Google Git
Sign in
webkit / WebKit / 986dbe7566b126ce4e199e835da67c50600532de / . / Source / JavaScriptCore / ChangeLog
blob: ac527dd6803658874cde011f4971681ba5331d9a [file] [log] [blame]
2021-10-13 Jean-Yves Avenard <jya@apple.com>
Clearly distinguish serial from concurrent WorkQueue
https://bugs.webkit.org/show_bug.cgi?id=231418
rdar://problem/84021977
Reviewed by Chris Dumez.
Replace instances of WorkQueue being constructed as a concurrent one
with ConcurrentWorkQueue.
Remove the now unnecessary use of WorkQueue::Type::Serial in constructor.
* jit/ExecutableAllocator.cpp:
(JSC::dumpJITMemory):
* runtime/Watchdog.cpp:
(JSC::Watchdog::Watchdog):
2021-10-13 Yusuke Suzuki <ysuzuki@apple.com>
Unreviewed, build fix with new clang
* wasm/WasmValueLocation.h:
2021-10-13 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Update adjusted thread numbers
https://bugs.webkit.org/show_bug.cgi?id=231696
Reviewed by Saam Barati.
This adjusted numbers were empirically obtained at that time.
But after that, we switched bmalloc to libpas in ARM64 macOS
so that we removed scalability bottleneck in concurrent compilers.
We evaluated and adjusted the configuration again.
It improves Speedometer2 by 0.9% and JetStream2 by 0.7%.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.361667 |115.145000 |0.989544 | 0.000869 (significant) |
| VueJS-TodoMVC |23.195000 |22.483333 |0.969318 | 0.002243 (significant) |
| EmberJS-TodoMVC |124.720000 |121.211667 |0.971870 | 0.000000 (significant) |
| BackboneJS-TodoMVC |43.923333 |43.771667 |0.996547 | 0.338425 |
| Preact-TodoMVC |16.791667 |17.013333 |1.013201 | 0.337214 |
| AngularJS-TodoMVC |129.860000 |128.475000 |0.989335 | 0.000838 (significant) |
| Vanilla-ES2015-TodoMVC |61.703333 |61.625000 |0.998730 | 0.534118 |
| Inferno-TodoMVC |62.638333 |62.101667 |0.991432 | 0.045766 |
| Flight-TodoMVC |63.878333 |63.723333 |0.997574 | 0.578999 |
| Angular2-TypeScript-TodoMVC |41.601667 |40.015000 |0.961861 | 0.000070 (significant) |
| VanillaJS-TodoMVC |51.065000 |50.830000 |0.995398 | 0.284824 |
| jQuery-TodoMVC |213.223333 |212.976667 |0.998843 | 0.536898 |
| EmberJS-Debug-TodoMVC |333.051667 |331.588333 |0.995606 | 0.032867 |
| React-TodoMVC |82.665000 |82.540000 |0.998488 | 0.542365 |
| React-Redux-TodoMVC |134.823333 |133.665000 |0.991409 | 0.000002 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.983333 |59.941667 |0.999305 | 0.700077 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 271.53654
b mean = 274.08757
pValue = 0.0000000000
(Bigger means are better.)
1.009 times better
Results ARE significant
-------------------------------------------------------------------------------------------------------------------------
| subtest | pts | pts | b / a | pValue (significance using False Discovery Rate) |
-------------------------------------------------------------------------------------------------------------------------
| gaussian-blur |545.633826 |544.387097 |0.997715 | 0.632889 |
| HashSet-wasm |47.725969 |53.977426 |1.130986 | 0.014208 |
| gcc-loops-wasm |46.592278 |45.484195 |0.976217 | 0.188166 |
| json-parse-inspector |252.822356 |254.060654 |1.004898 | 0.261381 |
| prepack-wtb |60.534710 |60.580410 |1.000755 | 0.932640 |
| date-format-xparb-SP |445.456679 |450.988456 |1.012418 | 0.563115 |
| WSL |1.814989 |1.806757 |0.995464 | 0.035202 |
| OfflineAssembler |191.018184 |191.527453 |1.002666 | 0.512619 |
| cdjs |194.872003 |197.611972 |1.014060 | 0.006522 |
| UniPoker |522.254384 |520.751124 |0.997122 | 0.738800 |
| json-stringify-inspector |272.090046 |269.563607 |0.990715 | 0.156680 |
| crypto-sha1-SP |788.203441 |786.796976 |0.998216 | 0.889433 |
| Basic |705.357988 |704.506995 |0.998794 | 0.851524 |
| chai-wtb |108.246674 |109.283047 |1.009574 | 0.313095 |
| crypto-aes-SP |716.467647 |722.010176 |1.007736 | 0.589988 |
| Babylon |669.393771 |670.186691 |1.001185 | 0.908244 |
| string-unpack-code-SP |400.848798 |397.690936 |0.992122 | 0.379538 |
| stanford-crypto-aes |448.517790 |450.916593 |1.005348 | 0.421547 |
| raytrace |834.526654 |876.061864 |1.049771 | 0.000000 (significant) |
| multi-inspector-code-load |398.195009 |400.638554 |1.006137 | 0.624663 |
| hash-map |588.390020 |593.336508 |1.008407 | 0.032313 |
| stanford-crypto-pbkdf2 |705.031717 |714.947310 |1.014064 | 0.451490 |
| coffeescript-wtb |41.104563 |41.590079 |1.011812 | 0.104485 |
| Box2D |457.517551 |457.676651 |1.000348 | 0.938025 |
| lebab-wtb |63.284589 |63.746412 |1.007298 | 0.021550 |
| tsf-wasm |121.000104 |116.584889 |0.963511 | 0.566993 |
| base64-SP |627.310289 |631.360337 |1.006456 | 0.380323 |
| navier-stokes |717.211598 |715.546883 |0.997679 | 0.776740 |
| jshint-wtb |52.822264 |53.067727 |1.004647 | 0.265734 |
| regex-dna-SP |444.626036 |444.565652 |0.999864 | 0.981250 |
| async-fs |232.138408 |234.088380 |1.008400 | 0.084059 |
| crypto-md5-SP |738.555352 |739.048809 |1.000668 | 0.936794 |
| first-inspector-code-load |272.911902 |274.186589 |1.004671 | 0.223172 |
| segmentation |53.421830 |53.253527 |0.996850 | 0.488595 |
| typescript |26.619459 |26.404921 |0.991941 | 0.021613 |
| octane-code-load |1229.345392 |1238.504125 |1.007450 | 0.273224 |
| float-mm.c |17.443005 |17.474949 |1.001831 | 0.160549 |
| quicksort-wasm |472.609429 |490.175315 |1.037168 | 0.134603 |
| Air |420.285523 |422.507814 |1.005288 | 0.535574 |
| splay |472.850630 |484.805521 |1.025283 | 0.202943 |
| ai-astar |663.547782 |684.429114 |1.031469 | 0.035910 |
| acorn-wtb |68.978436 |69.675311 |1.010103 | 0.085505 |
| gbemu |159.998563 |154.256612 |0.964112 | 0.052665 |
| richards |957.006036 |970.082604 |1.013664 | 0.080437 |
| 3d-cube-SP |539.329388 |548.346324 |1.016719 | 0.126931 |
| espree-wtb |71.026174 |72.950691 |1.027096 | 0.005430 |
| bomb-workers |100.837095 |102.616328 |1.017645 | 0.024650 |
| tagcloud-SP |293.735729 |295.721652 |1.006761 | 0.604433 |
| mandreel |150.843346 |151.169263 |1.002161 | 0.406810 |
| 3d-raytrace-SP |503.282797 |508.519569 |1.010405 | 0.330728 |
| delta-blue |1064.779647 |1085.099791 |1.019084 | 0.111789 |
| ML |143.453624 |144.404535 |1.006629 | 0.054459 |
| regexp |465.598651 |469.139986 |1.007606 | 0.040131 |
| crypto |1534.715604 |1518.978823 |0.989746 | 0.398916 |
| richards-wasm |144.325337 |144.296964 |0.999803 | 0.993066 |
| earley-boyer |831.216095 |862.902139 |1.038120 | 0.089284 |
| octane-zlib |27.146237 |27.203847 |1.002122 | 0.668749 |
| date-format-tofte-SP |390.913746 |391.453527 |1.001381 | 0.837893 |
| n-body-SP |1142.063928 |1139.347984 |0.997622 | 0.764020 |
| pdfjs |183.711632 |185.851180 |1.011646 | 0.144519 |
| FlightPlanner |908.621057 |901.866743 |0.992566 | 0.434806 |
| uglify-js-wtb |34.644842 |34.797497 |1.004406 | 0.126209 |
| babylon-wtb |82.702004 |83.505631 |1.009717 | 0.092402 |
| stanford-crypto-sha256 |810.898597 |810.480366 |0.999484 | 0.943677 |
-------------------------------------------------------------------------------------------------------------------------
a mean = 242.30806
b mean = 243.91901
pValue = 0.0014473755
(Bigger means are better.)
1.007 times better
Results ARE significant
* runtime/Options.cpp:
(JSC::overrideDefaults):
2021-10-13 Mikhail R. Gadelha <mikhail@igalia.com>
[JSC][32bit] Fix wrong branchAdd32 assembly for ARMv7
https://bugs.webkit.org/show_bug.cgi?id=231362
Reviewed by Yusuke Suzuki.
After the unlinked baseline jit was merged, a new branchAdd32 method
needed to be implemented for ARMv7, however, the first version
submitted by me used the add32 method to perform the add before
branching.
In this patch, we fix the call to add32 by adding a new private method
add32Impl with an optional parameter that selects either add or adds,
make branchAdd32 call the adds version.
(Patch co-authored with Geza Lore)
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branchAdd32):
2021-10-12 Alexey Proskuryakov <ap@apple.com>
Invoke build scripts with python3 explicitly
https://bugs.webkit.org/show_bug.cgi?id=231587
Reviewed by Jonathan Bedard.
Much of the work to support Python 3 was done years ago, but we need this to
actually use Python 3 on macOS.
Python 3 no longer raises ValueError on relative module import failure, so changed
that to the correct ImportError.
* DerivedSources.make:
* Scripts/UpdateContents.py:
* Scripts/cssmin.py:
* Scripts/generate-combined-inspector-json.py:
* Scripts/generate-js-builtins.py:
* Scripts/inline-and-minify-stylesheets-and-scripts.py:
* Scripts/lazywriter.py:
* Scripts/make-js-file-arrays.py:
* Scripts/wkbuiltins/builtins_generate_combined_header.py:
* Scripts/wkbuiltins/builtins_generate_combined_implementation.py:
* Scripts/wkbuiltins/builtins_generate_internals_wrapper_header.py:
* Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py:
* Scripts/wkbuiltins/builtins_generate_separate_header.py:
* Scripts/wkbuiltins/builtins_generate_separate_implementation.py:
* Scripts/wkbuiltins/builtins_generate_wrapper_header.py:
* Scripts/wkbuiltins/builtins_generate_wrapper_implementation.py:
* Scripts/wkbuiltins/builtins_generator.py:
* Scripts/wkbuiltins/builtins_model.py:
* Scripts/wkbuiltins/builtins_templates.py:
* disassembler/udis86/ud_opcode.py:
(UdOpcodeTable.entries):
(UdOpcodeTables.addSSE2AVXInsn):
(itemslist): Deleted.
* inspector/scripts/codegen/cpp_generator.py:
* inspector/scripts/codegen/cpp_generator_templates.py:
* inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
* inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
* inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
* inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
* inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
* inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
* inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
* inspector/scripts/codegen/generate_js_backend_commands.py:
* inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
* inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
* inspector/scripts/codegen/generate_objc_configuration_header.py:
* inspector/scripts/codegen/generate_objc_configuration_implementation.py:
* inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
* inspector/scripts/codegen/generate_objc_header.py:
* inspector/scripts/codegen/generate_objc_internal_header.py:
* inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
* inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py:
* inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
* inspector/scripts/codegen/generator.py:
* inspector/scripts/codegen/generator_templates.py:
* inspector/scripts/codegen/models.py:
* inspector/scripts/codegen/objc_generator.py:
* inspector/scripts/codegen/objc_generator_templates.py:
* inspector/scripts/generate-inspector-protocol-bindings.py:
* wasm/generateWasm.py:
* wasm/generateWasmB3IRGeneratorInlinesHeader.py:
* wasm/generateWasmOpsHeader.py:
* yarr/create_regex_tables:
(in): Deleted.
* yarr/generateYarrCanonicalizeUnicode:
* yarr/generateYarrUnicodePropertyTables.py:
* yarr/hasher.py:
2021-10-13 Alex Christensen <achristensen@webkit.org>
Remove WTF::Variant and WTF::get
https://bugs.webkit.org/show_bug.cgi?id=231675
Reviewed by Chris Dumez.
* bytecode/StructureStubClearingWatchpoint.cpp:
(JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndInstallWatchpoint):
(JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::branchIfValue):
* jit/SnippetReg.h:
(JSC::SnippetReg::gpr const):
(JSC::SnippetReg::fpr const):
(JSC::SnippetReg::jsValueRegs const):
* jsc.cpp:
(JSC_DEFINE_HOST_FUNCTION):
* parser/Lexer.cpp:
(JSC::Lexer<T>::lexWithoutClearingLineTerminator):
* parser/VariableEnvironment.cpp:
(JSC::CompactTDZEnvironment::toTDZEnvironmentSlow const):
* parser/VariableEnvironment.h:
(JSC::CompactTDZEnvironment::toTDZEnvironment const):
* runtime/CacheUpdate.cpp:
(JSC::CacheUpdate::asGlobal const):
(JSC::CacheUpdate::asFunction const):
* runtime/CachedTypes.cpp:
(JSC::CachedCompactTDZEnvironment::encode):
* wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::ControlType::isCatch):
(JSC::Wasm::LLIntGenerator::ControlType::targetLabelForBranch const):
(JSC::Wasm::LLIntGenerator::addLoop):
(JSC::Wasm::LLIntGenerator::addElseToUnreachable):
(JSC::Wasm::LLIntGenerator::addCatchToUnreachable):
(JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable):
(JSC::Wasm::LLIntGenerator::addDelegateToUnreachable):
(JSC::Wasm::LLIntGenerator::addRethrow):
2021-10-13 Diego Pino Garcia <dpino@igalia.com>
[GTK] Unreviewed, build fix for Ubuntu 18.04 after r283852
* wasm/WasmB3IRGenerator.h:
2021-10-12 Ross Kirsling <ross.kirsling@sony.com>
Non-unified build fixes, October 2021 edition.
https://bugs.webkit.org/show_bug.cgi?id=231654
Reviewed by Don Olmstead.
* runtime/ControlFlowProfiler.h:
2021-10-12 Alex Christensen <achristensen@webkit.org>
Use std::variant instead of WTF::Variant
https://bugs.webkit.org/show_bug.cgi?id=231629
Reviewed by Chris Dumez.
* bytecode/StructureStubClearingWatchpoint.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCallDOM):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::branchIfValue):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::branchIfTruthy):
(JSC::AssemblyHelpers::branchIfFalsey):
* jit/SnippetReg.h:
* jsc.cpp:
* parser/Lexer.h:
* parser/VariableEnvironment.h:
* runtime/BytecodeCacheError.h:
* runtime/CachePayload.cpp:
(JSC::CachePayload::CachePayload):
* runtime/CachePayload.h:
* runtime/CacheUpdate.h:
* runtime/ISO8601.cpp:
(JSC::ISO8601::parseTimeZoneBracketedAnnotation):
* runtime/ISO8601.h:
* wasm/WasmLLIntGenerator.cpp:
2021-10-12 Chris Dumez <cdumez@apple.com>
Decrease use of makeWeakPtr()
https://bugs.webkit.org/show_bug.cgi?id=231615
Reviewed by Alex Christensen.
