Attachment 359609 Details for Bug 186174 – Patch

[patch] Patch

bug-186174-20190119123418.patch (text/plain), 27.38 KB, created by Caio Lima on 2019-01-19 07:34:21 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Caio Lima

Created: 2019-01-19 07:34:21 PST

Size: 27.38 KB

patch

obsolete

>Subversion Revision: 240201
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index d6c084b72f51b6bbc9cce155c6088fde981d58bc..2f5f67a7a258bd51684e194c4fff1b00fc870190 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,51 @@
>+2019-01-19  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueMod into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186174
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This patch is introducing a new DFG node called ValueMod, that is
>+        responsible to handle BigInt and Untyped specialization of op_mod.
>+        With the introduction of BigInt, we think that cases where we can have
>+        ValueMod(Untyped, Untyped) can be common and we introduced
>+        support for such kind of node.
>+
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGBackwardsPropagationPhase.cpp:
>+        (JSC::DFG::BackwardsPropagationPhase::propagate):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::makeSafe):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGClobberize.h:
>+        (JSC::DFG::clobberize):
>+        * dfg/DFGDoesGC.cpp:
>+        (JSC::DFG::doesGC):
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupArithDivInt32):
>+        (JSC::DFG::FixupPhase::fixupArithDiv):
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGNodeType.h:
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileValueMod):
>+        * dfg/DFGSpeculativeJIT.h:
>+        * dfg/DFGSpeculativeJIT32_64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGValidate.cpp:
>+        * ftl/FTLCapabilities.cpp:
>+        (JSC::FTL::canCompile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueMod):
>+
> 2019-01-19  Antoine Quint  <graouts@apple.com>
> 
>         Add a POINTER_EVENTS feature flag
>diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>index b966adcbf7a50e1fd07d836118eb81088ef8b58e..80b40f697667c51ef366c77315a60803c7255756 100644
>--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>@@ -917,6 +917,7 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>         break;
>     }
>         
>+    case ValueMod:
>     case ValueDiv: {
>         if (node->binaryUseKind() == BigIntUse)
>             setTypeForNode(node, SpecBigInt);
>diff --git a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>index f4ce71eba58adbd5b36109e6fb6b32962cdd72f9..504d0442a9fa135609e61a8880728c711c721d45 100644
>--- a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>@@ -362,6 +362,7 @@ private:
>             break;
>         }
>             
>+        case ValueMod:
>         case ArithMod: {
>             flags |= NodeBytecodeUsesAsNumber;
>             flags &= ~NodeBytecodeUsesAsOther;
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index 4e18df703d3d216686f5859824f2ac6cb97fe00e..b8574bb9f2d0db164d8f8bca52e4be50d8a77472 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -930,7 +930,7 @@ private:
>         if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
>             node->mergeFlags(NodeMayNegZeroInDFG);
>         
>-        if (!isX86() && node->op() == ArithMod)
>+        if (!isX86() && (node->op() == ArithMod || node->op() == ValueMod))
>             return node;
> 
>         {
>@@ -991,6 +991,7 @@ private:
>             case ArithAdd:
>             case ArithSub:
>             case ValueAdd:
>+            case ValueMod:
>             case ArithMod: // for ArithMod "MayOverflow" means we tried to divide by zero, or we saw double.
