<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[189501] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/189501">189501</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2015-09-08 12:11:04 -0700 (Tue, 08 Sep 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>baseline JIT should emit better code for UnresolvedProperty in resolve_scope/get_from_scope/put_to_scope
https://bugs.webkit.org/show_bug.cgi?id=148895
Patch by Saam barati <sbarati@apple.com> on 2015-09-08
Reviewed by Geoffrey Garen.
Previously, if a resolve_scope/get_from_scope/put_to_scope with
UnresolvedProperty made it to the baseline JIT, we would hard compile
a jump to the slow path. This is bad and slow. Because UnresolvedProperty
tries to update itself to something more useful, and succeeds at doing so
with high probability, we should be emitting code that checks to see if the
slow path has performed an update, and if it has, execute more efficient code
and not go to the slow path (unless it needs to for var injection check failure,
or other check failures). This increases the speed of this code greatly because
we may decide to compile a program/function before certain resolve_scope/get_from_scope/put_to_scope
operations ever execute. And now, the baseline JIT code better adapts to such
compilation scenarios.
* bytecode/Watchpoint.h:
(JSC::WatchpointSet::isBeingWatched):
(JSC::WatchpointSet::addressOfState):
(JSC::WatchpointSet::offsetOfState):
(JSC::WatchpointSet::addressOfSetIsNotEmpty):
* jit/JIT.cpp:
(JSC::JIT::emitNotifyWrite):
(JSC::JIT::assertStackPointerOffset):
* jit/JIT.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emitSlow_op_resolve_scope):
(JSC::JIT::emitGetGlobalProperty):
(JSC::JIT::emitGetVarFromPointer):
(JSC::JIT::emitGetVarFromIndirectPointer):
(JSC::JIT::emitGetClosureVar):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emitPutGlobalProperty):
(JSC::JIT::emitPutGlobalVariable):
(JSC::JIT::emitPutGlobalVariableIndirect):
(JSC::JIT::emitPutClosureVar):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emitSlow_op_resolve_scope):
(JSC::JIT::emitGetGlobalProperty):
(JSC::JIT::emitGetVarFromPointer):
(JSC::JIT::emitGetVarFromIndirectPointer):
(JSC::JIT::emitGetClosureVar):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emitPutGlobalProperty):
(JSC::JIT::emitPutGlobalVariable):
(JSC::JIT::emitPutGlobalVariableIndirect):
(JSC::JIT::emitPutClosureVar):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
* runtime/JSScope.cpp:
(JSC::abstractAccess):
* tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js:
(foo):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeWatchpointh">trunk/Source/JavaScriptCore/bytecode/Watchpoint.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccesscpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathsh">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSScopecpp">trunk/Source/JavaScriptCore/runtime/JSScope.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressmultiplefilestestsgloballexicalvariableunresolvedpropertyfirstjs">trunk/Source/JavaScriptCore/tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -1,3 +1,69 @@
</span><ins>+2015-09-08 Saam barati <sbarati@apple.com>
+
+ baseline JIT should emit better code for UnresolvedProperty in resolve_scope/get_from_scope/put_to_scope
+ https://bugs.webkit.org/show_bug.cgi?id=148895
+
+ Reviewed by Geoffrey Garen.
+
+ Previously, if a resolve_scope/get_from_scope/put_to_scope with
+ UnresolvedProperty made it to the baseline JIT, we would hard compile
+ a jump to the slow path. This is bad and slow. Because UnresolvedProperty
+ tries to update itself to something more useful, and succeeds at doing so
+ with high probability, we should be emitting code that checks to see if the
+ slow path has performed an update, and if it has, execute more efficient code
+ and not go to the slow path (unless it needs to for var injection check failure,
+ or other check failures). This increases the speed of this code greatly because
+ we may decide to compile a program/function before certain resolve_scope/get_from_scope/put_to_scope
+ operations ever execute. And now, the baseline JIT code better adapts to such
+ compilation scenarios.
+
+ * bytecode/Watchpoint.h:
+ (JSC::WatchpointSet::isBeingWatched):
+ (JSC::WatchpointSet::addressOfState):
+ (JSC::WatchpointSet::offsetOfState):
+ (JSC::WatchpointSet::addressOfSetIsNotEmpty):
+ * jit/JIT.cpp:
+ (JSC::JIT::emitNotifyWrite):
+ (JSC::JIT::assertStackPointerOffset):
+ * jit/JIT.h:
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emit_op_resolve_scope):
+ (JSC::JIT::emitSlow_op_resolve_scope):
+ (JSC::JIT::emitGetGlobalProperty):
+ (JSC::JIT::emitGetVarFromPointer):
+ (JSC::JIT::emitGetVarFromIndirectPointer):
+ (JSC::JIT::emitGetClosureVar):
+ (JSC::JIT::emit_op_get_from_scope):
+ (JSC::JIT::emitSlow_op_get_from_scope):
+ (JSC::JIT::emitPutGlobalProperty):
+ (JSC::JIT::emitPutGlobalVariable):
+ (JSC::JIT::emitPutGlobalVariableIndirect):
+ (JSC::JIT::emitPutClosureVar):
+ (JSC::JIT::emit_op_put_to_scope):
+ (JSC::JIT::emitSlow_op_put_to_scope):
+ * jit/JITPropertyAccess32_64.cpp:
+ (JSC::JIT::emit_op_resolve_scope):
+ (JSC::JIT::emitSlow_op_resolve_scope):
+ (JSC::JIT::emitGetGlobalProperty):
+ (JSC::JIT::emitGetVarFromPointer):
+ (JSC::JIT::emitGetVarFromIndirectPointer):
+ (JSC::JIT::emitGetClosureVar):
+ (JSC::JIT::emit_op_get_from_scope):
+ (JSC::JIT::emitSlow_op_get_from_scope):
+ (JSC::JIT::emitPutGlobalProperty):
+ (JSC::JIT::emitPutGlobalVariable):
+ (JSC::JIT::emitPutGlobalVariableIndirect):
+ (JSC::JIT::emitPutClosureVar):
+ (JSC::JIT::emit_op_put_to_scope):
+ (JSC::JIT::emitSlow_op_put_to_scope):
+ * runtime/CommonSlowPaths.h:
+ (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+ (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+ * runtime/JSScope.cpp:
+ (JSC::abstractAccess):
+ * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js:
+ (foo):
+
</ins><span class="cx"> 2015-09-08 Sukolsak Sakshuwong <sukolsak@gmail.com>
</span><span class="cx">
</span><span class="cx"> Implement all the arithmetic and logical instructions in WebAssembly
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeWatchpointh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/Watchpoint.h (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/Watchpoint.h 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/bytecode/Watchpoint.h 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -194,6 +194,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> int8_t* addressOfState() { return &m_state; }
</span><ins>+ static ptrdiff_t offsetOfState() { return OBJECT_OFFSETOF(WatchpointSet, m_state); }
</ins><span class="cx"> int8_t* addressOfSetIsNotEmpty() { return &m_setIsNotEmpty; }
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE void fireAllSlow(const FireDetail&); // Call only if you've checked isWatched.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -101,6 +101,11 @@
</span><span class="cx"> addSlowCase(branch8(NotEqual, AbsoluteAddress(set->addressOfState()), TrustedImm32(IsInvalidated)));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void JIT::emitNotifyWrite(GPRReg pointerToSet)
+{
+ addSlowCase(branch8(NotEqual, Address(pointerToSet, WatchpointSet::offsetOfState()), TrustedImm32(IsInvalidated)));
+}
+
</ins><span class="cx"> void JIT::assertStackPointerOffset()
</span><span class="cx"> {
</span><span class="cx"> if (ASSERT_DISABLED)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/jit/JIT.h 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -668,14 +668,18 @@
</span><span class="cx"> void emitLoadWithStructureCheck(int scope, Structure** structureSlot);
</span><span class="cx"> void emitGetGlobalProperty(uintptr_t* operandSlot);
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- void emitGetVarFromPointer(uintptr_t operand, GPRReg);
</del><ins>+ void emitGetVarFromPointer(JSValue* operand, GPRReg);
+ void emitGetVarFromIndirectPointer(JSValue** operand, GPRReg);
</ins><span class="cx"> #else
</span><del>- void emitGetVarFromPointer(uintptr_t operand, GPRReg tag, GPRReg payload);
</del><ins>+ void emitGetVarFromIndirectPointer(JSValue** operand, GPRReg tag, GPRReg payload);
+ void emitGetVarFromPointer(JSValue* operand, GPRReg tag, GPRReg payload);
</ins><span class="cx"> #endif
</span><span class="cx"> void emitGetClosureVar(int scope, uintptr_t operand);
</span><span class="cx"> void emitPutGlobalProperty(uintptr_t* operandSlot, int value);
</span><span class="cx"> void emitNotifyWrite(WatchpointSet*);
</span><del>- void emitPutGlobalVariable(uintptr_t operand, int value, WatchpointSet*);
</del><ins>+ void emitNotifyWrite(GPRReg pointerToSet);
+ void emitPutGlobalVariable(JSValue* operand, int value, WatchpointSet*);
+ void emitPutGlobalVariableIndirect(JSValue** addressOfOperand, int value, WatchpointSet**);
</ins><span class="cx"> void emitPutClosureVar(int scope, uintptr_t operand, int value, WatchpointSet*);
</span><span class="cx">
</span><span class="cx"> void emitInitRegister(int dst);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -690,37 +690,74 @@
</span><span class="cx"> ResolveType resolveType = static_cast<ResolveType>(currentInstruction[4].u.operand);
</span><span class="cx"> unsigned depth = currentInstruction[5].u.operand;
</span><span class="cx">
</span><ins>+ auto emitCode = [&] (ResolveType resolveType) {
+ switch (resolveType) {
+ case GlobalProperty:
+ case GlobalVar:
+ case GlobalPropertyWithVarInjectionChecks:
+ case GlobalVarWithVarInjectionChecks:
+ case GlobalLexicalVar:
+ case GlobalLexicalVarWithVarInjectionChecks: {
+ JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+ RELEASE_ASSERT(constantScope);
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ move(TrustedImmPtr(constantScope), regT0);
+ emitPutVirtualRegister(dst);
+ break;
+ }
+ case ClosureVar:
+ case ClosureVarWithVarInjectionChecks:
+ emitResolveClosure(dst, scope, needsVarInjectionChecks(resolveType), depth);
+ break;
+ case ModuleVar:
+ move(TrustedImmPtr(currentInstruction[6].u.jsCell.get()), regT0);
+ emitPutVirtualRegister(dst);
+ break;
+ case Dynamic:
+ addSlowCase(jump());
+ break;
+ case LocalClosureVar:
+ case UnresolvedProperty:
+ case UnresolvedPropertyWithVarInjectionChecks:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
+ };
+
</ins><span class="cx"> switch (resolveType) {
</span><del>- case GlobalProperty:
- case GlobalVar:
- case GlobalPropertyWithVarInjectionChecks:
- case GlobalVarWithVarInjectionChecks:
- case GlobalLexicalVar:
- case GlobalLexicalVarWithVarInjectionChecks: {
- JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
- RELEASE_ASSERT(constantScope);
- RELEASE_ASSERT(static_cast<JSScope*>(currentInstruction[6].u.pointer) == constantScope);
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- move(TrustedImmPtr(constantScope), regT0);
- emitPutVirtualRegister(dst);
- break;
- }
- case ClosureVar:
- case ClosureVarWithVarInjectionChecks:
- emitResolveClosure(dst, scope, needsVarInjectionChecks(resolveType), depth);
- break;
- case ModuleVar:
- move(TrustedImmPtr(currentInstruction[6].u.jsCell.get()), regT0);
- emitPutVirtualRegister(dst);
- break;
</del><span class="cx"> case UnresolvedProperty:
</span><del>- case UnresolvedPropertyWithVarInjectionChecks:
- case Dynamic:
</del><ins>+ case UnresolvedPropertyWithVarInjectionChecks: {
+ JumpList skipToEnd;
+ load32(&currentInstruction[4], regT0);
+
+ Jump notGlobalProperty = branch32(NotEqual, regT0, TrustedImm32(GlobalProperty));
+ emitCode(GlobalProperty);
+ skipToEnd.append(jump());
+ notGlobalProperty.link(this);
+
+ Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+ emitCode(GlobalPropertyWithVarInjectionChecks);
