Skip to content

Commit 51fb9bc

Browse files
ConstellationConstellation
committed
[JSC][FTL] FTL should support Arrayify
https://bugs.webkit.org/show_bug.cgi?id=169596 Reviewed by Saam Barati. JSTests: * stress/arrayify.js: Added. (arrayifyInt32): (arrayifyDouble): (arrayifyContiguous): Source/JavaScriptCore: This patch simply expands the coverage of FTL by supporting Arrayify. While ArrayifyToStructure is already supported, Arrayify is not supported in FTL. While supporting Arrayify in FTL itself does not offer so much performance difference from DFG's one, no FTL support for Arrayify prevents us applying FTL to the code including Arrayify. * dfg/DFGArrayMode.cpp: (JSC::DFG::toIndexingShape): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileArrayify): (JSC::FTL::DFG::LowerDFGToB3::compileCheckArray): (JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify): (JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForCheckArray): (JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure): Deleted. (JSC::FTL::DFG::LowerDFGToB3::isArrayType): Deleted. Canonical link: https://commits.webkit.org/188004@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@215600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 4df2c9b commit 51fb9bc

7 files changed

Lines changed: 133 additions & 30 deletions

File tree

‎JSTests/ChangeLog‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
2017-04-20 Yusuke Suzuki <[email protected]>
2+
3+
[JSC][FTL] FTL should support Arrayify
4+
https://bugs.webkit.org/show_bug.cgi?id=169596
5+
6+
Reviewed by Saam Barati.
7+
8+
* stress/arrayify.js: Added.
9+
(arrayifyInt32):
10+
(arrayifyDouble):
11+
(arrayifyContiguous):
12+
113
2017-04-20 Mark Lam <[email protected]>
214

315
virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.

‎JSTests/stress/arrayify.js‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
function arrayifyInt32(array)
2+
{
3+
for (var i = 0; i < 1e2; ++i)
4+
array[i] = 42;
5+
}
6+
noInline(arrayifyInt32);
7+
8+
function arrayifyDouble(array)
9+
{
10+
for (var i = 0; i < 1e2; ++i)
11+
array[i] = 42.195;
12+
}
13+
noInline(arrayifyDouble);
14+
15+
function arrayifyContiguous(array)
16+
{
17+
for (var i = 0; i < 1e2; ++i)
18+
array[i] = true;
19+
}
20+
noInline(arrayifyContiguous);
21+
22+
for (var i = 0; i < 1e4; ++i) {
23+
let cocoa = { name: 'Cocoa' };
24+
let cappuccino = { name: 'Cappuccino' };
25+
arrayifyInt32(cocoa);
26+
arrayifyInt32(cappuccino);
27+
}
28+
29+
for (var i = 0; i < 1e4; ++i) {
30+
let cocoa = { name: 'Cocoa' };
31+
let cappuccino = { name: 'Cappuccino' };
32+
arrayifyDouble(cocoa);
33+
arrayifyDouble(cappuccino);
34+
}
35+
36+
for (var i = 0; i < 1e4; ++i) {
37+
let cocoa = { name: 'Cocoa' };
38+
let cappuccino = { name: 'Cappuccino' };
39+
arrayifyContiguous(cocoa);
40+
arrayifyContiguous(cappuccino);
41+
}

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,31 @@
1+
2017-04-20 Yusuke Suzuki <[email protected]>
2+
3+
[JSC][FTL] FTL should support Arrayify
4+
https://bugs.webkit.org/show_bug.cgi?id=169596
5+
6+
Reviewed by Saam Barati.
7+
8+
This patch simply expands the coverage of FTL by supporting Arrayify.
9+
While ArrayifyToStructure is already supported, Arrayify is not supported
10+
in FTL. While supporting Arrayify in FTL itself does not offer so much
11+
performance difference from DFG's one, no FTL support for Arrayify
12+
prevents us applying FTL to the code including Arrayify.
13+
14+
* dfg/DFGArrayMode.cpp:
15+
(JSC::DFG::toIndexingShape):
16+
* dfg/DFGSpeculativeJIT.cpp:
17+
(JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
18+
* ftl/FTLCapabilities.cpp:
19+
(JSC::FTL::canCompile):
20+
* ftl/FTLLowerDFGToB3.cpp:
21+
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
22+
(JSC::FTL::DFG::LowerDFGToB3::compileArrayify):
23+
(JSC::FTL::DFG::LowerDFGToB3::compileCheckArray):
24+
(JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):
25+
(JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForCheckArray):
26+
(JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure): Deleted.
27+
(JSC::FTL::DFG::LowerDFGToB3::isArrayType): Deleted.
28+
129
2017-04-20 Mark Lam <[email protected]>
230