>                 node->mergeFlags(NodeMayOverflowInt32InBaseline);
>                 break;
>@@ -5047,7 +5048,10 @@ void ByteCodeParser::parseBlock(unsigned limit)
>             auto bytecode = currentInstruction->as<OpMod>();
>             Node* op1 = get(bytecode.m_lhs);
>             Node* op2 = get(bytecode.m_rhs);
>-            set(bytecode.m_dst, makeSafe(addToGraph(ArithMod, op1, op2)));
>+            if (op1->hasNumberResult() && op2->hasNumberResult())
>+                set(bytecode.m_dst, makeSafe(addToGraph(ArithMod, op1, op2)));
>+            else
>+                set(bytecode.m_dst, makeSafe(addToGraph(ValueMod, op1, op2)));
>             NEXT_OPCODE(op_mod);
>         }
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
>index 9c2707332c5e75acf05881bd8841a16852c715bc..90db8d898c9e8818ff360da12b13ea6b27138da7 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
>+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
>@@ -670,6 +670,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
>     case ValueSub:
>     case ValueMul:
>     case ValueDiv:
>+    case ValueMod:
>         if (node->isBinaryUseKind(BigIntUse)) {
>             def(PureValue(node));
>             return;
>diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>index 4f79af6c4cc5c1d9a9581e712441ad703994cb2d..c7929d54a0c13f895322999f0b656c2fb7125679 100644
>--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>@@ -105,6 +105,7 @@ bool doesGC(Graph& graph, Node* node)
>     case ValueMul:
>     case ValueNegate:
>     case ValueDiv:
>+    case ValueMod:
>     case TryGetById:
>     case GetById:
>     case GetByIdFlush:
>diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>index 18b65a306c9659ff15f3feafe9bf8df8a989cab9..0ca4a1cc87535f02ecc0c4c6d87e744f3dbaa079 100644
>--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>@@ -75,38 +75,45 @@ public:
>     }
> 
> private:
>-    void fixupArithDiv(Node* node, Edge& leftChild, Edge& rightChild)
>+
>+    void fixupArithDivInt32(Node* node, Edge& leftChild, Edge& rightChild)
>     {
>-        if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>-            if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
>-                fixIntOrBooleanEdge(leftChild);
>-                fixIntOrBooleanEdge(rightChild);
>-                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>-                    node->setArithMode(Arith::Unchecked);
>-                else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>-                    node->setArithMode(Arith::CheckOverflow);
>-                else
>-                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>-                return;
>-            }
>-            
>-            // This will cause conversion nodes to be inserted later.
>-            fixDoubleOrBooleanEdge(leftChild);
>-            fixDoubleOrBooleanEdge(rightChild);
>-            
>-            // We don't need to do ref'ing on the children because we're stealing them from
>-            // the original division.
>-            Node* newDivision = m_insertionSet.insertNode(m_indexInBlock, SpecBytecodeDouble, *node);
>-            newDivision->setResult(NodeResultDouble);
>-            
>-            node->setOp(DoubleAsInt32);
>-            node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
>-            if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+        if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
>+            fixIntOrBooleanEdge(leftChild);
>+            fixIntOrBooleanEdge(rightChild);
>+            if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>+                node->setArithMode(Arith::Unchecked);
>+            else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>                 node->setArithMode(Arith::CheckOverflow);
>             else
>                 node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>             return;
>         }
>+
>+        // This will cause conversion nodes to be inserted later.
>+        fixDoubleOrBooleanEdge(leftChild);
>+        fixDoubleOrBooleanEdge(rightChild);
>+
>+        // We don't need to do ref'ing on the children because we're stealing them from
>+        // the original division.
>+        Node* newDivision = m_insertionSet.insertNode(m_indexInBlock, SpecBytecodeDouble, *node);
>+        newDivision->setResult(NodeResultDouble);
>+
>+        node->setOp(DoubleAsInt32);
>+        node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
>+        if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+            node->setArithMode(Arith::CheckOverflow);
