Changeset 267373 in webkit for trunk/Source/JavaScriptCore/runtime/JSBigInt.h

Timestamp:

Sep 21, 2020, 3:10:24 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] BigInt should work with Map / Set
​https://bugs.webkit.org/show_bug.cgi?id=216667
JSTests:

<rdar://problem/69107221>

Reviewed by Robin Morisset.

• stress/bigint-and-map-set.js: Added.

(shouldBe):
(opaque1n):
(testMap):
(let.set new):

• stress/bigint-string-map-set.js: Added.

(shouldBe):
(testMap):

• stress/bigint32-map-set.js: Added.

(shouldBe):
(testMap):

Source/JavaScriptCore:

Reviewed by Robin Morisset.

This patch makes BigInt supported in Map / Set.

1. In NormalizeMapKey, we always attempt to convert HeapBigInt to BigInt32 (if supported). So we ensure that,

normalized BigInt has one unique form for BigInt32 range. This allows us to use hashing for BigInt32 bit pattern directly.

2. In MapHash, for BigInt32, we directly has the JSValue bits. For HeapBigInt, we calculate hash via Hasher.
3. In GetMapBucket, we consider HeapBigInt case correctly.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupNormalizeMapKey):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
(JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):

• runtime/HashMapImpl.h:

(JSC::normalizeMapKey):
(JSC::jsMapHash):
(JSC::concurrentJSMapHash):

• runtime/JSBigInt.cpp:

(JSC::JSBigInt::concurrentHash):

• runtime/JSBigInt.h:

(JSC::tryConvertToBigInt32):

Source/WebCore:

<rdar://problem/69107221>

Reviewed by Robin Morisset.

Strongly ensure that BigInt32 is always selected since Map / Set could use it as a key.

• bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::readBigInt):

Source/WTF:

Reviewed by Robin Morisset.

• wtf/Hasher.h:

(WTF::Hasher::hash const):
(WTF::add):

File:

• trunk/Source/JavaScriptCore/runtime/JSBigInt.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/JSBigInt.h

@@ -428 +428 @@
     JS_EXPORT_PRIVATE JSBigInt* tryRightTrim(VM&);
 
+    JS_EXPORT_PRIVATE Optional<unsigned> concurrentHash();
+    unsigned hash()
+    {
+        if (m_hash)
+            return m_hash;
+        return hashSlow();
+    }
+
 private:
     JSBigInt(VM&, Structure*, Digit*, unsigned length);
 
     JSBigInt* rightTrim(JSGlobalObject*, VM&);
+
+    JS_EXPORT_PRIVATE unsigned hashSlow();
 
     static JSBigInt* createFromImpl(JSGlobalObject*, uint64_t value, bool sign);
@@ -573 +583 @@
 
     inline Digit* dataStorage() { return m_data.get(m_length); }
+    inline Digit* dataStorageUnsafe() { return m_data.getUnsafe(); }
 
     const unsigned m_length;
+    unsigned m_hash { 0 };
     bool m_sign { false };
     CagedBarrierPtr<Gigacage::Primitive, Digit, tagCagedPtr> m_data;
@@ -609 +621 @@
 }
 
+ALWAYS_INLINE JSValue tryConvertToBigInt32(JSBigInt* bigInt)
+{
+#if USE(BIGINT32)
+    if (UNLIKELY(!bigInt))
+        return JSValue();
+
+    if (bigInt->length() <= 1) {
+        if (!bigInt->length())
+            return jsBigInt32(0);
+        JSBigInt::Digit digit = bigInt->digit(0);
+        if (bigInt->sign()) {
+            static constexpr uint64_t maxValue = -static_cast<int64_t>(std::numeric_limits<int32_t>::min());
+            if (digit <= maxValue)
+                return jsBigInt32(static_cast<int32_t>(-static_cast<int64_t>(digit)));
+        } else {
+            static constexpr uint64_t maxValue = static_cast<uint64_t>(std::numeric_limits<int32_t>::max());
+            if (digit <= maxValue)
+                return jsBigInt32(static_cast<int32_t>(digit));
+        }
+    }
+#endif
+
+    return bigInt;
+}
+
 } // namespace JSC