blob: 3966b4dafe860f9a926e89935d1b9e1cf97075a4 [file] [log] [blame]
/*
* Copyright (C) 2014-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "config.h"
#include "FTLOperations.h"
#if ENABLE(FTL_JIT)
#include "BytecodeStructs.h"
#include "ClonedArguments.h"
#include "CommonSlowPaths.h"
#include "DirectArguments.h"
#include "FTLJITCode.h"
#include "FTLLazySlowPath.h"
#include "FrameTracers.h"
#include "InlineCallFrame.h"
#include "JSArrayIterator.h"
#include "JSAsyncFunction.h"
#include "JSAsyncGeneratorFunction.h"
#include "JSCInlines.h"
#include "JSGeneratorFunction.h"
#include "JSImmutableButterfly.h"
#include "JSInternalPromise.h"
#include "JSLexicalEnvironment.h"
#include "JSMapIterator.h"
#include "JSSetIterator.h"
#include "RegExpObject.h"
#include <wtf/Assertions.h>
IGNORE_WARNINGS_BEGIN("frame-address")
namespace JSC { namespace FTL {
JSC_DEFINE_JIT_OPERATION(operationPopulateObjectInOSR, void, (JSGlobalObject* globalObject, ExitTimeObjectMaterialization* materialization, EncodedJSValue* encodedValue, EncodedJSValue* values))
{
using namespace DFG;
VM& vm = globalObject->vm();
CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
CodeBlock* codeBlock = callFrame->codeBlock();
// We cannot GC. We've got pointers in evil places.
// FIXME: We are not doing anything that can GC here, and this is
// probably unnecessary.
DeferGCForAWhile deferGC(vm);
switch (materialization->type()) {
case PhantomNewObject: {
JSFinalObject* object = jsCast<JSFinalObject*>(JSValue::decode(*encodedValue));
Structure* structure = object->structure(vm);
// Figure out what the heck to populate the object with. Use
// getPropertiesConcurrently() because that happens to be
// lower-level and more convenient. It doesn't change the
// materialization of the property table. We want to have
// minimal visible effects on the system. Also, don't mind
// that this is O(n^2). It doesn't matter. We only get here
// from OSR exit.
for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != NamedPropertyPLoc)
continue;
if (codeBlock->identifier(property.location().info()).impl() != entry.key)
continue;
object->putDirect(vm, entry.offset, JSValue::decode(values[i]));
}
}
break;
}
case PhantomNewFunction:
case PhantomNewGeneratorFunction:
case PhantomNewAsyncFunction:
case PhantomNewAsyncGeneratorFunction:
case PhantomDirectArguments:
case PhantomClonedArguments:
case PhantomCreateRest:
case PhantomSpread:
case PhantomNewArrayWithSpread:
case PhantomNewArrayBuffer:
// Those are completely handled by operationMaterializeObjectInOSR
break;
case PhantomCreateActivation: {
JSLexicalEnvironment* activation = jsCast<JSLexicalEnvironment*>(JSValue::decode(*encodedValue));
// Figure out what to populate the activation with
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ClosureVarPLoc)
continue;
activation->variableAt(ScopeOffset(property.location().info())).set(vm, activation, JSValue::decode(values[i]));
}
break;
}
case PhantomNewInternalFieldObject: {
auto materialize = [&] (auto* target) {
using JSCellType = std::remove_reference_t<decltype(*target)>;
// Figure out what to populate the iterator with
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != InternalFieldObjectPLoc)
continue;
ASSERT(property.location().info() < JSCellType::numberOfInternalFields);
target->internalField(static_cast<typename JSCellType::Field>(property.location().info())).set(vm, target, JSValue::decode(values[i]));
}
};
JSObject* target = jsCast<JSObject*>(JSValue::decode(*encodedValue));
switch (target->type()) {
case JSArrayIteratorType:
materialize(jsCast<JSArrayIterator*>(target));
break;
case JSMapIteratorType:
materialize(jsCast<JSMapIterator*>(target));
break;
case JSSetIteratorType:
materialize(jsCast<JSSetIterator*>(target));
break;
case JSPromiseType:
if (target->classInfo(vm) == JSInternalPromise::info())
materialize(jsCast<JSInternalPromise*>(target));
else {
ASSERT(target->classInfo(vm) == JSPromise::info());
materialize(jsCast<JSPromise*>(target));
}
break;
default:
RELEASE_ASSERT_NOT_REACHED();
break;
}
break;
}
case PhantomNewRegexp: {
RegExpObject* regExpObject = jsCast<RegExpObject*>(JSValue::decode(*encodedValue));
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != RegExpObjectLastIndexPLoc)
continue;
regExpObject->setLastIndex(globalObject, JSValue::decode(values[i]), false /* shouldThrow */);
break;
}
break;
}
default:
RELEASE_ASSERT_NOT_REACHED();
break;
}
}
JSC_DEFINE_JIT_OPERATION(operationMaterializeObjectInOSR, JSCell*, (JSGlobalObject* globalObject, ExitTimeObjectMaterialization* materialization, EncodedJSValue* values))
{
using namespace DFG;
VM& vm = globalObject->vm();
CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
// We cannot GC. We've got pointers in evil places.