>+        else
>+            node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>+
>+    }
>+
>+    void fixupArithDiv(Node* node, Edge& leftChild, Edge& rightChild)
>+    {
>+        if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>+            fixupArithDivInt32(node, leftChild, rightChild);
>+            return;
>+        }
>         
>         fixDoubleOrBooleanEdge(leftChild);
>         fixDoubleOrBooleanEdge(rightChild);
>@@ -495,6 +502,7 @@ private:
>             break;
>         }
> 
>+        case ValueMod: 
>         case ValueDiv: {
>             Edge& leftChild = node->child1();
>             Edge& rightChild = node->child2();
>@@ -510,7 +518,12 @@ private:
>                 fixEdge<UntypedUse>(rightChild);
>                 break;
>             }
>-            node->setOp(ArithDiv);
>+
>+            if (op == ValueDiv)
>+                node->setOp(ArithDiv);
>+            else
>+                node->setOp(ArithMod);
>+
>             node->setResult(NodeResultNumber);
>             fixupArithDiv(node, leftChild, rightChild);
>             break;
>diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
>index ded0e2680b8e82018c3d4868335b4d03e4ac8fd2..5fa1291c96e6aab02b333527f010900684a411ef 100644
>--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
>+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
>@@ -176,6 +176,7 @@ namespace JSC { namespace DFG {
>     macro(ValueSub, NodeResultJS | NodeMustGenerate) \
>     macro(ValueMul, NodeResultJS | NodeMustGenerate) \
>     macro(ValueDiv, NodeResultJS | NodeMustGenerate) \
>+    macro(ValueMod, NodeResultJS | NodeMustGenerate) \
>     \
>     /* Add of values that always convers its inputs to strings. May have two or three kids. */\
>     macro(StrCat, NodeResultJS | NodeMustGenerate) \
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>index 6075ea327ceb92b0b9cbb726d2af6707c4abcdcd..e36b351e2b70e69272a6f76ee2503624de9dd1a1 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>@@ -354,6 +354,34 @@ JSCell* JIT_OPERATION operationToObject(ExecState* exec, JSGlobalObject* globalO
>     RELEASE_AND_RETURN(scope, value.toObject(exec, globalObject));
> }
> 
>+EncodedJSValue JIT_OPERATION operationValueMod(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
>+{
>+    VM* vm = &exec->vm();
>+    NativeCallFrameTracer tracer(vm, exec);
>+    auto scope = DECLARE_THROW_SCOPE(*vm);
>+
>+    JSValue op1 = JSValue::decode(encodedOp1);
>+    JSValue op2 = JSValue::decode(encodedOp2);
>+
>+    auto leftNumeric = op1.toNumeric(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    auto rightNumeric = op2.toNumeric(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+
>+    if (WTF::holds_alternative<JSBigInt*>(leftNumeric) || WTF::holds_alternative<JSBigInt*>(rightNumeric)) {
>+        if (WTF::holds_alternative<JSBigInt*>(leftNumeric) && WTF::holds_alternative<JSBigInt*>(rightNumeric))
>+            RELEASE_AND_RETURN(scope, JSValue::encode(JSBigInt::remainder(exec, WTF::get<JSBigInt*>(leftNumeric), WTF::get<JSBigInt*>(rightNumeric))));
>+
>+        return throwVMTypeError(exec, scope, "Invalid mix of BigInt and other type in remainder operation.");
>+    }
>+
>+    scope.release();
>+
>+    double a = WTF::get<double>(leftNumeric);
>+    double b = WTF::get<double>(rightNumeric);
>+    return JSValue::encode(jsNumber(jsMod(a, b)));
>+}
>+
> EncodedJSValue JIT_OPERATION operationValueBitNot(ExecState* exec, EncodedJSValue encodedOp1)
> {
>     VM* vm = &exec->vm();
>@@ -1354,6 +1382,17 @@ JSCell* JIT_OPERATION operationMulBigInt(ExecState* exec, JSCell* op1, JSCell* o
>     return JSBigInt::multiply(exec, leftOperand, rightOperand);
> }
>     
>+JSCell* JIT_OPERATION operationModBigInt(ExecState* exec, JSCell* op1, JSCell* op2)
>+{
>+    VM* vm = &exec->vm();
>+    NativeCallFrameTracer tracer(vm, exec);
>+    
>+    JSBigInt* leftOperand = jsCast<JSBigInt*>(op1);
>+    JSBigInt* rightOperand = jsCast<JSBigInt*>(op2);
>+    
>+    return JSBigInt::remainder(exec, leftOperand, rightOperand);
>+}
>+
> JSCell* JIT_OPERATION operationDivBigInt(ExecState* exec, JSCell* op1, JSCell* op2)
> {
>     VM* vm = &exec->vm();
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
>index 8b76f4d6bf37401de2c4a97c1c3205527cc63951..ae090e15e353198834fc3fa8d586a543b1b1f5d9 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.h
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
>@@ -50,6 +50,7 @@ JSCell* JIT_OPERATION operationObjectCreateObject(ExecState*, JSObject*) WTF_INT