Decrease use of makeWeakPtr() and use WeakPtr { } directly instead.
* inspector/JSGlobalObjectInspectorController.cpp:
(Inspector::JSGlobalObjectInspectorController::consoleClient const):
* wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::registerInstance):
2021-10-12 Saam Barati <sbarati@apple.com>
Fix spec-correctness when inlining __proto__ intrinsic using get_by_id_with_this
https://bugs.webkit.org/show_bug.cgi?id=231559
Reviewed by Yusuke Suzuki.
My original fix in r283512 has some theoretical spec correctness issues.
I'm not sure if they can be materialized or not since we only use
get_by_id_with_this in very limited scenarios. However, this patch just
makes it so we call the getter instead of attempting to inline it
when using get_by_id_with_this.
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitLoadPrototypeWithoutCheck): Deleted.
* jit/AssemblyHelpers.h:
* jit/IntrinsicEmitter.cpp:
(JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter):
(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
2021-10-12 Alex Christensen <achristensen@webkit.org>
Use STL instead of WTF::get_if, WTF::Monostate, WTF::visit, and WTF::holds_alternative
https://bugs.webkit.org/show_bug.cgi?id=231582
Reviewed by Darin Adler.
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::branchIfValue):
* jsc.cpp:
(JSC_DEFINE_HOST_FUNCTION):
* parser/Lexer.cpp:
(JSC::Lexer<T>::lexWithoutClearingLineTerminator):
* parser/VariableEnvironment.h:
(JSC::CompactTDZEnvironment::toTDZEnvironment const):
* runtime/CacheUpdate.cpp:
(JSC::CacheUpdate::isGlobal const):
* runtime/CachedTypes.cpp:
(JSC::CachedCompactTDZEnvironment::encode):
* wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::ControlType::isLoop):
(JSC::Wasm::LLIntGenerator::ControlType::isTopLevel):
(JSC::Wasm::LLIntGenerator::ControlType::isBlock):
(JSC::Wasm::LLIntGenerator::ControlType::isIf):
(JSC::Wasm::LLIntGenerator::ControlType::isTry):
(JSC::Wasm::LLIntGenerator::ControlType::isAnyCatch):
(JSC::Wasm::LLIntGenerator::ControlType::isCatch):
(JSC::Wasm::LLIntGenerator::ControlType::targetLabelForBranch const):
(JSC::Wasm::LLIntGenerator::ControlType::branchTargetArity const):
(JSC::Wasm::LLIntGenerator::ControlType::branchTargetType const):
(JSC::Wasm::LLIntGenerator::addElse):
(JSC::Wasm::LLIntGenerator::addCatchToUnreachable):
(JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable):
(JSC::Wasm::LLIntGenerator::addRethrow):
(JSC::Wasm::LLIntGenerator::addEndToUnreachable):
2021-10-12 Alex Christensen <achristensen@webkit.org>
Begin migration from WTF::Variant to std::variant
https://bugs.webkit.org/show_bug.cgi?id=231086
Reviewed by Chris Dumez.
* bytecode/StructureStubClearingWatchpoint.cpp:
(JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCallDOM):
* runtime/TemporalTimeZone.cpp:
(JSC::TemporalTimeZone::createFromID):
(JSC::TemporalTimeZone::createFromUTCOffset):
2021-10-11 Saam Barati <sbarati@apple.com>
Remove ImplicitAddress
https://bugs.webkit.org/show_bug.cgi?id=230820
<rdar://problem/83826318>
Reviewed by Yusuke Suzuki.
Because we rely on implicit conversion from RegisterID to int values,
some compilers (aka MSVC) might convert a constant RegisterID that's passed in
to nullptr instead of calling the implicit constructor in ImplicitAddress.
For example, I got bit by this when I had code that did:
loadPtr(regT0, xyz)
This called the loadPtr(void*, RegisterID) function with nullptr passed as
the first argument instead of the loadPtr(ImplicitAddress, RegisterID)
function.
Let's avoid any such problems in the future by just not using ImplicitAddress.
* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::ImplicitAddress::ImplicitAddress): Deleted.
* assembler/MacroAssembler.h:
(JSC::MacroAssembler::pushToSave):
(JSC::MacroAssembler::popToRestore):
(JSC::MacroAssembler::loadPtr):
(JSC::MacroAssembler::storePtr):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::load64):
(JSC::MacroAssemblerARM64::load32):
(JSC::MacroAssemblerARM64::load16):
(JSC::MacroAssemblerARM64::load16Unaligned):
(JSC::MacroAssemblerARM64::load16SignedExtendTo32):
(JSC::MacroAssemblerARM64::load8):
(JSC::MacroAssemblerARM64::load8SignedExtendTo32):
(JSC::MacroAssemblerARM64::store64):
(JSC::MacroAssemblerARM64::store32):
(JSC::MacroAssemblerARM64::store16):
(JSC::MacroAssemblerARM64::store8):
(JSC::MacroAssemblerARM64::loadDouble):
(JSC::MacroAssemblerARM64::loadFloat):
(JSC::MacroAssemblerARM64::storeDouble):
(JSC::MacroAssemblerARM64::storeFloat):
(JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters):
(JSC::MacroAssemblerARM64::popToRestore):
(JSC::MacroAssemblerARM64::pushToSave):
(JSC::MacroAssemblerARM64::storePtrWithPatch):
(JSC::MacroAssemblerARM64::loadAcq8SignedExtendTo32):
(JSC::MacroAssemblerARM64::loadAcq8):
(JSC::MacroAssemblerARM64::storeRel8):
(JSC::MacroAssemblerARM64::loadAcq16SignedExtendTo32):
(JSC::MacroAssemblerARM64::loadAcq16):
(JSC::MacroAssemblerARM64::storeRel16):
(JSC::MacroAssemblerARM64::loadAcq32):
(JSC::MacroAssemblerARM64::loadAcq64):
(JSC::MacroAssemblerARM64::storeRel32):
(JSC::MacroAssemblerARM64::storeRel64):
(JSC::MacroAssemblerARM64::loadLink8):
(JSC::MacroAssemblerARM64::loadLinkAcq8):
(JSC::MacroAssemblerARM64::storeCond8):
(JSC::MacroAssemblerARM64::storeCondRel8):
(JSC::MacroAssemblerARM64::loadLink16):
(JSC::MacroAssemblerARM64::loadLinkAcq16):
(JSC::MacroAssemblerARM64::storeCond16):
(JSC::MacroAssemblerARM64::storeCondRel16):
(JSC::MacroAssemblerARM64::loadLink32):
(JSC::MacroAssemblerARM64::loadLinkAcq32):
(JSC::MacroAssemblerARM64::storeCond32):
(JSC::MacroAssemblerARM64::storeCondRel32):
(JSC::MacroAssemblerARM64::loadLink64):
(JSC::MacroAssemblerARM64::loadLinkAcq64):
(JSC::MacroAssemblerARM64::storeCond64):
(JSC::MacroAssemblerARM64::storeCondRel64):
(JSC::MacroAssemblerARM64::extractSimpleAddress):
* assembler/MacroAssemblerARM64E.h:
(JSC::MacroAssemblerARM64E::atomicXchgAdd8):
(JSC::MacroAssemblerARM64E::atomicXchgAdd16):
(JSC::MacroAssemblerARM64E::atomicXchgAdd32):
(JSC::MacroAssemblerARM64E::atomicXchgAdd64):
(JSC::MacroAssemblerARM64E::atomicXchgXor8):
(JSC::MacroAssemblerARM64E::atomicXchgXor16):
(JSC::MacroAssemblerARM64E::atomicXchgXor32):
(JSC::MacroAssemblerARM64E::atomicXchgXor64):
(JSC::MacroAssemblerARM64E::atomicXchgOr8):
(JSC::MacroAssemblerARM64E::atomicXchgOr16):
(JSC::MacroAssemblerARM64E::atomicXchgOr32):
(JSC::MacroAssemblerARM64E::atomicXchgOr64):
(JSC::MacroAssemblerARM64E::atomicXchgClear8):
(JSC::MacroAssemblerARM64E::atomicXchgClear16):
(JSC::MacroAssemblerARM64E::atomicXchgClear32):
(JSC::MacroAssemblerARM64E::atomicXchgClear64):
(JSC::MacroAssemblerARM64E::atomicXchg8):
(JSC::MacroAssemblerARM64E::atomicXchg16):
(JSC::MacroAssemblerARM64E::atomicXchg32):
(JSC::MacroAssemblerARM64E::atomicXchg64):
(JSC::MacroAssemblerARM64E::atomicStrongCAS8):
(JSC::MacroAssemblerARM64E::atomicStrongCAS16):
(JSC::MacroAssemblerARM64E::atomicStrongCAS32):
(JSC::MacroAssemblerARM64E::atomicStrongCAS64):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::or8):
(JSC::MacroAssemblerARMv7::or16):
(JSC::MacroAssemblerARMv7::or32):
(JSC::MacroAssemblerARMv7::load32):
(JSC::MacroAssemblerARMv7::load8):
(JSC::MacroAssemblerARMv7::load8SignedExtendTo32):
(JSC::MacroAssemblerARMv7::load16):
(JSC::MacroAssemblerARMv7::load16SignedExtendTo32):
(JSC::MacroAssemblerARMv7::store32):
(JSC::MacroAssemblerARMv7::store16):
(JSC::MacroAssemblerARMv7::loadDouble):
(JSC::MacroAssemblerARMv7::loadFloat):
(JSC::MacroAssemblerARMv7::storeDouble):
(JSC::MacroAssemblerARMv7::storeFloat):
(JSC::MacroAssemblerARMv7::storePtrWithPatch):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::load8):
(JSC::MacroAssemblerMIPS::load8SignedExtendTo32):
(JSC::MacroAssemblerMIPS::load32):
(JSC::MacroAssemblerMIPS::load16):
(JSC::MacroAssemblerMIPS::store8):
(JSC::MacroAssemblerMIPS::store16):
(JSC::MacroAssemblerMIPS::store32):
(JSC::MacroAssemblerMIPS::storePtrWithPatch):
(JSC::MacroAssemblerMIPS::loadFloat):
(JSC::MacroAssemblerMIPS::loadDouble):
(JSC::MacroAssemblerMIPS::storeFloat):
(JSC::MacroAssemblerMIPS::storeDouble):
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::load32):
(JSC::MacroAssemblerX86Common::load16Unaligned):
(JSC::MacroAssemblerX86Common::load8):
(JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
(JSC::MacroAssemblerX86Common::load16):
(JSC::MacroAssemblerX86Common::store32):
(JSC::MacroAssemblerX86Common::store16):
(JSC::MacroAssemblerX86Common::loadDouble):
(JSC::MacroAssemblerX86Common::loadFloat):
(JSC::MacroAssemblerX86Common::storeDouble):
(JSC::MacroAssemblerX86Common::storeFloat):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::load8):
(JSC::MacroAssemblerX86_64::load32):
(JSC::MacroAssemblerX86_64::store32):
(JSC::MacroAssemblerX86_64::load64):
(JSC::MacroAssemblerX86_64::store64):
(JSC::MacroAssemblerX86_64::storePtrWithPatch):
* assembler/testmasm.cpp:
(JSC::testBranchTruncateDoubleToInt32):
(JSC::testLoadPrePostIndex32):
(JSC::testLoadPrePostIndex64):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileStringSlice):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
(JSC::DFG::SpeculativeJIT::compileClearCatchLocals):
* ftl/FTLLocation.cpp:
(JSC::FTL::Location::restoreInto const):
* ftl/FTLThunks.cpp:
(JSC::FTL::genericGenerationThunkGenerator):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::debugCall):
(JSC::AssemblyHelpers::sanitizeStackInline):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitGetVarFromIndirectPointer):
* jit/ThunkGenerators.cpp:
(JSC::arityFixupGenerator):
* wasm/WasmBinding.cpp:
(JSC::Wasm::wasmToWasm):
* yarr/YarrJIT.cpp:
2021-10-11 Saam Barati <sbarati@apple.com>
Share more code that uses ScratchRegisterAllocator in the ICs
https://bugs.webkit.org/show_bug.cgi?id=231125
<rdar://problem/84066374>
Reviewed by Sam Weinig.
We had the same code to allocate a scratch register allocator copy pasted
all over the IC code. This patch refactors that to use a shared helper.
Also, Delete was using a ScratchRegisterAllocator for no reason (it never
allocated a scratch register), so I deleted that code.
* bytecode/AccessCase.cpp:
(JSC::AccessCase::generateWithGuard):
(JSC::AccessCase::generateImpl):
* bytecode/GetterSetterAccessCase.cpp:
(JSC::GetterSetterAccessCase::emitDOMJITGetter):
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessGenerationState::makeDefaultScratchAllocator):
(JSC::PolymorphicAccess::regenerate):
* bytecode/PolymorphicAccess.h:
* jit/IntrinsicEmitter.cpp:
(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
2021-10-11 Saam Barati <sbarati@apple.com>
Don't branch around register allocation in DFG enumerator get by val and pass in the right LValue type to strictInt52ToJSValue
https://bugs.webkit.org/show_bug.cgi?id=231465
<rdar://83876470>
Reviewed by Yusuke Suzuki.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
2021-10-11 Geza Lore <glore@igalia.com>
[JSC][ARMv7] Make LLInt CSR save/restore order match the JITs
https://bugs.webkit.org/show_bug.cgi?id=231517
Reviewed by Saam Barati.
Since the new unlinked baseline JIT was introduced, the baseline JIT
uses the metadata table GPR the same way as the LLInt does, and relies
on it being in a saved CSR in emit_op_catch. This unearthed an issue
in the order in which LLInt on ARMv7 stores and restores CSRs when
trying to handle exceptions. This patch fixes the mismatch.
* llint/LowLevelInterpreter.asm:
2021-10-11 Alex Christensen <achristensen@webkit.org>
Prepare to switch from WTF::Variant to std::variant
https://bugs.webkit.org/show_bug.cgi?id=231239
Reviewed by Chris Dumez.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCallDOM):
* parser/Lexer.cpp:
(JSC::Lexer<T>::parseHex):
(JSC::Lexer<T>::parseBinary):
(JSC::Lexer<T>::parseOctal):
(JSC::Lexer<T>::parseDecimal):
* runtime/CachePayload.cpp:
(JSC::CachePayload::data const):
(JSC::CachePayload::size const):
* runtime/CacheUpdate.cpp:
(JSC::CacheUpdate::CacheUpdate):
2021-10-11 Keith Miller <keith_miller@apple.com>
SourceID should have a type name and only be 32-bits
https://bugs.webkit.org/show_bug.cgi?id=231436
Reviewed by Filip Pizlo.
This patch gives SourceID a proper type name and shrinks it to
32-bits on 64-bit systems. Shrinking the size makes room on
SourceProvider for metadata in a future patch I'm working on.
It's also pretty unlikely that any system has more than ~4 billion
script tags, evals, wasm modules so shinking the size is unlikely
to cause any debugger/profiling issues.
