<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207360] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207360">207360</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-10-14 16:22:07 -0700 (Fri, 14 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>B3 needs a special WasmAddress Opcode
https://bugs.webkit.org/show_bug.cgi?id=163394
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
This patch adds support for WasmAddress. WasmAddress will be used by
Wasm to compute the address of a memory operation from the pinned
base pointer. WasmAddress takes an IntPtr so we can avoid emitting
unnecessary Move32s in Air. This could happen in the following case:
@ptr = Trunc(...)
WasmAddress(@ptr, pinnedGPR)
...
PatchPoint(...) // Do Wasm call
WasmAddress(@ptr, pinnedGPR)
...
In this case we will not be able to CSE the WasmAddresses since the
call writes to pinnedGPR. Thus if WasmAddress took an Int32 we would need
to emit an extra Move32 at the second WasmAddress to ensure it saw a proper
32-bit value. If Wasm ensures that there there is a leading ZExt32 then
the duplicated moves become unnecessary.
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::effectiveAddr):
(JSC::B3::Air::LowerToAir::lower):
* b3/B3Opcode.cpp:
(WTF::printInternal):
* b3/B3Opcode.h:
* b3/B3Validate.cpp:
* b3/B3Value.cpp:
(JSC::B3::Value::effects):
* b3/B3WasmAddressValue.cpp: Added.
(JSC::B3::WasmAddressValue::~WasmAddressValue):
(JSC::B3::WasmAddressValue::dumpMeta):
(JSC::B3::WasmAddressValue::cloneImpl):
(JSC::B3::WasmAddressValue::WasmAddressValue):
* b3/B3WasmAddressValue.h: Added.
* b3/testb3.cpp:
(JSC::B3::testWasmAddress):
(JSC::B3::run):
Websites/webkit.org:
Update the b3 docs for the new WasmAddress opcode.
* docs/b3/intermediate-representation.html:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3LowerToAircpp">trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Opcodecpp">trunk/Source/JavaScriptCore/b3/B3Opcode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Opcodeh">trunk/Source/JavaScriptCore/b3/B3Opcode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Validatecpp">trunk/Source/JavaScriptCore/b3/B3Validate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Valuecpp">trunk/Source/JavaScriptCore/b3/B3Value.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3testb3cpp">trunk/Source/JavaScriptCore/b3/testb3.cpp</a></li>
<li><a href="#trunkWebsiteswebkitorgChangeLog">trunk/Websites/webkit.org/ChangeLog</a></li>
<li><a href="#trunkWebsiteswebkitorgdocsb3intermediaterepresentationhtml">trunk/Websites/webkit.org/docs/b3/intermediate-representation.html</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreb3B3WasmAddressValuecpp">trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3WasmAddressValueh">trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -172,6 +172,7 @@
</span><span class="cx"> b3/B3ValueRep.cpp
</span><span class="cx"> b3/B3Variable.cpp
</span><span class="cx"> b3/B3VariableValue.cpp
</span><ins>+ b3/B3WasmAddressValue.cpp
</ins><span class="cx"> b3/B3WasmBoundsCheckValue.cpp
</span><span class="cx">
</span><span class="cx"> bindings/ScriptFunctionCall.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -1,3 +1,49 @@
</span><ins>+2016-10-14 Keith Miller <keith_miller@apple.com>
+
+ B3 needs a special WasmAddress Opcode
+ https://bugs.webkit.org/show_bug.cgi?id=163394
+
+ Reviewed by Filip Pizlo.
+
+ This patch adds support for WasmAddress. WasmAddress will be used by
+ Wasm to compute the address of a memory operation from the pinned
+ base pointer. WasmAddress takes an IntPtr so we can avoid emitting
+ unnecessary Move32s in Air. This could happen in the following case:
+
+ @ptr = Trunc(...)
+ WasmAddress(@ptr, pinnedGPR)
+ ...
+ PatchPoint(...) // Do Wasm call
+ WasmAddress(@ptr, pinnedGPR)
+ ...
+
+ In this case we will not be able to CSE the WasmAddresses since the
+ call writes to pinnedGPR. Thus if WasmAddress took an Int32 we would need
+ to emit an extra Move32 at the second WasmAddress to ensure it saw a proper
+ 32-bit value. If Wasm ensures that there there is a leading ZExt32 then
+ the duplicated moves become unnecessary.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * b3/B3LowerToAir.cpp:
+ (JSC::B3::Air::LowerToAir::effectiveAddr):
+ (JSC::B3::Air::LowerToAir::lower):
+ * b3/B3Opcode.cpp:
+ (WTF::printInternal):
+ * b3/B3Opcode.h:
+ * b3/B3Validate.cpp:
+ * b3/B3Value.cpp:
+ (JSC::B3::Value::effects):
+ * b3/B3WasmAddressValue.cpp: Added.