+ skipToEnd.append(jump());
+ notGlobalPropertyWithVarInjections.link(this);
+
+ Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+ emitCode(GlobalLexicalVar);
+ skipToEnd.append(jump());
+ notGlobalLexicalVar.link(this);
+
+ Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+ emitCode(GlobalLexicalVarWithVarInjectionChecks);
+ skipToEnd.append(jump());
+ notGlobalLexicalVarWithVarInjections.link(this);
+
</ins><span class="cx"> addSlowCase(jump());
</span><ins>+ skipToEnd.link(this);
</ins><span class="cx"> break;
</span><del>- case LocalClosureVar:
- RELEASE_ASSERT_NOT_REACHED();
</del><span class="cx"> }
</span><ins>+
+ default:
+ emitCode(resolveType);
+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JIT::emitSlow_op_resolve_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="lines">@@ -729,6 +766,10 @@
</span><span class="cx"> if (resolveType == GlobalProperty || resolveType == GlobalVar || resolveType == ClosureVar || resolveType == GlobalLexicalVar || resolveType == ModuleVar)
</span><span class="cx"> return;
</span><span class="cx">
</span><ins>+ if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+ linkSlowCase(iter); // var injections check for GlobalPropertyWithVarInjectionChecks.
+ linkSlowCase(iter); // var injections check for GlobalLexicalVarWithVarInjectionChecks.
+ }
</ins><span class="cx">
</span><span class="cx"> linkSlowCase(iter);
</span><span class="cx"> JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_resolve_scope);
</span><span class="lines">@@ -750,11 +791,17 @@
</span><span class="cx"> compileGetDirectOffset(regT0, regT0, regT1, regT2, KnownNotFinal);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT::emitGetVarFromPointer(uintptr_t operand, GPRReg reg)
</del><ins>+void JIT::emitGetVarFromPointer(JSValue* operand, GPRReg reg)
</ins><span class="cx"> {
</span><del>- loadPtr(reinterpret_cast<void*>(operand), reg);
</del><ins>+ loadPtr(operand, reg);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+void JIT::emitGetVarFromIndirectPointer(JSValue** operand, GPRReg reg)
+{
+ loadPtr(operand, reg);
+ loadPtr(reg, reg);
+}
+
</ins><span class="cx"> void JIT::emitGetClosureVar(int scope, uintptr_t operand)
</span><span class="cx"> {
</span><span class="cx"> emitGetVirtualRegister(scope, regT0);
</span><span class="lines">@@ -769,35 +816,75 @@
</span><span class="cx"> Structure** structureSlot = currentInstruction[5].u.structure.slot();
</span><span class="cx"> uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
</span><span class="cx">
</span><ins>+ auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+ switch (resolveType) {
+ case GlobalProperty:
+ case GlobalPropertyWithVarInjectionChecks:
+ emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+ emitGetGlobalProperty(operandSlot);
+ break;
+ case GlobalVar:
+ case GlobalVarWithVarInjectionChecks:
+ case GlobalLexicalVar:
+ case GlobalLexicalVarWithVarInjectionChecks:
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ if (indirectLoadForOperand)
+ emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT0);
+ else
+ emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT0);
+ if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks) // TDZ check.
+ addSlowCase(branchTest64(Zero, regT0));
+ break;
+ case ClosureVar:
+ case ClosureVarWithVarInjectionChecks:
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ emitGetClosureVar(scope, *operandSlot);
+ break;
+ case Dynamic:
+ addSlowCase(jump());
+ break;
+ case LocalClosureVar:
+ case ModuleVar:
+ case UnresolvedProperty:
+ case UnresolvedPropertyWithVarInjectionChecks:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
+ };
+
</ins><span class="cx"> switch (resolveType) {
</span><del>- case GlobalProperty:
- case GlobalPropertyWithVarInjectionChecks:
- emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
- emitGetGlobalProperty(operandSlot);
- break;
- case GlobalVar:
- case GlobalVarWithVarInjectionChecks:
- case GlobalLexicalVar:
- case GlobalLexicalVarWithVarInjectionChecks:
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- emitGetVarFromPointer(*operandSlot, regT0);
- if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks) // TDZ check.
- addSlowCase(branchTest64(Zero, regT0));
- break;
- case ClosureVar:
- case ClosureVarWithVarInjectionChecks:
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- emitGetClosureVar(scope, *operandSlot);
- break;
</del><span class="cx"> case UnresolvedProperty:
</span><del>- case UnresolvedPropertyWithVarInjectionChecks:
- case Dynamic:
</del><ins>+ case UnresolvedPropertyWithVarInjectionChecks: {
+ JumpList skipToEnd;
+ load32(&currentInstruction[4], regT0);
+ and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+ Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+ Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+ isGlobalProperty.link(this);
+ emitCode(GlobalProperty, false);
+ skipToEnd.append(jump());
+ notGlobalPropertyWithVarInjections.link(this);
+
+ Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+ emitCode(GlobalLexicalVar, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVar.link(this);
+
+ Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+ emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVarWithVarInjections.link(this);
+
</ins><span class="cx"> addSlowCase(jump());
</span><ins>+
+ skipToEnd.link(this);
</ins><span class="cx"> break;
</span><del>- case ModuleVar:
- case LocalClosureVar:
- RELEASE_ASSERT_NOT_REACHED();
</del><span class="cx"> }
</span><ins>+
+ default:
+ emitCode(resolveType, false);
+ break;
+ }
</ins><span class="cx"> emitPutVirtualRegister(dst);
</span><span class="cx"> emitValueProfilingSite();
</span><span class="cx"> }
</span><span class="lines">@@ -816,6 +903,17 @@
</span><span class="cx"> if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var injections check.