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/TypeLocation.h:
* debugger/Debugger.cpp:
(JSC::Debugger::toggleBreakpoint):
(JSC::Debugger::pauseIfNeeded):
* debugger/DebuggerLocation.h:
(JSC::DebuggerLocation::DebuggerLocation):
* debugger/DebuggerPrimitives.h:
* inspector/JavaScriptCallFrame.h:
(Inspector::JavaScriptCallFrame::sourceID const):
* inspector/ScriptCallStackFactory.cpp:
(Inspector::CreateScriptCallStackFunctor::operator() const):
(Inspector::createScriptCallStackFromException):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::Frame::sourceID):
* interpreter/StackVisitor.h:
* parser/Nodes.h:
(JSC::ScopeNode::sourceID const):
* parser/SourceCode.h:
(JSC::SourceCode::SourceCode):
(JSC::SourceCode::firstLine const):
(JSC::SourceCode::startColumn const):
(JSC::SourceCode::providerID const):
(JSC::SourceCode::provider const):
(JSC::SourceCode::operator== const):
(JSC::SourceCode::operator!= const):
(JSC::makeSource):
(JSC::SourceCode::subExpression const):
* parser/SourceProvider.cpp:
(JSC::SourceProvider::getID):
* parser/SourceProvider.h:
(JSC::SourceProvider::asID):
* runtime/ControlFlowProfiler.cpp:
(JSC::ControlFlowProfiler::getBasicBlockLocation):
(JSC::ControlFlowProfiler::getBasicBlocksForSourceID const):
(JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted):
(JSC::ControlFlowProfiler::basicBlockExecutionCountAtTextOffset):
* runtime/ControlFlowProfiler.h:
* runtime/FunctionHasExecutedCache.cpp:
(JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
(JSC::FunctionHasExecutedCache::insertUnexecutedRange):
(JSC::FunctionHasExecutedCache::removeUnexecutedRange):
(JSC::FunctionHasExecutedCache::getFunctionRanges):
* runtime/FunctionHasExecutedCache.h:
* runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::StackFrame::sourceID):
* runtime/SamplingProfiler.h:
* runtime/ScriptExecutable.h:
(JSC::ScriptExecutable::sourceID const):
* runtime/StackFrame.cpp:
(JSC::StackFrame::sourceID const):
* runtime/StackFrame.h:
* runtime/TypeLocationCache.cpp:
(JSC::TypeLocationCache::getTypeLocation):
* runtime/TypeLocationCache.h:
* runtime/TypeProfiler.cpp:
(JSC::TypeProfiler::typeInformationForExpressionAtOffset):
(JSC::TypeProfiler::findLocation):
* runtime/TypeProfiler.h:
(JSC::QueryKey::QueryKey):
(JSC::QueryKey::isHashTableDeletedValue const):
2021-10-11 Geza Lore <glore@igalia.com>
[JSC][32bit] Fix profiling in baseline
https://bugs.webkit.org/show_bug.cgi?id=231368
Reviewed by Yusuke Suzuki.
Fixes profiling omissions introduced with the recent 32-bit baseline
build fixes, and also brings the rest of profile updates in-line with
the unlinked baseline on 64-bit platforms.
* jit/JIT.h:
* jit/JITCall32_64.cpp:
(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileOpCall):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):
* jit/JITInlines.h:
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitArrayProfilingSiteWithCell):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
2021-10-10 Sihui Liu <sihui_liu@apple.com>
Add support for iterating FileSystemDirectoryHandle
https://bugs.webkit.org/show_bug.cgi?id=231142
<rdar://problem/83848092>
Reviewed by Youenn Fablet and Yusuke Suzuki.
* CMakeLists.txt:
* runtime/JSBoundFunction.h:
* runtime/JSGlobalObject.h:
* runtime/JSGlobalObjectInlines.h:
(JSC::JSGlobalObject::performPromiseThenFunction const):
* runtime/JSPromise.cpp:
(JSC::JSPromise::createNewPromiseCapability):
(JSC::JSPromise::convertCapabilityToDeferredData):
(JSC::JSPromise::createDeferredData):
(JSC::JSPromise::performPromiseThen):
* runtime/JSPromise.h:
2021-10-09 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Refine RegExp#compile based on regexp-legacy-features proposal
https://bugs.webkit.org/show_bug.cgi?id=231486
Reviewed by Alexey Shvayka.
This patch refines RegExp#compile based regexp-legacy-features proposal[1].
We add legacyFeaturesDisabledFlag flag to RegExpObject so that we can
detect [[LegacyFeaturesEnabled]].
We also add regExpRecompiledWatchpoint to JSGlobalObject. We have strength
reduction in DFG / FTL, but we should recompile DFG / FTL code when RegExp
is recompiled. Since it is rare, instead of having this watchpoint per
RegExpObject, we hold it in JSGlobalObject.
[1]: https://github.com/tc39/proposal-regexp-legacy-features
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewRegexp):
(JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* ftl/FTLOperations.cpp:
(JSC::FTL::JSC_DEFINE_JIT_OPERATION):
* jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::regExpRecompiledWatchpoint):
(JSC::JSGlobalObject::isRegExpRecompiled const):
* runtime/RegExpConstructor.cpp:
(JSC::areLegacyFeaturesEnabled):
(JSC::regExpCreate):
(JSC::constructRegExp):
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::RegExpObject):
* runtime/RegExpObject.h:
* runtime/RegExpPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
2021-10-08 Saam Barati <sbarati@apple.com>
Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser
https://bugs.webkit.org/show_bug.cgi?id=230823
<rdar://problem/83565088>
Reviewed by Yusuke Suzuki.
When I ported the phase to run right after bytecode parsing, I wanted
to maintain the same behavior as the prior pass that ran after CPS
rethreading. I noticed a slight bug in some of my logic that changed
some of heuristics and how they'd effect double voting.
The old patch was mimicking the "is loaded from" bit by using the NodeFlags.
Howver, this has some issues with how this interacts with our other uses
of NodeFlags. So, to make things simple, I just add a new "VariableIsUsed"
bit.
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
2021-10-08 Tadeu Zagallo <tzagallo@apple.com> and Keith Miller <keith_miller@apple.com>
Implement the WebAssembly exception handling proposal
https://bugs.webkit.org/show_bug.cgi?id=229681
<rdar://81603387>
Reviewed by Keith Miller.
Add support for the WebAssembly exception handling proposal, as per
the WIP spec: https://github.com/WebAssembly/exception-handling
The proposal includes 6 new instructions: try, catch, catch_all,
delegate, throw and rethrow. All the instructions are supported by
the LLInt and B3 generators, but not yet supported in Air. Any
functions use exceptions will use B3 in BBQ.
A few important notes about the implementation:
- In B3, since we can now have multiple entrypoints (one for the
function entry + 1 for each catch/catch_all), we can no longer just
replace every value in the stack with a Phi when we find a new
entrypoint. This worked so far because of the assumption that any
block couldn't access its enclosing stack, and since the enclosing stack
would only be accessible when we exited the current block, we added Phis
at the end of each block when we had a new entrypoint. Now, since we have to capture all
live values at any point that might throw (calls, throw and rethrow),
we break that assumption. To simplify all the possible ways we might
have to merge the state from multiple entrypoints we now use B3
Variables to represent stack slots.
- Some extra information is required to be able to properly restore
the state when catching an exception:
- We added a field VM::calleeForWasmCatch. This field is necessary
because whenever we throw, we might end up in JavaScript, which
assumes the callee is a cell and uses it to get the VM and restore
callee saves. The issue is when catching exceptions in wasm we
still need the original callee, and if throwing and catching from
the same frame, that call frame slot has now been overwritten, so
we store its original value in the VM field.
- We also need to store the current Wasm Instance into the call
frame's slot for the `this` argument. The instance is used both by
the unwinder, to check if the exception being thrown matches the
exceptions handled by catch candidates, and by the catch implementation,
which is necessary when throwing from a cross instance call where both
the callee save or TLS will have the callee's instance.
- We store the current opcode for the llint, or the
call site index for B3, in the call frame slot for the argument
count tag. The call site index is used by the unwinder to check
if a given catch can handle the exception being thrown.
* DerivedSources-input.xcfilelist:
* DerivedSources-output.xcfilelist:
* DerivedSources.make:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/BytecodeList.rb:
* bytecode/HandlerInfo.h:
* bytecode/Instruction.h:
(JSC::BaseInstruction::name const):
* interpreter/CallFrame.cpp:
(JSC::CallFrame::bytecodeIndex const):
* interpreter/CallFrame.h:
(JSC::CallSiteIndex::CallSiteIndex):
(JSC::CallSiteIndex::hash const):
(JSC::CallSiteIndex::deletedValue):
(JSC::CallSiteIndex::isHashTableDeletedValue const):
(JSC::CallSiteIndexHash::hash):
(JSC::CallSiteIndexHash::equal):
* interpreter/Interpreter.cpp:
(JSC::CatchInfo::CatchInfo):
(JSC::UnwindFunctor::UnwindFunctor):
(JSC::UnwindFunctor::operator() const):
(JSC::Interpreter::unwind):
* interpreter/Interpreter.h:
(JSC::CatchInfo::CatchInfo):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::readNonInlinedFrame):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer):
(JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
(JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBufferImpl):
* jit/AssemblyHelpers.h:
* jit/JITExceptions.cpp:
(JSC::genericUnwind):
* jit/JSInterfaceJIT.h:
(JSC::JSInterfaceJIT::convertCalleeToVM):
* llint/LLIntData.h:
(JSC::LLInt::getCodeRef):
(JSC::LLInt::getWide16CodeRef):
(JSC::LLInt::getWide32CodeRef):
* llint/LLIntExceptions.cpp:
(JSC::LLInt::wasmReturnToThrow):
(JSC::LLInt::handleWasmCatch):
(JSC::LLInt::handleWasmCatchAll):
* llint/LLIntExceptions.h:
* llint/LLIntOffsetsExtractor.cpp:
* llint/WebAssembly.asm:
* runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::ErrorInstance):
* runtime/ErrorInstance.h:
(JSC::ErrorInstance::setCatchableFromWasm):
(JSC::ErrorInstance::isCatchableFromWasm const):
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
* runtime/OptionsList.h:
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
(JSC::VM::calleeForWasmCatchOffset):
* wasm/WasmAirIRGenerator.cpp:
(JSC::Wasm::AirIRGenerator::ControlData::isTry):
(JSC::Wasm::AirIRGenerator::ControlData::isCatch):
(JSC::Wasm::AirIRGenerator::ControlData::isAnyCatch):
(JSC::Wasm::AirIRGenerator::ControlData::isLoop):
(JSC::Wasm::AirIRGenerator::ControlData::isBlock):
(JSC::Wasm::AirIRGenerator::ControlData::dump const):
(JSC::Wasm::AirIRGenerator::addTry):
(JSC::Wasm::AirIRGenerator::addCatch):
(JSC::Wasm::AirIRGenerator::addCatchToUnreachable):
(JSC::Wasm::AirIRGenerator::addCatchAll):
(JSC::Wasm::AirIRGenerator::addCatchAllToUnreachable):
(JSC::Wasm::AirIRGenerator::addDelegate):
(JSC::Wasm::AirIRGenerator::addDelegateToUnreachable):
(JSC::Wasm::AirIRGenerator::addThrow):
(JSC::Wasm::AirIRGenerator::addRethrow):
* wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::ControlData::ControlData):
(JSC::Wasm::B3IRGenerator::ControlData::isTry):
(JSC::Wasm::B3IRGenerator::ControlData::isAnyCatch):
(JSC::Wasm::B3IRGenerator::ControlData::isLoop):
(JSC::Wasm::B3IRGenerator::ControlData::isBlock):
(JSC::Wasm::B3IRGenerator::ControlData::isCatch):
(JSC::Wasm::B3IRGenerator::ControlData::dump const):
(JSC::Wasm::B3IRGenerator::ControlData::convertTryToCatch):
(JSC::Wasm::B3IRGenerator::ControlData::convertTryToCatchAll):
(JSC::Wasm::B3IRGenerator::ControlData::tryStart const):
(JSC::Wasm::B3IRGenerator::ControlData::tryEnd const):
(JSC::Wasm::B3IRGenerator::ControlData::tryDepth const):
(JSC::Wasm::B3IRGenerator::ControlData::catchKind const):
(JSC::Wasm::B3IRGenerator::ControlData::exception const):
(JSC::Wasm::B3IRGenerator::ControlData::stackSize const):
(JSC::Wasm::B3IRGenerator::didPopValueFromStack):
(JSC::Wasm::B3IRGenerator::addStackMap):
(JSC::Wasm::B3IRGenerator::takeStackmaps):
(JSC::Wasm::B3IRGenerator::takeExceptionHandlers):
(JSC::Wasm::B3IRGenerator::push):
(JSC::Wasm::B3IRGenerator::get):
(JSC::Wasm::B3IRGenerator::set):
(JSC::Wasm::PatchpointExceptionHandle::generate const):
(JSC::Wasm::B3IRGenerator::fixupPointerPlusOffset):
(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
(JSC::Wasm::B3IRGenerator::insertEntrySwitch):
(JSC::Wasm::B3IRGenerator::insertConstants):
(JSC::Wasm::B3IRGenerator::addRefIsNull):
(JSC::Wasm::B3IRGenerator::addTableGet):
(JSC::Wasm::B3IRGenerator::addTableSet):
(JSC::Wasm::B3IRGenerator::addRefFunc):
(JSC::Wasm::B3IRGenerator::addTableInit):
(JSC::Wasm::B3IRGenerator::addTableSize):
(JSC::Wasm::B3IRGenerator::addTableGrow):
(JSC::Wasm::B3IRGenerator::addTableFill):
(JSC::Wasm::B3IRGenerator::addTableCopy):
(JSC::Wasm::B3IRGenerator::getLocal):
(JSC::Wasm::B3IRGenerator::emitIndirectCall):
(JSC::Wasm::B3IRGenerator::addGrowMemory):
(JSC::Wasm::B3IRGenerator::addCurrentMemory):
(JSC::Wasm::B3IRGenerator::addMemoryFill):
(JSC::Wasm::B3IRGenerator::addMemoryInit):
(JSC::Wasm::B3IRGenerator::addMemoryCopy):
(JSC::Wasm::B3IRGenerator::setLocal):
(JSC::Wasm::B3IRGenerator::getGlobal):
(JSC::Wasm::B3IRGenerator::setGlobal):
(JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
(JSC::Wasm::B3IRGenerator::emitLoadOp):
(JSC::Wasm::B3IRGenerator::load):
(JSC::Wasm::B3IRGenerator::emitStoreOp):
(JSC::Wasm::B3IRGenerator::store):
(JSC::Wasm::B3IRGenerator::sanitizeAtomicResult):
(JSC::Wasm::B3IRGenerator::fixupPointerPlusOffsetForAtomicOps):
(JSC::Wasm::B3IRGenerator::emitAtomicLoadOp):
(JSC::Wasm::B3IRGenerator::atomicLoad):
(JSC::Wasm::B3IRGenerator::emitAtomicStoreOp):
(JSC::Wasm::B3IRGenerator::atomicStore):
(JSC::Wasm::B3IRGenerator::emitAtomicBinaryRMWOp):
(JSC::Wasm::B3IRGenerator::atomicBinaryRMW):
(JSC::Wasm::B3IRGenerator::emitAtomicCompareExchange):
(JSC::Wasm::B3IRGenerator::atomicCompareExchange):
(JSC::Wasm::B3IRGenerator::atomicWait):
(JSC::Wasm::B3IRGenerator::atomicNotify):
(JSC::Wasm::B3IRGenerator::truncSaturated):
(JSC::Wasm::B3IRGenerator::addSelect):
(JSC::Wasm::B3IRGenerator::addConstant):
(JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
(JSC::Wasm::B3IRGenerator::loadFromScratchBuffer):
(JSC::Wasm::B3IRGenerator::connectControlEntry):
(JSC::Wasm::B3IRGenerator::addLoop):
(JSC::Wasm::B3IRGenerator::addTopLevel):
(JSC::Wasm::B3IRGenerator::addBlock):
(JSC::Wasm::B3IRGenerator::addIf):
(JSC::Wasm::B3IRGenerator::addElse):
(JSC::Wasm::B3IRGenerator::addElseToUnreachable):
(JSC::Wasm::B3IRGenerator::addTry):
(JSC::Wasm::B3IRGenerator::addCatch):
(JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions):
(JSC::Wasm::B3IRGenerator::addCatchToUnreachable):
(JSC::Wasm::B3IRGenerator::addCatchAll):
(JSC::Wasm::B3IRGenerator::addCatchAllToUnreachable):
(JSC::Wasm::B3IRGenerator::emitCatchImpl):
(JSC::Wasm::B3IRGenerator::addDelegate):
(JSC::Wasm::B3IRGenerator::addDelegateToUnreachable):
(JSC::Wasm::B3IRGenerator::addThrow):
(JSC::Wasm::B3IRGenerator::addRethrow):
(JSC::Wasm::B3IRGenerator::addReturn):
(JSC::Wasm::B3IRGenerator::addBranch):
(JSC::Wasm::B3IRGenerator::addSwitch):
(JSC::Wasm::B3IRGenerator::endBlock):
(JSC::Wasm::B3IRGenerator::addEndToUnreachable):
(JSC::Wasm::B3IRGenerator::createCallPatchpoint):
(JSC::Wasm::B3IRGenerator::addCall):
(JSC::Wasm::B3IRGenerator::addCallIndirect):
(JSC::Wasm::B3IRGenerator::addCallRef):
(JSC::Wasm::B3IRGenerator::unify):
(JSC::Wasm::B3IRGenerator::unifyValuesWithBlock):
(JSC::Wasm::parseAndCompile):
(JSC::Wasm::computeExceptionHandlerLocations):
(JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32DivS>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32RemS>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32DivU>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32RemU>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64DivS>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64RemS>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64DivU>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64RemU>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32Ctz>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64Ctz>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
(JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
* wasm/WasmB3IRGenerator.h:
* wasm/WasmBBQPlan.cpp:
(JSC::Wasm::BBQPlan::prepareImpl):
(JSC::Wasm::BBQPlan::work):
(JSC::Wasm::BBQPlan::compileFunction):
(JSC::Wasm::BBQPlan::didCompleteCompilation):
(JSC::Wasm::BBQPlan::initializeCallees):
* wasm/WasmBBQPlan.h:
* wasm/WasmCallee.cpp:
(JSC::Wasm::Callee::handlerForIndex):
(JSC::Wasm::LLIntCallee::LLIntCallee):
(JSC::Wasm::LLIntCallee::linkExceptionHandlers):
(JSC::Wasm::OptimizingJITCallee::linkExceptionHandlers):
(JSC::Wasm::OptimizingJITCallee::stackmap const):
* wasm/WasmCallee.h:
(JSC::Wasm::Callee::hasExceptionHandlers const):
(JSC::Wasm::Callee::functionCodeBlock const):
(JSC::Wasm::OptimizingJITCallee::OptimizingJITCallee):
* wasm/WasmCallingConvention.h:
(JSC::Wasm::WasmCallingConvention::callInformationFor const):
* wasm/WasmFormat.h:
(JSC::Wasm::typeToString):
(JSC::Wasm::isValidExternalKind):
(JSC::Wasm::makeString):
* wasm/WasmFunctionCodeBlock.h:
(JSC::Wasm::FunctionCodeBlock::numberOfExceptionHandlers const):
(JSC::Wasm::FunctionCodeBlock::exceptionHandler):
(JSC::Wasm::FunctionCodeBlock::addExceptionHandler):
* wasm/WasmFunctionParser.h:
(JSC::Wasm::isTryOrCatch):
(JSC::Wasm::FunctionParser<Context>::parseExceptionIndex):
(JSC::Wasm::FunctionParser<Context>::parseExpression):
(JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
* wasm/WasmHandlerInfo.cpp: Added.
