Attachment 347309 Details for Bug 188573 – WIP

[patch] WIP

c-backup.diff (text/plain), 31.82 KB, created by Saam Barati on 2018-08-16 14:43:57 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2018-08-16 14:43:57 PDT

Size: 31.82 KB

patch

obsolete

>Index: Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
>===================================================================
>--- Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h	(revision 234873)
>+++ Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h	(working copy)
>@@ -408,6 +408,11 @@ public:
>         m_assembler.popcnt_rr(src, dst);
>     }
> 
>+    void byteSwap(RegisterID dst)
>+    {
>+        m_assembler.bswap_r(dst);
>+    }
>+
>     // Only used for testing purposes.
>     void illegalInstruction()
>     {
>Index: Source/JavaScriptCore/assembler/X86Assembler.h
>===================================================================
>--- Source/JavaScriptCore/assembler/X86Assembler.h	(revision 234873)
>+++ Source/JavaScriptCore/assembler/X86Assembler.h	(working copy)
>@@ -337,6 +337,7 @@ private:
>         OP2_XADDb           = 0xC0,
>         OP2_XADD            = 0xC1,
>         OP2_PEXTRW_GdUdIb   = 0xC5,
>+        OP2_BSWAP           = 0xC8,
>         OP2_PSLLQ_UdqIb     = 0x73,
>         OP2_PSRLQ_UdqIb     = 0x73,
>         OP2_POR_VdqWdq      = 0XEB,
>@@ -1638,6 +1639,11 @@ public:
>     }
> #endif
> 
>+    void bswap_r(RegisterID dst)
>+    {
>+        m_formatter.twoByteOp(OP2_BSWAP, dst);
>+    }
>+
>     void tzcnt_rr(RegisterID src, RegisterID dst)
>     {
>         m_formatter.prefix(PRE_SSE_F3);
>@@ -4333,6 +4339,14 @@ private:
>             writer.putByteUnchecked(opcode);
>         }
> 
>+        void twoByteOp(TwoByteOpcodeID opcode, int reg)
>+        {
>+            SingleInstructionBufferWriter writer(m_buffer);
>+            writer.emitRexIfNeeded(0, 0, reg);
>+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
>+            writer.putByteUnchecked(opcode + (reg & 7));
>+        }
>+
>         void twoByteOp(TwoByteOpcodeID opcode, int reg, RegisterID rm)
>         {
>             SingleInstructionBufferWriter writer(m_buffer);
>Index: Source/JavaScriptCore/bytecode/SpeculatedType.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/SpeculatedType.cpp	(revision 234873)
>+++ Source/JavaScriptCore/bytecode/SpeculatedType.cpp	(working copy)
>@@ -203,6 +203,11 @@ void dumpSpeculation(PrintStream& outStr
>                 strOut.print("DerivedArray");
>             else
>                 isTop = false;
>+
>+            if (value & SpecDataViewObject)
>+                strOut.print("DataView");
>+            else
>+                isTop = false;
>         }
> 
>         if ((value & SpecString) == SpecString)
>@@ -432,6 +437,9 @@ SpeculatedType speculationFromClassInfo(
> 
>     if (classInfo == ProxyObject::info())
>         return SpecProxyObject;
>+
>+    if (classInfo == JSDataView::info())
>+        return SpecDataViewObject;
>     
>     if (classInfo->isSubClassOf(JSFunction::info())) {
>         if (classInfo == JSBoundFunction::info())
>@@ -559,6 +567,8 @@ SpeculatedType speculationFromJSType(JST
>         return SpecWeakMapObject;
>     case JSWeakSetType:
>         return SpecWeakSetObject;
>+    case DataViewType:
>+        return SpecDataViewObject;
>     default:
>         ASSERT_NOT_REACHED();
>     }
>@@ -750,6 +760,8 @@ SpeculatedType speculationFromString(con
>         return SpecProxyObject;
>     if (!strncmp(speculation, "SpecDerivedArray", strlen("SpecDerivedArray")))
>         return SpecDerivedArray;
>+    if (!strncmp(speculation, "SpecDataViewObject", strlen("SpecDataViewObject")))
>+        return SpecDataViewObject;
>     if (!strncmp(speculation, "SpecObjectOther", strlen("SpecObjectOther")))
>         return SpecObjectOther;
>     if (!strncmp(speculation, "SpecObject", strlen("SpecObject")))
>Index: Source/JavaScriptCore/bytecode/SpeculatedType.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/SpeculatedType.h	(revision 234873)
>+++ Source/JavaScriptCore/bytecode/SpeculatedType.h	(working copy)
>@@ -65,7 +65,6 @@ static const SpeculatedType SpecWeakSetO
> static const SpeculatedType SpecProxyObject                       = 1ull << 21; // It's definitely a Proxy object or one of its subclasses.