</span><span class="cx"> linkSlowCase(iter);
</span><span class="cx">
</span><ins>+ if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+ // GlobalProperty/GlobalPropertyWithVarInjectionChecks
+ linkSlowCase(iter); // emitLoadWithStructureCheck
+ linkSlowCase(iter); // emitLoadWithStructureCheck
+ // GlobalLexicalVar
+ linkSlowCase(iter); // TDZ check.
+ // GlobalLexicalVarWithVarInjectionChecks.
+ linkSlowCase(iter); // var injection check.
+ linkSlowCase(iter); // TDZ check.
+ }
+
</ins><span class="cx"> linkSlowCase(iter);
</span><span class="cx">
</span><span class="cx"> callOperation(WithProfile, operationGetFromScope, dst, currentInstruction);
</span><span class="lines">@@ -831,12 +929,20 @@
</span><span class="cx"> storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT::emitPutGlobalVariable(uintptr_t operand, int value, WatchpointSet* set)
</del><ins>+void JIT::emitPutGlobalVariable(JSValue* operand, int value, WatchpointSet* set)
</ins><span class="cx"> {
</span><span class="cx"> emitGetVirtualRegister(value, regT0);
</span><span class="cx"> emitNotifyWrite(set);
</span><del>- storePtr(regT0, reinterpret_cast<void*>(operand));
</del><ins>+ storePtr(regT0, operand);
</ins><span class="cx"> }
</span><ins>+void JIT::emitPutGlobalVariableIndirect(JSValue** addressOfOperand, int value, WatchpointSet** indirectWatchpointSet)
+{
+ emitGetVirtualRegister(value, regT0);
+ loadPtr(indirectWatchpointSet, regT1);
+ emitNotifyWrite(regT1);
+ loadPtr(addressOfOperand, regT1);
+ storePtr(regT0, regT1);
+}
</ins><span class="cx">
</span><span class="cx"> void JIT::emitPutClosureVar(int scope, uintptr_t operand, int value, WatchpointSet* set)
</span><span class="cx"> {
</span><span class="lines">@@ -855,44 +961,88 @@
</span><span class="cx"> Structure** structureSlot = currentInstruction[5].u.structure.slot();
</span><span class="cx"> uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
</span><span class="cx">
</span><del>- switch (resolveType) {
- case GlobalProperty:
- case GlobalPropertyWithVarInjectionChecks:
- emitWriteBarrier(m_codeBlock->globalObject(), value, ShouldFilterValue);
- emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
- emitPutGlobalProperty(operandSlot, value);
- break;
- case GlobalVar:
- case GlobalVarWithVarInjectionChecks:
- case GlobalLexicalVar:
- case GlobalLexicalVarWithVarInjectionChecks: {
- JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
- RELEASE_ASSERT(constantScope);
- emitWriteBarrier(constantScope, value, ShouldFilterValue);
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
- // We need to do a TDZ check here because we can't always prove we need to emit TDZ checks statically.
- emitGetVarFromPointer(*operandSlot, regT0);
- addSlowCase(branchTest64(Zero, regT0));
</del><ins>+ auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+ switch (resolveType) {
+ case GlobalProperty:
+ case GlobalPropertyWithVarInjectionChecks:
+ emitWriteBarrier(m_codeBlock->globalObject(), value, ShouldFilterValue);
+ emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+ emitPutGlobalProperty(operandSlot, value);
+ break;
+ case GlobalVar:
+ case GlobalVarWithVarInjectionChecks:
+ case GlobalLexicalVar:
+ case GlobalLexicalVarWithVarInjectionChecks: {
+ JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+ RELEASE_ASSERT(constantScope);
+ emitWriteBarrier(constantScope, value, ShouldFilterValue);
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
+ // We need to do a TDZ check here because we can't always prove we need to emit TDZ checks statically.
+ if (indirectLoadForOperand)
+ emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT0);
+ else
+ emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT0);
+ addSlowCase(branchTest64(Zero, regT0));
+ }
+ if (indirectLoadForOperand)
+ emitPutGlobalVariableIndirect(bitwise_cast<JSValue**>(operandSlot), value, bitwise_cast<WatchpointSet**>(&currentInstruction[5]));
+ else
+ emitPutGlobalVariable(bitwise_cast<JSValue*>(*operandSlot), value, currentInstruction[5].u.watchpointSet);
+ break;
</ins><span class="cx"> }
</span><ins>+ case LocalClosureVar:
+ case ClosureVar:
+ case ClosureVarWithVarInjectionChecks:
+ emitWriteBarrier(scope, value, ShouldFilterValue);
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ emitPutClosureVar(scope, *operandSlot, value, currentInstruction[5].u.watchpointSet);
+ break;
+ case ModuleVar:
+ case Dynamic:
+ addSlowCase(jump());
+ break;
+ case UnresolvedProperty:
+ case UnresolvedPropertyWithVarInjectionChecks:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+ };
</ins><span class="cx">
</span><del>- emitPutGlobalVariable(*operandSlot, value, currentInstruction[5].u.watchpointSet);
- break;
- }
- case LocalClosureVar:
- case ClosureVar:
- case ClosureVarWithVarInjectionChecks:
- emitWriteBarrier(scope, value, ShouldFilterValue);
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- emitPutClosureVar(scope, *operandSlot, value, currentInstruction[5].u.watchpointSet);
- break;
</del><ins>+ switch (resolveType) {
</ins><span class="cx"> case UnresolvedProperty:
</span><del>- case UnresolvedPropertyWithVarInjectionChecks:
- case ModuleVar:
- case Dynamic:
</del><ins>+ case UnresolvedPropertyWithVarInjectionChecks: {
+ JumpList skipToEnd;
+ load32(&currentInstruction[4], regT0);
+ and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+ Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+ Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+ isGlobalProperty.link(this);
+ emitCode(GlobalProperty, false);
+ skipToEnd.append(jump());
+ notGlobalPropertyWithVarInjections.link(this);
+
+ Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+ emitCode(GlobalLexicalVar, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVar.link(this);
+
+ Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+ emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVarWithVarInjections.link(this);
+
</ins><span class="cx"> addSlowCase(jump());
</span><ins>+
+ skipToEnd.link(this);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+
+ default:
+ emitCode(resolveType, false);
+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="lines">@@ -911,6 +1061,23 @@
</span><span class="cx"> linkCount++;
</span><span class="cx"> if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
</span><span class="cx"> linkCount++;
</span><ins>+ if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+ // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
+ linkCount++; // emitLoadWithStructureCheck
+ linkCount++; // emitLoadWithStructureCheck
+
+ // GlobalLexicalVar
+ bool needsTDZCheck = getPutInfo.initializationMode() != Initialization;
+ if (needsTDZCheck)
+ linkCount++;
+ linkCount++; // Notify write check.