331
virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.

‎Source/JavaScriptCore/dfg/DFGArrayMode.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,8 @@ IndexingType toIndexingShape(Array::Type type)
623623
return DoubleShape;
624624
case Array::Contiguous:
625625
return ContiguousShape;
626+
case Array::Undecided:
627+
return UndecidedShape;
626628
case Array::ArrayStorage:
627629
return ArrayStorageShape;
628630
case Array::SlowPutArrayStorage:

‎Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -762,16 +762,10 @@ JITCompiler::JumpList SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGP
762762

763763
switch (arrayMode.type()) {
764764
case Array::Int32:
765-
return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, Int32Shape);
766-
767765
case Array::Double:
768-
return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, DoubleShape);
769-
770766
case Array::Contiguous:
771-
return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, ContiguousShape);
772-
773767
case Array::Undecided:
774-
return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, UndecidedShape);
768+
return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, arrayMode.shapeMask());
775769

776770
case Array::ArrayStorage:
777771
case Array::SlowPutArrayStorage: {

‎Source/JavaScriptCore/ftl/FTLCapabilities.cpp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,16 @@ inline CapabilityLevel canCompile(Node* node)
305305
// case because it would prevent us from catching bugs where the FTL backend
306306
// pipeline failed to optimize out an Identity.
307307
break;
308+
case Arrayify:
309+
switch (node->arrayMode().type()) {
310+
case Array::Int32:
311+
case Array::Double:
312+
case Array::Contiguous:
313+
break;
314+
default:
315+
return CannotCompile;
316+
}
317+
break;
308318
case CheckArray:
309319
switch (node->arrayMode().type()) {
310320
case Array::Int32:

‎Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp‎

Lines changed: 39 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -623,8 +623,9 @@ class LowerDFGToB3 {
623623
case GetExecutable:
624624
compileGetExecutable();
625625
break;
626+
case Arrayify:
626627
case ArrayifyToStructure:
627-
compileArrayifyToStructure();
628+
compileArrayify();
628629
break;
629630
case PutStructure:
630631
compilePutStructure();
@@ -2767,20 +2768,24 @@ class LowerDFGToB3 {
27672768
setJSValue(m_out.loadPtr(cell, m_heaps.JSFunction_executable));
27682769
}
27692770

2770-
void compileArrayifyToStructure()
2771+
void compileArrayify()
27712772
{
27722773
LValue cell = lowCell(m_node->child1());
27732774
LValue property = !!m_node->child2() ? lowInt32(m_node->child2()) : 0;
27742775

27752776
LBasicBlock unexpectedStructure = m_out.newBlock();
27762777
LBasicBlock continuation = m_out.newBlock();
27772778

2778-
LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
2779-
2780-
m_out.branch(
2781-
m_out.notEqual(structureID, weakStructureID(m_node->structure())),
2782-
rarely(unexpectedStructure), usually(continuation));
2783-
2779+
auto isUnexpectedArray = [&] (LValue cell) {
2780+
if (m_node->op() == Arrayify)
2781+
return m_out.logicalNot(isArrayTypeForArrayify(cell, m_node->arrayMode()));
2782+
2783+
ASSERT(m_node->op() == ArrayifyToStructure);
2784+
return m_out.notEqual(m_out.load32(cell, m_heaps.JSCell_structureID), weakStructureID(m_node->structure()));
2785+
};
2786+
2787+
m_out.branch(isUnexpectedArray(cell), rarely(unexpectedStructure), usually(continuation));
2788+
27842789
LBasicBlock lastNext = m_out.appendTo(unexpectedStructure, continuation);
27852790

