Attachment 357630 Details for Bug 186174 – WIP - Patch

[patch] WIP - Patch

bug-186174-20181218221627.patch (text/plain), 27.87 KB, created by Caio Lima on 2018-12-18 16:16:30 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Caio Lima

Created: 2018-12-18 16:16:30 PST

Size: 27.87 KB

patch

obsolete

>Subversion Revision: 239286
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 9c12c632ad2329ae738fea32d5ae63cf9e4dd6ff..14314d800a7ff7afe862c80d5492a1fa1670fb7f 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,49 @@
>+2018-12-18  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueMod into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186174
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This patch is introducing a new DFG node called ValueMod, that is
>+        responsible to handle BigInt and Untyped specialization of op_mod.
>+        With the introduction of BigInt, we think that cases where we can have
>+        ValueMod(Untyped, Untyped) can be common and we introduced
>+        support for such kind of node.
>+
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGBackwardsPropagationPhase.cpp:
>+        (JSC::DFG::BackwardsPropagationPhase::propagate):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::makeSafe):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGClobberize.h:
>+        (JSC::DFG::clobberize):
>+        * dfg/DFGDoesGC.cpp:
>+        (JSC::DFG::doesGC):
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGNodeType.h:
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileValueMod):
>+        * dfg/DFGSpeculativeJIT.h:
>+        * dfg/DFGSpeculativeJIT32_64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGValidate.cpp:
>+        * ftl/FTLCapabilities.cpp:
>+        (JSC::FTL::canCompile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueMod):
>+
> 2018-12-17  Matt Lewis  <jlewis3@apple.com>
> 
>         Unreviewed, rolling out r239254.
>diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>index 5f5eccc330c22be8bd91e1b4cd7b759714a0dd67..cd56ff604ca3bbe63f792f7d9afb1ae4b0d551f2 100644
>--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>@@ -913,6 +913,7 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>         break;
>     }
>         
>+    case ValueMod:
>     case ValueDiv: {
>         clobberWorld();
>         if (node->binaryUseKind() == BigIntUse)
>diff --git a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>index 05c86ed1eb05f129ed4d00206d31e4e1f25d6159..265f1952f53c7db2f2eed4b67601b2234dc1095b 100644
>--- a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>@@ -356,6 +356,7 @@ private:
>             break;
>         }
>             
>+        case ValueMod:
>         case ArithMod: {
>             flags |= NodeBytecodeUsesAsNumber;
>             flags &= ~NodeBytecodeUsesAsOther;
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index 646b02c4a8a834f825db6e105a8ac10cfd22037b..b5f3095cf8433144016409ed148b3503bc1699a7 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -930,7 +930,7 @@ private:
>         if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
>             node->mergeFlags(NodeMayNegZeroInDFG);
>         
>-        if (!isX86() && node->op() == ArithMod)
>+        if (!isX86() && (node->op() == ArithMod || node->op() == ValueMod))
>             return node;
> 
>         {
>@@ -991,6 +991,7 @@ private:
>             case ArithAdd:
>             case ArithSub:
>             case ValueAdd:
>+            case ValueMod:
>             case ArithMod: // for ArithMod "MayOverflow" means we tried to divide by zero, or we saw double.