DeferGCForAWhile deferGC(vm);
switch (materialization->type()) {
case PhantomNewObject: {
// Figure out what the structure is
Structure* structure = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() != PromotedLocationDescriptor(StructurePLoc))
continue;
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<Structure>(vm));
structure = jsCast<Structure*>(JSValue::decode(values[i]));
break;
}
RELEASE_ASSERT(structure);
JSFinalObject* result = JSFinalObject::create(vm, structure);
// The real values will be put subsequently by
// operationPopulateNewObjectInOSR. We can't fill them in
// now, because they may not be available yet (typically
// because we have a cyclic dependency graph).
// We put a dummy value here in order to avoid super-subtle
// GC-and-OSR-exit crashes in case we have a bug and some
// field is, for any reason, not filled later.
// We use a random-ish number instead of a sensible value like
// undefined to make possible bugs easier to track.
for (PropertyMapEntry entry : structure->getPropertiesConcurrently())
result->putDirect(vm, entry.offset, jsNumber(19723));
return result;
}
case PhantomNewFunction:
case PhantomNewGeneratorFunction:
case PhantomNewAsyncGeneratorFunction:
case PhantomNewAsyncFunction: {
// Figure out what the executable and activation are
FunctionExecutable* executable = nullptr;
JSScope* activation = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() == PromotedLocationDescriptor(FunctionExecutablePLoc)) {
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<FunctionExecutable>(vm));
executable = jsCast<FunctionExecutable*>(JSValue::decode(values[i]));
}
if (property.location() == PromotedLocationDescriptor(FunctionActivationPLoc)) {
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<JSScope>(vm));
activation = jsCast<JSScope*>(JSValue::decode(values[i]));
}
}
RELEASE_ASSERT(executable && activation);
if (materialization->type() == PhantomNewFunction)
return JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
else if (materialization->type() == PhantomNewGeneratorFunction)
return JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
else if (materialization->type() == PhantomNewAsyncGeneratorFunction)
return JSAsyncGeneratorFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
ASSERT(materialization->type() == PhantomNewAsyncFunction);
return JSAsyncFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
}
case PhantomCreateActivation: {
// Figure out what the scope and symbol table are
JSScope* scope = nullptr;
SymbolTable* table = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() == PromotedLocationDescriptor(ActivationScopePLoc)) {
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<JSScope>(vm));
scope = jsCast<JSScope*>(JSValue::decode(values[i]));
} else if (property.location() == PromotedLocationDescriptor(ActivationSymbolTablePLoc)) {
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<SymbolTable>(vm));
table = jsCast<SymbolTable*>(JSValue::decode(values[i]));
}
}
RELEASE_ASSERT(scope);
RELEASE_ASSERT(table);
CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
materialization->origin(), callFrame->codeBlock()->baselineAlternative());
Structure* structure = codeBlock->globalObject()->activationStructure();
// It doesn't matter what values we initialize as bottom values inside the activation constructor because
// activation sinking will set bottom values for each slot.
// FIXME: Slight optimization would be to create a constructor that doesn't initialize all slots.
JSLexicalEnvironment* result = JSLexicalEnvironment::create(vm, structure, scope, table, jsUndefined());
RELEASE_ASSERT(materialization->properties().size() - 2 == table->scopeSize());
// The real values will be put subsequently by
// operationPopulateNewObjectInOSR. See the PhantomNewObject
// case for details.