(JSC::Wasm::HandlerInfo::initialize):
(JSC::Wasm::HandlerInfo::handlerForIndex):
* wasm/WasmHandlerInfo.h: Added.
(JSC::Wasm::UnlinkedHandlerInfo::UnlinkedHandlerInfo):
(JSC::Wasm::HandlerInfo::tag const):
(JSC::Wasm::HandlerInfo::delegateTarget const):
* wasm/WasmInstance.cpp:
(JSC::Wasm::Instance::~Instance):
* wasm/WasmInstance.h:
(JSC::Wasm::Instance::addTag):
(JSC::Wasm::Instance::tag const):
* wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::ControlType::try_):
(JSC::Wasm::LLIntGenerator::ControlType::catch_):
(JSC::Wasm::LLIntGenerator::ControlType::isLoop):
(JSC::Wasm::LLIntGenerator::ControlType::isBlock):
(JSC::Wasm::LLIntGenerator::ControlType::isIf):
(JSC::Wasm::LLIntGenerator::ControlType::isTry):
(JSC::Wasm::LLIntGenerator::ControlType::isAnyCatch):
(JSC::Wasm::LLIntGenerator::ControlType::isCatch):
(JSC::Wasm::LLIntGenerator::unifyValuesWithBlock):
(JSC::Wasm::LLIntGenerator::walkExpressionStack):
(JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
(JSC::Wasm::parseAndCompileBytecode):
(JSC::Wasm::LLIntGenerator::LLIntGenerator):
(JSC::Wasm::LLIntGenerator::repatch):
(JSC::Wasm::LLIntGenerator::finalize):
(JSC::Wasm::LLIntGenerator::callInformationForCaller):
(JSC::Wasm::LLIntGenerator::callInformationForCallee):
(JSC::Wasm::LLIntGenerator::addArguments):
(JSC::Wasm::LLIntGenerator::addLoop):
(JSC::Wasm::LLIntGenerator::addTry):
(JSC::Wasm::LLIntGenerator::finalizePreviousBlockForCatch):
(JSC::Wasm::LLIntGenerator::addCatch):
(JSC::Wasm::LLIntGenerator::addCatchToUnreachable):
(JSC::Wasm::LLIntGenerator::addCatchAll):
(JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable):
(JSC::Wasm::LLIntGenerator::addDelegate):
(JSC::Wasm::LLIntGenerator::addDelegateToUnreachable):
(JSC::Wasm::LLIntGenerator::addThrow):
(JSC::Wasm::LLIntGenerator::addRethrow):
(JSC::Wasm::LLIntGenerator::endBlock):
(JSC::Wasm::LLIntGenerator::addEndToUnreachable):
* wasm/WasmLLIntGenerator.h:
* wasm/WasmLimits.h:
* wasm/WasmModuleInformation.cpp:
* wasm/WasmModuleInformation.h:
(JSC::Wasm::ModuleInformation::exceptionIndexSpaceSize const):
(JSC::Wasm::ModuleInformation::isImportedExceptionFromExceptionIndexSpace const):
(JSC::Wasm::ModuleInformation::signatureIndexFromExceptionIndexSpace const):
(JSC::Wasm::ModuleInformation::importExceptionCount const):
(JSC::Wasm::ModuleInformation::isDeclaredException const):
(JSC::Wasm::ModuleInformation::addDeclaredException):
* wasm/WasmOMGForOSREntryPlan.cpp:
(JSC::Wasm::OMGForOSREntryPlan::work):
* wasm/WasmOMGPlan.cpp:
(JSC::Wasm::OMGPlan::work):
* wasm/WasmOSREntryData.h:
(JSC::Wasm::OSREntryData::values):
* wasm/WasmOperations.cpp:
(JSC::Wasm::loadValuesIntoBuffer):
(JSC::Wasm::doOSREntry):
(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
* wasm/WasmOperations.h:
* wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseImport):
(JSC::Wasm::SectionParser::parseExport):
(JSC::Wasm::SectionParser::parseException):
* wasm/WasmSections.h:
(JSC::Wasm::validateOrder):
* wasm/WasmSignature.cpp:
(JSC::Wasm::SignatureInformation::SignatureInformation):
(JSC::Wasm::SignatureInformation::signatureFor):
* wasm/WasmSlowPaths.cpp:
(JSC::LLInt::WASM_SLOW_PATH_DECL):
* wasm/WasmSlowPaths.h:
* wasm/WasmStreamingParser.cpp:
(JSC::Wasm::StreamingParser::parseCodeSectionSize):
* wasm/WasmTag.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
* wasm/WasmTag.h: Copied from Source/JavaScriptCore/wasm/WasmLLIntGenerator.h.
(JSC::Wasm::Tag::create):
(JSC::Wasm::Tag::parameterCount const):
(JSC::Wasm::Tag::parameter const):
(JSC::Wasm::Tag::operator== const):
(JSC::Wasm::Tag::operator!= const):
(JSC::Wasm::Tag::signature const):
(JSC::Wasm::Tag::Tag):
* wasm/WasmThunks.cpp:
* wasm/WasmThunks.h:
* wasm/generateWasmB3IRGeneratorInlinesHeader.py:
(CodeGenerator.generateOpcode):
(CodeGenerator.makeResult):
(CodeGenerator.generate):
* wasm/generateWasmOpsHeader.py:
(typeMacroizer):
* wasm/js/JSWebAssembly.cpp:
* wasm/js/JSWebAssemblyException.cpp: Added.
(JSC::JSWebAssemblyException::JSWebAssemblyException):
(JSC::JSWebAssemblyException::finishCreation):
(JSC::JSWebAssemblyException::visitChildrenImpl):
(JSC::JSWebAssemblyException::destroy):
(JSC::JSWebAssemblyException::getArg const):
* wasm/js/JSWebAssemblyException.h: Added.
(JSC::JSWebAssemblyException::subspaceFor):
(JSC::JSWebAssemblyException::createStructure):
(JSC::JSWebAssemblyException::create):
(JSC::JSWebAssemblyException::tag const):
(JSC::JSWebAssemblyException::payload const):
* wasm/js/JSWebAssemblyHelpers.h:
(JSC::toJSValue):
(JSC::fromJSValue):
* wasm/js/JSWebAssemblyInstance.cpp:
(JSC::JSWebAssemblyInstance::tryCreate):
* wasm/js/JSWebAssemblyInstance.h:
* wasm/js/JSWebAssemblyRuntimeError.cpp:
(JSC::createJSWebAssemblyRuntimeError):
* wasm/js/JSWebAssemblyRuntimeError.h:
* wasm/js/JSWebAssemblyTag.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp.
(JSC::JSWebAssemblyTag::create):
(JSC::JSWebAssemblyTag::createStructure):
(JSC::JSWebAssemblyTag::JSWebAssemblyTag):
* wasm/js/JSWebAssemblyTag.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
* wasm/js/WasmToJS.cpp:
(JSC::Wasm::wasmToJS):
* wasm/js/WebAssemblyExceptionConstructor.cpp: Added.
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::WebAssemblyExceptionConstructor::create):
(JSC::WebAssemblyExceptionConstructor::createStructure):
(JSC::WebAssemblyExceptionConstructor::finishCreation):
(JSC::WebAssemblyExceptionConstructor::WebAssemblyExceptionConstructor):
* wasm/js/WebAssemblyExceptionConstructor.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
* wasm/js/WebAssemblyExceptionPrototype.cpp: Added.
(JSC::WebAssemblyExceptionPrototype::create):
(JSC::WebAssemblyExceptionPrototype::createStructure):
(JSC::WebAssemblyExceptionPrototype::finishCreation):
(JSC::WebAssemblyExceptionPrototype::WebAssemblyExceptionPrototype):
(JSC::getException):
(JSC::getTag):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* wasm/js/WebAssemblyExceptionPrototype.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
* wasm/js/WebAssemblyFunction.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::linkImpl):
* wasm/js/WebAssemblyTagConstructor.cpp: Added.
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::WebAssemblyTagConstructor::createTag):
(JSC::WebAssemblyTagConstructor::create):
(JSC::WebAssemblyTagConstructor::createStructure):
(JSC::WebAssemblyTagConstructor::finishCreation):
(JSC::WebAssemblyTagConstructor::WebAssemblyTagConstructor):
* wasm/js/WebAssemblyTagConstructor.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
* wasm/js/WebAssemblyTagPrototype.cpp: Added.
(JSC::WebAssemblyTagPrototype::create):
(JSC::WebAssemblyTagPrototype::createStructure):
(JSC::WebAssemblyTagPrototype::finishCreation):
(JSC::WebAssemblyTagPrototype::WebAssemblyTagPrototype):
(JSC::getTag):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* wasm/js/WebAssemblyTagPrototype.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
* wasm/wasm.json:
2021-10-08 Jer Noble <jer.noble@apple.com>
[Build-time perf] Forward-declare more things in Element.h
https://bugs.webkit.org/show_bug.cgi?id=231283
Reviewed by Myles C. Maxfield.
Add two new forwarding headers: one for Strong, and as a dependency, one for Handle.
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/Handle.h:
* heap/HandleForward.h: Copied from Source/JavaScriptCore/runtime/Forward.h.
* heap/Strong.h:
* heap/StrongForward.h: Copied from Source/JavaScriptCore/runtime/Forward.h.
* runtime/Forward.h:
2021-10-08 Ross Kirsling <ross.kirsling@sony.com> and Stephan Szabo <stephan.szabo@sony.com>
[JSC] Add private C API for JSGlobalObject::setEvalEnabled
https://bugs.webkit.org/show_bug.cgi?id=231448
Reviewed by Yusuke Suzuki.
WebCore can prohibit eval (and Function constructor) usage in JS execution based on content security policy;
this patch gives embedders the ability to do similarly.
* API/JSContextRef.cpp:
(JSGlobalContextSetEvalEnabled): Added.
* API/JSContextRefPrivate.h:
* API/tests/testapi.c:
2021-10-08 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] UnlinkedCodeBlock::m_instructions can be nullptr
https://bugs.webkit.org/show_bug.cgi?id=231445
rdar://83975933
Reviewed by Mark Lam.
UnlinkedCodeBlock is first created with m_instructions = nullptr.
If BytecodeGenerator failed (due to OOM error etc.), then we keep it nullptr.
So, when destroying UnlinkedCodeBlock, we should have nullptr check.
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock):
2021-10-08 Saam Barati <sbarati@apple.com>
RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp*
https://bugs.webkit.org/show_bug.cgi?id=231382
<rdar://83722151>
Reviewed by Mark Lam.
Because of the RegExp.prototype.compile API, we don't know if the RegExp
produced by RegExpExec will have indices or not, because that bit of
information can be reset by the RegExp.prototype.compile API. So, we
conservatively say that it can produce either structure.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2021-10-07 Alexey Shvayka <shvaikalesh@gmail.com>
`highWaterMark` should be a readonly WebIDL attribute of queuing strategies
https://bugs.webkit.org/show_bug.cgi?id=231355
Reviewed by Youenn Fablet.
Removes now unused @Object.@defineProperty private method.
In most cases, property descriptor merging is unnecessary and @putDirect should be used instead.
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructor::finishCreation):
2021-10-07 Ross Kirsling <ross.kirsling@sony.com>
Unreviewed, build fix for non-unified JSC.
* dfg/DFGBackwardsPropagationPhase.cpp:
Add missing include.
2021-10-07 Carlos Garcia Campos <cgarcia@igalia.com>
[GTK] Reenable -fvisibility=hidden
https://bugs.webkit.org/show_bug.cgi?id=181916
Reviewed by Michael Catanzaro.
* shell/PlatformGTK.cmake:
2021-10-07 Philip Chimento <pchimento@igalia.com>
[JSC] Temporal tweaks to pass more test262 tests
https://bugs.webkit.org/show_bug.cgi?id=231331
Reviewed by Yusuke Suzuki.