> JSCell* JIT_OPERATION operationCreateThis(ExecState*, JSObject* constructor, uint32_t inlineCapacity) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationToThisStrict(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationValueMod(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationValueBitNot(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationValueBitAnd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationValueBitOr(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
>@@ -168,6 +169,7 @@ size_t JIT_OPERATION operationRegExpTestGeneric(ExecState*, JSGlobalObject*, Enc
> size_t JIT_OPERATION operationCompareStrictEqCell(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationSubBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationMulBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
>+JSCell* JIT_OPERATION operationModBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationDivBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationBitAndBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationBitOrBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index b0d49e08539baafadd215df51c784938cddee2f4..8f4115d23e51a5d624e31df4495131fa1e2513f8 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -348,6 +348,7 @@ private:
>         }
> 
>         case ValueDiv:
>+        case ValueMod:
>         case ArithDiv:
>         case ArithMod: {
>             SpeculatedType left = node->child1()->prediction();
>@@ -360,11 +361,11 @@ private:
>                         changed |= mergePrediction(SpecInt32Only);
>                     else
>                         changed |= mergePrediction(SpecBytecodeDouble);
>-                } else if (op == ValueDiv && isBigIntSpeculation(left) && isBigIntSpeculation(right))
>+                } else if ((op == ValueDiv || op == ValueMod) && isBigIntSpeculation(left) && isBigIntSpeculation(right))
>                     changed |= mergePrediction(SpecBigInt);
>                 else {
>                     changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
>-                    if (op == ValueDiv && (node->mayHaveBigIntResult()
>+                    if ((op == ValueDiv || op == ValueMod) && (node->mayHaveBigIntResult()
>                         || (left & SpecBigInt)
>                         || (right & SpecBigInt)))
>                         changed |= mergePrediction(SpecBigInt);
>@@ -601,6 +602,7 @@ private:
>         case ArithMax:
>         case ArithMod:
>         case ValueDiv:
>+        case ValueMod:
>         case ArithDiv: {
>             SpeculatedType left = node->child1()->prediction();
>             SpeculatedType right = node->child2()->prediction();
>@@ -1118,6 +1120,7 @@ private:
>         case ValueSub:
>         case ValueMul:
>         case ValueDiv:
>+        case ValueMod:
>         case ArithAdd:
>         case ArithSub:
>         case ArithNegate:
>diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>index c4e566cb6c6ba121336b6c2e28bf70d951857fe1..b35d7d2829c498c57478832da4d7e74f322cbe50 100644
>--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>@@ -236,6 +236,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node, bool igno
>     case ValueSub:
>     case ValueMul:
>     case ValueDiv:
>+    case ValueMod:
>     case TryGetById:
>     case DeleteById:
>     case DeleteByVal:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 948bb979c8e65429f4bc620a24672ece294b50ac..53fa349f43fd4966500f9d37110b577cda9c32db 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -5265,6 +5265,44 @@ void SpeculativeJIT::compileArithFRound(Node* node)
>     doubleResult(result.fpr(), node);
> }
> 
>+void SpeculativeJIT::compileValueMod(Node* node)
>+{
>+    Edge& leftChild = node->child1();
>+    Edge& rightChild = node->child2();
>+
>+    if (leftChild.useKind() == BigIntUse && rightChild.useKind() == BigIntUse) {
>+        SpeculateCellOperand left(this, leftChild);
>+        SpeculateCellOperand right(this, rightChild);
>+        GPRReg leftGPR = left.gpr();
>+        GPRReg rightGPR = right.gpr();
>+
>+        speculateBigInt(leftChild, leftGPR);
>+        speculateBigInt(rightChild, rightGPR);
>+
>+        flushRegisters();
>+        GPRFlushedCallResult result(this);
>+        GPRReg resultGPR = result.gpr();
>+
>+        callOperation(operationModBigInt, resultGPR, leftGPR, rightGPR);
>+
>+        m_jit.exceptionCheck();
>+        cellResult(resultGPR, node);
>+        return;
>+    }
>+
>+    DFG_ASSERT(m_jit.graph(), node, node->binaryUseKind() == UntypedUse, node->binaryUseKind());
>+    JSValueOperand op1(this, leftChild);