+ (JSC::B3::WasmAddressValue::~WasmAddressValue):
+ (JSC::B3::WasmAddressValue::dumpMeta):
+ (JSC::B3::WasmAddressValue::cloneImpl):
+ (JSC::B3::WasmAddressValue::WasmAddressValue):
+ * b3/B3WasmAddressValue.h: Added.
+ * b3/testb3.cpp:
+ (JSC::B3::testWasmAddress):
+ (JSC::B3::run):
+
</ins><span class="cx"> 2016-10-14 Joseph Pecoraro <pecoraro@apple.com>
</span><span class="cx">
</span><span class="cx"> test262: @isConstructor incorrectly thinks Math.cos is a constructor
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -1221,6 +1221,8 @@
</span><span class="cx"> 539EB07A1D55607000C82EF7 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
</span><span class="cx"> 539EB0811D55608A00C82EF7 /* testWASM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 539EB0711D553DF800C82EF7 /* testWASM.cpp */; };
</span><span class="cx"> 539FB8BA1C99DA7C00940FA1 /* JSArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */; };
</span><ins>+ 53D444DC1DAF08AB00B92784 /* B3WasmAddressValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */; };
+ 53D444DE1DAF09A000B92784 /* B3WasmAddressValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53D444DD1DAF09A000B92784 /* B3WasmAddressValue.cpp */; };
</ins><span class="cx"> 53F40E851D58F9770099A1B6 /* WASMSections.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E841D58F9770099A1B6 /* WASMSections.h */; };
</span><span class="cx"> 53F40E8B1D5901BB0099A1B6 /* WASMFunctionParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E8A1D5901BB0099A1B6 /* WASMFunctionParser.h */; };
</span><span class="cx"> 53F40E8D1D5901F20099A1B6 /* WASMParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E8C1D5901F20099A1B6 /* WASMParser.h */; };
</span><span class="lines">@@ -3461,6 +3463,8 @@
</span><span class="cx"> 539EB0711D553DF800C82EF7 /* testWASM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = testWASM.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 539EB0801D55607000C82EF7 /* testWASM */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testWASM; sourceTree = BUILT_PRODUCTS_DIR; };
</span><span class="cx"> 539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayInlines.h; sourceTree = "<group>"; };
</span><ins>+ 53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3WasmAddressValue.h; path = b3/B3WasmAddressValue.h; sourceTree = "<group>"; };
+ 53D444DD1DAF09A000B92784 /* B3WasmAddressValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3WasmAddressValue.cpp; path = b3/B3WasmAddressValue.cpp; sourceTree = "<group>"; };
</ins><span class="cx"> 53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayViewPrototype.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 53F40E841D58F9770099A1B6 /* WASMSections.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMSections.h; sourceTree = "<group>"; };
</span><span class="cx"> 53F40E8A1D5901BB0099A1B6 /* WASMFunctionParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMFunctionParser.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -5005,6 +5009,8 @@
</span><span class="cx"> 0F2BBD931C5FF3F50023EF23 /* B3Variable.h */,
</span><span class="cx"> 0F2BBD941C5FF3F50023EF23 /* B3VariableValue.cpp */,
</span><span class="cx"> 0F2BBD951C5FF3F50023EF23 /* B3VariableValue.h */,
</span><ins>+ 53D444DD1DAF09A000B92784 /* B3WasmAddressValue.cpp */,
+ 53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */,
</ins><span class="cx"> 0FEC85AE1BDB5D5E0080FF74 /* testb3.cpp */,
</span><span class="cx"> );
</span><span class="cx"> name = b3;
</span><span class="lines">@@ -7248,6 +7254,7 @@
</span><span class="cx"> 0F3730931C0D67EE00052BFA /* AirUseCounts.h in Headers */,
</span><span class="cx"> 0F4570391BE44C910062A629 /* AirEliminateDeadCode.h in Headers */,
</span><span class="cx"> 79B00CBD1C6AB07E0088C65D /* ProxyConstructor.h in Headers */,
</span><ins>+ 53D444DC1DAF08AB00B92784 /* B3WasmAddressValue.h in Headers */,
</ins><span class="cx"> 990DA67F1C8E316A00295159 /* generate_objc_protocol_type_conversions_implementation.py in Headers */,
</span><span class="cx"> DC17E8191C9C91DB008A6AB3 /* ShadowChickenInlines.h in Headers */,
