<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[208738] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/208738">208738</a></dd>
<dt>Author</dt> <dd>utatane.tea@gmail.com</dd>
<dt>Date</dt> <dd>2016-11-15 11:21:41 -0800 (Tue, 15 Nov 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
https://bugs.webkit.org/show_bug.cgi?id=164727
Reviewed by Filip Pizlo.
JSTests:
* stress/check-dom-with-signature.js: Added.
(shouldBe):
(calling):
(i.array.forEach):
Source/JavaScriptCore:
While CallDOMGetter can use macro assembler scratch registers, we previiously
assumed that CheckDOM code generator does not use macro assembler scratch registers.
It is currently true in x86 environment. But it is not true in the other environments.
We should not limit DOMJIT::Patchpoint's functionality in such a way. We should allow
arbitrary macro assembler operations inside the DOMJIT::Patchpoint. This patch allows
CheckDOM to use macro assembler scratch registers.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
* jsc.cpp:
(WTF::DOMJITFunctionObject::DOMJITFunctionObject):
(WTF::DOMJITFunctionObject::createStructure):
(WTF::DOMJITFunctionObject::create):
(WTF::DOMJITFunctionObject::unsafeFunction):
(WTF::DOMJITFunctionObject::safeFunction):
(WTF::DOMJITFunctionObject::checkDOMJITNode):
(WTF::DOMJITFunctionObject::finishCreation):
(GlobalObject::finishCreation):
(functionCreateDOMJITFunctionObject):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkJSTestsstresscheckdomwithsignaturejs">trunk/JSTests/stress/check-dom-with-signature.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (208737 => 208738)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/ChangeLog 2016-11-15 19:08:25 UTC (rev 208737)
+++ trunk/JSTests/ChangeLog 2016-11-15 19:21:41 UTC (rev 208738)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-11-15 Yusuke Suzuki <utatane.tea@gmail.com>
+
+ [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
+ https://bugs.webkit.org/show_bug.cgi?id=164727
+
+ Reviewed by Filip Pizlo.
+
+ * stress/check-dom-with-signature.js: Added.
+ (shouldBe):
+ (calling):
+ (i.array.forEach):
+
</ins><span class="cx"> 2016-11-14 Caitlin Potter <caitp@igalia.com>
</span><span class="cx">
</span><span class="cx"> [JSC] do not reference AwaitExpression Promises in async function Promise chain
</span></span></pre></div>
<a id="trunkJSTestsstresscheckdomwithsignaturejs"></a>
<div class="addfile"><h4>Added: trunk/JSTests/stress/check-dom-with-signature.js (0 => 208738)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/stress/check-dom-with-signature.js (rev 0)
+++ trunk/JSTests/stress/check-dom-with-signature.js 2016-11-15 19:21:41 UTC (rev 208738)
</span><span class="lines">@@ -0,0 +1,20 @@
</span><ins>+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+var array = [];
+for (var i = 0; i < 100; ++i)
+ array.push(createDOMJITFunctionObject());
+
+function calling(dom)
+{
+ return dom.func();
+}
+noInline(calling);
+
+for (var i = 0; i < 1e3; ++i) {
+ array.forEach((obj) => {
+ shouldBe(calling(obj), 42);
+ });
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (208737 => 208738)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-11-15 19:08:25 UTC (rev 208737)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-11-15 19:21:41 UTC (rev 208738)
</span><span class="lines">@@ -1,3 +1,31 @@
</span><ins>+2016-11-15 Yusuke Suzuki <utatane.tea@gmail.com>
+
+ [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
+ https://bugs.webkit.org/show_bug.cgi?id=164727
+
+ Reviewed by Filip Pizlo.
+
+ While CallDOMGetter can use macro assembler scratch registers, we previiously
+ assumed that CheckDOM code generator does not use macro assembler scratch registers.
+ It is currently true in x86 environment. But it is not true in the other environments.
