Changeset 252680 in webkit for trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Timestamp:

Nov 19, 2019, 7:41:57 PM (6 years ago)

Author:

[email protected]

Message:

[ESNext][BigInt] Add support for op_inc
​https://bugs.webkit.org/show_bug.cgi?id=193240

Reviewed by Yusuke Suzuki.

JSTests:

Some parts of these tests are inspired by tests in a WIP patch by Caio Lima.
Thanks to him for allowing their reuse.

• stress/inc-osr-exit-from-big-int.js: Added.

(let.assert.sameValue):
(postInc):
(preInc):
(postDec):
(preDec):

• stress/inc-osr-exit-to-big-int.js: Added.

(let.assert.sameValue):
(postInc):
(preInc):
(postDec):
(preDec):
(o.valueOf):

Source/JavaScriptCore:

This patch adds support for both ++ and -- on BigInts.

It required the following secondary changes:

• teaching FixupPhase how to replace it by ArithAdd/ArithSub/ValueAdd/ValueSub when the type is Int32/Double/BigInt
• pulling ObservedResults out of UnaryArithProfile/BinaryArithProfile, so that it can be used by ArithAdd regardless of whether it comes from an Inc or from an Add
• adding the constant 1n to the VM object so that it can be used by FixupPhase since it cannot allocate a new JSValue.
• adding an UnaryArithProfile to op_inc and op_dec, and teaching the llint to update them.
• adding ToNumeric (identity on bigints, same as toNumber on everything else) to all tiers

• bytecode/ArithProfile.cpp:

(JSC::ArithProfile<BitfieldType>::shouldEmitSetDouble const):
(JSC::ArithProfile<BitfieldType>::emitSetDouble const):
(JSC::ArithProfile<BitfieldType>::shouldEmitSetNonNumeric const):
(JSC::ArithProfile<BitfieldType>::shouldEmitSetBigInt const):
(JSC::ArithProfile<BitfieldType>::emitSetNonNumeric const):
(JSC::ArithProfile<BitfieldType>::emitSetBigInt const):

• bytecode/ArithProfile.h:

(JSC::ObservedResults::ObservedResults):
(JSC::ObservedResults::didObserveNonInt32):
(JSC::ObservedResults::didObserveDouble):
(JSC::ObservedResults::didObserveNonNegZeroDouble):
(JSC::ObservedResults::didObserveNegZeroDouble):
(JSC::ObservedResults::didObserveNonNumeric):
(JSC::ObservedResults::didObserveBigInt):
(JSC::ObservedResults::didObserveInt32Overflow):
(JSC::ObservedResults::didObserveInt52Overflow):
(JSC::ArithProfile::observedResults const):
(JSC::ArithProfile::didObserveNonInt32 const):
(JSC::ArithProfile::didObserveDouble const):
(JSC::ArithProfile::didObserveNonNegZeroDouble const):
(JSC::ArithProfile::didObserveNegZeroDouble const):
(JSC::ArithProfile::didObserveNonNumeric const):
(JSC::ArithProfile::didObserveBigInt const):
(JSC::ArithProfile::didObserveInt32Overflow const):
(JSC::ArithProfile::didObserveInt52Overflow const):
(JSC::ArithProfile::setObservedNonNegZeroDouble):
(JSC::ArithProfile::setObservedNegZeroDouble):
(JSC::ArithProfile::setObservedNonNumeric):
(JSC::ArithProfile::setObservedBigInt):
(JSC::ArithProfile::setObservedInt32Overflow):
(JSC::ArithProfile::setObservedInt52Overflow):
(JSC::ArithProfile::observeResult):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeIndex):
(JSC::computeDefsForBytecodeIndex):

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::unaryArithProfileForPC):

• bytecode/ExitKind.h:
• bytecode/SpeculatedType.h:

(JSC::isInt32SpeculationForArithmetic):
(JSC::isInt32OrBooleanSpeculationForArithmetic):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitUnaryOp):
(JSC::BytecodeGenerator::emitToNumeric):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::emitPostIncOrDec):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGBackwardsPropagationPhase.cpp:

(JSC::DFG::BackwardsPropagationPhase::propagate):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupToNumeric):

• dfg/DFGMayExit.cpp:
• dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):