> static const SpeculatedType SpecDerivedArray                      = 1ull << 22; // It's definitely a DerivedArray object.
> static const SpeculatedType SpecObjectOther                       = 1ull << 23; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction.
>-static const SpeculatedType SpecObject                            = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecMapObject | SpecSetObject | SpecWeakMapObject | SpecWeakSetObject | SpecProxyObject | SpecDerivedArray | SpecObjectOther; // Bitmask used for testing for any kind of object prediction.
> static const SpeculatedType SpecStringIdent                       = 1ull << 24; // It's definitely a JSString, and it's an identifier.
> static const SpeculatedType SpecStringVar                         = 1ull << 25; // It's definitely a JSString, and it's not an identifier.
> static const SpeculatedType SpecString                            = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
>@@ -93,7 +92,9 @@ static const SpeculatedType SpecOther   
> static const SpeculatedType SpecMisc                              = SpecBoolean | SpecOther; // It's definitely either a boolean, Null, or Undefined.
> static const SpeculatedType SpecEmpty                             = 1ull << 37; // It's definitely an empty value marker.
> static const SpeculatedType SpecBigInt                            = 1ull << 38; // It's definitely a BigInt.
>+static const SpeculatedType SpecDataViewObject                          = 1ull << 39; // It's definitely a JSDataView.
> static const SpeculatedType SpecPrimitive                         = SpecString | SpecSymbol | SpecBytecodeNumber | SpecMisc | SpecBigInt; // It's any non-Object JSValue.
>+static const SpeculatedType SpecObject                            = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecMapObject | SpecSetObject | SpecWeakMapObject | SpecWeakSetObject | SpecProxyObject | SpecDerivedArray | SpecObjectOther | SpecDataViewObject; // Bitmask used for testing for any kind of object prediction.
> static const SpeculatedType SpecCell                              = SpecObject | SpecString | SpecSymbol | SpecCellOther | SpecBigInt; // It's definitely a JSCell.
> static const SpeculatedType SpecHeapTop                           = SpecCell | SpecBytecodeNumber | SpecMisc; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN.
> static const SpeculatedType SpecBytecodeTop                       = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local.
>Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(working copy)
>@@ -3770,9 +3770,24 @@ bool AbstractInterpreter<AbstractStateTy
>         filter(node->child1(), SpecCell);
>         break;
>     }
>-        
>-        break;
> 
>+    case DataViewGetInt: {
>+        DataViewData data = node->dataViewData();
>+        if (data.byteSize < 4)
>+            setNonCellTypeForNode(node, SpecInt32Only);
>+        else {
>+            if (!(node->prediction() & ~SpecInt32Only))
>+                setNonCellTypeForNode(node, SpecInt32Only);
>+            else
>+                setNonCellTypeForNode(node, SpecBytecodeDouble);
>+        }
>+        break;
>+    }
>+    case DataViewGetFloat: {
>+        setNonCellTypeForNode(node, SpecFullDouble);
>+        break;
>+    }
>+        
>     case Unreachable:
>         // It may be that during a previous run of AI we proved that something was unreachable, but
>         // during this run of AI we forget that it's unreachable. AI's proofs don't have to get
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -3079,6 +3079,94 @@ bool ByteCodeParser::handleIntrinsicCall
>         return true;
>     }
> 
>+    case DataViewGetInt8:
>+    case DataViewGetUint8:
>+    case DataViewGetInt16:
>+    case DataViewGetUint16:
>+    case DataViewGetInt32:
>+    case DataViewGetUint32:
>+    case DataViewGetFloat32:
>+    case DataViewGetFloat64: {
>+        if (argumentCountIncludingThis < 2)
>+            return false;
>+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType))
>+            return false;
>+
>+        insertChecks();
>+        TriState isLittleEndian;
>+
>+        Node* littleEndianChild = nullptr;
>+        if (argumentCountIncludingThis < 3)
>+            isLittleEndian = FalseTriState;
>+        else {
>+            littleEndianChild = get(virtualRegisterForArgument(2, registerOffset));
>+            if (littleEndianChild->hasConstant()) {
>+                JSValue constant = littleEndianChild->constant()->value();
>+                isLittleEndian = constant.pureToBoolean();
>+                if (isLittleEndian != MixedTriState)
>+                    littleEndianChild = nullptr;
>+            }
>+        }
>+
>+        uint8_t byteSize;
>+        NodeType op = DataViewGetInt;
>+        bool isSigned = false;
>+        switch (intrinsic) {
>+        case DataViewGetInt8:
>+            isSigned = true;
>+            FALLTHROUGH;
>+        case DataViewGetUint8:
>+            byteSize = 1;
>+            break;
>+
>+        case DataViewGetInt16:
>+            isSigned = true;
>+            FALLTHROUGH;
>+        case DataViewGetUint16:
>+            byteSize = 2;
>+            break;
>+
>+        case DataViewGetInt32:
>+            isSigned = true;
>+            FALLTHROUGH;
>+        case DataViewGetUint32:
>+            byteSize = 4;
>+            break;
>+
>+        case DataViewGetFloat32:
>+            byteSize = 4;
>+            op = DataViewGetFloat;
>+            break;
>+        case DataViewGetFloat64:
>+            byteSize = 8;
>+            op = DataViewGetFloat;
>+            break;
>+        default:
>+            RELEASE_ASSERT_NOT_REACHED();
>+        }
>+
>+        DataViewData data { };
>+        data.isLittleEndian = isLittleEndian;
>+        data.isSigned = isSigned;
>+        data.byteSize = byteSize;
>+
>+        set(VirtualRegister(resultOperand),
>+            addToGraph(op, OpInfo(data.asQuadWord), OpInfo(prediction), get(virtualRegisterForArgument(0, registerOffset)), get(virtualRegisterForArgument(1, registerOffset)), littleEndianChild));
>+        return true;
>+    }
>+
>+    case DataViewSetInt8:
>+    case DataViewSetUint8:
>+    case DataViewSetInt16:
>+    case DataViewSetUint16:
>+    case DataViewSetInt32:
>+    case DataViewSetUint32:
>+    case DataViewSetFloat32:
>+    case DataViewSetFloat64: {
>+        CRASH();
>+        // OOPS
>+    }
>+
>     case HasOwnPropertyIntrinsic: {
>         if (argumentCountIncludingThis != 2)
>             return false;
>Index: Source/JavaScriptCore/dfg/DFGClobberize.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGClobberize.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGClobberize.h	(working copy)
>@@ -1758,7 +1758,14 @@ void clobberize(Graph& graph, Node* node
>     case NumberToStringWithValidRadixConstant:
>         def(PureValue(node, node->validRadixConstant()));
>         return;
>-        
>+
>+    case DataViewGetFloat:
>+    case DataViewGetInt: {
>+        read(MiscFields);
>+        read(TypedArrayProperties);
>+        return;
>+    }
>+
>     case LastNodeType:
>         RELEASE_ASSERT_NOT_REACHED();
>         return;
>Index: Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDoesGC.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGDoesGC.cpp	(working copy)
>@@ -318,6 +318,8 @@ bool doesGC(Graph& graph, Node* node)
>     case FilterGetByIdStatus:
>     case FilterPutByIdStatus:
>     case FilterInByIdStatus:
>+    case DataViewGetInt:
>+    case DataViewGetFloat:
>         return false;
> 
>     case PushWithScope:
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -2104,6 +2104,15 @@ private:
>             fixEdge<CellUse>(node->child1());
>             break;
> 
>+        case DataViewGetInt:
>+        case DataViewGetFloat: {
>+            fixEdge<DataViewObjectUse>(node->child1());
>+            fixEdge<Int32Use>(node->child2());
>+            if (node->child3())
>+                fixEdge<BooleanUse>(node->child3());
>+            break;
>+        }
>+
> #if !ASSERT_DISABLED
>         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
>         case SetArgument:
>Index: Source/JavaScriptCore/dfg/DFGNode.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNode.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGNode.h	(working copy)
>@@ -117,6 +117,18 @@ struct NewArrayBufferData {
> static_assert(sizeof(IndexingType) <= sizeof(unsigned), "");
> static_assert(sizeof(NewArrayBufferData) == sizeof(uint64_t), "");
> 
>+struct DataViewData {
>+    union {
>+        struct {
>+            uint8_t byteSize;
>+            bool isSigned;
>+            TriState isLittleEndian;
>+        };
>+        uint64_t asQuadWord;
>+    };
>+};
>+static_assert(sizeof(DataViewData) == sizeof(uint64_t), "");
>+
> struct BranchTarget {
>     BranchTarget()
>         : block(0)
>@@ -1659,6 +1671,8 @@ public:
>         case GetDynamicVar:
>         case ExtractValueFromWeakMapGet:
>         case ToThis:
>+        case DataViewGetInt:
>+        case DataViewGetFloat:
>             return true;
>         default:
>             return false;
>@@ -2143,6 +2157,12 @@ public:
>         return m_opInfo.as<unsigned>();
>     }
> 
>+    DataViewData dataViewData()
>+    {
>+        //ASSERT(op() == DataViewGetInt || op() == DataViewGetFloat || op() == DataViewSet);
>+        return bitwise_cast<DataViewData>(m_opInfo.as<uint64_t>());
>+    }
>+
>     bool shouldGenerate()
>     {
>         return m_refCount;
>Index: Source/JavaScriptCore/dfg/DFGNodeType.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNodeType.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGNodeType.h	(working copy)
>@@ -483,6 +483,11 @@ namespace JSC { namespace DFG {
>     macro(FilterGetByIdStatus, NodeMustGenerate) \
>     macro(FilterInByIdStatus, NodeMustGenerate) \
>     macro(FilterPutByIdStatus, NodeMustGenerate) \
>+    /* Data view access */ \
>+    macro(DataViewGetInt, NodeMustGenerate | NodeResultJS) \
>+    macro(DataViewGetFloat, NodeMustGenerate | NodeResultDouble) \
>+
>+    //macro(DataViewSet, NodeMustGenerate | NodeMustGenerate) \
> 
> 
> // This enum generates a monotonically increasing id for all Node types,
>Index: Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp	(working copy)
>@@ -750,7 +750,9 @@ private:
>         case CallDOMGetter:
>         case GetDynamicVar:
>         case GetPrototypeOf:
>-        case ExtractValueFromWeakMapGet: {
>+        case ExtractValueFromWeakMapGet: 
>+        case DataViewGetInt:
>+        case DataViewGetFloat: {
>             setPrediction(m_currentNode->getHeapPrediction());
>             break;
>         }
>Index: Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(working copy)
>@@ -65,6 +65,7 @@ public:
>         case SetObjectUse:
>         case WeakMapObjectUse:
>         case WeakSetObjectUse:
>+        case DataViewObjectUse:
>         case ObjectOrOtherUse:
>         case StringIdentUse:
>         case StringUse:
>@@ -602,6 +603,10 @@ bool safeToExecute(AbstractStateType& st
>         return true;
>     }
> 
>+    case DataViewGetInt:
>+    case DataViewGetFloat:
>+        return false; // OOPS: can we always do this or just sometimes?