* runtime/ISO8601.h:
(JSC::ISO8601::Duration::operator[]): Add an overload for Duration[]
that indexes by TemporalUnit enum instead of integer index.
(JSC::ISO8601::Duration::operator[] const):
* runtime/TemporalDuration.cpp:
(JSC::TemporalDuration::fromDurationLike): Access Duration properties in
the order defined in the specification.
(JSC::TemporalDuration::with const): Access Duration properties in the
order defined in the specification.
(JSC::TemporalDuration::round const): Temporarily throw an exception
here instead of failing an assertion, when attempting to use
unimplemented relativeTo functionality.
* runtime/TemporalObject.cpp:
(JSC::temporalUnitPluralPropertyName): Rename from
temporalUnitPropertyName.
(JSC::temporalUnitSingularPropertyName): Added.
* runtime/TemporalObject.h: Add array corresponding to the table in the
spec text specifying alphabetical access order for unit properties.
* runtime/TemporalPlainTime.cpp:
(JSC::toTemporalTimeRecord): Access PlainTime properties in the order
defined in the specification.
(JSC::toPartialTime): Access PlainTime properties in the order defined
in the specification.
2021-10-06 Fujii Hironori <Hironori.Fujii@sony.com>
Python 3: run-inspector-generator-tests and generate-inspector-protocol-bindings.py
https://bugs.webkit.org/show_bug.cgi?id=231055
Reviewed by Jonathan Bedard.
BaseException.message has been deprecated as of Python 2.6. Use
str(e) instead.
It seems that using frozenset causes flaky test failures in Python
3. Stopped using frozenset.
Rebaselined test expected results with Python 3. This change is
not Python 2 compatible because Python 2 represent a unicode text
as u'pagee' while Python 3 does 'pagee'.
* inspector/scripts/codegen/models.py:
* inspector/scripts/generate-inspector-protocol-bindings.py:
* inspector/scripts/tests/expected/fail-on-command-targetType-matching-domain-debuggableType.json-error:
* inspector/scripts/tests/expected/fail-on-command-targetTypes-value.json-error:
* inspector/scripts/tests/expected/fail-on-domain-debuggableTypes-value.json-error:
* inspector/scripts/tests/expected/fail-on-domain-targetType-matching-domain-debuggableType.json-error:
* inspector/scripts/tests/expected/fail-on-domain-targetTypes-value.json-error:
* inspector/scripts/tests/expected/fail-on-event-targetType-matching-domain-debuggableType.json-error:
* inspector/scripts/tests/expected/fail-on-event-targetTypes-value.json-error:
2021-10-06 Mark Lam <mark.lam@apple.com>
Speculative fix for a null pointer dereference in ByteCodeParser::handlePutByVal.
https://bugs.webkit.org/show_bug.cgi?id=231252
rdar://83310320
Reviewed by Yusuke Suzuki.
We're seeing a null pointer dereference in ByteCodeParser::handlePutByVal().
Adding a null check here as a speculative fix to mitigate crashes while we
investigate further.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handlePutByVal):
2021-10-06 Saam Barati <sbarati@apple.com>
Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser
https://bugs.webkit.org/show_bug.cgi?id=230823
<rdar://problem/83565088>
Reviewed by Robin Morisset.
We've found yet another bug where pruning code after OSR exits
before running backwards propagation leads to us breaking the spec
in weird IR situations. In the particular test case here, we end
up not thinking we care about negative zero for an ArithNegate,
and we exit the program while recovering the value 0 instead of -0.
Fundamentally, backwards propagation wants to see all bytecode uses.
Therefore, it seems like a more sound strategy to run backwards propagation
before we end up mucking with the graph. This patch makes it so we run
backwards propagation inside bytecode parser before we prune the IR.
That way, the phase sees the graph as if it's an IR over the whole bytecode
graph.
* bytecode/Operands.h:
(JSC::Operands::operator!= const):
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase):
(JSC::DFG::BackwardsPropagationPhase::run):
(JSC::DFG::BackwardsPropagationPhase::mergeFlags):
(JSC::DFG::BackwardsPropagationPhase::propagate):
(JSC::DFG::performBackwardsPropagation):
* dfg/DFGBackwardsPropagationPhase.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parse):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGUnificationPhase.cpp:
(JSC::DFG::UnificationPhase::run):
2021-10-06 Xan López <xan@igalia.com>
[JSC][32bit] Remove a bunch of compiler warnings
https://bugs.webkit.org/show_bug.cgi?id=231091
Reviewed by Carlos Alberto Lopez Perez.
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileExit): silence warning about unused
variable, it's not used in 32-bit.
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_enter): use an unsigned int for the loop count.
2021-10-06 Carlos Garcia Campos <cgarcia@igalia.com>
[WPE][GTK] TestJSC incorrectly expects garbage collector to collect variables still on the stack
https://bugs.webkit.org/show_bug.cgi?id=222972
Reviewed by Michael Catanzaro.
Add JSCContextInternal.h header to be used by unit tests to use private JSC API and add
jscContextGarbageCollect().
* API/glib/JSCContext.cpp:
(jscContextGarbageCollect): Moved from unit tests here adding a parameter to optionally call
sanitizeStackForVM() before doing the garbage collection.
* API/glib/JSCContextInternal.h: Added.
2021-10-06 Jer Noble <jer.noble@apple.com>
[Build-time perf] Forward declare JS TypedArrays
https://bugs.webkit.org/show_bug.cgi?id=231196
Reviewed by Tim Horton.
Add a new file, Forward.h, containing forward declarations of commonly used JavaScriptCore types. Removed duplicate declarations
of TypedArray classes from TypedArrayAdapters.h and TypedArrays.h.
* JavaScriptCore.xcodeproj/project.pbxproj:
* runtime/Forward.h: Added.
* runtime/TypedArrayAdaptors.h:
* runtime/TypedArrayAdaptersForwardDeclarations.h: Added.
* runtime/TypedArrays.h:
2021-10-06 Mikhail R. Gadelha <mikhail@igalia.com>
Fix wrong edge type from get-by-val in 32 bits
https://bugs.webkit.org/show_bug.cgi?id=231179
Reviewed by Yusuke Suzuki.
After https://bugs.webkit.org/show_bug.cgi?id=230801, a different type
can be set in DFG nodes, however, in 32 bits jsc was always setting the
type to Cell. This caused jsc to abort when verify the type of the edge:
DFG ASSERTION FAILED: Edge verification error: D@64->Check:Object:D@60 was expected to have type Object but has type Cell (43984760078335)
This patch changes the 32 bits version of the compileEnumeratorGetByVal
to manually speculate the edge if it is a Cell, since a differente Kind
could've been during Fixup.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
2021-10-05 Saam Barati <sbarati@apple.com>
Don't pass DontBuildStrings to next token after parsing an empty parameter list
https://bugs.webkit.org/show_bug.cgi?id=225094
<rdar://problem/77231778>
Reviewed by Yusuke Suzuki.
We might need the string, it turns out!
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseArguments):
2021-10-05 Patrick Angle <pangle@apple.com>
Web Inspector: Show color space for canvases in the Graphics tab on the overview cards
https://bugs.webkit.org/show_bug.cgi?id=231205
Reviewed by Devin Rousso.
Use an enum instead of strings for color space values sent to the frontend.
* inspector/protocol/Canvas.json:
* inspector/scripts/codegen/generator.py:
2021-10-05 Mark Lam <mark.lam@apple.com>
CodeBlock should not add/remove LoopHintExecutionCounters.
https://bugs.webkit.org/show_bug.cgi?id=231209
rdar://83571235
Reviewed by Saam Barati.
This is because cached unlinked baseline JIT code would retain a pointer to those
counters. Hence, the UnlinkedCodeBlock should do the add /remove of the counters
instead.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::~CodeBlock):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::initializeLoopHintExecutionCounter):
(JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock):
* bytecode/UnlinkedCodeBlock.h:
* bytecode/UnlinkedCodeBlockGenerator.cpp:
(JSC::UnlinkedCodeBlockGenerator::finalize):
2021-10-05 Kate Cheney <katherine_cheney@apple.com>
CSP: unsafe-eval tests timing out or failing
https://bugs.webkit.org/show_bug.cgi?id=231113
<rdar://problem/83425041>
Reviewed by Brent Fulgham.
Many imported unsafe-eval tests are failing because we don't report
violations to the DOM or report URI when an eval is blocked. This
patch adds support for that by calling
ContentSecurityPolicy::allowEval() when eval is disabled.
Eventually I think we can remove the evalEnabled() code and check the
CSP policy instead, but I will save that for another patch.
* API/JSAPIGlobalObject.cpp:
* API/JSAPIGlobalObject.mm:
* interpreter/Interpreter.cpp:
(JSC::eval):
* jsc.cpp:
* runtime/DirectEvalExecutable.cpp:
(JSC::DirectEvalExecutable::create):
* runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
* runtime/IndirectEvalExecutable.cpp:
(JSC::IndirectEvalExecutable::create):
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::reportViolationForUnsafeEval):
Per the spec we should send the report to the element's document and
bubble it up to the window.
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
2021-10-05 Xan López <xan@igalia.com>
[JSC][32bit] Fix bugs after unlinked baseline jit
https://bugs.webkit.org/show_bug.cgi?id=231232
Reviewed by Yusuke Suzuki.
Fix a bunch of bugs introduced with unlinked baseline jit. As of
now we are disabling DataIC on baseline JIT to get things working
ASAP, making that work will be the next step. This makes us almost
go back to green bots.
(Patch co-authored with Geza Lore)
* bytecode/CallLinkInfo.cpp:
(JSC::CallLinkInfo::emitDataICFastPath): ASSERT we are not using DataIC on 32-bit.
* bytecode/CodeBlock.h:
(JSC::CodeBlock::hasDebuggerRequests const):
(JSC::CodeBlock::debuggerRequestsAddress): Deleted.
* jit/JITCall32_64.cpp:
(JSC::JIT::compileOpCall): don't use DataIC.
(JSC::JIT::compileOpCallSlowCase): set missing label.
* jit/JITCode.h:
(JSC::JITCode::useDataIC): disable DataIC on baseline JIT for 32-bit.
* jit/JITInlines.h:
(JSC::JIT::getConstantOperand): get constants from the CodeBlock,
since we don't do sharing on 32-bit.
(JSC::JIT::emitValueProfilingSite): remove an overzealous ASSERT.
(JSC::JIT::loadConstant): use sizeof(void*) instead of '8', makes
things work on 32-bit.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_debug): share this with 32-bit.
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_debug): Deleted.
* llint/LowLevelInterpreter32_64.asm: do not thrash the PC register.
2021-10-05 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] JSPropertyNameEnumerator should not have cached prototype chain since empty JSPropertyNameEnumerator is shared
https://bugs.webkit.org/show_bug.cgi?id=231202
rdar://83815122
Reviewed by Keith Miller.
r282014 assumed an invariant that JSPropertyNameEnumerator's StructureChain is immutable.
This invariant is also used in validation of JSPropertyNameEnumerator. However, this
invariant was broken since we now have shared empty sentinel JSPropertyNameEnumerator, which can
be used for different structures having different prototype chain.
Since now we have shared JSPropertyNameEnumerator, JSPropertyNameEnumerator should not have
StructureChain in its member. When invalidating StructureChain in Structure, we also clear
cached JSPropertyNameEnumerator so that we do not get a stale JSPropertyNameEnumerator from
Structure even though watchpoint-based validation is not used.
This patch also removes ValidatedViaWatchpoint flag in JSPropertyNameEnumerator due to the same
reason. We should not modify JSPropertyNameEnumerator once it is instantiated. Instead, we encode
this flag as a lowest bit of m_cachedPropertyNameEnumerator. If it is validated via traversing (not watchpoints),
then this bit is set. So when loading that pointer from StructureRareData, we can quickly detect
it without even accessing to the enumerator. This fixes the issue, and it is even cleaner.
We rename m_cachedPropertyNameEnumerator to m_cachedPropertyNameEnumeratorAndFlag since it now
includes this flag.
While reviewing the code, we also found that watchpoint-based validation didn't care about PolyProto.
We should disable watchpoint-based validation if PolyProto is used.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_property_enumerator):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter64.asm:
* runtime/JSPropertyNameEnumerator.cpp:
(JSC::JSPropertyNameEnumerator::visitChildrenImpl):
* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):
* runtime/Structure.cpp:
(JSC::Structure::visitChildrenImpl):
(JSC::Structure::setCachedPropertyNameEnumerator):
(JSC::Structure::cachedPropertyNameEnumeratorAndFlag const):
* runtime/Structure.h:
(JSC::Structure::propertyNameEnumeratorShouldWatch const):
* runtime/StructureInlines.h:
(JSC::Structure::prototypeChain const):
(JSC::Structure::clearCachedPrototypeChain):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::visitChildrenImpl):
* runtime/StructureRareData.h:
* runtime/StructureRareDataInlines.h:
(JSC::StructureRareData::cachedPropertyNameEnumerator const):
(JSC::StructureRareData::cachedPropertyNameEnumeratorAndFlag const):
(JSC::StructureRareData::setCachedPropertyNameEnumerator):
(JSC::StructureChainInvalidationWatchpoint::fireInternal):
(JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
(JSC::StructureRareData::clearCachedPropertyNameEnumerator):
(JSC::StructureRareData::invalidateWatchpointBasedValidation): Deleted.
2021-10-04 Saam Barati <sbarati@apple.com>
Display return values in nicer way in the jsc REPL and add a prettyPrint function
https://bugs.webkit.org/show_bug.cgi?id=230931
<rdar://problem/83698777>
Reviewed by Tadeu Zagallo.
Currently, print(1), print("1"), and print([1]) all print to stdout
simply as "1" (without the quotes). Same for values when running the
REPL. This isn't super helpful. Let's print quotes for strings, and
brackets for arrays. This patch adds a prettyPrint function to do
that, since we have a lot of tests that depend on the old print behavior.
This patch also makes values printed in the REPL the new pretty style.
* jsc.cpp:
(toCString):
(printInternal):
(JSC_DEFINE_HOST_FUNCTION):
(runInteractive):
(cStringFromViewWithString): Deleted.
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toWTFStringForConsole const):
* runtime/JSCJSValue.h:
2021-10-04 Saam Barati <sbarati@apple.com>
IntrinsicGetterAccessCase implementation of __proto__ needs to handle get_by_id_with_this
https://bugs.webkit.org/show_bug.cgi?id=229951
<rdar://problem/82787527>
Reviewed by Yusuke Suzuki.
The whole point of get_by_id_with_this is to have different
slot base values for |this| vs the slot base when invoking
getters. However, our intrinsic getter inlining wasn't respecting
this. This patch makes the __proto__ intrinsic getter do the right
thing. For typed array intrinsic getters, if they have different
|this| value vs slot base, we chose not to inline them, because
the type checks are not on the |this| value, so they're not guaranteed
to be typed arrays. We can improve upon this in the future.
* bytecode/IntrinsicGetterAccessCase.h:
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitLoadPrototypeWithoutCheck):
* jit/AssemblyHelpers.h:
* jit/IntrinsicEmitter.cpp:
(JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter):
(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
* jit/Repatch.cpp:
(JSC::tryCacheGetBy):
2021-10-03 Don Olmstead <don.olmstead@sony.com>
Non-unified build fixes, early October 2021 edition
https://bugs.webkit.org/show_bug.cgi?id=231143
Unreviewed non-unified build fixes.