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ClosureVarPLoc)
continue;
result->variableAt(ScopeOffset(property.location().info())).set(
vm, result, jsNumber(29834));
}
if (validationEnabled()) {
// Validate to make sure every slot in the scope has one value.
ConcurrentJSLocker locker(table->m_lock);
for (auto iter = table->begin(locker), end = table->end(locker); iter != end; ++iter) {
bool found = false;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ClosureVarPLoc)
continue;
if (ScopeOffset(property.location().info()) == iter->value.scopeOffset()) {
found = true;
break;
}
}
ASSERT_UNUSED(found, found);
}
unsigned numberOfClosureVarPloc = 0;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() == ClosureVarPLoc)
numberOfClosureVarPloc++;
}
ASSERT(numberOfClosureVarPloc == table->scopeSize());
}
return result;
}
case PhantomNewInternalFieldObject: {
// Figure out what structure.
Structure* structure = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() == PromotedLocationDescriptor(StructurePLoc)) {
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<Structure>(vm));
structure = jsCast<Structure*>(JSValue::decode(values[i]));
}
}
RELEASE_ASSERT(structure);
// The real values will be put subsequently by
// operationPopulateNewObjectInOSR. See the PhantomNewObject
// case for details.
switch (structure->typeInfo().type()) {
case JSArrayIteratorType: {
JSArrayIterator* result = JSArrayIterator::createWithInitialValues(vm, structure);
RELEASE_ASSERT(materialization->properties().size() - 1 == JSArrayIterator::numberOfInternalFields);
return result;
}
case JSMapIteratorType: {
JSMapIterator* result = JSMapIterator::createWithInitialValues(vm, structure);
RELEASE_ASSERT(materialization->properties().size() - 1 == JSMapIterator::numberOfInternalFields);
return result;
}
case JSSetIteratorType: {
JSSetIterator* result = JSSetIterator::createWithInitialValues(vm, structure);
RELEASE_ASSERT(materialization->properties().size() - 1 == JSSetIterator::numberOfInternalFields);
return result;
}
case JSPromiseType: {
if (structure->classInfo() == JSInternalPromise::info()) {
JSInternalPromise* result = JSInternalPromise::createWithInitialValues(vm, structure);
RELEASE_ASSERT(materialization->properties().size() - 1 == JSInternalPromise::numberOfInternalFields);
return result;
}
ASSERT(structure->classInfo() == JSPromise::info());
JSPromise* result = JSPromise::createWithInitialValues(vm, structure);
RELEASE_ASSERT(materialization->properties().size() - 1 == JSPromise::numberOfInternalFields);
return result;
}
default:
RELEASE_ASSERT_NOT_REACHED();
return nullptr;
}
}
case PhantomCreateRest:
case PhantomDirectArguments:
case PhantomClonedArguments: {
if (!materialization->origin().inlineCallFrame()) {
switch (materialization->type()) {
case PhantomDirectArguments:
return DirectArguments::createByCopying(globalObject, callFrame);
case PhantomClonedArguments:
return ClonedArguments::createWithMachineFrame(globalObject, callFrame, ArgumentsMode::Cloned);
case PhantomCreateRest: {
CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
materialization->origin(), callFrame->codeBlock()->baselineAlternative());
unsigned numberOfArgumentsToSkip = codeBlock->numberOfArgumentsToSkip();
JSGlobalObject* globalObject = codeBlock->globalObject();
Structure* structure = globalObject->restParameterStructure();
JSValue* argumentsToCopyRegion = callFrame->addressOfArgumentsStart() + numberOfArgumentsToSkip;
unsigned arraySize = callFrame->argumentCount() > numberOfArgumentsToSkip ? callFrame->argumentCount() - numberOfArgumentsToSkip : 0;
return constructArray(globalObject, structure, argumentsToCopyRegion, arraySize);
}
default:
RELEASE_ASSERT_NOT_REACHED();
return nullptr;
}
}
// First figure out the argument count. If there isn't one then we represent the machine frame.
