Changeset 254252 in webkit for trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Timestamp:

Jan 8, 2020, 10:07:29 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] Introduce JSArrayIterator
​https://bugs.webkit.org/show_bug.cgi?id=204043

Reviewed by Yusuke Suzuki.

JSTests:

• stress/array-iterator-materialize-at-osr-exit.js: Added.

(shouldBe):
(test):

• stress/array-iterator-materialize-one-path.js: Added.

(shouldBe):
(test):

• stress/array-iterator-materialize.js: Added.

(shouldBe):
(test):

• stress/array-iterator-sinking.js: Added.

(shouldBe):
(test):

• stress/array-iterators-next-error-messages.js:

(catch):

• stress/array-iterators-next-with-call.js:
• stress/for-of-iteration.js: Added.

(shouldBe):
(test1):
(test2):
(test3):

• stress/typedarray-functions-with-neutered.js:

(checkProtoFunc):

Source/JavaScriptCore:

This patch introduces JSArrayIterator that changes the iterator object
from a JSFinalObject to an InternalFieldsObject. This makes accessing it
much easier from C++ code and makes the iterator object smaller. It also
means that the JS code for the next function is much simpler and can *almost*
be inlined without shenanigans.

As part of this patch the keys/values/entries functions have been converted to
C++ with intrinsics since that's slightly more efficient in the LLInt/Baseline.

Lastly, this patch also add a custom ISOSubspace for JSArrayIterator objects.

• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• builtins/ArrayIteratorPrototype.js:

(next):
(globalPrivate.arrayIteratorNextHelper):
(globalPrivate.arrayIteratorValueNext): Deleted.
(globalPrivate.arrayIteratorKeyNext): Deleted.
(globalPrivate.arrayIteratorKeyValueNext): Deleted.

• builtins/ArrayPrototype.js:

(globalPrivate.ArrayIterator): Deleted.
(values): Deleted.
(keys): Deleted.
(entries): Deleted.

• builtins/TypedArrayPrototype.js:

(values): Deleted.
(keys): Deleted.
(entries): Deleted.

• bytecode/BytecodeIntrinsicRegistry.cpp:

(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):

• bytecode/BytecodeIntrinsicRegistry.h:
• bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitIsArrayIterator):

• bytecompiler/NodesCodegen.cpp:

(JSC::arrayIteratorInternalFieldIndex):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_getArrayIteratorInternalField):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_putArrayIteratorInternalField):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isGenerator): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isAsyncGenerator): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isJSArray): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isPromise): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isProxyObject): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isRegExpObject): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isObject): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isDerivedArray): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isMap): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isSet): Deleted.
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isUndefinedOrNull): Deleted.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

• dfg/DFGHeapLocation.h:
• dfg/DFGMayExit.cpp:
• dfg/DFGNode.h:

(JSC::DFG::Node::convertToPhantomNewObject):
(JSC::DFG::Node::convertToPhantomNewArrayIterator):
(JSC::DFG::Node::convertToPhantomCreateActivation):
(JSC::DFG::Node::hasStructure):
(JSC::DFG::Node::hasObjectMaterializationData):
(JSC::DFG::Node::isPhantomAllocation):

• dfg/DFGNodeType.h:
• dfg/DFGObjectAllocationSinkingPhase.cpp:
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGPromotedHeapLocation.cpp:

(WTF::printInternal):

• dfg/DFGPromotedHeapLocation.h:

(JSC::DFG::PromotedLocationDescriptor::neededForMaterialization const):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCheckNeutered):
(JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor):
(JSC::DFG::SpeculativeJIT::compileNewInternalFieldObject):
(JSC::DFG::SpeculativeJIT::compileNewArrayIterator):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStoreBarrierInsertionPhase.cpp:
• dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):

• dfg/DFGValidate.cpp:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileToObjectOrCallObjectConstructor):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckArray):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckNeutered):
(JSC::FTL::DFG::LowerDFGToB3::compileNewInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileNewArrayIterator):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewInternalFieldObjectImpl):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewInternalFieldObject):

• ftl/FTLOperations.cpp:

(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):

• inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::subtype):
(Inspector::JSInjectedScriptHost::getInternalProperties):
(Inspector::cloneArrayIteratorObject):
(Inspector::JSInjectedScriptHost::iteratorEntries):

• runtime/ArrayPrototype.cpp:

(JSC::ArrayPrototype::finishCreation):
(JSC::createArrayIteratorObject):
(JSC::arrayProtoFuncValues):
(JSC::arrayProtoFuncEntries):
(JSC::arrayProtoFuncKeys):

• runtime/CommonIdentifiers.h:
• runtime/Intrinsic.cpp:

(JSC::intrinsicName):

• runtime/Intrinsic.h:
• runtime/IterationKind.h:

(): Deleted.

• runtime/JSArrayIterator.cpp: Added.

