Attachment 357114 Details for Bug 192619 – Patch

[patch] Patch

bug-192619-20181212190256.patch (text/plain), 9.03 KB, created by Yusuke Suzuki on 2018-12-12 02:02:57 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2018-12-12 02:02:57 PST

Size: 9.03 KB

patch

obsolete

>Subversion Revision: 239099
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 31522434d77a3ffa3b1ef47ca56d57c52db43d66..ab19d65416f75e62e7c480ce42937e8da6cb45a3 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,22 @@
>+2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [BigInt] Implement DFG/FTL typeof for BigInt
>+        https://bugs.webkit.org/show_bug.cgi?id=192619
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This patch implements typeof for BigInt in DFG and FTL. Our DFG and FTL tiers now correctly consider about BigInt
>+        in the code generated for typeof.
>+
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::boolify): We add (SpecCell - SpecString) type filter for proven type since isString
>+        check is already performed here.
>+        (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf): We use (SpecCell - SpecObject - SpecString) type filter for proven type
>+        since String and Object are already checked here. If we know the proven type does not include Symbol type here, we
>+        can omit the code for Symbol type.
>+        * jit/AssemblyHelpers.h:
>+        (JSC::AssemblyHelpers::emitTypeOf):
>+
> 2018-12-11  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         [BigInt] Simplify boolean context evaluation by leveraging JSString::offsetOfLength() == JSBigInt::offsetOfLength()
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 72eb9363edbbe575dbbedc6cc8d5a31f053e748b..7c3061da16758058d5a5626ed6cafae3c2427a14 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -13626,7 +13626,7 @@ class LowerDFGToB3 {
>             
>             m_out.appendTo(notStringCase, stringOrBigIntCase);
>             m_out.branch(
>-                isBigInt(value, provenType(edge) & SpecCell),
>+                isBigInt(value, provenType(edge) & (SpecCell - SpecString)),
>                 unsure(stringOrBigIntCase), unsure(notStringOrBigIntCase));
> 
>             m_out.appendTo(stringOrBigIntCase, notStringOrBigIntCase);
>@@ -14217,6 +14217,8 @@ class LowerDFGToB3 {
>         //         }
>         //     } else if (is string) {
>         //         return string
>+        //     } else if (is bigint) {
>+        //         return bigint
>         //     } else {
>         //         return symbol
>         //     }
>@@ -14239,6 +14241,8 @@ class LowerDFGToB3 {
>         LBasicBlock unreachable = m_out.newBlock();
>         LBasicBlock notObjectCase = m_out.newBlock();
>         LBasicBlock stringCase = m_out.newBlock();
>+        LBasicBlock notStringCase = m_out.newBlock();
>+        LBasicBlock bigIntCase = m_out.newBlock();
>         LBasicBlock symbolCase = m_out.newBlock();
>         LBasicBlock notCellCase = m_out.newBlock();
>         LBasicBlock numberCase = m_out.newBlock();
>@@ -14288,10 +14292,18 @@ class LowerDFGToB3 {
>         m_out.appendTo(notObjectCase, stringCase);
>         m_out.branch(
>             isString(value, provenType(child) & (SpecCell - SpecObject)),
>-            unsure(stringCase), unsure(symbolCase));
>+            unsure(stringCase), unsure(notStringCase));
>         
>-        m_out.appendTo(stringCase, symbolCase);
>+        m_out.appendTo(stringCase, notStringCase);
>         functor(TypeofType::String);
>+
>+        m_out.appendTo(notStringCase, bigIntCase);
>+        m_out.branch(
>+            isBigInt(value, provenType(child) & (SpecCell - SpecObject - SpecString)),
>+            unsure(bigIntCase), unsure(symbolCase));
>+
>+        m_out.appendTo(bigIntCase, symbolCase);
>+        functor(TypeofType::BigInt);
>         
>         m_out.appendTo(symbolCase, notCellCase);
>         functor(TypeofType::Symbol);
>diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>index ec295b9e8faec3b6aada48a5d151636a7527dfa6..3ea29ae030d52948b8744508259c91885f72f89a 100644
>--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
>+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>@@ -1654,6 +1654,8 @@ class AssemblyHelpers : public MacroAssembler {
>         //         }
>         //     } else if (is string) {
>         //         return string
>+        //     } else if (is bigint) {
>+        //         return bigint
>         //     } else {
>         //         return symbol
>         //     }
>@@ -1687,7 +1689,13 @@ class AssemblyHelpers : public MacroAssembler {
>         
>         Jump notString = branchIfNotString(cellGPR);
>         functor(TypeofType::String, false);
>+
>         notString.link(this);