+
+ We should not limit DOMJIT::Patchpoint's functionality in such a way. We should allow
+ arbitrary macro assembler operations inside the DOMJIT::Patchpoint. This patch allows
+ CheckDOM to use macro assembler scratch registers.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+ * jsc.cpp:
+ (WTF::DOMJITFunctionObject::DOMJITFunctionObject):
+ (WTF::DOMJITFunctionObject::createStructure):
+ (WTF::DOMJITFunctionObject::create):
+ (WTF::DOMJITFunctionObject::unsafeFunction):
+ (WTF::DOMJITFunctionObject::safeFunction):
+ (WTF::DOMJITFunctionObject::checkDOMJITNode):
+ (WTF::DOMJITFunctionObject::finishCreation):
+ (GlobalObject::finishCreation):
+ (functionCreateDOMJITFunctionObject):
+
</ins><span class="cx"> 2016-11-14 Geoffrey Garen <ggaren@apple.com>
</span><span class="cx">
</span><span class="cx"> CodeCache should stop pretending to cache builtins
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (208737 => 208738)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-11-15 19:08:25 UTC (rev 208737)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-11-15 19:21:41 UTC (rev 208738)
</span><span class="lines">@@ -9334,21 +9334,26 @@
</span><span class="cx">
</span><span class="cx"> PatchpointValue* patchpoint = m_out.patchpoint(Void);
</span><span class="cx"> patchpoint->appendSomeRegister(cell);
</span><del>- patchpoint->numGPScratchRegisters = domJIT->numGPScratchRegisters;
- patchpoint->numFPScratchRegisters = domJIT->numFPScratchRegisters;
</del><span class="cx"> patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
</span><span class="cx"> patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
</span><span class="cx">
</span><del>- State* state = &m_ftlState;
- Node* node = m_node;
</del><span class="cx"> NodeOrigin origin = m_origin;
</span><span class="cx"> unsigned osrExitArgumentOffset = patchpoint->numChildren();
</span><span class="cx"> OSRExitDescriptor* exitDescriptor = appendOSRExitDescriptor(jsValueValue(cell), m_node->child1().node());
</span><span class="cx"> patchpoint->appendColdAnys(buildExitArguments(exitDescriptor, origin.forExit, jsValueValue(cell)));
</span><ins>+
+ patchpoint->numGPScratchRegisters = domJIT->numGPScratchRegisters;
+ patchpoint->numFPScratchRegisters = domJIT->numFPScratchRegisters;
+ patchpoint->clobber(RegisterSet::macroScratchRegisters());
+
+ State* state = &m_ftlState;
+ Node* node = m_node;
</ins><span class="cx"> JSValue child1Constant = m_state.forNode(m_node->child1()).value();
</span><span class="cx">
</span><span class="cx"> patchpoint->setGenerator(
</span><span class="cx"> [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><ins>+ AllowMacroScratchRegisterUsage allowScratch(jit);
+
</ins><span class="cx"> Vector<GPRReg> gpScratch;
</span><span class="cx"> Vector<FPRReg> fpScratch;
</span><span class="cx"> Vector<DOMJIT::Value> regs;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (208737 => 208738)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp 2016-11-15 19:08:25 UTC (rev 208737)
+++ trunk/Source/JavaScriptCore/jsc.cpp 2016-11-15 19:21:41 UTC (rev 208738)
</span><span class="lines">@@ -791,16 +791,89 @@
</span><span class="cx"> bool m_enableException { false };
</span><span class="cx"> };
</span><span class="cx">
</span><del>-const ClassInfo Element::s_info = { "Element", &Base::s_info, 0, CREATE_METHOD_TABLE(Element) };
-const ClassInfo Masquerader::s_info = { "Masquerader", &Base::s_info, 0, CREATE_METHOD_TABLE(Masquerader) };
-const ClassInfo Root::s_info = { "Root", &Base::s_info, 0, CREATE_METHOD_TABLE(Root) };
-const ClassInfo ImpureGetter::s_info = { "ImpureGetter", &Base::s_info, 0, CREATE_METHOD_TABLE(ImpureGetter) };
-const ClassInfo CustomGetter::s_info = { "CustomGetter", &Base::s_info, 0, CREATE_METHOD_TABLE(CustomGetter) };
-const ClassInfo DOMJITNode::s_info = { "DOMJITNode", &Base::s_info, 0, CREATE_METHOD_TABLE(DOMJITNode) };
-const ClassInfo DOMJITGetter::s_info = { "DOMJITGetter", &Base::s_info, 0, CREATE_METHOD_TABLE(DOMJITGetter) };
-const ClassInfo DOMJITGetterComplex::s_info = { "DOMJITGetterComplex", &Base::s_info, 0, CREATE_METHOD_TABLE(DOMJITGetterComplex) };
-const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &Base::s_info, 0, CREATE_METHOD_TABLE(RuntimeArray) };
-const ClassInfo SimpleObject::s_info = { "SimpleObject", &Base::s_info, 0, CREATE_METHOD_TABLE(SimpleObject) };
</del><ins>+class DOMJITFunctionObject : public DOMJITNode {
+public:
+ DOMJITFunctionObject(VM& vm, Structure* structure)
+ : Base(vm, structure)
+ {
+ }
+
+ DECLARE_INFO;
+ typedef DOMJITNode Base;
+ static const unsigned StructureFlags = Base::StructureFlags;
+
+
+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+ {
+ return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());
+ }
+
+ static DOMJITFunctionObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+ {
+ DOMJITFunctionObject* object = new (NotNull, allocateCell<DOMJITFunctionObject>(vm.heap, sizeof(DOMJITFunctionObject))) DOMJITFunctionObject(vm, structure);
+ object->finishCreation(vm, globalObject);
+ return object;
+ }
+
+ static EncodedJSValue JIT_OPERATION unsafeFunction(ExecState* exec, DOMJITNode* node)
+ {
+ NativeCallFrameTracer tracer(&exec->vm(), exec);
+ return JSValue::encode(jsNumber(node->value()));
+ }
+
+ static EncodedJSValue JSC_HOST_CALL safeFunction(ExecState* exec)
+ {
+ VM& vm = exec->vm();
+ auto scope = DECLARE_THROW_SCOPE(vm);
+
+ DOMJITNode* thisObject = jsDynamicCast<DOMJITNode*>(exec->thisValue());
+ if (!thisObject)
+ return throwVMTypeError(exec, scope);
+ return JSValue::encode(jsNumber(thisObject->value()));
+ }
+
+ static Ref<DOMJIT::Patchpoint> checkDOMJITNode()
+ {
+ static const double value = 42.0;
+ Ref<DOMJIT::Patchpoint> patchpoint = DOMJIT::Patchpoint::create();
+ patchpoint->numFPScratchRegisters = 1;
+ patchpoint->setGenerator([=](CCallHelpers& jit, DOMJIT::PatchpointParams& params) {
+ CCallHelpers::JumpList failureCases;
+ // May use scratch registers.