27862791
if (property) {
@@ -2816,10 +2821,7 @@ class LowerDFGToB3 {
28162821
break;
28172822
}
28182823

2819-
structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
2820-
speculate(
2821-
BadIndexingType, jsValueValue(cell), 0,
2822-
m_out.notEqual(structureID, weakStructureID(m_node->structure())));
2824+
speculate(BadIndexingType, jsValueValue(cell), 0, isUnexpectedArray(cell));
28232825
m_out.jump(continuation);
28242826

28252827
m_out.appendTo(continuation, lastNext);
@@ -3307,7 +3309,7 @@ class LowerDFGToB3 {
33073309

33083310
speculate(
33093311
BadIndexingType, jsValueValue(cell), 0,
3310-
m_out.logicalNot(isArrayType(cell, m_node->arrayMode())));
3312+
m_out.logicalNot(isArrayTypeForCheckArray(cell, m_node->arrayMode())));
33113313
}
33123314

33133315
void compileGetTypedArrayByteOffset()
@@ -13024,38 +13026,52 @@ class LowerDFGToB3 {
1302413026
m_out.constInt32(vm().symbolStructure->id()));
1302513027
}
1302613028

13027-
LValue isArrayType(LValue cell, ArrayMode arrayMode)
13029+
LValue isArrayTypeForArrayify(LValue cell, ArrayMode arrayMode)
1302813030
{
1302913031
switch (arrayMode.type()) {
1303013032
case Array::Int32:
1303113033
case Array::Double:
1303213034
case Array::Contiguous: {
13035+
IndexingType shape = arrayMode.shapeMask();
1303313036
LValue indexingType = m_out.load8ZeroExt32(cell, m_heaps.JSCell_indexingTypeAndMisc);
13034-
13037+
1303513038
switch (arrayMode.arrayClass()) {
1303613039
case Array::OriginalArray:
1303713040
DFG_CRASH(m_graph, m_node, "Unexpected original array");
1303813041
return 0;
13039-
13042+
1304013043
case Array::Array:
1304113044
return m_out.equal(
1304213045
m_out.bitAnd(indexingType, m_out.constInt32(IsArray | IndexingShapeMask)),
13043-
m_out.constInt32(IsArray | arrayMode.shapeMask()));
13044-
13046+
m_out.constInt32(IsArray | shape));
13047+
1304513048
case Array::NonArray:
1304613049
case Array::OriginalNonArray:
1304713050
return m_out.equal(
1304813051
m_out.bitAnd(indexingType, m_out.constInt32(IsArray | IndexingShapeMask)),
13049-
m_out.constInt32(arrayMode.shapeMask()));
13050-
13052+
m_out.constInt32(shape));
13053+
1305113054
case Array::PossiblyArray:
1305213055
return m_out.equal(
1305313056
m_out.bitAnd(indexingType, m_out.constInt32(IndexingShapeMask)),
13054-
m_out.constInt32(arrayMode.shapeMask()));
13057+
m_out.constInt32(shape));
1305513058
}
13056-
13057-
DFG_CRASH(m_graph, m_node, "Corrupt array class");
13059+
break;
13060+
}
13061+
13062+
default:
13063+
break;
1305813064
}
13065+
DFG_CRASH(m_graph, m_node, "Corrupt array class");
13066+
}
13067+
13068+
LValue isArrayTypeForCheckArray(LValue cell, ArrayMode arrayMode)
13069+
{
13070+
switch (arrayMode.type()) {
13071+
case Array::Int32:
13072+
case Array::Double:
13073+
case Array::Contiguous:
13074+
return isArrayTypeForArrayify(cell, arrayMode);
1305913075

1306013076
case Array::DirectArguments:
1306113077
return m_out.equal(

0 commit comments

Comments
 (0)