+
+ // GlobalLexicalVarWithVarInjectionsCheck
+ linkCount++; // var injection check.
+ if (needsTDZCheck)
+ linkCount++;
+ linkCount++; // Notify write check.
+ }
</ins><span class="cx"> if (!linkCount)
</span><span class="cx"> return;
</span><span class="cx"> while (linkCount--)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -720,40 +720,75 @@
</span><span class="cx"> int scope = currentInstruction[2].u.operand;
</span><span class="cx"> ResolveType resolveType = static_cast<ResolveType>(currentInstruction[4].u.operand);
</span><span class="cx"> unsigned depth = currentInstruction[5].u.operand;
</span><del>-
</del><ins>+ auto emitCode = [&] (ResolveType resolveType) {
+ switch (resolveType) {
+ case GlobalProperty:
+ case GlobalVar:
+ case GlobalLexicalVar:
+ case GlobalPropertyWithVarInjectionChecks:
+ case GlobalVarWithVarInjectionChecks:
+ case GlobalLexicalVarWithVarInjectionChecks: {
+ JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+ RELEASE_ASSERT(constantScope);
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ move(TrustedImm32(JSValue::CellTag), regT1);
+ move(TrustedImmPtr(constantScope), regT0);
+ emitStore(dst, regT1, regT0);
+ break;
+ }
+ case ClosureVar:
+ case ClosureVarWithVarInjectionChecks:
+ emitResolveClosure(dst, scope, needsVarInjectionChecks(resolveType), depth);
+ break;
+ case ModuleVar:
+ move(TrustedImm32(JSValue::CellTag), regT1);
+ move(TrustedImmPtr(currentInstruction[6].u.jsCell.get()), regT0);
+ emitStore(dst, regT1, regT0);
+ break;
+ case Dynamic:
+ addSlowCase(jump());
+ break;
+ case LocalClosureVar:
+ case UnresolvedProperty:
+ case UnresolvedPropertyWithVarInjectionChecks:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
+ };
</ins><span class="cx"> switch (resolveType) {
</span><del>- case GlobalProperty:
- case GlobalVar:
- case GlobalLexicalVar:
- case GlobalPropertyWithVarInjectionChecks:
- case GlobalVarWithVarInjectionChecks:
- case GlobalLexicalVarWithVarInjectionChecks: {
- JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
- RELEASE_ASSERT(constantScope);
- RELEASE_ASSERT(static_cast<JSScope*>(currentInstruction[6].u.pointer) == constantScope);
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- move(TrustedImm32(JSValue::CellTag), regT1);
- move(TrustedImmPtr(constantScope), regT0);
- emitStore(dst, regT1, regT0);
- break;
- }
- case ClosureVar:
- case ClosureVarWithVarInjectionChecks:
- emitResolveClosure(dst, scope, needsVarInjectionChecks(resolveType), depth);
- break;
- case ModuleVar:
- move(TrustedImm32(JSValue::CellTag), regT1);
- move(TrustedImmPtr(currentInstruction[6].u.jsCell.get()), regT0);
- emitStore(dst, regT1, regT0);
- break;
</del><span class="cx"> case UnresolvedProperty:
</span><del>- case UnresolvedPropertyWithVarInjectionChecks:
- case Dynamic:
</del><ins>+ case UnresolvedPropertyWithVarInjectionChecks: {
+ JumpList skipToEnd;
+ load32(&currentInstruction[4], regT0);
+
+ Jump notGlobalProperty = branch32(NotEqual, regT0, TrustedImm32(GlobalProperty));
+ emitCode(GlobalProperty);
+ skipToEnd.append(jump());
+ notGlobalProperty.link(this);
+
+ Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+ emitCode(GlobalPropertyWithVarInjectionChecks);
+ skipToEnd.append(jump());
+ notGlobalPropertyWithVarInjections.link(this);
+
+ Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+ emitCode(GlobalLexicalVar);
+ skipToEnd.append(jump());
+ notGlobalLexicalVar.link(this);
+
+ Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+ emitCode(GlobalLexicalVarWithVarInjectionChecks);
+ skipToEnd.append(jump());
+ notGlobalLexicalVarWithVarInjections.link(this);
+
</ins><span class="cx"> addSlowCase(jump());
</span><ins>+ skipToEnd.link(this);
</ins><span class="cx"> break;
</span><del>- case LocalClosureVar:
- RELEASE_ASSERT_NOT_REACHED();
</del><span class="cx"> }
</span><ins>+
+ default:
+ emitCode(resolveType);
+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JIT::emitSlow_op_resolve_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="lines">@@ -762,6 +797,10 @@
</span><span class="cx">
</span><span class="cx"> if (resolveType == GlobalProperty || resolveType == GlobalVar || resolveType == ClosureVar || resolveType == GlobalLexicalVar || resolveType == ModuleVar)
</span><span class="cx"> return;
</span><ins>+ if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+ linkSlowCase(iter); // Var injections check for GlobalPropertyWithVarInjectionChecks.