>+
>     case SetAdd:
>     case MapSet:
>         return false;
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -4553,6 +4553,83 @@ void SpeculativeJIT::compile(Node* node)
>         compileClearCatchLocals(node);
>         break;
> 
>+    case DataViewGetInt: {
>+        SpeculateCellOperand dataView(this, node->child1());
>+        GPRReg dataViewGPR = dataView.gpr();
>+        speculateDataViewObject(node->child1(), dataViewGPR);
>+
>+        SpeculateInt32Operand index(this, node->child2());
>+        GPRReg indexGPR = index.gpr();
>+
>+        RELEASE_ASSERT(!node->child3()); // OOPS
>+
>+        GPRTemporary temp1(this);
>+        GPRReg t1 = temp1.gpr();
>+        GPRTemporary temp2(this);
>+        GPRReg t2 = temp2.gpr();
>+
>+        DataViewData data = node->dataViewData();
>+
>+        m_jit.load32(MacroAssembler::Address(dataViewGPR, JSArrayBufferView::offsetOfLength()), t2);
>+        if (data.byteSize > 1) {
>+            m_jit.sub32(TrustedImm32(data.byteSize - 1), t2);
>+            speculationCheck(OutOfBounds, JSValueRegs(), node,
>+                m_jit.branch32(MacroAssembler::LessThan, t2, MacroAssembler::TrustedImm32(0)));
>+        }
>+        speculationCheck(OutOfBounds, JSValueRegs(), node,
>+            m_jit.branch32(MacroAssembler::GreaterThanOrEqual, indexGPR, t2));
>+
>+        m_jit.loadPtr(JITCompiler::Address(dataViewGPR, JSArrayBufferView::offsetOfVector()), t2);
>+        speculationCheck(Uncountable, JSValueSource(), node, m_jit.branchTestPtr(MacroAssembler::Zero, t2)); // OOPS: add test. Can we neuter a JSDataView?
>+
>+        m_jit.zeroExtend32ToPtr(indexGPR, t1);
>+        auto baseIndex = JITCompiler::BaseIndex(t2, t1, MacroAssembler::TimesOne);
>+        switch (data.byteSize) {
>+        case 1:
>+            if (data.isSigned)
>+                m_jit.load8SignedExtendTo32(baseIndex, t2);
>+            else
>+                m_jit.load8(baseIndex, t2);
>+            int32Result(t2, node);
>+            break;
>+        case 2:
>+            if (data.isLittleEndian == FalseTriState) {
>+                m_jit.load16(baseIndex, t2);
>+                m_jit.byteSwap(t2);
>+                m_jit.urshift32(TrustedImm32(16), t2);
>+            } else {
>+                if (data.isSigned)
>+                    m_jit.load16SignedExtendTo32(baseIndex, t2);
>+                else
>+                    m_jit.load16(baseIndex, t2);
>+            }
>+            int32Result(t2, node);
>+            break;
>+        case 4:
>+            if (data.isSigned) {
>+                m_jit.load32(baseIndex, t2);
>+                if (data.isLittleEndian == FalseTriState)
>+                    m_jit.byteSwap(t2);
>+                int32Result(t2, node);
>+            } else {
>+                // OOPS: implement this!
>+                CRASH();
>+            }
>+            break;
>+        default:
>+            RELEASE_ASSERT_NOT_REACHED();
>+        }
>+
>+        //RELEASE_ASSERT(data.isLittleEndian = TrueTriState); // OOPS
>+
>+        break;
>+    }
>+
>+    case DataViewGetFloat: {
>+        CRASH();
>+        break;
>+    }
>+
> #if ENABLE(FTL_JIT)        
>     case CheckTierUpInLoop: {
>         MacroAssembler::Jump callTierUp = m_jit.branchAdd32(
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -9903,6 +9903,20 @@ void SpeculativeJIT::speculateWeakSetObj
>     speculateWeakSetObject(edge, operand.gpr());
> }
> 
>+void SpeculativeJIT::speculateDataViewObject(Edge edge, GPRReg cell)
>+{
>+    speculateCellType(edge, cell, SpecDataViewObject, DataViewType);
