2, Uint8ClampedArrayType - FirstArrayType, .opGetByValAboveUint8ClampedArray
-    
-    # We have one of Int8ArrayType .. Uint8ClampedArrayType.
-    bia t2, Int16ArrayType - FirstArrayType, .opGetByValInt32ArrayOrUint8Array
-    
-    # We have one of Int8ArrayType or Int16ArrayType
-    bineq t2, Int8ArrayType - FirstArrayType, .opGetByValInt16Array
-    
+    # Now bisect through the various types:
+    #    Int8ArrayType,
+    #    Uint8ArrayType,
+    #    Uint8ClampedArrayType,
+    #    Int16ArrayType,
+    #    Uint16ArrayType,
+    #    Int32ArrayType,
+    #    Uint32ArrayType,
+    #    Float32ArrayType,
+    #    Float64ArrayType,
+
+    bia t2, Uint16ArrayType - FirstArrayType, .opGetByValAboveUint16Array
+
+    # We have one of Int8ArrayType .. Uint16ArrayType.
+    bia t2, Uint8ClampedArrayType - FirstArrayType, .opGetByValInt16ArrayOrUint16Array
+
+    # We have one of Int8ArrayType ... Uint8ClampedArrayType
+    bineq t2, Int8ArrayType - FirstArrayType, .opGetByValUint8ArrayOrUint8ClampedArray
+
     # We have Int8ArrayType
     loadbs [t3, t1], t0
     finishIntGetByVal(t0, t1)
 
-.opGetByValInt16Array:
+.opGetByValUint8ArrayOrUint8ClampedArray:
+    # We have either Uint8ArrayType or Uint8ClampedArrayType. They behave the same so that's cool.
+    loadb [t3, t1], t0
+    finishIntGetByVal(t0, t1)
+
+.opGetByValInt16ArrayOrUint16Array:
+    # We have either Int16ArrayType or Uint16ClampedArrayType.
+    bieq t2, Uint16ArrayType - FirstArrayType, .opGetByValUint16Array
+
+    # We have Int16ArrayType.
     loadhs [t3, t1, 2], t0
     finishIntGetByVal(t0, t1)
 
-.opGetByValInt32ArrayOrUint8Array:
-    # We have one of Int16Array, Uint8Array, or Uint8ClampedArray.
-    bieq t2, Int32ArrayType - FirstArrayType, .opGetByValInt32Array
-    
-    # We have either Uint8Array or Uint8ClampedArray. They behave the same so that's cool.
-    loadb [t3, t1], t0
-    finishIntGetByVal(t0, t1)
-
-.opGetByValInt32Array:
-    loadi [t3, t1, 4], t0
-    finishIntGetByVal(t0, t1)
-
-.opGetByValAboveUint8ClampedArray:
-    # We have one of Uint16ArrayType .. Float64ArrayType.
-    bia t2, Uint32ArrayType - FirstArrayType, .opGetByValAboveUint32Array
-    
-    # We have either Uint16ArrayType or Uint32ArrayType.
-    bieq t2, Uint32ArrayType - FirstArrayType, .opGetByValUint32Array
-
+.opGetByValUint16Array:
     # We have Uint16ArrayType.
     loadh [t3, t1, 2], t0
     finishIntGetByVal(t0, t1)
 
+.opGetByValAboveUint16Array:
+    # We have one of Int32ArrayType .. Float64ArrayType.
+    bia t2, Uint32ArrayType - FirstArrayType, .opGetByValFloat32ArrayOrFloat64Array
+
+    # We have either Int32ArrayType or Uint32ArrayType
+    bineq t2, Int32ArrayType - FirstArrayType, .opGetByValUint32Array
+
+    # We have Int32ArrayType
+    loadi [t3, t1, 4], t0
+    finishIntGetByVal(t0, t1)
+
 .opGetByValUint32Array:
+    # We have Uint32ArrayType.
     # This is the hardest part because of large unsigned values.
     loadi [t3, t1, 4], t0
@@ -1592 +1604 @@
     finishIntGetByVal(t0, t1)
 
-.opGetByValAboveUint32Array:
+.opGetByValFloat32ArrayOrFloat64Array:
     # We have one of Float32ArrayType or Float64ArrayType. Sadly, we cannot handle Float32Array
     # inline yet. That would require some offlineasm changes.