+ linkSlowCase(iter); // Var injections check for GlobalLexicalVarWithVarInjectionChecks.
+ }
</ins><span class="cx">
</span><span class="cx"> linkSlowCase(iter);
</span><span class="cx"> JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_resolve_scope);
</span><span class="lines">@@ -782,11 +821,18 @@
</span><span class="cx"> compileGetDirectOffset(regT2, regT1, regT0, regT3, KnownNotFinal);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT::emitGetVarFromPointer(uintptr_t operand, GPRReg tag, GPRReg payload)
</del><ins>+void JIT::emitGetVarFromPointer(JSValue* operand, GPRReg tag, GPRReg payload)
</ins><span class="cx"> {
</span><del>- load32(reinterpret_cast<char*>(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag), tag);
- load32(reinterpret_cast<char*>(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), payload);
</del><ins>+ uintptr_t rawAddress = bitwise_cast<uintptr_t>(operand);
+ load32(bitwise_cast<void*>(rawAddress + TagOffset), tag);
+ load32(bitwise_cast<void*>(rawAddress + PayloadOffset), payload);
</ins><span class="cx"> }
</span><ins>+void JIT::emitGetVarFromIndirectPointer(JSValue** operand, GPRReg tag, GPRReg payload)
+{
+ loadPtr(operand, payload);
+ load32(Address(payload, TagOffset), tag);
+ load32(Address(payload, PayloadOffset), payload);
+}
</ins><span class="cx">
</span><span class="cx"> void JIT::emitGetClosureVar(int scope, uintptr_t operand)
</span><span class="cx"> {
</span><span class="lines">@@ -802,36 +848,76 @@
</span><span class="cx"> ResolveType resolveType = GetPutInfo(currentInstruction[4].u.operand).resolveType();
</span><span class="cx"> Structure** structureSlot = currentInstruction[5].u.structure.slot();
</span><span class="cx"> uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
</span><ins>+
+ auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+ switch (resolveType) {
+ case GlobalProperty:
+ case GlobalPropertyWithVarInjectionChecks:
+ emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+ emitGetGlobalProperty(operandSlot);
+ break;
+ case GlobalVar:
+ case GlobalVarWithVarInjectionChecks:
+ case GlobalLexicalVar:
+ case GlobalLexicalVarWithVarInjectionChecks:
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ if (indirectLoadForOperand)
+ emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT1, regT0);
+ else
+ emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT1, regT0);
+ if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks) // TDZ check.
+ addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+ break;
+ case ClosureVar:
+ case ClosureVarWithVarInjectionChecks:
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ emitGetClosureVar(scope, *operandSlot);
+ break;
+ case Dynamic:
+ addSlowCase(jump());
+ break;
+ case ModuleVar:
+ case LocalClosureVar:
+ case UnresolvedProperty:
+ case UnresolvedPropertyWithVarInjectionChecks:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
+ };
</ins><span class="cx">
</span><span class="cx"> switch (resolveType) {
</span><del>- case GlobalProperty:
- case GlobalPropertyWithVarInjectionChecks:
- emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
- emitGetGlobalProperty(operandSlot);
- break;
- case GlobalVar:
- case GlobalVarWithVarInjectionChecks:
- case GlobalLexicalVar:
- case GlobalLexicalVarWithVarInjectionChecks:
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- emitGetVarFromPointer(*operandSlot, regT1, regT0);
- if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks) // TDZ check.
- addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
- break;
- case ClosureVar:
- case ClosureVarWithVarInjectionChecks:
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- emitGetClosureVar(scope, *operandSlot);
- break;
</del><span class="cx"> case UnresolvedProperty:
</span><del>- case UnresolvedPropertyWithVarInjectionChecks:
- case Dynamic:
</del><ins>+ case UnresolvedPropertyWithVarInjectionChecks: {
+ JumpList skipToEnd;
+ load32(&currentInstruction[4], regT0);
+ and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+ Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+ Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+ isGlobalProperty.link(this);
+ emitCode(GlobalProperty, false);
+ skipToEnd.append(jump());
+ notGlobalPropertyWithVarInjections.link(this);
+
+ Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+ emitCode(GlobalLexicalVar, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVar.link(this);
+
+ Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+ emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVarWithVarInjections.link(this);
+
</ins><span class="cx"> addSlowCase(jump());
</span><ins>+
+ skipToEnd.link(this);
</ins><span class="cx"> break;
</span><del>- case ModuleVar:
- case LocalClosureVar:
- RELEASE_ASSERT_NOT_REACHED();
</del><span class="cx"> }
</span><ins>+
+ default:
+ emitCode(resolveType, false);
+ break;
+ }
</ins><span class="cx"> emitValueProfilingSite();
</span><span class="cx"> emitStore(dst, regT1, regT0);
</span><span class="cx"> }
</span><span class="lines">@@ -847,6 +933,16 @@
</span><span class="cx"> if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var Injections check.
</span><span class="cx"> linkSlowCase(iter);
</span><span class="cx">
</span><ins>+ if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+ // GlobalProperty/GlobalPropertyWithVarInjectionChecks
+ linkSlowCase(iter); // emitLoadWithStructureCheck
+ // GlobalLexicalVar
+ linkSlowCase(iter); // TDZ check.
+ // GlobalLexicalVarWithVarInjectionChecks.
+ linkSlowCase(iter); // var injection check.
+ linkSlowCase(iter); // TDZ check.