>                 node->mergeFlags(NodeMayOverflowInt32InBaseline);
>                 break;
>@@ -5050,7 +5051,10 @@ void ByteCodeParser::parseBlock(unsigned limit)
>             auto bytecode = currentInstruction->as<OpMod>();
>             Node* op1 = get(bytecode.lhs);
>             Node* op2 = get(bytecode.rhs);
>-            set(bytecode.dst, makeSafe(addToGraph(ArithMod, op1, op2)));
>+            if (op1->hasNumberResult() && op2->hasNumberResult())
>+                set(bytecode.dst, makeSafe(addToGraph(ArithMod, op1, op2)));
>+            else
>+                set(bytecode.dst, makeSafe(addToGraph(ValueMod, op1, op2)));
>             NEXT_OPCODE(op_mod);
>         }
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
>index 87424207c4016483bdbfb4202990e2a27ee99d5f..e18f5c35589a0c4fd02482ab65dc57926fc2f9a3 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
>+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
>@@ -652,6 +652,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
>     case ValueSub:
>     case ValueMul:
>     case ValueDiv:
>+    case ValueMod:
>     case SetFunctionName:
>     case GetDynamicVar:
>     case PutDynamicVar:
>diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>index 89fb3258de6668f6d7fbd19be4787e4c3aab7981..0478efeebfc191f16a1e6204ca0f036ca8297cd2 100644
>--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>@@ -105,6 +105,7 @@ bool doesGC(Graph& graph, Node* node)
>     case ValueMul:
>     case ValueNegate:
>     case ValueDiv:
>+    case ValueMod:
>     case TryGetById:
>     case GetById:
>     case GetByIdFlush:
>diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>index 35b611863bbbd6a83b25b2614eef912dde9c7271..ce68ec3dd0228fc439326854da74b6eb9f0e905c 100644
>--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>@@ -76,38 +76,45 @@ public:
>     }
> 
> private:
>-    void fixupArithDiv(Node* node, Edge& leftChild, Edge& rightChild)
>+
>+    void fixupArithDivInt32(Node* node, Edge& leftChild, Edge& rightChild)
>     {
>-        if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>-            if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
>-                fixIntOrBooleanEdge(leftChild);
>-                fixIntOrBooleanEdge(rightChild);
>-                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>-                    node->setArithMode(Arith::Unchecked);
>-                else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>-                    node->setArithMode(Arith::CheckOverflow);
>-                else
>-                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>-                return;
>-            }
>-            
>-            // This will cause conversion nodes to be inserted later.
>-            fixDoubleOrBooleanEdge(leftChild);
>-            fixDoubleOrBooleanEdge(rightChild);
>-            
>-            // We don't need to do ref'ing on the children because we're stealing them from
>-            // the original division.
>-            Node* newDivision = m_insertionSet.insertNode(m_indexInBlock, SpecBytecodeDouble, *node);
>-            newDivision->setResult(NodeResultDouble);
>-            
>-            node->setOp(DoubleAsInt32);
>-            node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
>-            if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+        if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
>+            fixIntOrBooleanEdge(leftChild);
>+            fixIntOrBooleanEdge(rightChild);
>+            if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>+                node->setArithMode(Arith::Unchecked);
>+            else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>                 node->setArithMode(Arith::CheckOverflow);
>             else
>                 node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>             return;
>         }
>+
>+        // This will cause conversion nodes to be inserted later.
>+        fixDoubleOrBooleanEdge(leftChild);
>+        fixDoubleOrBooleanEdge(rightChild);
>+
>+        // We don't need to do ref'ing on the children because we're stealing them from
>+        // the original division.
>+        Node* newDivision = m_insertionSet.insertNode(m_indexInBlock, SpecBytecodeDouble, *node);
>+        newDivision->setResult(NodeResultDouble);
>+
>+        node->setOp(DoubleAsInt32);
>+        node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
>+        if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+            node->setArithMode(Arith::CheckOverflow);
>+        else
>+            node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>+
>+    }
>+
>+    void fixupArithDiv(Node* node, Edge& leftChild, Edge& rightChild)