>+    JSValueOperand op2(this, rightChild);
>+    JSValueRegs op1Regs = op1.jsValueRegs();
>+    JSValueRegs op2Regs = op2.jsValueRegs();
>+    flushRegisters();
>+    JSValueRegsFlushedCallResult result(this);
>+    JSValueRegs resultRegs = result.regs();
>+    callOperation(operationValueMod, resultRegs, op1Regs, op2Regs);
>+    m_jit.exceptionCheck();
>+    jsValueResult(resultRegs, node);
>+}
>+
> void SpeculativeJIT::compileArithMod(Node* node)
> {
>     switch (node->binaryUseKind()) {
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index a2ad6bed487cb34d687d7bedb51b5540d6befd8a..1d923cc770ad029ba905bd73728b6047e0f1e70e 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -1360,6 +1360,7 @@ public:
>     void compileValueDiv(Node*);
>     void compileArithDiv(Node*);
>     void compileArithFRound(Node*);
>+    void compileValueMod(Node*);
>     void compileArithMod(Node*);
>     void compileArithPow(Node*);
>     void compileArithRounding(Node*);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>index c299bccd61322c2ebbe8136447f34d15f6b97545..3084794b359703654390c296ddb25ac22b123f96 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>@@ -2081,6 +2081,11 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ValueMod: {
>+        compileValueMod(node);
>+        break;
>+    }
>+
>     case ArithMod: {
>         compileArithMod(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index 32e08c99f465f006c19731bd2bb0a02b4c1488ba..f5cd3532f117399a39edd9e1a027a582390275e4 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -2223,6 +2223,11 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ValueMod: {
>+        compileValueMod(node);
>+        break;
>+    }
>+
>     case ArithMod: {
>         compileArithMod(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGValidate.cpp b/Source/JavaScriptCore/dfg/DFGValidate.cpp
>index abd1ab2f512c35677cad4f4c95fdd5fb94ec15ce..9118058240a72f3e81ff427be21cc02a945e7f58 100644
>--- a/Source/JavaScriptCore/dfg/DFGValidate.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGValidate.cpp
>@@ -257,6 +257,7 @@ public:
>                 case ValueSub:
>                 case ValueMul:
>                 case ValueDiv:
>+                case ValueMod:
>                 case ArithAdd:
>                 case ArithSub:
>                 case ArithMul:
>diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>index 7db5b56d326ddad666ec69cfa4d8d186d224ff4a..a87d83aa3312b78c1dd809af9b6809f9957df39e 100644
>--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>@@ -96,6 +96,7 @@ inline CapabilityLevel canCompile(Node* node)
>     case ValueSub:
>     case ValueMul:
>     case ValueDiv:
>+    case ValueMod:
>     case StrCat:
>     case ArithAdd:
>     case ArithClz32:
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index edc6f0d3bc283510e5879b6ae4efa370f9aff671..e4466b90aad27f1adfd4d5b13bb658fc5aef4a76 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -619,6 +619,9 @@ private:
>         case ArithDiv:
>             compileArithDiv();
>             break;
>+        case ValueMod:
>+            compileValueMod();
>+            break;
>         case ArithMod:
>             compileArithMod();
>             break;
>@@ -2373,6 +2376,24 @@ private:
>         }
>     }
>     
>+    void compileValueMod()
>+    {
>+        if (m_node->binaryUseKind() == BigIntUse) {
>+            LValue left = lowBigInt(m_node->child1());
>+            LValue right = lowBigInt(m_node->child2());
>+
>+            LValue result = vmCall(pointerType(), m_out.operation(operationModBigInt), m_callFrame, left, right);
>+            setJSValue(result);
>+            return;
>+        }
>+
>+        DFG_ASSERT(m_graph, m_node, m_node->binaryUseKind() == UntypedUse, m_node->binaryUseKind());
>+        LValue left = lowJSValue(m_node->child1());
>+        LValue right = lowJSValue(m_node->child2());
>+        LValue result = vmCall(Int64, m_out.operation(operationValueMod), m_callFrame, left, right);
>+        setJSValue(result);
>+    }
>+
>     void compileArithMod()
>     {
>         switch (m_node->binaryUseKind()) {
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 777a853bfe709f942ac64f8b41717e0a94ab67b0..15dd99ccd227975fc16031e565ae2184cfa38ef4 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2019-01-19  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueMod into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186174
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * microbenchmarks/mod-untyped.js: Added.
>+        * stress/big-int-mod-osr.js: Added.