+ jit.loadDouble(CCallHelpers::TrustedImmPtr(&value), params.fpScratch(0));
+ failureCases.append(jit.branch8(
+ CCallHelpers::NotEqual,
+ CCallHelpers::Address(params[0].gpr(), JSCell::typeInfoTypeOffset()),
+ CCallHelpers::TrustedImm32(JSC::JSType(LastJSCObjectType + 1))));
+ return failureCases;
+ });
+ return patchpoint;
+ }
+
+private:
+ void finishCreation(VM&, JSGlobalObject*);
+};
+
+static const DOMJIT::Signature DOMJITFunctionObjectSignature((uintptr_t)DOMJITFunctionObject::unsafeFunction, DOMJITFunctionObject::checkDOMJITNode, DOMJITFunctionObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
+
+void DOMJITFunctionObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+ Base::finishCreation(vm);
+ putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, &DOMJITFunctionObjectSignature, ReadOnly);
+}
+
+
+const ClassInfo Element::s_info = { "Element", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Element) };
+const ClassInfo Masquerader::s_info = { "Masquerader", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Masquerader) };
+const ClassInfo Root::s_info = { "Root", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Root) };
+const ClassInfo ImpureGetter::s_info = { "ImpureGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(ImpureGetter) };
+const ClassInfo CustomGetter::s_info = { "CustomGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(CustomGetter) };
+const ClassInfo DOMJITNode::s_info = { "DOMJITNode", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITNode) };
+const ClassInfo DOMJITGetter::s_info = { "DOMJITGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITGetter) };
+const ClassInfo DOMJITGetterComplex::s_info = { "DOMJITGetterComplex", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITGetterComplex) };
+const ClassInfo DOMJITFunctionObject::s_info = { "DOMJITFunctionObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITFunctionObject) };
+const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &Base::s_info, nullptr, CREATE_METHOD_TABLE(RuntimeArray) };
+const ClassInfo SimpleObject::s_info = { "SimpleObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(SimpleObject) };
</ins><span class="cx"> static bool test262AsyncPassed { false };
</span><span class="cx"> static bool test262AsyncTest { false };
</span><span class="cx">
</span><span class="lines">@@ -830,6 +903,7 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITNodeObject(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterObject(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterComplexObject(ExecState*);
</span><ins>+static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITFunctionObject(ExecState*);
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateBuiltin(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateGlobalObject(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionSetImpureGetterDelegate(ExecState*);
</span><span class="lines">@@ -1125,6 +1199,7 @@
</span><span class="cx"> addFunction(vm, "createDOMJITNodeObject", functionCreateDOMJITNodeObject, 0);
</span><span class="cx"> addFunction(vm, "createDOMJITGetterObject", functionCreateDOMJITGetterObject, 0);
</span><span class="cx"> addFunction(vm, "createDOMJITGetterComplexObject", functionCreateDOMJITGetterComplexObject, 0);
</span><ins>+ addFunction(vm, "createDOMJITFunctionObject", functionCreateDOMJITFunctionObject, 0);
</ins><span class="cx"> addFunction(vm, "createBuiltin", functionCreateBuiltin, 2);
</span><span class="cx"> addFunction(vm, "createGlobalObject", functionCreateGlobalObject, 0);
</span><span class="cx"> addFunction(vm, "setImpureGetterDelegate", functionSetImpureGetterDelegate, 2);
</span><span class="lines">@@ -1665,6 +1740,14 @@
</span><span class="cx"> return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+EncodedJSValue JSC_HOST_CALL functionCreateDOMJITFunctionObject(ExecState* exec)
+{
+ JSLockHolder lock(exec);
+ Structure* structure = DOMJITFunctionObject::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
+ DOMJITFunctionObject* result = DOMJITFunctionObject::create(exec->vm(), exec->lexicalGlobalObject(), structure);
+ return JSValue::encode(result);
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL functionSetImpureGetterDelegate(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx"> JSLockHolder lock(exec);
</span></span></pre>
</div>
</div>
</body>
</html>