>+    {
>+        if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>+            fixupArithDivInt32(node, leftChild, rightChild);
>+            return;
>+        }
>         
>         fixDoubleOrBooleanEdge(leftChild);
>         fixDoubleOrBooleanEdge(rightChild);
>@@ -492,6 +499,36 @@ private:
>             break;
>         }
> 
>+        case ValueMod: {
>+            Edge& leftChild = node->child1();
>+            Edge& rightChild = node->child2();
>+
>+            if (Node::shouldSpeculateBigInt(leftChild.node(), rightChild.node())) {
>+                fixEdge<BigIntUse>(leftChild);
>+                fixEdge<BigIntUse>(rightChild);
>+                break; 
>+            }
>+
>+            if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>+                node->setOp(ArithMod);
>+                node->setResult(NodeResultNumber);
>+                fixupArithDivInt32(node, leftChild, rightChild);
>+                break;
>+            }
>+
>+            if (leftChild->shouldSpeculateNotCell() && rightChild->shouldSpeculateNotCell()) {
>+                fixDoubleOrBooleanEdge(leftChild);
>+                fixDoubleOrBooleanEdge(rightChild);
>+                node->setOp(ArithMod);
>+                node->setResult(NodeResultDouble);
>+                break;
>+            }
>+
>+            fixEdge<UntypedUse>(leftChild);
>+            fixEdge<UntypedUse>(rightChild);
>+            break;
>+        }
>+
>         case ValueDiv: {
>             Edge& leftChild = node->child1();
>             Edge& rightChild = node->child2();
>diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
>index 4cfafe7db368a6d41393b85654a6228f32b7b777..b400296325c4c5aa276a2ec07d6c69c3c294016e 100644
>--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
>+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
>@@ -176,6 +176,7 @@ namespace JSC { namespace DFG {
>     macro(ValueSub, NodeResultJS | NodeMustGenerate) \
>     macro(ValueMul, NodeResultJS | NodeMustGenerate) \
>     macro(ValueDiv, NodeResultJS | NodeMustGenerate) \
>+    macro(ValueMod, NodeResultJS | NodeMustGenerate) \
>     \
>     /* Add of values that always convers its inputs to strings. May have two or three kids. */\
>     macro(StrCat, NodeResultJS | NodeMustGenerate) \
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>index b75fcdfb975d91eca2e38fdfc6ed05db0c7cbc3b..e28f9c036db0d65f2509fa368e82cfcf0e04b35e 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>@@ -333,6 +333,37 @@ JSCell* JIT_OPERATION operationToObject(ExecState* exec, JSGlobalObject* globalO
>     RELEASE_AND_RETURN(scope, value.toObject(exec, globalObject));
> }
> 
>+EncodedJSValue JIT_OPERATION operationValueMod(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
>+{
>+    VM* vm = &exec->vm();
>+    NativeCallFrameTracer tracer(vm, exec);
>+    auto scope = DECLARE_THROW_SCOPE(*vm);
>+
>+    JSValue op1 = JSValue::decode(encodedOp1);
>+    JSValue op2 = JSValue::decode(encodedOp2);
>+
>+    auto leftNumeric = op1.toNumeric(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    auto rightNumeric = op2.toNumeric(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+
>+    if (WTF::holds_alternative<JSBigInt*>(leftNumeric) || WTF::holds_alternative<JSBigInt*>(rightNumeric)) {
>+        if (WTF::holds_alternative<JSBigInt*>(leftNumeric) && WTF::holds_alternative<JSBigInt*>(rightNumeric)) {
>+            JSBigInt* result = JSBigInt::remainder(exec, WTF::get<JSBigInt*>(leftNumeric), WTF::get<JSBigInt*>(rightNumeric));
>+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+            return JSValue::encode(result);
>+        }
>+
>+        return throwVMTypeError(exec, scope, "Invalid mix of BigInt and other type in remainder operation.");
>+    }
>+
>+    scope.release();
>+
>+    double a = WTF::get<double>(leftNumeric);
>+    double b = WTF::get<double>(rightNumeric);
>+    return JSValue::encode(jsNumber(jsMod(a, b)));
>+}
>+
> EncodedJSValue JIT_OPERATION operationValueBitNot(ExecState* exec, EncodedJSValue encodedOp1)
> {
>     VM* vm = &exec->vm();
>@@ -1333,6 +1364,17 @@ JSCell* JIT_OPERATION operationMulBigInt(ExecState* exec, JSCell* op1, JSCell* o
>     return JSBigInt::multiply(exec, leftOperand, rightOperand);
> }
>     
>+JSCell* JIT_OPERATION operationModBigInt(ExecState* exec, JSCell* op1, JSCell* op2)
>+{
>+    VM* vm = &exec->vm();
>+    NativeCallFrameTracer tracer(vm, exec);
>+    
>+    JSBigInt* leftOperand = jsCast<JSBigInt*>(op1);
>+    JSBigInt* rightOperand = jsCast<JSBigInt*>(op2);
>+    
>+    return JSBigInt::remainder(exec, leftOperand, rightOperand);
>+}
>+
> JSCell* JIT_OPERATION operationDivBigInt(ExecState* exec, JSCell* op1, JSCell* op2)
> {
>     VM* vm = &exec->vm();