unsigned argumentCount = 0;
if (materialization->origin().inlineCallFrame()->isVarargs()) {
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() != PromotedLocationDescriptor(ArgumentCountPLoc))
continue;
argumentCount = JSValue::decode(values[i]).asUInt32();
break;
}
} else
argumentCount = materialization->origin().inlineCallFrame()->argumentCountIncludingThis;
RELEASE_ASSERT(argumentCount);
JSFunction* callee = nullptr;
if (materialization->origin().inlineCallFrame()->isClosureCall) {
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() != PromotedLocationDescriptor(ArgumentsCalleePLoc))
continue;
callee = jsCast<JSFunction*>(JSValue::decode(values[i]));
break;
}
} else
callee = materialization->origin().inlineCallFrame()->calleeConstant();
RELEASE_ASSERT(callee);
CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
materialization->origin(), callFrame->codeBlock()->baselineAlternative());
// We have an inline frame and we have all of the data we need to recreate it.
switch (materialization->type()) {
case PhantomDirectArguments: {
unsigned length = argumentCount - 1;
unsigned capacity = std::max(length, static_cast<unsigned>(codeBlock->numParameters() - 1));
DirectArguments* result = DirectArguments::create(
vm, codeBlock->globalObject()->directArgumentsStructure(), length, capacity);
result->setCallee(vm, callee);
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ArgumentPLoc)
continue;
unsigned index = property.location().info();
if (index >= capacity)
continue;
// We don't want to use setIndexQuickly(), since that's only for the passed-in
// arguments but sometimes the number of named arguments is greater. For
// example:
//
// function foo(a, b, c) { ... }
// foo();
//
// setIndexQuickly() would fail for indices 0, 1, 2 - but we need to recover
// those here.
result->argument(DirectArgumentsOffset(index)).set(
vm, result, JSValue::decode(values[i]));
}
return result;
}
case PhantomClonedArguments: {
unsigned length = argumentCount - 1;
ClonedArguments* result = ClonedArguments::createEmpty(
vm, codeBlock->globalObject()->clonedArgumentsStructure(), callee, length);
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ArgumentPLoc)
continue;
unsigned index = property.location().info();
if (index >= length)
continue;
result->putDirectIndex(globalObject, index, JSValue::decode(values[i]));
}
return result;
}
case PhantomCreateRest: {
unsigned numberOfArgumentsToSkip = codeBlock->numberOfArgumentsToSkip();
JSGlobalObject* globalObject = codeBlock->globalObject();
Structure* structure = globalObject->restParameterStructure();
ASSERT(argumentCount > 0);
unsigned arraySize = (argumentCount - 1) > numberOfArgumentsToSkip ? argumentCount - 1 - numberOfArgumentsToSkip : 0;
// FIXME: we should throw an out of memory error here if tryCreate() fails.
// https://bugs.webkit.org/show_bug.cgi?id=169784
JSArray* array = JSArray::tryCreate(vm, structure, arraySize);
RELEASE_ASSERT(array);
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ArgumentPLoc)
continue;
unsigned argIndex = property.location().info();
if (numberOfArgumentsToSkip > argIndex)
continue;
unsigned arrayIndex = argIndex - numberOfArgumentsToSkip;
if (arrayIndex >= arraySize)
continue;
array->putDirectIndex(globalObject, arrayIndex, JSValue::decode(values[i]));
}
#if ASSERT_ENABLED
// We avoid this O(n^2) loop when asserts are disabled, but the condition checked here
// must hold to ensure the correctness of the above loop because of how we allocate the array.
for (unsigned targetIndex = 0; targetIndex < arraySize; ++targetIndex) {
bool found = false;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() != ArgumentPLoc)
continue;
unsigned argIndex = property.location().info();
if (numberOfArgumentsToSkip > argIndex)
continue;
unsigned arrayIndex = argIndex - numberOfArgumentsToSkip;
if (arrayIndex >= arraySize)
continue;
if (arrayIndex == targetIndex) {
found = true;
break;
}
}
ASSERT(found);
}
#endif // ASSERT_ENABLED
return array;
}
default:
RELEASE_ASSERT_NOT_REACHED();
return nullptr;
}
}
case PhantomSpread: {
JSArray* array = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() == SpreadPLoc) {
array = jsCast<JSArray*>(JSValue::decode(values[i]));
break;
}
}
RELEASE_ASSERT(array);
// Note: it is sound for JSImmutableButterfly::createFromArray to call getDirectIndex here
// because we're guaranteed we won't be calling any getters. The reason for this is
// that we only support PhantomSpread over CreateRest, which is an array we create.