</span><span class="cx"> DC17E8181C9C91D9008A6AB3 /* ShadowChicken.h in Headers */,
</span><span class="lines">@@ -9786,6 +9793,7 @@
</span><span class="cx"> 0F919D2515853CE0004A4E7D /* Watchpoint.cpp in Sources */,
</span><span class="cx"> 1ACF7377171CA6FB00C9BB1E /* Weak.cpp in Sources */,
</span><span class="cx"> 14E84F9E14EE1ACC00D6D5D4 /* WeakBlock.cpp in Sources */,
</span><ins>+ 53D444DE1DAF09A000B92784 /* B3WasmAddressValue.cpp in Sources */,
</ins><span class="cx"> 14F7256514EE265E00B1652B /* WeakHandleOwner.cpp in Sources */,
</span><span class="cx"> A7CA3AE317DA41AE006538AF /* WeakMapConstructor.cpp in Sources */,
</span><span class="cx"> 0F338DF91BE96AA80013C88F /* B3CCallValue.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3LowerToAircpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -54,6 +54,7 @@
</span><span class="cx"> #include "B3ValueInlines.h"
</span><span class="cx"> #include "B3Variable.h"
</span><span class="cx"> #include "B3VariableValue.h"
</span><ins>+#include "B3WasmAddressValue.h"
</ins><span class="cx"> #include <wtf/IndexMap.h>
</span><span class="cx"> #include <wtf/IndexSet.h>
</span><span class="cx"> #include <wtf/ListDump.h>
</span><span class="lines">@@ -508,6 +509,21 @@
</span><span class="cx"> case SlotBase:
</span><span class="cx"> return Arg::stack(m_stackToStack.get(address->as<SlotBaseValue>()->slot()), offset);
</span><span class="cx">
</span><ins>+ case WasmAddress: {
+ WasmAddressValue* wasmAddress = address->as<WasmAddressValue>();
+ Value* pointer = wasmAddress->child(0);
+ ASSERT(Arg::isValidIndexForm(1, offset, width));
+ if (m_locked.contains(pointer))
+ return fallback();
+
+ // FIXME: We should support ARM64 LDR 32-bit addressing, which will
+ // allow us to fuse a Shl ptr, 2 into the address. Additionally, and
+ // perhaps more importantly, it would allow us to avoid a truncating
+ // move. See: https://bugs.webkit.org/show_bug.cgi?id=163465
+
+ return Arg::index(Tmp(wasmAddress->pinnedGPR()), tmp(pointer), 1, offset);
+ }
+
</ins><span class="cx"> default:
</span><span class="cx"> return fallback();
</span><span class="cx"> }
</span><span class="lines">@@ -2276,7 +2292,14 @@
</span><span class="cx"> appendStore(Air::Store16, valueToStore, addr(m_value));
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>-
</del><ins>+
+ case WasmAddress: {
+ WasmAddressValue* address = m_value->as<WasmAddressValue>();
+
+ append(Add64, Arg(address->pinnedGPR()), tmp(address));
+ return;
+ }
+
</ins><span class="cx"> case Fence: {
</span><span class="cx"> FenceValue* fence = m_value->as<FenceValue>();
</span><span class="cx"> if (!fence->write && !fence->read)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Opcodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Opcode.cpp (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Opcode.cpp 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/b3/B3Opcode.cpp 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -251,6 +251,9 @@
</span><span class="cx"> case Store:
</span><span class="cx"> out.print("Store");
</span><span class="cx"> return;
</span><ins>+ case WasmAddress:
+ out.print("WasmAddress");
+ return;
</ins><span class="cx"> case Fence:
</span><span class="cx"> out.print("Fence");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Opcodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Opcode.h (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Opcode.h 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/b3/B3Opcode.h 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -157,6 +157,12 @@
</span><span class="cx"> Store16,
</span><span class="cx"> // This is a polymorphic store for Int32, Int64, Float, and Double.
</span><span class="cx"> Store,
</span><ins>+
+ // This is used to compute the actual address of a Wasm memory operation. It takes an IntPtr
+ // and a pinned register then computes the appropriate IntPtr address. For the use-case of
+ // Wasm it is important that the first child initially be a ZExt32 so the top bits are cleared.
+ // We do WasmAddress(ZExt32(ptr), ...) so that we can avoid generating extraneous moves in Air.