>+
> 2019-01-17  Saam barati  <sbarati@apple.com>
> 
>         StringObjectUse should not be a structure check for the original string object structure
>diff --git a/JSTests/microbenchmarks/mod-untyped.js b/JSTests/microbenchmarks/mod-untyped.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..800864d03d1133012e697418f5ee12d17ca5249f
>--- /dev/null
>+++ b/JSTests/microbenchmarks/mod-untyped.js
>@@ -0,0 +1,39 @@
>+let assert = {
>+    sameValue: function(i, e, m) {
>+        if (i !== e)
>+            throw new Error(m);
>+    }
>+}
>+
>+function untypedMod(x, y) {
>+    return x % y;
>+}
>+noInline(untypedMod);
>+
>+let o =  {valueOf: () => 10};
>+
>+for (let i = 0; i < 100000; i++) {
>+    let r = untypedMod(30, o);
>+    assert.sameValue(r, 0, 30 + " % {valueOf: () => 10} = " + r);
>+}
>+
>+o2 =  {valueOf: () => 10000};
>+
>+for (let i = 0; i < 100000; i++) {
>+    let r = untypedMod(o2, o);
>+    assert.sameValue(r, 0, "{valueOf: () => 10000} % {valueOf: () => 10}  = " + r);
>+}
>+
>+o = Object(10);
>+let r = untypedMod(30, o);
>+assert.sameValue(r, 0, 30 + " % Object(10) = " + r);
>+
>+o2 = Object(3240);
>+r = untypedMod(o2, o);
>+assert.sameValue(r, 0, "Object(3240) % Object(10) = " + r);
>+
>+for (let i = 0; i < 100000; i++) {
>+    let r = untypedMod("9", "8");
>+    assert.sameValue(r, 1, "9 % 8 = " + r);
>+}
>+
>diff --git a/JSTests/stress/big-int-mod-osr.js b/JSTests/stress/big-int-mod-osr.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..8c109052c2b9c74e5a4476a0c861d570122b1008
>--- /dev/null
>+++ b/JSTests/stress/big-int-mod-osr.js
>@@ -0,0 +1,30 @@
>+//@ runBigIntEnabled
>+
>+let assert = {
>+    sameValue: function(i, e, m) {
>+        if (i !== e)
>+            throw new Error(m);
>+    }
>+}
>+
>+function bigIntMod(x, y) {
>+    return x % y;
>+}
>+noInline(bigIntMod);
>+
>+for (let i = 0; i < 10000; i++) {
>+    let r = bigIntMod(3n, 10n);
>+    assert.sameValue(r, 3n, 3n + " % " + 10n + " = " + r);
>+}
>+
>+let r = bigIntMod(3, 10);
>+assert.sameValue(r, 3, 3 + " % " + 10 + " = " + r);
>+
>+for (let i = 0; i < 10000; i++) {
>+    let r = bigIntMod(3n, 10n);
>+    assert.sameValue(r, 3n, 3n + " % " + 10n + " = " + r);
>+}
>+
>+r = bigIntMod("3", "10");
>+assert.sameValue(r, 3, 3 + " % " + 10 + " = " + r);
>+
>diff --git a/PerformanceTests/BigIntBench/big-int-simple-mod.js b/PerformanceTests/BigIntBench/big-int-simple-mod.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..a50dc6ff372d153523a9c873cea55d32304e1133
>--- /dev/null
>+++ b/PerformanceTests/BigIntBench/big-int-simple-mod.js
>@@ -0,0 +1,15 @@
>+function bigInt(a, b) {
>+    let c = a % b;
>+    return a + c % b;
>+}
>+noInline(bigInt);
>+
>+for (let i = 0; i < 100000; i++) {
>+    bigInt(0b1111n, 0b1010n);
>+}
>+
>+let out;
>+for (let i = 0; i < 100000; i++) {
>+    out = bigInt(0xffffffffffffffffffn, 0xaaffffffffffffffffffn);
>+}
>+
>diff --git a/PerformanceTests/ChangeLog b/PerformanceTests/ChangeLog
>index c045c1e094ce3fcf6682fdd145da510ba2f87f51..0fc73672108ef06373aa0a522f2a172a7208279e 100644
>--- a/PerformanceTests/ChangeLog
>+++ b/PerformanceTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2019-01-19  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueMod into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186174
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * BigIntBench/big-int-simple-mod.js: Added.
>+
> 2019-01-18  Saam Barati  <sbarati@apple.com>
> 
>         Use scores everywhere in JetStream2's UI

Actions: View | Formatted Diff | Diff

Attachments on bug 186174: 357312 | 357558 | 357559 | 357630 | 357669 | 357671 | 358259 | 358260 | 359609 | 359875 | 359877 | 359973 | 360005 | 360926 | 362254 | 364011 | 367063 | 368939 | 368952 | 369347 | 369361 | 369381 | 369390 | 369393