+ }
+
</ins><span class="cx"> linkSlowCase(iter);
</span><span class="cx"> callOperation(WithProfile, operationGetFromScope, dst, currentInstruction);
</span><span class="cx"> }
</span><span class="lines">@@ -862,14 +958,25 @@
</span><span class="cx"> store32(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT::emitPutGlobalVariable(uintptr_t operand, int value, WatchpointSet* set)
</del><ins>+void JIT::emitPutGlobalVariable(JSValue* operand, int value, WatchpointSet* set)
</ins><span class="cx"> {
</span><span class="cx"> emitLoad(value, regT1, regT0);
</span><span class="cx"> emitNotifyWrite(set);
</span><del>- store32(regT1, reinterpret_cast<char*>(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
- store32(regT0, reinterpret_cast<char*>(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
</del><ins>+ uintptr_t rawAddress = bitwise_cast<uintptr_t>(operand);
+ store32(regT1, bitwise_cast<void*>(rawAddress + TagOffset));
+ store32(regT0, bitwise_cast<void*>(rawAddress + PayloadOffset));
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+void JIT::emitPutGlobalVariableIndirect(JSValue** addressOfOperand, int value, WatchpointSet** indirectWatchpointSet)
+{
+ emitLoad(value, regT1, regT0);
+ loadPtr(indirectWatchpointSet, regT2);
+ emitNotifyWrite(regT2);
+ loadPtr(addressOfOperand, regT2);
+ store32(regT1, Address(regT2, TagOffset));
+ store32(regT0, Address(regT2, PayloadOffset));
+}
+
</ins><span class="cx"> void JIT::emitPutClosureVar(int scope, uintptr_t operand, int value, WatchpointSet* set)
</span><span class="cx"> {
</span><span class="cx"> emitLoad(value, regT3, regT2);
</span><span class="lines">@@ -887,44 +994,88 @@
</span><span class="cx"> ResolveType resolveType = getPutInfo.resolveType();
</span><span class="cx"> Structure** structureSlot = currentInstruction[5].u.structure.slot();
</span><span class="cx"> uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
</span><ins>+
+ auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+ switch (resolveType) {
+ case GlobalProperty:
+ case GlobalPropertyWithVarInjectionChecks:
+ emitWriteBarrier(m_codeBlock->globalObject(), value, ShouldFilterValue);
+ emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+ emitPutGlobalProperty(operandSlot, value);
+ break;
+ case GlobalVar:
+ case GlobalVarWithVarInjectionChecks:
+ case GlobalLexicalVar:
+ case GlobalLexicalVarWithVarInjectionChecks: {
+ JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+ RELEASE_ASSERT(constantScope);
+ emitWriteBarrier(constantScope, value, ShouldFilterValue);
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
+ // We need to do a TDZ check here because we can't always prove we need to emit TDZ checks statically.
+ if (indirectLoadForOperand)
+ emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT1, regT0);
+ else
+ emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT1, regT0);
+ addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+ }
+ if (indirectLoadForOperand)
+ emitPutGlobalVariableIndirect(bitwise_cast<JSValue**>(operandSlot), value, bitwise_cast<WatchpointSet**>(&currentInstruction[5]));
+ else
+ emitPutGlobalVariable(bitwise_cast<JSValue*>(*operandSlot), value, currentInstruction[5].u.watchpointSet);
+ break;
+ }
+ case LocalClosureVar:
+ case ClosureVar:
+ case ClosureVarWithVarInjectionChecks:
+ emitWriteBarrier(scope, value, ShouldFilterValue);
+ emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+ emitPutClosureVar(scope, *operandSlot, value, currentInstruction[5].u.watchpointSet);
+ break;
+ case ModuleVar:
+ case Dynamic:
+ addSlowCase(jump());
+ break;
+ case UnresolvedProperty:
+ case UnresolvedPropertyWithVarInjectionChecks:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
+ };
</ins><span class="cx">
</span><span class="cx"> switch (resolveType) {
</span><del>- case GlobalProperty:
- case GlobalPropertyWithVarInjectionChecks:
- emitWriteBarrier(m_codeBlock->globalObject(), value, ShouldFilterValue);
- emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
- emitPutGlobalProperty(operandSlot, value);
- break;
- case GlobalVar:
- case GlobalVarWithVarInjectionChecks:
- case GlobalLexicalVar:
- case GlobalLexicalVarWithVarInjectionChecks: {
- JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
- RELEASE_ASSERT(constantScope);
- emitWriteBarrier(constantScope, value, ShouldFilterValue);
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
- // We need to do a TDZ check here because we can't always prove we need to emit TDZ checks statically.
- emitGetVarFromPointer(*operandSlot, regT1, regT0);
- addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
- }
- emitPutGlobalVariable(*operandSlot, value, currentInstruction[5].u.watchpointSet);
- break;
- }
- case LocalClosureVar:
- case ClosureVar:
- case ClosureVarWithVarInjectionChecks:
- emitWriteBarrier(scope, value, ShouldFilterValue);
- emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
- emitPutClosureVar(scope, *operandSlot, value, currentInstruction[5].u.watchpointSet);
- break;
- case ModuleVar:
</del><span class="cx"> case UnresolvedProperty:
</span><del>- case UnresolvedPropertyWithVarInjectionChecks:
- case Dynamic:
</del><ins>+ case UnresolvedPropertyWithVarInjectionChecks: {
+ JumpList skipToEnd;
+ load32(&currentInstruction[4], regT0);
+ and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+ Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+ Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+ isGlobalProperty.link(this);
+ emitCode(GlobalProperty, false);
+ skipToEnd.append(jump());
+ notGlobalPropertyWithVarInjections.link(this);
+
+ Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+ emitCode(GlobalLexicalVar, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVar.link(this);
+
+ Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+ emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+ skipToEnd.append(jump());
+ notGlobalLexicalVarWithVarInjections.link(this);
+
</ins><span class="cx"> addSlowCase(jump());
</span><ins>+
+ skipToEnd.link(this);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+
+ default:
+ emitCode(resolveType, false);
+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="lines">@@ -940,6 +1091,22 @@
</span><span class="cx"> linkCount++;
</span><span class="cx"> if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
</span><span class="cx"> linkCount++;
</span><ins>+ if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+ // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
+ linkCount++; // emitLoadWithStructureCheck
+
+ // GlobalLexicalVar
+ bool needsTDZCheck = getPutInfo.initializationMode() != Initialization;
+ if (needsTDZCheck)
+ linkCount++;
+ linkCount++; // Notify write check.
