Changeset 263035 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Jun 15, 2020, 7:42:43 AM (5 years ago)

Author:

Alexey Shvayka

Message:

super should not depend on proto
​https://bugs.webkit.org/show_bug.cgi?id=157972

Reviewed by Saam Barati.

JSTests:

• microbenchmarks/object-get-prototype-of-primitive.js: Added.
• stress/class-syntax-derived-default-constructor.js:
• stress/get-prototype-of.js: Added.
• stress/super-property-access.js:
• test262/expectations.yaml: Mark 4 test cases as passing.

Source/JavaScriptCore:

Before this change, both super() call [1] and super.property [2] relied on
Object.prototype.proto to acquire super base, which was observable and
incorrect if proto gets removed.

This patch introduces get_prototype_of bytecode, ensuring returned values
are profiled so the op can be wired to existing DFG and FTL implementations.
In order to avoid performance regression w/o DFG (proto is optimized via
IntrinsicGetterAccessCase), fast paths for LLInt and baseline JIT are added
(64-bit only), utilizing OverridesGetPrototypeOutOfLine type info flag.

This change aligns JSC with V8 and SpiderMonkey, progressing microbenchmarks/
super-get-by-{id,val}-with-this-monomorphic.js by 7-10%. SixSpeed is neutral.

Also, extracts JSValue::getPrototype() method to avoid code duplication and
utilizes it in objectConstructorGetPrototypeOf(), advancing provided
microbenchmark by 40%.

[1]: ​https://tc39.es/ecma262/#sec-getsuperconstructor (step 5)
[2]: ​https://tc39.es/ecma262/#sec-getsuperbase (step 5)

• builtins/BuiltinNames.h:
• bytecode/BytecodeIntrinsicRegistry.h:
• bytecode/BytecodeList.rb:
• bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):

• bytecode/Opcode.h:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitGetPrototypeOf):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::emitSuperBaseForCallee):
(JSC::emitGetSuperFunctionForConstruct):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_getPrototypeOf):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGOperations.cpp:
• jit/IntrinsicEmitter.cpp:

(JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

• jit/JIT.h:
• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_get_prototype_of):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/CommonSlowPaths.h:
• runtime/JSCJSValue.h:
• runtime/JSCJSValueInlines.h:

(JSC::JSValue::getPrototype const):

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):

• runtime/JSObject.cpp:

(JSC::JSObject::calculatedClassName):

• runtime/JSObject.h:

(JSC::JSObject::getPrototype):

• runtime/JSObjectInlines.h:

(JSC::JSObject::canPerformFastPutInlineExcludingProto):
(JSC::JSObject::getPropertySlot):
(JSC::JSObject::getNonIndexPropertySlot):

• runtime/JSProxy.h:
• runtime/JSTypeInfo.h:

(JSC::TypeInfo::overridesGetPrototype const):

• runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetPrototypeOf):

• runtime/ProxyObject.h:
• runtime/Structure.h:
• runtime/Structure.cpp:

(JSC::Structure::validateFlags):

Source/WebCore:

No new tests, no behavior change.

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader): Set OverridesGetPrototype structure flag for CustomGetPrototype IDL attribute.

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -197 +197 @@
 {
     RefPtr<RegisterID> homeObject = emitHomeObjectForCallee(generator);
-    return generator.emitGetById(generator.newTemporary(), homeObject.get(), generator.propertyNames().underscoreProto);
+    return generator.emitGetPrototypeOf(generator.newTemporary(), homeObject.get());
 }
 
@@ -203 +203 @@
 {
     if (generator.isDerivedConstructorContext())
-        return generator.emitGetById(generator.newTemporary(), generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment(), generator.propertyNames().underscoreProto);
+        return generator.emitGetPrototypeOf(generator.newTemporary(), generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment());
 
     RegisterID callee;
     callee.setIndex(CallFrameSlot::callee);
-    return generator.emitGetById(generator.newTemporary(), &callee, generator.propertyNames().underscoreProto);
+    return generator.emitGetPrototypeOf(generator.newTemporary(), &callee);
 }
 
@@ -1155 +1155 @@
     ASSERT(!node->m_next);
     return generator.emitDirectGetById(generator.finalDestination(dst), base.get(), generator.parserArena().identifierArena().makeIdentifier(generator.vm(), symbol));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_getPrototypeOf(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> value = generator.emitNode(node);
+    ASSERT(!node->m_next);
+    return generator.emitGetPrototypeOf(generator.finalDestination(dst), value.get());
 }