>+}
>+
>+void SpeculativeJIT::speculateDataViewObject(Edge edge)
>+{
>+    if (!needsTypeCheck(edge, SpecDataViewObject))
>+        return;
>+
>+    SpeculateCellOperand operand(this, edge);
>+    speculateDataViewObject(edge, operand.gpr());
>+}
>+
> void SpeculativeJIT::speculateObjectOrOther(Edge edge)
> {
>     if (!needsTypeCheck(edge, SpecObject | SpecOther))
>@@ -10271,6 +10285,9 @@ void SpeculativeJIT::speculate(Node*, Ed
>     case WeakSetObjectUse:
>         speculateWeakSetObject(edge);
>         break;
>+    case DataViewObjectUse:
>+        speculateDataViewObject(edge);
>+        break;
>     case ObjectOrOtherUse:
>         speculateObjectOrOther(edge);
>         break;
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h	(working copy)
>@@ -1610,6 +1610,8 @@ public:
>     void speculateWeakMapObject(Edge, GPRReg cell);
>     void speculateWeakSetObject(Edge);
>     void speculateWeakSetObject(Edge, GPRReg cell);
>+    void speculateDataViewObject(Edge);
>+    void speculateDataViewObject(Edge, GPRReg cell);
>     void speculateObjectOrOther(Edge);
>     void speculateString(Edge edge, GPRReg cell);
>     void speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage);
>Index: Source/JavaScriptCore/dfg/DFGUseKind.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGUseKind.cpp	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGUseKind.cpp	(working copy)
>@@ -104,16 +104,19 @@ void printInternal(PrintStream& out, Use
>         out.print("DerivedArray");
>         return;
>     case MapObjectUse:
>-        out.print("MapObjectUse");
>+        out.print("MapObject");
>         return;
>     case SetObjectUse:
>-        out.print("SetObjectUse");
>+        out.print("SetObject");
>         return;
>     case WeakMapObjectUse:
>-        out.print("WeakMapObjectUse");
>+        out.print("WeakMapObject");
>         return;
>     case WeakSetObjectUse:
>-        out.print("WeakSetObjectUse");
>+        out.print("WeakSetObject");
>+        return;
>+    case DataViewObjectUse:
>+        out.print("DataViewObject");
>         return;
>     case ObjectOrOtherUse:
>         out.print("ObjectOrOther");
>Index: Source/JavaScriptCore/dfg/DFGUseKind.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGUseKind.h	(revision 234873)
>+++ Source/JavaScriptCore/dfg/DFGUseKind.h	(working copy)
>@@ -70,6 +70,7 @@ enum UseKind {
>     SetObjectUse,
>     WeakMapObjectUse,
>     WeakSetObjectUse,
>+    DataViewObjectUse,
>     StringObjectUse,
>     StringOrStringObjectUse,
>     NotStringVarUse,
>@@ -160,6 +161,8 @@ inline SpeculatedType typeFilterFor(UseK
>         return SpecWeakMapObject;
>     case WeakSetObjectUse:
>         return SpecWeakSetObject;
>+    case DataViewObjectUse:
>+        return SpecDataViewObject;
>     case StringObjectUse:
>         return SpecStringObject;
>     case StringOrStringObjectUse:
>@@ -259,6 +262,7 @@ inline bool isCell(UseKind kind)
>     case SetObjectUse:
>     case WeakMapObjectUse:
>     case WeakSetObjectUse:
>+    case DataViewObjectUse:
>         return true;
>     default:
>         return false;
>Index: Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLCapabilities.cpp	(revision 234873)
>+++ Source/JavaScriptCore/ftl/FTLCapabilities.cpp	(working copy)
>@@ -369,6 +369,10 @@ inline CapabilityLevel canCompile(Node* 
>         // pipeline failed to optimize out an Identity.
>         break;
> 
>+    case DataViewGetInt:
>+    case DataViewGetFloat:
>+        return CannotCompile; // OOPS!