* jit/BaselineJITCode.cpp:
2021-10-03 Lauro Moura <lmoura@igalia.com>
Remove control reaches end of non-void function warning
Unreviewed. Warning introduced in r283139.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
2021-10-02 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] DateTimeFormat.resolvedOptions shouldn't return an object with other date/time properties if dateStyle or timeStyle are set
https://bugs.webkit.org/show_bug.cgi?id=231041
Reviewed by Ross Kirsling.
When "dateStyle" or "timestyle" option is specified in Intl.DateTimeFormat, we should not expose detailed
resolved format information in resolvedOptions, since specifying these options is not what the user of
this Intl.DateTimeFormat intended. This is specified in the spec[1] step 5-d.
[1]: https://tc39.es/ecma402/#sec-intl.datetimeformat.prototype.resolvedoptions
* runtime/IntlDateTimeFormat.cpp:
(JSC::IntlDateTimeFormat::resolvedOptions const):
2021-10-02 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Enable Intl.DisplayNames without ICU version check
https://bugs.webkit.org/show_bug.cgi?id=231122
Reviewed by Ross Kirsling.
Now every port requires ICU 61.2 or later. Since Intl.DisplayNames requires ICU 61, we can enable it without ICU version check.
This simplifies Intl.DisplayNames code.
* runtime/IntlDisplayNames.cpp:
(JSC::IntlDisplayNames::initializeDisplayNames):
(JSC::IntlDisplayNames::of const):
* runtime/IntlDisplayNames.h:
* runtime/IntlObject.cpp:
(JSC::IntlObject::finishCreation):
2021-10-02 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Enable HAVE_ICU_U_DATE_INTERVAL_FORMAT_FORMAT_RANGE_TO_PARTS on Darwin OSS build
https://bugs.webkit.org/show_bug.cgi?id=231120
Reviewed by Ross Kirsling.
We now assume that ICU is 64.2 or later in Darwin since Mojave WebKit build is no longer supported.
We enable HAVE_ICU_U_DATE_INTERVAL_FORMAT_FORMAT_RANGE_TO_PARTS on Darwin OSS build.
* runtime/IntlDateTimeFormat.h:
2021-10-02 Yusuke Suzuki <ysuzuki@apple.com>
Remove JSC hack after r283410
https://bugs.webkit.org/show_bug.cgi?id=230261
Reviewed by Mark Lam.
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertyDescriptor):
* runtime/PropertySlot.h:
2021-10-01 Commit Queue <commit-queue@webkit.org>
Unreviewed, reverting r283293.
https://bugs.webkit.org/show_bug.cgi?id=231116
changing print() broke a lot of random things
Reverted changeset:
"Print values in a nicer way in the jsc shell"
https://bugs.webkit.org/show_bug.cgi?id=230931
https://commits.webkit.org/r283293
2021-10-01 Yusuke Suzuki <ysuzuki@apple.com>
Disable new incumbent-window until it is fully implemented
https://bugs.webkit.org/show_bug.cgi?id=230261
<rdar://problem/83099726>
Reviewed by Chris Dumez and Geoffrey Garen.
* interpreter/CallFrame.cpp:
(JSC::CallFrame::globalObjectOfClosestCodeBlock):
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertyDescriptor):
* runtime/PropertySlot.h:
2021-10-01 Xan López <xan@igalia.com>
[JSC][32bit] Fix build after unlinked baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=230803
Reviewed by Saam Barati.
This is enough to make things build, but pretty much nothing works
yet. Will fix in a follow-up, this way we at least give people a
chance at not introducing more build regressions.
(With some code by Mikhail R. Gadelha and Geza Lore)
* CMakeLists.txt:
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branch32):
(JSC::MacroAssemblerARMv7::branchAdd32):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::branchAdd32):
* bytecode/CallLinkInfo.h:
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis):
* jit/JIT.h:
* jit/JITCall32_64.cpp:
(JSC::JIT::compileOpCall):
* jit/JITInlines.h:
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_loop_hint):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitVarInjectionCheck):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitPutGlobalVariableIndirect):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emitVarInjectionCheck): Deleted.
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
2021-10-01 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Remove CodeBlock::m_numberOfNonArgumentValueProfiles since we can get the same value from UnlinkedCodeBlock
https://bugs.webkit.org/show_bug.cgi?id=231066
Reviewed by Robin Morisset.
Since UnlinkedCodeBlock has UnlinkedValueProfile FixedVector, we can get CodeBlock::m_numberOfNonArgumentValueProfiles
from UnlinkedCodeBlock. So CodeBlock does not need to keep it in its member.
We also reorder some fields to shrink sizeof(CodeBlock) after this change.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::numberOfNonArgumentValueProfiles):
(JSC::CodeBlock::totalNumberOfValueProfiles):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::numberOfValueProfiles const):
(JSC::UnlinkedCodeBlock::numberOfArrayProfiles const):
2021-10-01 Olivier Blin <olivier.blin@softathome.com>
[JSC][GLib] Fix typo in WrapperMap creation methods
https://bugs.webkit.org/show_bug.cgi?id=231076
Reviewed by Michael Catanzaro.
* API/glib/JSCContext.cpp:
(jscContextGetOrCreateJSWrapper):
(jscContextCreateContextWithJSWrapper):
* API/glib/JSCWrapperMap.cpp:
(JSC::WrapperMap::createJSWrapper):
(JSC::WrapperMap::createContextWithJSWrapper):
(JSC::WrapperMap::createJSWrappper): Deleted.
(JSC::WrapperMap::createContextWithJSWrappper): Deleted.
* API/glib/JSCWrapperMap.h:
2021-09-30 Yusuke Suzuki <ysuzuki@apple.com>
Upgrade GCC requirement to 8.3.0
https://bugs.webkit.org/show_bug.cgi?id=231042
Reviewed by Darin Adler.
* runtime/ConfigFile.cpp:
(JSC::ConfigFile::canonicalizePaths):
2021-09-30 Saam Barati <sbarati@apple.com>
Regressions (r283288): [ macOS Debug ] webgl/2.0.0/conformance/state/gl-object-get-calls.html is timing out
https://bugs.webkit.org/show_bug.cgi?id=231024
<rdar://problem/83723856>
Reviewed by Mark Lam.
Speed up our debug assert by not using a probe.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
2021-09-30 Saam Barati <sbarati@apple.com>
The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
https://bugs.webkit.org/show_bug.cgi?id=230804
<rdar://problem/83543951>
Reviewed by Yusuke Suzuki.
This patch fixes a couple bugs:
- We were constant folding typeof on ProxyObject to "object"
even when ProxyObject might produce a callable Proxy, and hence,
should produce "function". This was a bug in AI.
- This also fixes a similar bug in IsCallable's implementation in
the FTL where we assumed that ProxyObject's type can't be callable.
* bytecode/SpeculatedType.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
2021-09-30 Fujii Hironori <Hironori.Fujii@sony.com>
Python 3 fails to run run-builtins-generator-tests : ModuleNotFoundError: No module named 'builtins_model'
https://bugs.webkit.org/show_bug.cgi?id=230870
Reviewed by Jonathan Bedard.
BaseException.message has been deprecated as of Python 2.6. Use
str(e) instead.
Implicit relative imports have been deprecated in Python 3.
Basically, relative imports should be used. However, the scripts
in wkbuiltins directory are flattened when they are copied to
WebKitBuild directory. So, relative imports can't be used.
So, append wkbuiltins directory to sys.path as a workaround.
* Scripts/generate-js-builtins.py:
2021-09-29 Mark Lam <mark.lam@apple.com>
DFG strength reduction on % operator should handle an INT_MIN divisor.
https://bugs.webkit.org/show_bug.cgi?id=230391
<rdar://problem/83229740>
Reviewed by Robin Morisset.
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
2021-09-29 Saam Barati <sbarati@apple.com>
Print values in a nicer way in the jsc shell
https://bugs.webkit.org/show_bug.cgi?id=230931
Reviewed by Tadeu Zagallo.
Currently, print(1), print("1"), and print([1]) all print to stdout
simply as "1" (without the quotes). Same for values when running the
REPL. This isn't super helpful. Let's print quotes for strings, and
brackets for arrays.
Some tests rely on the old print behavior. Those tests now use the legacyPrint
instead.
* jsc.cpp:
(toCString):
(printInternal):
(JSC_DEFINE_HOST_FUNCTION):
(runInteractive):
(cStringFromViewWithString): Deleted.
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toWTFStringForConsole const):
* runtime/JSCJSValue.h:
2021-09-29 Saam Barati <sbarati@apple.com>
We need to load the baseline JIT's constant pool register after OSR exit to checkpoints if we return to baseline code
https://bugs.webkit.org/show_bug.cgi?id=230972
<rdar://83659469>
Reviewed by Mark Lam and Yusuke Suzuki.
Consider the following:
- We have a CodeBlock A.
- DFG or FTL compiles an exit to A when A is still LLInt code. This means
the OSR exit code will materialize registers as if A is LLInt.
- We tier up A to Baseline JIT code.
- Now, we take the exit to A as if it's LLInt. But the checkpoint OSR exit
code will actually jump to the tiered up baseline code when it's done,
because it determines where to jump at runtime. Because of this, when
we return from the checkpoint code, and if we are jumping into baseline
code, we must always load the constant pool register.
- There's no need to load the metadata register because that register is
shared with LLInt code, and will already contain the right value.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::dispatchToNextInstructionDuringExit):
(JSC::LLInt::llint_slow_path_checkpoint_osr_exit_from_inlined_call):
(JSC::LLInt::llint_slow_path_checkpoint_osr_exit):
(JSC::LLInt::dispatchToNextInstruction): Deleted.
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter64.asm:
2021-09-29 Basuke Suzuki <basuke.suzuki@sony.com>
Suppress warnings for implicit copy assignment operator/copy constructor with clang 13
https://bugs.webkit.org/show_bug.cgi?id=230963
Reviewed by Mark Lam.
Added default copy constructor to suppress warning.
* bytecode/Operands.h:
2021-09-29 Basuke Suzuki <basuke.suzuki@sony.com>
[JSC] Add objectTypeCounts to JSGetMemoryUsageStatistics
https://bugs.webkit.org/show_bug.cgi?id=230957
Reviewed by Yusuke Suzuki.
* API/JSBase.cpp: Added objectTypeCounts property
(JSGetMemoryUsageStatistics):
* API/JSBasePrivate.h: Added description of objectTypeCounts property
* jsc.cpp: Added memoryUsageStatistics() function
2021-09-29 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Remove CodeBlock::m_llintExecuteCounter
https://bugs.webkit.org/show_bug.cgi?id=230938
Reviewed by Keith Miller.
CodeBlock::m_llintExecuteCounter is a pointer pointing the middle of UnlinkedCodeBlock.
So this is not necessary to have this pointer separately to access to that from LLInt,
since loading UnlinkedCodeBlock and accessing to the middle of that do the same number
of loads.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
* llint/LowLevelInterpreter.asm:
2021-09-29 Saam Barati <sbarati@apple.com>
Code inside strength reduction can incorrectly prove that we know what lastIndex is
https://bugs.webkit.org/show_bug.cgi?id=230802
<rdar://problem/83543699>
Reviewed by Mark Lam.
The phase was searching backwards in the graph to see if it found the RegExp
node. However, the RegExp node might be a JSConstant. Hence, the program
didn't allocate it. So we can't assume that we know what the lastIndex is.
We were incorrectly assuming it was "0" in a program like this:
a: JSConstant(RegExp)
b: RegExpExec(@a)
And we assumed we're invoking RegExpExec with lastIndex is 0, because we found
our RegExp in a backwards search. This is likely because we're also matching
NewRegExp nodes, in which case, it is valid to say lastIndex is 0.
This caused us to return a constant value that would've been the exec
result had we invoked it with a NewRegExpNode.
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::run):
(JSC::DFG::StrengthReductionPhase::handleNode):
2021-09-29 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Use FixedVector in JITConstantPool
https://bugs.webkit.org/show_bug.cgi?id=230937
Reviewed by Keith Miller.
This patch changes JITConstantPool to use FixedVector. This allocates exact size
of memory and Making sizeof(JITConstantPool) smaller. We also use CompactPointerTuple
for JITConstantPool::Value since it is faster for access.
To achieve that, in JIT, we append Value to normal Vector. And when finalizing BaselineJITCode
we construct JITConstantPool from that Vector.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
* jit/BaselineJITCode.h:
(JSC::JITConstantPool::JITConstantPool):
(JSC::JITConstantPool::add): Deleted.
* jit/JIT.cpp:
(JSC::JIT::JIT):
(JSC::JIT::addToConstantPool):
* jit/JIT.h:
* jit/JITCall.cpp:
(JSC::JIT::compileOpCall):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emit_op_enumerator_get_by_val):
2021-09-28 Saam Barati <sbarati@apple.com>
DoesGCCheck does not use enough bits for nodeIndex
https://bugs.webkit.org/show_bug.cgi?id=230915
<rdar://83297515>
Reviewed by Mark Lam.
* dfg/DFGDoesGCCheck.h:
(JSC::DFG::DoesGCCheck::DoesGCCheck):
(JSC::DFG::DoesGCCheck::encode):
(JSC::DFG::DoesGCCheck::set):
(JSC::DFG::DoesGCCheck::expectDoesGC const):
(JSC::DFG::DoesGCCheck::isSpecial const):
(JSC::DFG::DoesGCCheck::special):
(JSC::DFG::DoesGCCheck::nodeOp):
(JSC::DFG::DoesGCCheck::nodeIndex):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileExit):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileLoopHint):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
2021-09-28 Alex Christensen <achristensen@webkit.org>
Mostly fix Mac CMake build
https://bugs.webkit.org/show_bug.cgi?id=230868
Reviewed by Don Olmstead.
* shell/PlatformMac.cmake:
2021-09-28 Saam Barati <sbarati@apple.com>
Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata
https://bugs.webkit.org/show_bug.cgi?id=230798
Reviewed by Yusuke Suzuki.
This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile
have an index into a table instead of storing a pointer to the profile in its metadata.
Then, we can just load the profile using the index in the bytecode, which saves memory.
* bytecode/BytecodeList.rb:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):
* bytecode/UnlinkedCodeBlock.h:
* bytecode/UnlinkedCodeBlockGenerator.cpp:
(JSC::UnlinkedCodeBlockGenerator::finalize):
* bytecode/UnlinkedCodeBlockGenerator.h:
(JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile):
(JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitUnaryOp):
(JSC::BytecodeGenerator::emitInc):
(JSC::BytecodeGenerator::emitDec):
* bytecompiler/BytecodeGenerator.h:
* jit/JITArithmetic.cpp:
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::updateArithProfileForUnaryArithOp):
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
2021-09-28 Alexey Shvayka <shvaikalesh@gmail.com>
Speed up setting JSFunction's "prototype" property
https://bugs.webkit.org/show_bug.cgi?id=230864
Reviewed by Yusuke Suzuki.
This patch:
1. Removes "prototype" lookup from put(), which was non-inlineable and created an
interim object with "constructor" field. Instead, the new value is put directly,
with correct attributes, and respecting an altered receiver. This results in 2.8X
perf boost for very common case of setting "prototype": `Cat.prototype = new Animal`.
2. Simplifies initialization of class constructor's prototype object, removing tentacles
from getOwnPropertySlot() and extracting constructPrototypeObject() helper. Provides
a fast path for op_define_data_property, speeding up `class` creation by ~40%, while
reifies normal function's prototype with correct attributes for Object.defineProperty().
* runtime/JSFunction.cpp:
(JSC::constructPrototypeObject):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):
2021-09-27 Yusuke Suzuki <ysuzuki@apple.com>
[WTF] Add ApproximateTime
https://bugs.webkit.org/show_bug.cgi?id=230876
Reviewed by Filip Pizlo.