+ WasmAddress,
</ins><span class="cx">
</span><span class="cx"> // This is used to represent standalone fences - i.e. fences that are not part of other
</span><span class="cx"> // instructions. It's expressive enough to expose mfence on x86 and dmb ish/ishst on ARM. On
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Validatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Validate.cpp (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Validate.cpp 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/b3/B3Validate.cpp 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -371,6 +371,12 @@
</span><span class="cx"> VALIDATE(value->type() == Void, ("At ", *value));
</span><span class="cx"> validateStackAccess(value);
</span><span class="cx"> break;
</span><ins>+ case WasmAddress:
+ VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+ VALIDATE(value->numChildren() == 1, ("At ", *value));
+ VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
+ VALIDATE(value->type() == pointerType(), ("At ", *value));
+ break;
</ins><span class="cx"> case CCall:
</span><span class="cx"> VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
</span><span class="cx"> VALIDATE(value->numChildren() >= 1, ("At ", *value));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Valuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Value.cpp (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Value.cpp 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/b3/B3Value.cpp 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -586,6 +586,9 @@
</span><span class="cx"> result.writes = as<MemoryValue>()->range();
</span><span class="cx"> result.controlDependent = true;
</span><span class="cx"> break;
</span><ins>+ case WasmAddress:
+ result.readsPinned = true;
+ break;
</ins><span class="cx"> case Fence: {
</span><span class="cx"> const FenceValue* fence = as<FenceValue>();
</span><span class="cx"> result.reads = fence->read;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3WasmAddressValuecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.cpp (0 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.cpp 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -0,0 +1,56 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "B3WasmAddressValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+WasmAddressValue::~WasmAddressValue()
+{
+}
+
+void WasmAddressValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+ out.print(comma, m_pinnedGPR);
+}
+
+Value* WasmAddressValue::cloneImpl() const
+{
+ return new WasmAddressValue(*this);
+}
+
+WasmAddressValue::WasmAddressValue(Origin origin, Value* value, GPRReg pinnedGPR)
+ : Value(CheckedOpcode, WasmAddress, Int64, origin, value)
+ , m_pinnedGPR(pinnedGPR)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3WasmAddressValueh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.h (0 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.h (rev 0)
+++ trunk/Source/JavaScriptCore/b3/B3WasmAddressValue.h 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -0,0 +1,58 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE WasmAddressValue : public Value {
+public:
+ static bool accepts(Kind kind) { return kind == WasmAddress; }
+
+ ~WasmAddressValue();
+
+ GPRReg pinnedGPR() const { return m_pinnedGPR; }
+
+protected:
+ void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+ Value* cloneImpl() const override;
+
+private:
+ friend class Procedure;
+
+ WasmAddressValue(Origin, Value*, GPRReg);
+
+ GPRReg m_pinnedGPR;
+};
+
+} } // namespace JSC::B3
+
+
+#endif // ENABLE(B3_JIT)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3testb3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/testb3.cpp (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/testb3.cpp 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Source/JavaScriptCore/b3/testb3.cpp 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -54,6 +54,7 @@
</span><span class="cx"> #include "B3Validate.h"
</span><span class="cx"> #include "B3ValueInlines.h"
</span><span class="cx"> #include "B3VariableValue.h"
</span><ins>+#include "B3WasmAddressValue.h"
</ins><span class="cx"> #include "B3WasmBoundsCheckValue.h"
</span><span class="cx"> #include "CCallHelpers.h"
</span><span class="cx"> #include "FPRInfo.h"
</span><span class="lines">@@ -13761,6 +13762,57 @@
</span><span class="cx"> CHECK_EQ(invoke<int32_t>(*code, 2, 2 + offset), 42);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void testWasmAddress()
+{
+ Procedure proc;
+ GPRReg pinnedGPR = GPRInfo::argumentGPR2;
+ proc.pinRegister(pinnedGPR);
+
+ unsigned loopCount = 100;
+ Vector<unsigned> values(loopCount);