(JSC::JSArrayIterator::create):
(JSC::JSArrayIterator::createWithInitialValues):
(JSC::JSArrayIterator::createStructure):
(JSC::JSArrayIterator::JSArrayIterator):
(JSC::JSArrayIterator::finishCreation):
(JSC::JSArrayIterator::visitChildren):

• runtime/JSArrayIterator.h: Added.
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::arrayIteratorPrototype const):
(JSC::JSGlobalObject::arrayIteratorStructure const):

• runtime/JSMapIterator.h:
• runtime/JSSetIterator.h:
• runtime/JSType.cpp:

(WTF::printInternal):

• runtime/JSType.h:
• runtime/JSTypedArrayViewPrototype.cpp:

(JSC::createTypedArrayIteratorObject):
(JSC::typedArrayViewProtoFuncValues):
(JSC::typedArrayProtoViewFuncEntries):
(JSC::typedArrayViewProtoFuncKeys):
(JSC::JSTypedArrayViewPrototype::finishCreation):

• runtime/VM.cpp:
• runtime/VM.h:

Source/WebCore:

JSDOMIterator should just use the JSC IterationKind enum. Also,
update other files for the enum member name changes.

• bindings/js/JSDOMIterator.h:

(WebCore::IteratorTraits>::asJS):

• bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::serialize):

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateIterableDefinition):

• bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::jsTestInterfacePrototypeFunctionEntriesCaller):
(WebCore::jsTestInterfacePrototypeFunctionKeysCaller):
(WebCore::jsTestInterfacePrototypeFunctionValuesCaller):

• bindings/scripts/test/JS/JSTestIterable.cpp:

(WebCore::jsTestIterablePrototypeFunctionEntriesCaller):
(WebCore::jsTestIterablePrototypeFunctionKeysCaller):
(WebCore::jsTestIterablePrototypeFunctionValuesCaller):

• bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::jsTestNodePrototypeFunctionEntriesCaller):
(WebCore::jsTestNodePrototypeFunctionKeysCaller):
(WebCore::jsTestNodePrototypeFunctionValuesCaller):

LayoutTests:

Change the labels of iteration kinds to match what JS refers to them as.

• inspector/model/remote-object/iterator-expected.txt:
• inspector/model/remote-object/iterator-large-expected.txt:
• inspector/model/remote-object/iterators-mutated-expected.txt:

File:

• trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -53 +53 @@
 #include "InByIdStatus.h"
 #include "InstanceOfStatus.h"
+#include "JSArrayIterator.h"
 #include "JSCInlines.h"
 #include "JSImmutableButterfly.h"
@@ -2359 +2360 @@
             VirtualRegister yOperand = virtualRegisterForArgument(2, registerOffset);
             setResult(addToGraph(ArithPow, get(xOperand), get(yOperand)));
+            return true;
+        }
+
+        case TypedArrayEntriesIntrinsic:
+        case TypedArrayKeysIntrinsic:
+        case TypedArrayValuesIntrinsic: {
+            if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIndexingType)
+                || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType))
+                return false;
+
+            ArrayMode mode = getArrayMode(Array::Read);
+            if (!mode.isSomeTypedArrayView())
+                return false;
+
+            addToGraph(CheckArray, OpInfo(mode.asWord()), get(virtualRegisterForArgument(0, registerOffset)));
+            addToGraph(CheckNeutered, get(virtualRegisterForArgument(0, registerOffset)));
+            FALLTHROUGH;
+        }
+
+        case ArrayEntriesIntrinsic:
+        case ArrayKeysIntrinsic:
+        case ArrayValuesIntrinsic: {
+            insertChecks();
+
+            IterationKind kind;
+            switch (intrinsic) {
+            case ArrayValuesIntrinsic:
+            case TypedArrayValuesIntrinsic:
+                kind = IterationKind::Values;
+                break;
+            case ArrayKeysIntrinsic:
+            case TypedArrayKeysIntrinsic:
+                kind = IterationKind::Keys;
+                break;
+            case ArrayEntriesIntrinsic:
+            case TypedArrayEntriesIntrinsic:
+                kind = IterationKind::Entries;
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+
+            // Add the constant before exit becomes invalid because we may want to insert (redundant) checks on it in Fixup.
+            Node* kindNode = jsConstant(jsNumber(static_cast<uint32_t>(kind)));
+
+            // We don't have an existing error string.
+            unsigned errorStringIndex = UINT32_MAX;
+            Node* object = addToGraph(ToObject, OpInfo(errorStringIndex), OpInfo(SpecNone), get(virtualRegisterForArgument(0, registerOffset)));
+
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(currentNodeOrigin().semantic);
+            Node* iterator = addToGraph(NewArrayIterator, OpInfo(m_graph.registerStructure(globalObject->arrayIteratorStructure())));
+
+            addToGraph(PutInternalField, OpInfo(static_cast<uint32_t>(JSArrayIterator::Field::IteratedObject)), iterator, object);
+            addToGraph(PutInternalField, OpInfo(static_cast<uint32_t>(JSArrayIterator::Field::Kind)), iterator, kindNode);
+
+            setResult(iterator);
             return true;
         }