• dfg/DFGNodeType.h:
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileIncOrDec):
(JSC::DFG::SpeculativeJIT::compileToPrimitive):
(JSC::DFG::SpeculativeJIT::compileToNumeric):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileIncOrDec):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

• jit/JIT.h:
• jit/JITMathIC.h:

(JSC::JITMathIC::generateInline):

• jit/JITMulGenerator.cpp:

(JSC::JITMulGenerator::generateFastPath):

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_to_numeric):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_to_numeric):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/CommonSlowPaths.h:
• runtime/JSBigInt.cpp:

(JSC::JSBigInt::inc):
(JSC::JSBigInt::dec):

• runtime/JSBigInt.h:
• runtime/VM.cpp:

(JSC::VM::VM):

• runtime/VM.h:

File:

• trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -947 +947 @@
         case ArithSub:
         case ValueAdd: {
-            BinaryArithProfile* arithProfile = m_inlineStackTop->m_profiledBlock->binaryArithProfileForBytecodeIndex(m_currentIndex);
-            if (!arithProfile)
+            ObservedResults observed;
+            if (BinaryArithProfile* arithProfile = m_inlineStackTop->m_profiledBlock->binaryArithProfileForBytecodeIndex(m_currentIndex))
+                observed = arithProfile->observedResults();
+            else if (UnaryArithProfile* arithProfile = m_inlineStackTop->m_profiledBlock->unaryArithProfileForBytecodeIndex(m_currentIndex)) {
+                // Happens for OpInc/OpDec
+                observed = arithProfile->observedResults();
+            } else
                 break;
-            if (arithProfile->didObserveDouble())
+
+            if (observed.didObserveDouble())
                 node->mergeFlags(NodeMayHaveDoubleResult);
-            if (arithProfile->didObserveNonNumeric())
+            if (observed.didObserveNonNumeric())
                 node->mergeFlags(NodeMayHaveNonNumericResult);
-            if (arithProfile->didObserveBigInt())
+            if (observed.didObserveBigInt())
                 node->mergeFlags(NodeMayHaveBigIntResult);
             break;
@@ -978 +984 @@
         }
         case ValueNegate:
-        case ArithNegate: {
+        case ArithNegate:
+        case Inc:
+        case Dec: {
             UnaryArithProfile* arithProfile = m_inlineStackTop->m_profiledBlock->unaryArithProfileForBytecodeIndex(m_currentIndex);
             if (!arithProfile)
@@ -5216 +5224 @@
             auto bytecode = currentInstruction->as<OpInc>();
             Node* op = get(bytecode.m_srcDst);
-            set(bytecode.m_srcDst, makeSafe(addToGraph(ArithAdd, op, addToGraph(JSConstant, OpInfo(m_constantOne)))));
+            // FIXME: we can replace the Inc by either ArithAdd with m_constantOne or ArithAdd with the equivalent BigInt in many cases.
+            // For now we only do so in DFGFixupPhase.
+            // We could probably do it earlier in some cases, but it is not clearly worth the trouble.
+            set(bytecode.m_srcDst, makeSafe(addToGraph(Inc, op)));
             NEXT_OPCODE(op_inc);
         }
@@ -5223 +5234 @@
             auto bytecode = currentInstruction->as<OpDec>();
             Node* op = get(bytecode.m_srcDst);
-            set(bytecode.m_srcDst, makeSafe(addToGraph(ArithSub, op, addToGraph(JSConstant, OpInfo(m_constantOne)))));
+            // FIXME: we can replace the Inc by either ArithSub with m_constantOne or ArithSub with the equivalent BigInt in many cases.
+            // For now we only do so in DFGFixupPhase.
+            // We could probably do it earlier in some cases, but it is not clearly worth the trouble.
+            set(bytecode.m_srcDst, makeSafe(addToGraph(Dec, op)));
             NEXT_OPCODE(op_dec);
         }
@@ -6972 +6986 @@
         }
 
+        case op_to_numeric: {
+            auto bytecode = currentInstruction->as<OpToNumeric>();
+            SpeculatedType prediction = getPrediction();
+            Node* value = get(bytecode.m_operand);
+            set(bytecode.m_dst, addToGraph(ToNumeric, OpInfo(0), OpInfo(prediction), value));
+            NEXT_OPCODE(op_to_numeric);
+        }
+
         case op_to_string: {
             auto bytecode = currentInstruction->as<OpToString>();