// Any attempts to put a getter on any indices on the rest array will escape the array.
auto* fixedArray = JSImmutableButterfly::createFromArray(globalObject, vm, array);
RELEASE_ASSERT(fixedArray);
return fixedArray;
}
case PhantomNewArrayBuffer: {
JSImmutableButterfly* immutableButterfly = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() == NewArrayBufferPLoc) {
immutableButterfly = jsCast<JSImmutableButterfly*>(JSValue::decode(values[i]));
break;
}
}
RELEASE_ASSERT(immutableButterfly);
// For now, we use array allocation profile in the actual CodeBlock. It is OK since current NewArrayBuffer
// and PhantomNewArrayBuffer are always bound to a specific op_new_array_buffer.
CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(materialization->origin(), callFrame->codeBlock()->baselineAlternative());
const Instruction* currentInstruction = codeBlock->instructions().at(materialization->origin().bytecodeIndex()).ptr();
if (!currentInstruction->is<OpNewArrayBuffer>()) {
// This case can happen if Object.keys, an OpCall is first converted into a NewArrayBuffer which is then converted into a PhantomNewArrayBuffer.
// There is no need to update the array allocation profile in that case.
RELEASE_ASSERT(currentInstruction->is<OpCall>());
Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(immutableButterfly->indexingMode());
return CommonSlowPaths::allocateNewArrayBuffer(vm, structure, immutableButterfly);
}
auto newArrayBuffer = currentInstruction->as<OpNewArrayBuffer>();
ArrayAllocationProfile* profile = &newArrayBuffer.metadata(codeBlock).m_arrayAllocationProfile;
// FIXME: Share the code with CommonSlowPaths. Currently, codeBlock etc. are slightly different.
IndexingType indexingMode = profile->selectIndexingType();
Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingMode);
ASSERT(isCopyOnWrite(indexingMode));
ASSERT(!structure->outOfLineCapacity());
if (UNLIKELY(immutableButterfly->indexingMode() != indexingMode)) {
auto* newButterfly = JSImmutableButterfly::create(vm, indexingMode, immutableButterfly->length());
for (unsigned i = 0; i < immutableButterfly->length(); ++i)
newButterfly->setIndex(vm, i, immutableButterfly->get(i));
immutableButterfly = newButterfly;
// FIXME: This is kinda gross and only works because we can't inline new_array_bufffer in the baseline.
// We also cannot allocate a new butterfly from compilation threads since it's invalid to allocate cells from
// a compilation thread.
WTF::storeStoreFence();
codeBlock->constantRegister(newArrayBuffer.m_immutableButterfly).set(vm, codeBlock, immutableButterfly);
WTF::storeStoreFence();
}
JSArray* result = CommonSlowPaths::allocateNewArrayBuffer(vm, structure, immutableButterfly);
ArrayAllocationProfile::updateLastAllocationFor(profile, result);
return result;
}
case PhantomNewArrayWithSpread: {
CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
materialization->origin(), callFrame->codeBlock()->baselineAlternative());
JSGlobalObject* globalObject = codeBlock->globalObject();
Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
CheckedUint32 checkedArraySize = 0;
unsigned numProperties = 0;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() == NewArrayWithSpreadArgumentPLoc) {
++numProperties;
JSValue value = JSValue::decode(values[i]);
if (JSImmutableButterfly* immutableButterfly = jsDynamicCast<JSImmutableButterfly*>(vm, value))
checkedArraySize += immutableButterfly->publicLength();
else
checkedArraySize += 1;
}
}
// FIXME: we should throw an out of memory error here if checkedArraySize has hasOverflowed() or tryCreate() fails.
// https://bugs.webkit.org/show_bug.cgi?id=169784
unsigned arraySize = checkedArraySize; // Crashes if overflowed.
JSArray* result = JSArray::tryCreate(vm, structure, arraySize);
RELEASE_ASSERT(result);
#if ASSERT_ENABLED
// Ensure we see indices for everything in the range: [0, numProperties)
for (unsigned i = 0; i < numProperties; ++i) {
bool found = false;
for (unsigned j = 0; j < materialization->properties().size(); ++j) {
const ExitPropertyValue& property = materialization->properties()[j];
if (property.location().kind() == NewArrayWithSpreadArgumentPLoc && property.location().info() == i) {
found = true;
break;
}
}
ASSERT(found);
}
#endif // ASSERT_ENABLED
Vector<JSValue, 8> arguments;
arguments.grow(numProperties);
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location().kind() == NewArrayWithSpreadArgumentPLoc) {
JSValue value = JSValue::decode(values[i]);
RELEASE_ASSERT(property.location().info() < numProperties);
arguments[property.location().info()] = value;
}
}
unsigned arrayIndex = 0;
for (JSValue value : arguments) {
if (JSImmutableButterfly* immutableButterfly = jsDynamicCast<JSImmutableButterfly*>(vm, value)) {
for (unsigned i = 0; i < immutableButterfly->publicLength(); i++) {
ASSERT(immutableButterfly->get(i));
result->putDirectIndex(globalObject, arrayIndex, immutableButterfly->get(i));
++arrayIndex;
}
} else {
// We are not spreading.