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
>index 315fd6adc5271d32e2b5817a80fb02819cbbf283..e7e6bd331c32fdeb3bb40d0c0b477822e3a04b41 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.h
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
>@@ -48,6 +48,7 @@ JSCell* JIT_OPERATION operationObjectCreateObject(ExecState*, JSObject*) WTF_INT
> JSCell* JIT_OPERATION operationCreateThis(ExecState*, JSObject* constructor, uint32_t inlineCapacity) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationToThisStrict(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationValueMod(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationValueBitNot(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationValueBitAnd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationValueBitOr(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
>@@ -166,6 +167,7 @@ size_t JIT_OPERATION operationRegExpTestGeneric(ExecState*, JSGlobalObject*, Enc
> size_t JIT_OPERATION operationCompareStrictEqCell(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationSubBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationMulBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
>+JSCell* JIT_OPERATION operationModBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationDivBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationBitAndBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationBitOrBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index cf2557d1ca2f7cb3d39f0dc1b113949388722f17..e02037e539d8e3e2b1b58b72b36aec8a7734b987 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -356,6 +356,7 @@ private:
>         }
> 
>         case ValueDiv:
>+        case ValueMod:
>         case ArithDiv:
>         case ArithMod: {
>             SpeculatedType left = node->child1()->prediction();
>@@ -368,11 +369,11 @@ private:
>                         changed |= mergePrediction(SpecInt32Only);
>                     else
>                         changed |= mergePrediction(SpecBytecodeDouble);
>-                } else if (op == ValueDiv && isBigIntSpeculation(left) && isBigIntSpeculation(right))
>+                } else if ((op == ValueDiv || op == ValueMod) && isBigIntSpeculation(left) && isBigIntSpeculation(right))
>                     changed |= mergePrediction(SpecBigInt);
>                 else {
>                     changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
>-                    if (op == ValueDiv && (node->mayHaveBigIntResult()
>+                    if ((op == ValueDiv || op == ValueMod) && (node->mayHaveBigIntResult()
>                         || (left & SpecBigInt)
>                         || (right & SpecBigInt)))
>                         changed |= mergePrediction(SpecBigInt);
>@@ -609,6 +610,7 @@ private:
>         case ArithMax:
>         case ArithMod:
>         case ValueDiv:
>+        case ValueMod:
>         case ArithDiv: {
>             SpeculatedType left = node->child1()->prediction();
>             SpeculatedType right = node->child2()->prediction();
>@@ -1123,6 +1125,7 @@ private:
>         case ValueSub:
>         case ValueMul:
>         case ValueDiv:
>+        case ValueMod:
>         case ArithAdd:
>         case ArithSub:
>         case ArithNegate:
>diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>index d19ee8e1bfcdfbfc91cbe8fa0b345146c6f11bd3..902b9d2f65f389ce36790e18dfbb8bdcaecb59b8 100644
>--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>@@ -235,6 +235,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node, bool igno
>     case ValueSub:
>     case ValueMul:
>     case ValueDiv:
>+    case ValueMod:
>     case TryGetById:
>     case DeleteById:
>     case DeleteByVal:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index fe3d6862e2f40ab7d74fbb6bb65baf8533459c47..bf975551ade8ee8b1545dc4ce893d349274db01d 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -5265,6 +5265,44 @@ void SpeculativeJIT::compileArithFRound(Node* node)
>     doubleResult(result.fpr(), node);
> }
> 
>+void SpeculativeJIT::compileValueMod(Node* node)
>+{
>+    Edge& leftChild = node->child1();
>+    Edge& rightChild = node->child2();
>+
>+    if (leftChild.useKind() == BigIntUse && rightChild.useKind() == BigIntUse) {
>+        SpeculateCellOperand left(this, leftChild);
>+        SpeculateCellOperand right(this, rightChild);
>+        GPRReg leftGPR = left.gpr();
>+        GPRReg rightGPR = right.gpr();
>+
>+        speculateBigInt(leftChild, leftGPR);
>+        speculateBigInt(rightChild, rightGPR);
>+
>+        flushRegisters();
>+        GPRFlushedCallResult result(this);
>+        GPRReg resultGPR = result.gpr();
>+
>+        callOperation(operationModBigInt, resultGPR, leftGPR, rightGPR);
>+
>+        m_jit.exceptionCheck();