>+
>     case IdentityWithProfile:
>     case CheckTierUpInLoop:
>     case CheckTierUpAndOSREnter:
>@@ -445,6 +449,7 @@ CapabilityLevel canCompile(Graph& graph)
>                 case SetObjectUse:
>                 case WeakMapObjectUse:
>                 case WeakSetObjectUse:
>+                case DataViewObjectUse:
>                 case FinalObjectUse:
>                 case RegExpObjectUse:
>                 case ProxyObjectUse:
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(revision 234873)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(working copy)
>@@ -14468,6 +14468,13 @@ private:
>         speculateWeakSetObject(edge, result);
>         return result;
>     }
>+
>+    LValue lowDataViewObject(Edge edge)
>+    {
>+        LValue result = lowCell(edge);
>+        speculateDataViewObject(edge, result);
>+        return result;
>+    }
>     
>     LValue lowString(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
>     {
>@@ -14943,6 +14950,9 @@ private:
>         case WeakSetObjectUse:
>             speculateWeakSetObject(edge);
>             break;
>+        case DataViewObjectUse:
>+            speculateDataViewObject(edge);
>+            break;
>         case StringUse:
>             speculateString(edge);
>             break;
>@@ -15437,6 +15447,17 @@ private:
>     {
>         speculateWeakSetObject(edge, lowCell(edge));
>     }
>+
>+    void speculateDataViewObject(Edge edge, LValue cell)
>+    {
>+        FTL_TYPE_CHECK(
>+            jsValueValue(cell), edge, SpecDataViewObject, isNotType(cell, DataViewType));
>+    }
>+
>+    void speculateDataViewObject(Edge edge)
>+    {
>+        speculateDataViewObject(edge, lowCell(edge));
>+    }
>     
>     void speculateString(Edge edge, LValue cell)
>     {
>Index: Source/JavaScriptCore/runtime/Intrinsic.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Intrinsic.cpp	(revision 234873)
>+++ Source/JavaScriptCore/runtime/Intrinsic.cpp	(working copy)
>@@ -239,6 +239,38 @@ const char* intrinsicName(Intrinsic intr
>         return "CPUCpuidIntrinsic";
>     case CPUPauseIntrinsic:
>         return "CPUPauseIntrinsic";
>+    case DataViewGetInt8:
>+        return "DataViewGetInt8";
>+    case DataViewGetUint8:
>+        return "DataViewGetUint8";
>+    case DataViewGetInt16:
>+        return "DataViewGetInt16";
>+    case DataViewGetUint16:
>+        return "DataViewGetUint16";
>+    case DataViewGetInt32:
>+        return "DataViewGetInt32";
>+    case DataViewGetUint32:
>+        return "DataViewGetUint32";
>+    case DataViewGetFloat32:
>+        return "DataViewGetFloat32";
>+    case DataViewGetFloat64:
>+        return "DataViewGetFloat64";
>+    case DataViewSetInt8:
>+        return "DataViewSetInt8";
>+    case DataViewSetUint8:
>+        return "DataViewSetUint8";
>+    case DataViewSetInt16:
>+        return "DataViewSetInt16";
>+    case DataViewSetUint16:
>+        return "DataViewSetUint16";
>+    case DataViewSetInt32:
>+        return "DataViewSetInt32";
>+    case DataViewSetUint32:
>+        return "DataViewSetUint32";
>+    case DataViewSetFloat32:
>+        return "DataViewSetFloat32";
>+    case DataViewSetFloat64:
>+        return "DataViewSetFloat64";
>     }
>     RELEASE_ASSERT_NOT_REACHED();
>     return nullptr;
>Index: Source/JavaScriptCore/runtime/Intrinsic.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Intrinsic.h	(revision 234873)
>+++ Source/JavaScriptCore/runtime/Intrinsic.h	(working copy)
>@@ -139,6 +139,23 @@ enum Intrinsic {
>     CPURdtscIntrinsic,
>     CPUCpuidIntrinsic,
>     CPUPauseIntrinsic,
>+
>+    DataViewGetInt8,
>+    DataViewGetUint8,
>+    DataViewGetInt16,
>+    DataViewGetUint16,
>+    DataViewGetInt32,
>+    DataViewGetUint32,
>+    DataViewGetFloat32,
>+    DataViewGetFloat64,
>+    DataViewSetInt8,
>+    DataViewSetUint8,
>+    DataViewSetInt16,
>+    DataViewSetUint16,
>+    DataViewSetInt32,
>+    DataViewSetUint32,
>+    DataViewSetFloat32,
>+    DataViewSetFloat64,
> };
> 
> const char* intrinsicName(Intrinsic);
>Index: Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp	(revision 234873)