+
+ // GlobalLexicalVarWithVarInjectionsCheck
+ linkCount++; // var injection check.
+ if (needsTDZCheck)
+ linkCount++;
+ linkCount++; // Notify write check.
+ }
</ins><span class="cx"> if (!linkCount)
</span><span class="cx"> return;
</span><span class="cx"> while (linkCount--)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -93,7 +93,6 @@
</span><span class="cx"> GetPutInfo getPutInfo, PutPropertySlot& slot, const Identifier& ident)
</span><span class="cx"> {
</span><span class="cx"> // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
</span><del>-
</del><span class="cx"> ResolveType resolveType = getPutInfo.resolveType();
</span><span class="cx"> if (resolveType != GlobalProperty && resolveType != GlobalPropertyWithVarInjectionChecks
</span><span class="cx"> && resolveType != UnresolvedProperty && resolveType != UnresolvedPropertyWithVarInjectionChecks)
</span><span class="lines">@@ -109,26 +108,30 @@
</span><span class="cx"> pc[6].u.pointer = static_cast<void*>(globalLexicalEnvironment->variableAt(entry.scopeOffset()).slot());
</span><span class="cx"> } else if (jsDynamicCast<JSGlobalObject*>(scope)) {
</span><span class="cx"> ResolveType newResolveType = resolveType == UnresolvedProperty ? GlobalProperty : GlobalPropertyWithVarInjectionChecks;
</span><del>- pc[4].u.operand = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode()).operand();
-
- if (!slot.isCacheablePut()
- || slot.base() != scope
- || !scope->structure()->propertyAccessesAreCacheable())
- return;
-
- if (slot.type() == PutPropertySlot::NewProperty) {
- // Don't cache if we've done a transition. We want to detect the first replace so that we
- // can invalidate the watchpoint.
- return;
- }
-
- scope->structure()->didCachePropertyReplacement(exec->vm(), slot.cachedOffset());
-
- ConcurrentJITLocker locker(codeBlock->m_lock);
- pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
- pc[6].u.operand = slot.cachedOffset();
</del><ins>+ resolveType = newResolveType;
+ getPutInfo = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode());
+ pc[4].u.operand = getPutInfo.operand();
</ins><span class="cx"> }
</span><span class="cx"> }
</span><ins>+
+ if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
+ if (!slot.isCacheablePut()
+ || slot.base() != scope
+ || !scope->structure()->propertyAccessesAreCacheable())
+ return;
+
+ if (slot.type() == PutPropertySlot::NewProperty) {
+ // Don't cache if we've done a transition. We want to detect the first replace so that we
+ // can invalidate the watchpoint.
+ return;
+ }
+
+ scope->structure()->didCachePropertyReplacement(exec->vm(), slot.cachedOffset());
+
+ ConcurrentJITLocker locker(codeBlock->m_lock);
+ pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
+ pc[6].u.operand = slot.cachedOffset();
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> inline void tryCacheGetFromScopeGlobal(
</span><span class="lines">@@ -147,7 +150,7 @@
</span><span class="cx"> pc[6].u.pointer = static_cast<void*>(globalLexicalEnvironment->variableAt(entry.scopeOffset()).slot());
</span><span class="cx"> } else if (jsDynamicCast<JSGlobalObject*>(scope)) {
</span><span class="cx"> ResolveType newResolveType = resolveType == UnresolvedProperty ? GlobalProperty : GlobalPropertyWithVarInjectionChecks;
</span><del>- resolveType = newResolveType; // Allow bottom caching mechanism to kick in.
</del><ins>+ resolveType = newResolveType; // Allow below caching mechanism to kick in.
</ins><span class="cx"> pc[4].u.operand = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode()).operand();
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSScope.cpp (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSScope.cpp 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/runtime/JSScope.cpp 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -128,15 +128,21 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> PropertySlot slot(globalObject);
</span><del>- if (!globalObject->getOwnPropertySlot(globalObject, exec, ident, slot)
- || !slot.isCacheableValue()
</del><ins>+ bool hasOwnProperty = globalObject->getOwnPropertySlot(globalObject, exec, ident, slot);
+ if (!hasOwnProperty) {
+ op = ResolveOp(makeType(UnresolvedProperty, needsVarInjectionChecks), 0, 0, 0, 0, 0);
+ return true;
+ }
+
+ if (!slot.isCacheableValue()
</ins><span class="cx"> || !globalObject->structure()->propertyAccessesAreCacheable()
</span><span class="cx"> || (globalObject->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto() && getOrPut == Put)) {
</span><span class="cx"> // We know the property will be at global scope, but we don't know how to cache it.
</span><span class="cx"> ASSERT(!scope->next());
</span><del>- op = ResolveOp(makeType(UnresolvedProperty, needsVarInjectionChecks), 0, 0, 0, 0, 0);
</del><ins>+ op = ResolveOp(makeType(GlobalProperty, needsVarInjectionChecks), 0, 0, 0, 0, 0);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx">
</span><span class="cx"> WatchpointState state = globalObject->structure()->ensurePropertyReplacementWatchpointSet(exec->vm(), slot.cachedOffset())->state();
</span><span class="cx"> if (state == IsWatched && getOrPut == Put) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressmultiplefilestestsgloballexicalvariableunresolvedpropertyfirstjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js (189500 => 189501)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js 2015-09-08 18:47:45 UTC (rev 189500)
+++ trunk/Source/JavaScriptCore/tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js 2015-09-08 19:11:04 UTC (rev 189501)
</span><span class="lines">@@ -19,7 +19,9 @@
</span><span class="cx">
</span><span class="cx"> let b = false;
</span><span class="cx"> function foo() {
</span><del>- if (b)
</del><ins>+ if (b) {
+ x = x;
</ins><span class="cx"> return x;
</span><ins>+ }
</ins><span class="cx"> }
</span><span class="cx"> foo(); // Link as UnresolvedProperty.
</span></span></pre>
</div>
</div>
</body>
</html>