>+        cellResult(resultGPR, node);
>+        return;
>+    }
>+
>+    DFG_ASSERT(m_jit.graph(), node, node->binaryUseKind() == UntypedUse, node->binaryUseKind());
>+    JSValueOperand op1(this, leftChild);
>+    JSValueOperand op2(this, rightChild);
>+    JSValueRegs op1Regs = op1.jsValueRegs();
>+    JSValueRegs op2Regs = op2.jsValueRegs();
>+    flushRegisters();
>+    JSValueRegsFlushedCallResult result(this);
>+    JSValueRegs resultRegs = result.regs();
>+    callOperation(operationValueMod, resultRegs, op1Regs, op2Regs);
>+    m_jit.exceptionCheck();
>+    jsValueResult(resultRegs, node);
>+}
>+
> void SpeculativeJIT::compileArithMod(Node* node)
> {
>     switch (node->binaryUseKind()) {
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index 438b114c9de65035f049e8f3e5bf555ca8396350..15494dc636e8087b95e51c512b116e66bf73c841 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -1360,6 +1360,7 @@ public:
>     void compileValueDiv(Node*);
>     void compileArithDiv(Node*);
>     void compileArithFRound(Node*);
>+    void compileValueMod(Node*);
>     void compileArithMod(Node*);
>     void compileArithPow(Node*);
>     void compileArithRounding(Node*);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>index 952f89158d4cc30bc768beef79c8db7b3dfdf659..dea95dec6a9ae631b7bf7f4b6940e4d6be6eaa5f 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>@@ -2081,6 +2081,11 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ValueMod: {
>+        compileValueMod(node);
>+        break;
>+    }
>+
>     case ArithMod: {
>         compileArithMod(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index 18ae7d81ba92ae1dbd4c852eb084f9778f66d0fb..525a18a8ec0f13a2400faaf08d843e8717e2f96b 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -2223,6 +2223,11 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ValueMod: {
>+        compileValueMod(node);
>+        break;
>+    }
>+
>     case ArithMod: {
>         compileArithMod(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGValidate.cpp b/Source/JavaScriptCore/dfg/DFGValidate.cpp
>index abd1ab2f512c35677cad4f4c95fdd5fb94ec15ce..9118058240a72f3e81ff427be21cc02a945e7f58 100644
>--- a/Source/JavaScriptCore/dfg/DFGValidate.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGValidate.cpp
>@@ -257,6 +257,7 @@ public:
>                 case ValueSub:
>                 case ValueMul:
>                 case ValueDiv:
>+                case ValueMod:
>                 case ArithAdd:
>                 case ArithSub:
>                 case ArithMul:
>diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>index 0f6ceebb5553dfa8a0c00c3264b96591479ba7d1..eb8a02a1d92dfae2814f25502dff31b97ee2ed88 100644
>--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>@@ -96,6 +96,7 @@ inline CapabilityLevel canCompile(Node* node)
>     case ValueSub:
>     case ValueMul:
>     case ValueDiv:
>+    case ValueMod:
>     case StrCat:
>     case ArithAdd:
>     case ArithClz32:
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 185876b83716dbf352629eadfb6184658dd0f3e8..5b8a7fbedf4906a8b55c0b24799eee6382404cab 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -619,6 +619,9 @@ private:
>         case ArithDiv:
>             compileArithDiv();
>             break;
>+        case ValueMod:
>+            compileValueMod();
>+            break;
>         case ArithMod:
>             compileArithMod();
>             break;
>@@ -2364,6 +2367,24 @@ private:
>         }
>     }
>     
>+    void compileValueMod()
>+    {
>+        if (m_node->binaryUseKind() == BigIntUse) {
>+            LValue left = lowBigInt(m_node->child1());
>+            LValue right = lowBigInt(m_node->child2());
>+
>+            LValue result = vmCall(pointerType(), m_out.operation(operationModBigInt), m_callFrame, left, right);
>+            setJSValue(result);
>+            return;
>+        }
>+
>+        DFG_ASSERT(m_graph, m_node, m_node->binaryUseKind() == UntypedUse, m_node->binaryUseKind());
>+        LValue left = lowJSValue(m_node->child1());
>+        LValue right = lowJSValue(m_node->child2());
>+        LValue result = vmCall(Int64, m_out.operation(operationValueMod), m_callFrame, left, right);
>+        setJSValue(result);
>+    }
>+
>     void compileArithMod()
>     {
>         switch (m_node->binaryUseKind()) {
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 82e7e48b438af61ff3e8f25163cd805684bebd20..a7a951719eb5ba8c0e60a9d1225fff75f76e0dcb 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2018-12-18  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueMod into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186174
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * microbenchmarks/mod-untyped.js: Added.