+ unsigned numToStore = 42;
+
+ BasicBlock* root = proc.addBlock();
+ BasicBlock* header = proc.addBlock();
+ BasicBlock* body = proc.addBlock();
+ BasicBlock* continuation = proc.addBlock();
+
+ // Root
+ Value* loopCountValue = root->appendNew<Value>(proc, Trunc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+ Value* valueToStore = root->appendNew<Value>(proc, Trunc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+ UpsilonValue* beginUpsilon = root->appendNew<UpsilonValue>(proc, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+ root->appendNewControlValue(proc, Jump, Origin(), header);
+
+ // Header
+ Value* indexPhi = header->appendNew<Value>(proc, Phi, Int32, Origin());
+ header->appendNewControlValue(proc, Branch, Origin(),
+ header->appendNew<Value>(proc, Below, Origin(), indexPhi, loopCountValue),
+ body, continuation);
+
+ // Body
+ Value* pointer = body->appendNew<Value>(proc, Mul, Origin(), indexPhi,
+ body->appendNew<Const32Value>(proc, Origin(), sizeof(unsigned)));
+ pointer = body->appendNew<Value>(proc, ZExt32, Origin(), pointer);
+ body->appendNew<MemoryValue>(proc, Store, Origin(), valueToStore,
+ body->appendNew<WasmAddressValue>(proc, Origin(), pointer, pinnedGPR));
+ UpsilonValue* incUpsilon = body->appendNew<UpsilonValue>(proc, Origin(),
+ body->appendNew<Value>(proc, Add, Origin(), indexPhi,
+ body->appendNew<Const32Value>(proc, Origin(), 1)));
+ body->appendNewControlValue(proc, Jump, Origin(), header);
+
+ // Continuation
+ continuation->appendNewControlValue(proc, Return, Origin());
+
+ beginUpsilon->setPhi(indexPhi);
+ incUpsilon->setPhi(indexPhi);
+
+
+ auto code = compile(proc);
+ invoke<void>(*code, loopCount, numToStore, values.data());
+ for (unsigned value : values)
+ CHECK_EQ(numToStore, value);
+}
+
</ins><span class="cx"> // Make sure the compiler does not try to optimize anything out.
</span><span class="cx"> NEVER_INLINE double zero()
</span><span class="cx"> {
</span><span class="lines">@@ -15205,6 +15257,7 @@
</span><span class="cx"> RUN(testWasmBoundsCheck(100));
</span><span class="cx"> RUN(testWasmBoundsCheck(10000));
</span><span class="cx"> RUN(testWasmBoundsCheck(std::numeric_limits<unsigned>::max() - 5));
</span><ins>+ RUN(testWasmAddress());
</ins><span class="cx">
</span><span class="cx"> if (isX86()) {
</span><span class="cx"> RUN(testBranchBitAndImmFusion(Identity, Int64, 1, Air::BranchTest32, Air::Arg::Tmp));
</span></span></pre></div>
<a id="trunkWebsiteswebkitorgChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Websites/webkit.org/ChangeLog (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Websites/webkit.org/ChangeLog 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Websites/webkit.org/ChangeLog 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2016-10-14 Keith Miller <keith_miller@apple.com>
+
+ B3 needs a special WasmAddress Opcode
+ https://bugs.webkit.org/show_bug.cgi?id=163394
+
+ Reviewed by Filip Pizlo.
+
+ Update the b3 docs for the new WasmAddress opcode.
+
+ * docs/b3/intermediate-representation.html:
+
</ins><span class="cx"> 2016-10-14 Simon Fraser <simon.fraser@apple.com>
</span><span class="cx">
</span><span class="cx"> Annotate bots in contributors.json and don't show them on webkit.org/team
</span></span></pre></div>
<a id="trunkWebsiteswebkitorgdocsb3intermediaterepresentationhtml"></a>
<div class="modfile"><h4>Modified: trunk/Websites/webkit.org/docs/b3/intermediate-representation.html (207359 => 207360)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Websites/webkit.org/docs/b3/intermediate-representation.html 2016-10-14 23:10:34 UTC (rev 207359)
+++ trunk/Websites/webkit.org/docs/b3/intermediate-representation.html 2016-10-14 23:22:07 UTC (rev 207360)
</span><span class="lines">@@ -423,7 +423,12 @@
</span><span class="cx"> <dd>Stores the value in the first child into the address computed by adding the
</span><span class="cx"> compile-time 32-bit signed integer offset to the second child. Misaligned stores are
</span><span class="cx"> not penalized. Must use the MemoryValue class. May have the Traps flag set.</dd>
</span><del>-
</del><ins>+
+ <dt>IntPtr WasmAddress(IntPtr, pinnedGPR)</dt>
+ <dd>This is used to compute the address of a wasm memory load from a pinned base GPR.
+ Must use the WasmAddressValue class.</dd>
+
+
</ins><span class="cx"> <dt>Void Fence()</dt>
</span><span class="cx"> <dd>Abstracts standalone data fences on x86 and ARM. Must use the FenceValue class, which has
</span><span class="cx"> two additional members that configure the precise meaning of the fence:
</span></span></pre>
</div>
</div>
</body>
</html>