>+
>+        Jump notBigInt = branchIfNotBigInt(cellGPR);
>+        functor(TypeofType::BigInt, false);
>+
>+        notBigInt.link(this);
>         functor(TypeofType::Symbol, false);
>         
>         notCell.link(this);
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index c6b86c9c26d5b33f88bf9cc998a05ced901d2265..1b45dcf6a85013d44c68f7200bddc562000ef878 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,24 @@
>+2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [BigInt] Implement DFG/FTL typeof for BigInt
>+        https://bugs.webkit.org/show_bug.cgi?id=192619
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/big-int-boolean-proven-type.js: Added.
>+        (assert):
>+        (bool):
>+        * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
>+        (assert):
>+        (typeOf):
>+        (i.switch):
>+        * stress/big-int-type-of-proven-type-non-constant.js: Added.
>+        (assert):
>+        (typeOf):
>+        * stress/big-int-type-of.js:
>+        (typeOf):
>+        (func):
>+
> 2018-12-10  Mark Lam  <mark.lam@apple.com>
> 
>         PropertyAttribute needs a CustomValue bit.
>diff --git a/JSTests/stress/big-int-boolean-proven-type.js b/JSTests/stress/big-int-boolean-proven-type.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..3be17b42ab200e74c4309c575c94c81071734235
>--- /dev/null
>+++ b/JSTests/stress/big-int-boolean-proven-type.js
>@@ -0,0 +1,21 @@
>+//@ runBigIntEnabled
>+
>+function assert(a) {
>+    if (!a)
>+        throw new Error("Bad assertion");
>+}
>+
>+function bool(n) {
>+    var value = "string";
>+    if (n & 0x1)
>+        value = 0n;
>+    return !!value;
>+}
>+noInline(bool);
>+
>+for (let i = 0; i < 1e6; i++) {
>+    if (i & 0x1)
>+        assert(bool(i) === false);
>+    else
>+        assert(bool(i) === true);
>+}
>diff --git a/JSTests/stress/big-int-type-of-proven-type-non-constant-including-symbol.js b/JSTests/stress/big-int-type-of-proven-type-non-constant-including-symbol.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..a845f7e028daed2b053f5fe9e14980793fe6941e
>--- /dev/null
>+++ b/JSTests/stress/big-int-type-of-proven-type-non-constant-including-symbol.js
>@@ -0,0 +1,33 @@
>+//@ runBigIntEnabled
>+
>+function assert(a) {
>+    if (!a)
>+        throw new Error("Bad assertion");
>+}
>+
>+function typeOf(n) {
>+    var value = "string";
>+    var dispatcher = n % 3;
>+    if (dispatcher === 0)
>+        value = 1n;
>+    else if (dispatcher === 1)
>+        value = "string";
>+    else
>+        value = Symbol("symbol");
>+    return typeof value;
>+}
>+noInline(typeOf);
>+
>+for (let i = 0; i < 1e6; i++) {
>+    switch (i % 3) {
>+    case 0:
>+        assert(typeOf(i) === "bigint");
>+        break;
>+    case 1:
>+        assert(typeOf(i) === "string");
>+        break;
>+    case 2:
>+        assert(typeOf(i) === "symbol");
>+        break;
>+    }
>+}
>diff --git a/JSTests/stress/big-int-type-of-proven-type-non-constant.js b/JSTests/stress/big-int-type-of-proven-type-non-constant.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..13c36445d51b6182020e6304bb5f1258fac9e619
>--- /dev/null
>+++ b/JSTests/stress/big-int-type-of-proven-type-non-constant.js
>@@ -0,0 +1,21 @@
>+//@ runBigIntEnabled
>+
>+function assert(a) {
>+    if (!a)
>+        throw new Error("Bad assertion");
>+}
>+
>+function typeOf(n) {
>+    var value = "string";
>+    if (n & 0x1)
>+        value = 1n;
>+    return typeof value;
>+}
>+noInline(typeOf);
>+
>+for (let i = 0; i < 1e6; i++) {
>+    if (i & 0x1)
>+        assert(typeOf(i) === "bigint");
>+    else
>+        assert(typeOf(i) === "string");
>+}
>diff --git a/JSTests/stress/big-int-type-of.js b/JSTests/stress/big-int-type-of.js
>index e53cd301246b958f4c6d4da11af7cd0a6b4092ac..37f3ab6fd34da7935a5a5025d15f04c1296721b8 100644
>--- a/JSTests/stress/big-int-type-of.js
>+++ b/JSTests/stress/big-int-type-of.js
>@@ -8,3 +8,27 @@ function assert(a) {
> assert(typeof 0n === "bigint");
> assert(typeof 1n !== "object");
> 
>+function typeOf(value)
>+{
>+    return typeof value;
>+}
>+noInline(typeOf);
>+
>+var object = {};
>+var func = function () { };
>+var bigInt = 1n;
>+var number = 0;
>+var string = "String";
>+var symbol = Symbol("Symbol");
>+
>+for (var i = 0; i < 1e6; ++i) {
>+    assert(typeOf(object) === "object");
>+    assert(typeOf(func) === "function");
>+    assert(typeOf(bigInt) === "bigint");
>+    assert(typeOf(number) === "number");
>+    assert(typeOf(string) === "string");
>+    assert(typeOf(symbol) === "symbol");
>+    assert(typeOf(null) === "object");
>+    assert(typeOf(undefined) === "undefined");
>+    assert(typeOf(true) === "boolean");
>+}

Flags:

keith_miller: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 192619: 357114