result->putDirectIndex(globalObject, arrayIndex, value);
++arrayIndex;
}
}
return result;
}
case PhantomNewRegexp: {
RegExp* regExp = nullptr;
for (unsigned i = materialization->properties().size(); i--;) {
const ExitPropertyValue& property = materialization->properties()[i];
if (property.location() == PromotedLocationDescriptor(RegExpObjectRegExpPLoc)) {
RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits<RegExp>(vm));
regExp = jsCast<RegExp*>(JSValue::decode(values[i]));
}
}
RELEASE_ASSERT(regExp);
CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(materialization->origin(), callFrame->codeBlock()->baselineAlternative());
Structure* structure = codeBlock->globalObject()->regExpStructure();
static constexpr bool areLegacyFeaturesEnabled = true;
return RegExpObject::create(vm, structure, regExp, areLegacyFeaturesEnabled);
}
default:
RELEASE_ASSERT_NOT_REACHED();
return nullptr;
}
}
JSC_DEFINE_JIT_OPERATION(operationSwitchStringAndGetIndex, unsigned, (JSGlobalObject* globalObject, const UnlinkedStringJumpTable* unlinkedTable, JSString* string))
{
VM& vm = globalObject->vm();
CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
auto throwScope = DECLARE_THROW_SCOPE(vm);
StringImpl* strImpl = string->value(globalObject).impl();
RETURN_IF_EXCEPTION(throwScope, 0);
return unlinkedTable->indexForValue(strImpl, std::numeric_limits<unsigned>::max());
}
JSC_DEFINE_JIT_OPERATION(operationTypeOfObjectAsTypeofType, int32_t, (JSGlobalObject* globalObject, JSCell* object))
{
VM& vm = globalObject->vm();
CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
ASSERT(jsDynamicCast<JSObject*>(vm, object));
if (object->structure(vm)->masqueradesAsUndefined(globalObject))
return static_cast<int32_t>(TypeofType::Undefined);
if (object->isCallable(vm))
return static_cast<int32_t>(TypeofType::Function);
return static_cast<int32_t>(TypeofType::Object);
}
JSC_DEFINE_JIT_OPERATION(operationCompileFTLLazySlowPath, void*, (CallFrame* callFrame, unsigned index))
{
VM& vm = callFrame->deprecatedVM();
// Don't need an ActiveScratchBufferScope here because we DeferGCForAWhile.
// We cannot GC. We've got pointers in evil places.
DeferGCForAWhile deferGC(vm);
CodeBlock* codeBlock = callFrame->codeBlock();
JITCode* jitCode = codeBlock->jitCode()->ftl();
LazySlowPath& lazySlowPath = *jitCode->lazySlowPaths[index];
lazySlowPath.generate(codeBlock);
return lazySlowPath.stub().code().executableAddress();
}
JSC_DEFINE_JIT_OPERATION_WITH_ATTRIBUTES(operationReportBoundsCheckEliminationErrorAndCrash, NO_RETURN_DUE_TO_CRASH, void, (intptr_t codeBlockAsIntPtr, int32_t nodeIndex, int32_t child1Index, int32_t child2Index, int32_t checkedIndex, int32_t bounds))
{
CodeBlock* codeBlock = bitwise_cast<CodeBlock*>(codeBlockAsIntPtr);
dataLogLn("Bounds Check Eimination error found @ D@", nodeIndex, ": AssertInBounds(index D@", child1Index, ": ", checkedIndex, ", bounds D@", child2Index, " ", bounds, ") in ", codeBlock);
CRASH();
}
} } // namespace JSC::FTL
IGNORE_WARNINGS_END
#endif // ENABLE(FTL_JIT)