This patch adds ApproximateTime, which offers monotonically increasing time but with coarse-grained resolution.
ApproximateTime::now() is faster than normal MonotonicTime::now(), so that we can use this when we do not care
about high resolution. For example, in Darwin x64, it is ~4x faster.
Internally, it is using mach_approximate_time() in Darwin, clock_gettime+CLOCK_MONOTONIC_COARSE in Linux, and
clock_gettime+CLOCK_MONOTONIC_FAST in FreeBSD. On the other platforms, we simply use the same source to MonotonicTime.
wall-time-now 102.2614+-0.2449
approximate-time-now 23.2583+-0.4083
monotonic-time-now 88.8518+-2.4106
We would like to use it in some places in JavaScriptCore in a subsequent patch: CodeBlock's creation time, GC time etc.
* tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::JSDollarVM::finishCreation):
2021-09-28 Alexey Shvayka <shvaikalesh@gmail.com>
Tweak isCallable() to early return `true` for InternalFunction instances
https://bugs.webkit.org/show_bug.cgi?id=230869
Reviewed by Yusuke Suzuki.
With this change, isCallable() avoids calling into InternalFunction::getCallData(),
which is concurrency-aware and guaranteed to never return CallData::Type::None.
We have a similar optimization for JSFunction.
* runtime/JSCellInlines.h:
(JSC::JSCell::isCallableWithConcurrency):
2021-09-27 Saam Barati <sbarati@apple.com>
Build an unlinked baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>
Reviewed by Yusuke Suzuki.
This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".
To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.
Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.
This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.
This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.
This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's
"done location". However, this "done location" didn't used to restore SP.
This patch conservatively makes it so that we restore the SP at these sites.
This is measured as a 1% speedup on Speedometer2.
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/AccessCase.cpp:
(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::generateImpl):
* bytecode/BytecodeList.rb:
* bytecode/BytecodeOperandsForCheckpoint.h:
(JSC::valueProfileOffsetFor):
* bytecode/CallLinkInfo.cpp:
(JSC::CallLinkInfo::fastPathStart):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::emitFastPath):
(JSC::CallLinkInfo::emitTailCallFastPath):
(JSC::CallLinkInfo::emitDataICFastPath):
(JSC::CallLinkInfo::emitTailCallDataICFastPath):
(JSC::CallLinkInfo::emitDataICSlowPath):
(JSC::CallLinkInfo::initializeDataIC):
(JSC::CallLinkInfo::emitDirectFastPath):
(JSC::CallLinkInfo::emitDirectTailCallFastPath):
* bytecode/CallLinkInfo.h:
(JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
(JSC::CallLinkInfo::slowStub): Deleted.
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::finalizeJITInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::frameRegisterCount):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
(JSC::CodeBlock::findPC):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
(JSC::CodeBlock::dumpMathICStats):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
(JSC::CodeBlock::addJITAddIC): Deleted.
(JSC::CodeBlock::addJITMulIC): Deleted.
(JSC::CodeBlock::addJITSubIC): Deleted.
(JSC::CodeBlock::addJITNegIC): Deleted.
(JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
(JSC::CodeBlock::thresholdForJIT): Deleted.
(JSC::CodeBlock::jitAfterWarmUp): Deleted.
* bytecode/CodeBlock.h:
(JSC::CodeBlock::JITData::offsetOfJITConstantPool):
(JSC::CodeBlock::offsetOfJITData):
(JSC::CodeBlock::offsetOfArgumentValueProfiles):
(JSC::CodeBlock::offsetOfConstantsVectorBuffer):
(JSC::CodeBlock::baselineJITConstantPool):
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::offsetOfDebuggerRequests):
(JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
(JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::CodeBlock::addressOfNumParameters): Deleted.
(JSC::CodeBlock::isKnownCell): Deleted.
(JSC::CodeBlock::addMathIC): Deleted.
(JSC::CodeBlock::setJITCodeMap): Deleted.
(JSC::CodeBlock::jitCodeMap): Deleted.
(JSC::CodeBlock::switchJumpTable): Deleted.
(JSC::CodeBlock::stringSwitchJumpTable): Deleted.
* bytecode/CodeBlockInlines.h:
(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::jitCodeMap):
(JSC::CodeBlock::baselineSwitchJumpTable):
(JSC::CodeBlock::baselineStringSwitchJumpTable):
(JSC::CodeBlock::dfgSwitchJumpTable):
(JSC::CodeBlock::dfgStringSwitchJumpTable):
* bytecode/ExecutableToCodeBlockEdge.h:
* bytecode/ExecutionCounter.cpp:
(JSC::ExecutionCounter<countingVariant>::setThreshold):
* bytecode/ExecutionCounter.h:
(JSC::ExecutionCounter::clippedThreshold):
* bytecode/GetByIdMetadata.h:
(JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
(JSC::GetByIdModeMetadata::offsetOfMode):
* bytecode/GetByStatus.cpp:
(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
* bytecode/GetterSetterAccessCase.cpp:
(JSC::GetterSetterAccessCase::emitDOMJITGetter):
* bytecode/InByStatus.cpp:
(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
* bytecode/InlineAccess.cpp:
(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::isCacheableArrayLength):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::isCacheableStringLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):
* bytecode/InlineAccess.h:
* bytecode/IterationModeMetadata.h:
(JSC::IterationModeMetadata::offsetOfSeenModes):
* bytecode/LLIntCallLinkInfo.h:
(JSC::LLIntCallLinkInfo::offsetOfArrayProfile):
* bytecode/Opcode.h:
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessGenerationState::succeed):
(JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::PolymorphicAccess::regenerate):
* bytecode/PolymorphicAccess.h:
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.
* bytecode/PutByStatus.cpp:
(JSC::PutByStatus::computeForStubInfo):
* bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
* bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfDoneLocation):
* bytecode/SuperSampler.cpp:
(JSC::printSuperSamplerState):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::hasIdentifier):
(JSC::UnlinkedCodeBlock::thresholdForJIT):
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::constantRegister):
(JSC::UnlinkedCodeBlock::instructionAt const):
(JSC::UnlinkedCodeBlock::bytecodeOffset):
(JSC::UnlinkedCodeBlock::instructionsSize const):
(JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlock::binaryArithProfile):
(JSC::UnlinkedCodeBlock::unaryArithProfile):
(JSC::UnlinkedCodeBlock::llintExecuteCounter):
* bytecode/UnlinkedMetadataTable.h:
(JSC::UnlinkedMetadataTable::offsetInMetadataTable):
* bytecode/ValueProfile.h:
(JSC::ValueProfileBase::ValueProfileBase):
(JSC::ValueProfileBase::clearBuckets):
(JSC::ValueProfile::offsetOfFirstBucket):
* dfg/DFGCommonData.h:
* dfg/DFGJITCode.cpp:
* dfg/DFGJITCode.h:
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileExit):
* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::handleExitCounts):
(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):
* dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLJITCode.h:
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::addMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* generator/Metadata.rb:
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::storeProperty):
(JSC::AssemblyHelpers::emitVirtualCall):
(JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):
* jit/BaselineJITCode.cpp: Added.
(JSC::MathICHolder::addJITAddIC):
(JSC::MathICHolder::addJITMulIC):
(JSC::MathICHolder::addJITSubIC):
(JSC::MathICHolder::addJITNegIC):
(JSC::MathICHolder::adoptMathICs):
(JSC::BaselineJITCode::BaselineJITCode):
(JSC::BaselineJITCode::~BaselineJITCode):
* jit/BaselineJITCode.h: Added.
(JSC::JITConstantPool::add):
(JSC::JITConstantPool::size const):
(JSC::JITConstantPool::at const):
* jit/BaselineJITPlan.cpp:
(JSC::BaselineJITPlan::finalize):
* jit/CCallHelpers.cpp:
(JSC::CCallHelpers::logShadowChickenTailPacketImpl):
(JSC::CCallHelpers::logShadowChickenTailPacket):
* jit/CCallHelpers.h:
* jit/CallFrameShuffleData.cpp:
(JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
* jit/CallFrameShuffleData.h:
* jit/CallFrameShuffler.cpp:
(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareForTailCall):
* jit/CallFrameShuffler.h:
(JSC::CallFrameShuffler::snapshot const):
* jit/JIT.cpp:
(JSC::JIT::JIT):
(JSC::JIT::emitEnterOptimizationCheck):
(JSC::JIT::emitNotifyWriteWatchpoint):
(JSC::JIT::emitVarReadOnlyCheck):
(JSC::JIT::assertStackPointerOffset):
(JSC::JIT::resetSP):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
(JSC::JIT::emitRestoreCalleeSaves):
(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::link):
(JSC::JIT::finalizeOnMainThread):
(JSC::JIT::privateCompile):
(JSC::JIT::frameRegisterCountFor):
(JSC::JIT::stackPointerOffsetFor):
* jit/JIT.h:
* jit/JITArithmetic.cpp:
(JSC::JIT::emit_compareAndJumpSlowImpl):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):
* jit/JITCall.cpp:
(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):
* jit/JITCall32_64.cpp:
(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):
* jit/JITCode.h:
(JSC::JITCode::useDataIC):
(JSC::JITCode::pcToCodeOriginMap):
* jit/JITCompilationKey.cpp:
(JSC::JITCompilationKey::dump const):
* jit/JITCompilationKey.h:
(JSC::JITCompilationKey::JITCompilationKey):
(JSC::JITCompilationKey::operator! const):
(JSC::JITCompilationKey::isHashTableDeletedValue const):
(JSC::JITCompilationKey::operator== const):
(JSC::JITCompilationKey::hash const):
(JSC::JITCompilationKey::profiledBlock const): Deleted.
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
(JSC::JITInlineCacheGenerator::finalize):
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
(JSC::generateGetByIdInlineAccess):
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInstanceOfGenerator::generateFastPath):
(JSC::JITGetByValGenerator::generateFastPath):
(JSC::JITPutByValGenerator::generateFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateFastPath):
* jit/JITInlineCacheGenerator.h:
* jit/JITInlines.h:
(JSC::JIT::isOperandConstantDouble):
(JSC::JIT::isOperandConstantInt):
(JSC::JIT::isKnownCell):
(JSC::JIT::getConstantOperand):
(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
(JSC::JIT::linkSlowCaseIfNotJSCell):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::isOperandConstantChar):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitJumpSlowCaseIfNotJSCell):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::jumpTarget):
(JSC::JIT::loadPtrFromMetadata):
(JSC::JIT::load32FromMetadata):
(JSC::JIT::load8FromMetadata):
(JSC::JIT::store8ToMetadata):
(JSC::JIT::store32ToMetadata):
(JSC::JIT::materializePointerIntoMetadata):
(JSC::JIT::loadConstant):
(JSC::JIT::loadGlobalObject):
(JSC::JIT::loadCodeBlockConstant):
(JSC::JIT::copiedGetPutInfo): Deleted.
(JSC::JIT::copiedArithProfile): Deleted.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::op_ret_handlerGenerator):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::valueIsFalseyGenerator):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jeq_ptr):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::valueIsTruthyGenerator):
(JSC::JIT::emit_op_throw):
(JSC::JIT::op_throw_handlerGenerator):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_enter):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_loop_hint):
(JSC::JIT::emitSlow_op_check_traps):
(JSC::JIT::op_check_traps_handlerGenerator):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_get_argument):
(JSC::JIT::emit_op_get_prototype_of):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::compileOpEqJumpSlow):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_enter):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
* jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* jit/JITOperations.h:
* jit/JITPlan.cpp:
(JSC::JITPlan::key):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::slow_op_resolve_scopeGenerator):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::slow_op_get_from_scopeGenerator):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::slow_op_put_to_scopeGenerator):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
(JSC::JIT::emit_op_enumerator_next):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_enumerator_has_propertyImpl):
(JSC::JIT::emitWriteBarrier):
(JSC::JIT::emitPutGlobalVariable): Deleted.
(JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
(JSC::JIT::emitPutClosureVar): Deleted.
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
* jit/Repatch.cpp:
(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
(JSC::tryCacheInBy):
(JSC::unlinkCall):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CacheableIdentifier.h:
* runtime/CacheableIdentifierInlines.h:
(JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):
* runtime/CachedTypes.cpp:
(JSC::CachedCodeBlock::numBinaryArithProfiles const):
(JSC::CachedCodeBlock::numUnaryArithProfiles const):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::CachedCodeBlock<CodeBlockType>::encode):
* runtime/CommonSlowPaths.cpp:
(JSC::updateArithProfileForUnaryArithOp):
* runtime/FunctionExecutable.h:
* runtime/Options.cpp:
(JSC::Options::recomputeDependentOptions):
* runtime/OptionsList.h:
* runtime/ScriptExecutable.cpp:
(JSC::ScriptExecutable::prepareForExecutionImpl):
* wasm/WasmLLIntTierUpCounter.h:
(JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
(JSC::Wasm::LLIntTierUpCounter::optimizeSoon):
* wasm/WasmTierUpCount.cpp:
(JSC::Wasm::TierUpCount::TierUpCount):
* wasm/WasmTierUpCount.h:
(JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
(JSC::Wasm::TierUpCount::optimizeNextInvocation):
(JSC::Wasm::TierUpCount::optimizeSoon):
2021-09-27 Xan López <xan@igalia.com>
[JSC][32bit] Fix build after r283098
https://bugs.webkit.org/show_bug.cgi?id=230856
Unreviewed build fix.
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jeq_ptr): remove unused (broken) line.
2021-09-27 Commit Queue <commit-queue@webkit.org>
Unreviewed, reverting r283102, r283103 and r283104.
https://bugs.webkit.org/show_bug.cgi?id=230854
It regresses JetStream2 on iOS devices
Reverted changesets:
"Build an unlinked baseline JIT"
https://bugs.webkit.org/show_bug.cgi?id=229223
https://commits.webkit.org/r283102
"Unreviewed, fix CLoop build"
https://bugs.webkit.org/show_bug.cgi?id=229223
https://commits.webkit.org/r283103
"Unreviewed, fix CLoop build part 2"
https://bugs.webkit.org/show_bug.cgi?id=229223
https://commits.webkit.org/r283104
2021-09-27 Yusuke Suzuki <ysuzuki@apple.com>
Unreviewed, fix CLoop build part 2
https://bugs.webkit.org/show_bug.cgi?id=229223
* llint/LowLevelInterpreter64.asm:
2021-09-27 Yusuke Suzuki <ysuzuki@apple.com>
Unreviewed, fix CLoop build
https://bugs.webkit.org/show_bug.cgi?id=229223
* llint/LLIntOfflineAsmConfig.h:
* llint/LowLevelInterpreter64.asm:
2021-09-27 Saam Barati <sbarati@apple.com>
Build an unlinked baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>
Reviewed by Yusuke Suzuki.
This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".
To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.
Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.
This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.
This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.
This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's
"done location". However, this "done location" didn't used to restore SP.
This patch conservatively makes it so that we restore the SP at these sites.
This is measured as a 1% speedup on Speedometer2.
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/AccessCase.cpp:
(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::generateImpl):
* bytecode/BytecodeList.rb:
* bytecode/BytecodeOperandsForCheckpoint.h:
(JSC::valueProfileOffsetFor):
* bytecode/CallLinkInfo.cpp:
(JSC::CallLinkInfo::fastPathStart):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::emitFastPath):
(JSC::CallLinkInfo::emitTailCallFastPath):
(JSC::CallLinkInfo::emitDataICFastPath):
(JSC::CallLinkInfo::emitTailCallDataICFastPath):
(JSC::CallLinkInfo::emitDataICSlowPath):
(JSC::CallLinkInfo::initializeDataIC):
(JSC::CallLinkInfo::emitDirectFastPath):
(JSC::CallLinkInfo::emitDirectTailCallFastPath):
* bytecode/CallLinkInfo.h:
(JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
(JSC::CallLinkInfo::slowStub): Deleted.