>+
> 2018-12-14  Mark Lam  <mark.lam@apple.com>
> 
>         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
>diff --git a/JSTests/microbenchmarks/mod-untyped.js b/JSTests/microbenchmarks/mod-untyped.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..800864d03d1133012e697418f5ee12d17ca5249f
>--- /dev/null
>+++ b/JSTests/microbenchmarks/mod-untyped.js
>@@ -0,0 +1,39 @@
>+let assert = {
>+    sameValue: function(i, e, m) {
>+        if (i !== e)
>+            throw new Error(m);
>+    }
>+}
>+
>+function untypedMod(x, y) {
>+    return x % y;
>+}
>+noInline(untypedMod);
>+
>+let o =  {valueOf: () => 10};
>+
>+for (let i = 0; i < 100000; i++) {
>+    let r = untypedMod(30, o);
>+    assert.sameValue(r, 0, 30 + " % {valueOf: () => 10} = " + r);
>+}
>+
>+o2 =  {valueOf: () => 10000};
>+
>+for (let i = 0; i < 100000; i++) {
>+    let r = untypedMod(o2, o);
>+    assert.sameValue(r, 0, "{valueOf: () => 10000} % {valueOf: () => 10}  = " + r);
>+}
>+
>+o = Object(10);
>+let r = untypedMod(30, o);
>+assert.sameValue(r, 0, 30 + " % Object(10) = " + r);
>+
>+o2 = Object(3240);
>+r = untypedMod(o2, o);
>+assert.sameValue(r, 0, "Object(3240) % Object(10) = " + r);
>+
>+for (let i = 0; i < 100000; i++) {
>+    let r = untypedMod("9", "8");
>+    assert.sameValue(r, 1, "9 % 8 = " + r);
>+}
>+
>diff --git a/JSTests/stress/big-int-mod-osr.js b/JSTests/stress/big-int-mod-osr.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..8c109052c2b9c74e5a4476a0c861d570122b1008
>--- /dev/null
>+++ b/JSTests/stress/big-int-mod-osr.js
>@@ -0,0 +1,30 @@
>+//@ runBigIntEnabled
>+
>+let assert = {
>+    sameValue: function(i, e, m) {
>+        if (i !== e)
>+            throw new Error(m);
>+    }
>+}
>+
>+function bigIntMod(x, y) {
>+    return x % y;
>+}
>+noInline(bigIntMod);
>+
>+for (let i = 0; i < 10000; i++) {
>+    let r = bigIntMod(3n, 10n);
>+    assert.sameValue(r, 3n, 3n + " % " + 10n + " = " + r);
>+}
>+
>+let r = bigIntMod(3, 10);
>+assert.sameValue(r, 3, 3 + " % " + 10 + " = " + r);
>+
>+for (let i = 0; i < 10000; i++) {
>+    let r = bigIntMod(3n, 10n);
>+    assert.sameValue(r, 3n, 3n + " % " + 10n + " = " + r);
>+}
>+
>+r = bigIntMod("3", "10");
>+assert.sameValue(r, 3, 3 + " % " + 10 + " = " + r);
>+
>diff --git a/PerformanceTests/BigIntBench/big-int-simple-mod.js b/PerformanceTests/BigIntBench/big-int-simple-mod.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..a50dc6ff372d153523a9c873cea55d32304e1133
>--- /dev/null
>+++ b/PerformanceTests/BigIntBench/big-int-simple-mod.js
>@@ -0,0 +1,15 @@
>+function bigInt(a, b) {
>+    let c = a % b;
>+    return a + c % b;
>+}
>+noInline(bigInt);
>+
>+for (let i = 0; i < 100000; i++) {
>+    bigInt(0b1111n, 0b1010n);
>+}
>+
>+let out;
>+for (let i = 0; i < 100000; i++) {
>+    out = bigInt(0xffffffffffffffffffn, 0xaaffffffffffffffffffn);
>+}
>+
>diff --git a/PerformanceTests/ChangeLog b/PerformanceTests/ChangeLog
>index c59f3f60d28bb7d0b85229d339934ffa3a8b4763..0c30917a8962588e9307eccffccaabfc82fe2145 100644
>--- a/PerformanceTests/ChangeLog
>+++ b/PerformanceTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2018-12-18  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueMod into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186174
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * BigIntBench/big-int-simple-mod.js: Added.
>+
> 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
> 
>         [BigInt] Add ValueDiv into DFG

Actions: View | Formatted Diff | Diff

Attachments on bug 186174: 357312 | 357558 | 357559 | 357630 | 357669 | 357671 | 358259 | 358260 | 359609 | 359875 | 359877 | 359973 | 360005 | 360926 | 362254 | 364011 | 367063 | 368939 | 368952 | 369347 | 369361 | 369381 | 369390 | 369393