>+++ Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp	(working copy)
>@@ -39,22 +39,22 @@ namespace JSC {
> 
> /* Source for JSDataViewPrototype.lut.h
> @begin dataViewTable
>-  getInt8               dataViewProtoFuncGetInt8             DontEnum|Function       1
>-  getUint8              dataViewProtoFuncGetUint8            DontEnum|Function       1
>-  getInt16              dataViewProtoFuncGetInt16            DontEnum|Function       1
>-  getUint16             dataViewProtoFuncGetUint16           DontEnum|Function       1
>-  getInt32              dataViewProtoFuncGetInt32            DontEnum|Function       1
>-  getUint32             dataViewProtoFuncGetUint32           DontEnum|Function       1
>-  getFloat32            dataViewProtoFuncGetFloat32          DontEnum|Function       1
>-  getFloat64            dataViewProtoFuncGetFloat64          DontEnum|Function       1
>-  setInt8               dataViewProtoFuncSetInt8             DontEnum|Function       2
>-  setUint8              dataViewProtoFuncSetUint8            DontEnum|Function       2
>-  setInt16              dataViewProtoFuncSetInt16            DontEnum|Function       2
>-  setUint16             dataViewProtoFuncSetUint16           DontEnum|Function       2
>-  setInt32              dataViewProtoFuncSetInt32            DontEnum|Function       2
>-  setUint32             dataViewProtoFuncSetUint32           DontEnum|Function       2
>-  setFloat32            dataViewProtoFuncSetFloat32          DontEnum|Function       2
>-  setFloat64            dataViewProtoFuncSetFloat64          DontEnum|Function       2
>+  getInt8               dataViewProtoFuncGetInt8             DontEnum|Function       1  DataViewGetInt8
>+  getUint8              dataViewProtoFuncGetUint8            DontEnum|Function       1  DataViewGetUint8
>+  getInt16              dataViewProtoFuncGetInt16            DontEnum|Function       1  DataViewGetInt16
>+  getUint16             dataViewProtoFuncGetUint16           DontEnum|Function       1  DataViewGetUint16
>+  getInt32              dataViewProtoFuncGetInt32            DontEnum|Function       1  DataViewGetInt32
>+  getUint32             dataViewProtoFuncGetUint32           DontEnum|Function       1  DataViewGetUint32
>+  getFloat32            dataViewProtoFuncGetFloat32          DontEnum|Function       1  DataViewGetFloat32
>+  getFloat64            dataViewProtoFuncGetFloat64          DontEnum|Function       1  DataViewGetFloat64
>+  setInt8               dataViewProtoFuncSetInt8             DontEnum|Function       2  DataViewSetInt8
>+  setUint8              dataViewProtoFuncSetUint8            DontEnum|Function       2  DataViewSetUint8
>+  setInt16              dataViewProtoFuncSetInt16            DontEnum|Function       2  DataViewSetInt16
>+  setUint16             dataViewProtoFuncSetUint16           DontEnum|Function       2  DataViewSetUint16
>+  setInt32              dataViewProtoFuncSetInt32            DontEnum|Function       2  DataViewSetInt32
>+  setUint32             dataViewProtoFuncSetUint32           DontEnum|Function       2  DataViewSetUint32
>+  setFloat32            dataViewProtoFuncSetFloat32          DontEnum|Function       2  DataViewSetFloat32
>+  setFloat64            dataViewProtoFuncSetFloat64          DontEnum|Function       2  DataViewSetFloat64
>   buffer                dataViewProtoGetterBuffer            DontEnum|Accessor       0
>   byteLength            dataViewProtoGetterByteLength        DontEnum|Accessor       0
>   byteOffset            dataViewProtoGetterByteOffset        DontEnum|Accessor       0
>Index: Source/WTF/wtf/TriState.h
>===================================================================
>--- Source/WTF/wtf/TriState.h	(revision 234873)
>+++ Source/WTF/wtf/TriState.h	(working copy)
>@@ -28,7 +28,7 @@
> 
> namespace WTF {
> 
>-enum TriState {
>+enum TriState : int8_t {
>     FalseTriState,
>     TrueTriState,
>     MixedTriState

Actions: View | Formatted Diff | Diff

Attachments on bug 188573: 347152 | 347278 | 347290 | 347309 | 347334 | 347342 | 347354 | 347415 | 347465 | 347476 | 347484 | 347579