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::finalizeJITInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::frameRegisterCount):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
(JSC::CodeBlock::findPC):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
(JSC::CodeBlock::dumpMathICStats):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
(JSC::CodeBlock::addJITAddIC): Deleted.
(JSC::CodeBlock::addJITMulIC): Deleted.
(JSC::CodeBlock::addJITSubIC): Deleted.
(JSC::CodeBlock::addJITNegIC): Deleted.
(JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
(JSC::CodeBlock::thresholdForJIT): Deleted.
(JSC::CodeBlock::jitAfterWarmUp): Deleted.
* bytecode/CodeBlock.h:
(JSC::CodeBlock::JITData::offsetOfJITConstantPool):
(JSC::CodeBlock::offsetOfJITData):
(JSC::CodeBlock::offsetOfArgumentValueProfiles):
(JSC::CodeBlock::offsetOfConstantsVectorBuffer):
(JSC::CodeBlock::baselineJITConstantPool):
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::offsetOfDebuggerRequests):
(JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
(JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::CodeBlock::addressOfNumParameters): Deleted.
(JSC::CodeBlock::isKnownCell): Deleted.
(JSC::CodeBlock::addMathIC): Deleted.
(JSC::CodeBlock::setJITCodeMap): Deleted.
(JSC::CodeBlock::jitCodeMap): Deleted.
(JSC::CodeBlock::switchJumpTable): Deleted.
(JSC::CodeBlock::stringSwitchJumpTable): Deleted.
* bytecode/CodeBlockInlines.h:
(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::jitCodeMap):
(JSC::CodeBlock::baselineSwitchJumpTable):
(JSC::CodeBlock::baselineStringSwitchJumpTable):
(JSC::CodeBlock::dfgSwitchJumpTable):
(JSC::CodeBlock::dfgStringSwitchJumpTable):
* bytecode/ExecutableToCodeBlockEdge.h:
* bytecode/ExecutionCounter.cpp:
(JSC::ExecutionCounter<countingVariant>::setThreshold):
* bytecode/ExecutionCounter.h:
(JSC::ExecutionCounter::clippedThreshold):
* bytecode/GetByIdMetadata.h:
(JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
(JSC::GetByIdModeMetadata::offsetOfMode):
* bytecode/GetByStatus.cpp:
(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
* bytecode/GetterSetterAccessCase.cpp:
(JSC::GetterSetterAccessCase::emitDOMJITGetter):
* bytecode/InByStatus.cpp:
(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
* bytecode/InlineAccess.cpp:
(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::isCacheableArrayLength):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::isCacheableStringLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):
* bytecode/InlineAccess.h:
* bytecode/IterationModeMetadata.h:
(JSC::IterationModeMetadata::offsetOfSeenModes):
* bytecode/LLIntCallLinkInfo.h:
(JSC::LLIntCallLinkInfo::offsetOfArrayProfile):
* bytecode/Opcode.h:
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessGenerationState::succeed):
(JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::PolymorphicAccess::regenerate):
* bytecode/PolymorphicAccess.h:
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.
* bytecode/PutByStatus.cpp:
(JSC::PutByStatus::computeForStubInfo):
* bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
* bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfDoneLocation):
* bytecode/SuperSampler.cpp:
(JSC::printSuperSamplerState):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::hasIdentifier):
(JSC::UnlinkedCodeBlock::thresholdForJIT):
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::constantRegister):
(JSC::UnlinkedCodeBlock::instructionAt const):
(JSC::UnlinkedCodeBlock::bytecodeOffset):
(JSC::UnlinkedCodeBlock::instructionsSize const):
(JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlock::binaryArithProfile):
(JSC::UnlinkedCodeBlock::unaryArithProfile):
(JSC::UnlinkedCodeBlock::llintExecuteCounter):
* bytecode/UnlinkedMetadataTable.h:
(JSC::UnlinkedMetadataTable::offsetInMetadataTable):
* bytecode/ValueProfile.h:
(JSC::ValueProfileBase::ValueProfileBase):
(JSC::ValueProfileBase::clearBuckets):
(JSC::ValueProfile::offsetOfFirstBucket):
* dfg/DFGCommonData.h:
* dfg/DFGJITCode.cpp:
* dfg/DFGJITCode.h:
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileExit):
* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::handleExitCounts):
(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):
* dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLJITCode.h:
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::addMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* generator/Metadata.rb:
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::storeProperty):
(JSC::AssemblyHelpers::emitVirtualCall):
(JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):
* jit/BaselineJITCode.cpp: Added.
(JSC::MathICHolder::addJITAddIC):
(JSC::MathICHolder::addJITMulIC):
(JSC::MathICHolder::addJITSubIC):
(JSC::MathICHolder::addJITNegIC):
(JSC::MathICHolder::adoptMathICs):
(JSC::BaselineJITCode::BaselineJITCode):
(JSC::BaselineJITCode::~BaselineJITCode):
* jit/BaselineJITCode.h: Added.
(JSC::JITConstantPool::add):
(JSC::JITConstantPool::size const):
(JSC::JITConstantPool::at const):
* jit/BaselineJITPlan.cpp:
(JSC::BaselineJITPlan::finalize):
* jit/CCallHelpers.cpp:
(JSC::CCallHelpers::logShadowChickenTailPacketImpl):
(JSC::CCallHelpers::logShadowChickenTailPacket):
* jit/CCallHelpers.h:
* jit/CallFrameShuffleData.cpp:
(JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
* jit/CallFrameShuffleData.h:
* jit/CallFrameShuffler.cpp:
(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareForTailCall):
* jit/CallFrameShuffler.h:
(JSC::CallFrameShuffler::snapshot const):
* jit/JIT.cpp:
(JSC::JIT::JIT):
(JSC::JIT::emitEnterOptimizationCheck):
(JSC::JIT::emitNotifyWriteWatchpoint):
(JSC::JIT::emitVarReadOnlyCheck):
(JSC::JIT::assertStackPointerOffset):
(JSC::JIT::resetSP):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
(JSC::JIT::emitRestoreCalleeSaves):
(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::link):
(JSC::JIT::finalizeOnMainThread):
(JSC::JIT::privateCompile):
(JSC::JIT::frameRegisterCountFor):
(JSC::JIT::stackPointerOffsetFor):
* jit/JIT.h:
* jit/JITArithmetic.cpp:
(JSC::JIT::emit_compareAndJumpSlowImpl):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):
* jit/JITCall.cpp:
(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):
* jit/JITCall32_64.cpp:
(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):
* jit/JITCode.h:
(JSC::JITCode::useDataIC):
(JSC::JITCode::pcToCodeOriginMap):
* jit/JITCompilationKey.cpp:
(JSC::JITCompilationKey::dump const):
* jit/JITCompilationKey.h:
(JSC::JITCompilationKey::JITCompilationKey):
(JSC::JITCompilationKey::operator! const):
(JSC::JITCompilationKey::isHashTableDeletedValue const):
(JSC::JITCompilationKey::operator== const):
(JSC::JITCompilationKey::hash const):
(JSC::JITCompilationKey::profiledBlock const): Deleted.
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
(JSC::JITInlineCacheGenerator::finalize):
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
(JSC::generateGetByIdInlineAccess):
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInstanceOfGenerator::generateFastPath):
(JSC::JITGetByValGenerator::generateFastPath):
(JSC::JITPutByValGenerator::generateFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateFastPath):
* jit/JITInlineCacheGenerator.h:
* jit/JITInlines.h:
(JSC::JIT::isOperandConstantDouble):
(JSC::JIT::isOperandConstantInt):
(JSC::JIT::isKnownCell):
(JSC::JIT::getConstantOperand):
(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
(JSC::JIT::linkSlowCaseIfNotJSCell):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::isOperandConstantChar):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitJumpSlowCaseIfNotJSCell):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::jumpTarget):
(JSC::JIT::loadPtrFromMetadata):
(JSC::JIT::load32FromMetadata):
(JSC::JIT::load8FromMetadata):
(JSC::JIT::store8ToMetadata):
(JSC::JIT::store32ToMetadata):
(JSC::JIT::materializePointerIntoMetadata):
(JSC::JIT::loadConstant):
(JSC::JIT::loadGlobalObject):
(JSC::JIT::loadCodeBlockConstant):
(JSC::JIT::copiedGetPutInfo): Deleted.
(JSC::JIT::copiedArithProfile): Deleted.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::op_ret_handlerGenerator):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::valueIsFalseyGenerator):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jeq_ptr):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::valueIsTruthyGenerator):
(JSC::JIT::emit_op_throw):
(JSC::JIT::op_throw_handlerGenerator):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_enter):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_loop_hint):
(JSC::JIT::emitSlow_op_check_traps):
(JSC::JIT::op_check_traps_handlerGenerator):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_get_argument):
(JSC::JIT::emit_op_get_prototype_of):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::compileOpEqJumpSlow):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_enter):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
* jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* jit/JITOperations.h:
* jit/JITPlan.cpp:
(JSC::JITPlan::key):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::slow_op_resolve_scopeGenerator):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::slow_op_get_from_scopeGenerator):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::slow_op_put_to_scopeGenerator):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
(JSC::JIT::emit_op_enumerator_next):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_enumerator_has_propertyImpl):
(JSC::JIT::emitWriteBarrier):
(JSC::JIT::emitPutGlobalVariable): Deleted.
(JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
(JSC::JIT::emitPutClosureVar): Deleted.
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
* jit/Repatch.cpp:
(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
(JSC::tryCacheInBy):
(JSC::unlinkCall):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CacheableIdentifier.h:
* runtime/CacheableIdentifierInlines.h:
(JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):
* runtime/CachedTypes.cpp:
(JSC::CachedCodeBlock::numBinaryArithProfiles const):
(JSC::CachedCodeBlock::numUnaryArithProfiles const):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::CachedCodeBlock<CodeBlockType>::encode):
* runtime/CommonSlowPaths.cpp:
(JSC::updateArithProfileForUnaryArithOp):
* runtime/FunctionExecutable.h:
* runtime/Options.cpp:
(JSC::Options::recomputeDependentOptions):
* runtime/OptionsList.h:
* runtime/ScriptExecutable.cpp:
(JSC::ScriptExecutable::prepareForExecutionImpl):
* wasm/WasmLLIntTierUpCounter.h:
(JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
(JSC::Wasm::LLIntTierUpCounter::optimizeSoon):
* wasm/WasmTierUpCount.cpp:
(JSC::Wasm::TierUpCount::TierUpCount):
* wasm/WasmTierUpCount.h:
(JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
(JSC::Wasm::TierUpCount::optimizeNextInvocation):
(JSC::Wasm::TierUpCount::optimizeSoon):
2021-09-27 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Use op_jeq_ptr for empty JSPropertyNameEnumerator check
https://bugs.webkit.org/show_bug.cgi?id=230817
Reviewed by Saam Barati.
We use op_jeq_ptr for empty JSPropertyNameEnumerator check instead of stricteq for smaller
bytecode size and efficient branching in LLInt and Baseline. In DFG and FTL, both will get
the same nodes.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitJumpIfEmptyPropertyNameEnumerator):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ForInNode::emitBytecode):
2021-09-26 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize PutByVal with for-in
https://bugs.webkit.org/show_bug.cgi?id=230801
Reviewed by Saam Barati.
We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.
In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.
To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.
We also clean up DFG operation related to PutByVal.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant
* builtins/BuiltinNames.h:
* bytecode/BytecodeList.rb:
* bytecode/BytecodeUseDef.cpp:
(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):
* bytecode/LinkTimeConstant.h:
* bytecode/Opcode.h:
(JSC::isBranch):
* bytecode/PreciseJumpTargetsInlines.h:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::GenericLabel<JSGeneratorTraits>::setLocation):
(JSC::BytecodeGenerator::emitJumpIfSentinelString):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ForInNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGOperations.cpp:
(JSC::DFG::putByVal):
(JSC::DFG::putByValInternal):
(JSC::DFG::putByValCellInternal):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_jeq_ptr):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jeq_ptr):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_enumerator_next):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/SmallStrings.cpp:
(JSC::SmallStrings::initializeCommonStrings):
(JSC::SmallStrings::visitStrongReferences):
* runtime/SmallStrings.h:
(JSC::SmallStrings::sentinelString const):
2021-09-26 Commit Queue <commit-queue@webkit.org>
Unreviewed, reverting r283095.
https://bugs.webkit.org/show_bug.cgi?id=230815
We should land the original patch since this does not work
with bytecode cache
Reverted changeset:
"[JSC] Optimize PutByVal with for-in"
https://bugs.webkit.org/show_bug.cgi?id=230801
https://commits.webkit.org/r283095
2021-09-26 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize PutByVal with for-in
https://bugs.webkit.org/show_bug.cgi?id=230801
Reviewed by Saam Barati.
We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.
In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.
To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.
We also clean up DFG operation related to PutByVal.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant
* builtins/BuiltinNames.h:
* bytecode/BytecodeList.rb:
* bytecode/BytecodeUseDef.cpp:
(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):
* bytecode/LinkTimeConstant.h:
* bytecode/Opcode.h:
(JSC::isBranch):
* bytecode/PreciseJumpTargetsInlines.h:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::GenericLabel<JSGeneratorTraits>::setLocation):
(JSC::BytecodeGenerator::emitJumpIfSentinelString):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ForInNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGOperations.cpp:
(JSC::DFG::putByVal):
(JSC::DFG::putByValInternal):
(JSC::DFG::putByValCellInternal):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_jeq_ptr):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jeq_ptr):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_enumerator_next):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/SmallStrings.cpp:
(JSC::SmallStrings::initializeCommonStrings):
(JSC::SmallStrings::visitStrongReferences):
* runtime/SmallStrings.h:
(JSC::SmallStrings::sentinelString const):
2021-09-26 Commit Queue <commit-queue@webkit.org>
Unreviewed, reverting r283083 and r283088.
https://bugs.webkit.org/show_bug.cgi?id=230806
Windows pors are crashing
Reverted changesets:
"Build an unlinked baseline JIT"
https://bugs.webkit.org/show_bug.cgi?id=229223
https://commits.webkit.org/r283083
"Make byte codes with arithmetic profiles switch to using an
index instead of a pointer in metadata"
https://bugs.webkit.org/show_bug.cgi?id=230798
https://commits.webkit.org/r283088
2021-09-26 Saam Barati <sbarati@apple.com>
Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata
https://bugs.webkit.org/show_bug.cgi?id=230798
Reviewed by Yusuke Suzuki.
This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile
have an index into a table instead of storing a pointer to the profile in its metadata.
Then, we can just load the profile using the index in the bytecode, which saves memory.
* bytecode/BytecodeList.rb:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):
* bytecode/UnlinkedCodeBlock.h:
* bytecode/UnlinkedCodeBlockGenerator.cpp:
(JSC::UnlinkedCodeBlockGenerator::finalize):
* bytecode/UnlinkedCodeBlockGenerator.h:
(JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile):
(JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitUnaryOp):
(JSC::BytecodeGenerator::emitInc):
(JSC::BytecodeGenerator::emitDec):
* bytecompiler/BytecodeGenerator.h:
* jit/JITArithmetic.cpp:
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::updateArithProfileForUnaryArithOp):
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
2021-09-25 Saam Barati <sbarati@apple.com>
Build an unlinked baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>
Reviewed by Yusuke Suzuki.
This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".
To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.
Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.
This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.
This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.
This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's