WebKit Bugzilla
Attachment 361495 Details for
Bug 193546
: [JSC] Reduce size of memory used for ShadowChicken
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
WIP
bug-193546-20190208002901.patch (text/plain), 82.21 KB, created by
Yusuke Suzuki
on 2019-02-08 00:29:02 PST
(
hide
)
Description:
WIP
Filename:
MIME Type:
Creator:
Yusuke Suzuki
Created:
2019-02-08 00:29:02 PST
Size:
82.21 KB
patch
obsolete
>Subversion Revision: 241169 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index 1a08fea7c578a822a7e8194a2b6220555548a836..4d8ba655050e76b2f35ebbade2864a5603c66d59 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,84 @@ >+2019-02-08 Yusuke Suzuki <ysuzuki@apple.com> >+ >+ [JSC] Reduce size of memory used for ShadowChicken >+ https://bugs.webkit.org/show_bug.cgi?id=193546 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * bytecode/AccessCase.cpp: >+ (JSC::AccessCase::generateImpl): >+ * bytecode/InlineAccess.cpp: >+ (JSC::InlineAccess::dumpCacheSizesAndCrash): >+ (JSC::InlineAccess::generateStringLength): >+ * dfg/DFGSpeculativeJIT.cpp: >+ (JSC::DFG::SpeculativeJIT::compileStringSlice): >+ (JSC::DFG::SpeculativeJIT::compileToLowerCase): >+ (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt): >+ (JSC::DFG::SpeculativeJIT::compileGetByValOnString): >+ (JSC::DFG::SpeculativeJIT::compileMakeRope): >+ (JSC::DFG::SpeculativeJIT::compileStringEquality): >+ (JSC::DFG::SpeculativeJIT::compileStringZeroLength): >+ (JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther): >+ (JSC::DFG::SpeculativeJIT::emitStringBranch): >+ (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch): >+ (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): >+ (JSC::DFG::SpeculativeJIT::compileGetArrayLength): >+ (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage): >+ (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): >+ (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString): >+ * dfg/DFGSpeculativeJIT32_64.cpp: >+ (JSC::DFG::SpeculativeJIT::compile): >+ * dfg/DFGSpeculativeJIT64.cpp: >+ (JSC::DFG::SpeculativeJIT::compile): >+ * ftl/FTLAbstractHeapRepository.cpp: >+ (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository): >+ * ftl/FTLAbstractHeapRepository.h: >+ * ftl/FTLLowerDFGToB3.cpp: >+ (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage): >+ (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength): >+ (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope): >+ (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt): >+ (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt): >+ (JSC::FTL::DFG::LowerDFGToB3::compileSwitch): >+ (JSC::FTL::DFG::LowerDFGToB3::mapHashString): >+ (JSC::FTL::DFG::LowerDFGToB3::compileMapHash): >+ (JSC::FTL::DFG::LowerDFGToB3::compileHasOwnProperty): >+ (JSC::FTL::DFG::LowerDFGToB3::compileStringSlice): >+ (JSC::FTL::DFG::LowerDFGToB3::compileToLowerCase): >+ (JSC::FTL::DFG::LowerDFGToB3::stringsEqual): >+ (JSC::FTL::DFG::LowerDFGToB3::boolify): >+ (JSC::FTL::DFG::LowerDFGToB3::switchString): >+ (JSC::FTL::DFG::LowerDFGToB3::isRope): >+ (JSC::FTL::DFG::LowerDFGToB3::isNotRope): >+ (JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent): >+ * jit/AssemblyHelpers.cpp: >+ (JSC::AssemblyHelpers::emitConvertValueToBoolean): >+ (JSC::AssemblyHelpers::branchIfValue): >+ * jit/AssemblyHelpers.h: >+ (JSC::AssemblyHelpers::branchIfRope): >+ (JSC::AssemblyHelpers::branchIfNotRope): >+ * jit/JITInlines.h: >+ (JSC::JIT::emitLoadCharacterString): >+ * jit/ThunkGenerators.cpp: >+ (JSC::stringGetByValGenerator): >+ (JSC::stringCharLoad): >+ * llint/LowLevelInterpreter.asm: >+ * llint/LowLevelInterpreter32_64.asm: >+ * llint/LowLevelInterpreter64.asm: >+ * runtime/JSString.cpp: >+ (JSC::JSRopeString::resolveRopeToAtomicString const): >+ (JSC::JSRopeString::resolveRopeToExistingAtomicString const): >+ (JSC::JSRopeString::resolveRope const): >+ * runtime/JSString.h: >+ (JSC::JSString::finishCreation): >+ (JSC::JSString::isRope const): >+ (JSC::JSString::is8Bit const): >+ (JSC::JSString::length const): >+ (JSC::JSString::offsetOfLength): Deleted. >+ (JSC::JSString::offsetOfFlags): Deleted. >+ (JSC::JSString::setIs8Bit const): Deleted. >+ (JSC::JSString::setLength): Deleted. >+ > 2019-02-07 Mark Lam <mark.lam@apple.com> > > Fix more doesGC() for CheckTraps, GetMapBucket, and Switch nodes. >diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog >index 90f351994933437f9fecd10ea8b8638e50460bc5..7241de7bc8ea073d14e655d4f272ded1d8312c17 100644 >--- a/Source/WTF/ChangeLog >+++ b/Source/WTF/ChangeLog >@@ -1,3 +1,16 @@ >+2019-02-08 Yusuke Suzuki <ysuzuki@apple.com> >+ >+ [JSC] Reduce size of memory used for ShadowChicken >+ https://bugs.webkit.org/show_bug.cgi?id=193546 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * wtf/text/StringImpl.h: >+ (WTF::StringImpl::flagIs8Bit): >+ (WTF::StringImpl::flagIsAtomic): >+ (WTF::StringImpl::flagIsSymbol): >+ (WTF::StringImpl::maskStringKind): >+ > 2019-02-07 Per Arne Vollan <pvollan@apple.com> > > [macOS] Block coreservicesd in sandbox. >diff --git a/Source/JavaScriptCore/bytecode/AccessCase.cpp b/Source/JavaScriptCore/bytecode/AccessCase.cpp >index 9e6ec7b063ceaa26b2b278dc17a8f21bb8cd3c5f..b7ee8c5bd4d6ff8ae9e8a87a7639895fa2b4bc0c 100644 >--- a/Source/JavaScriptCore/bytecode/AccessCase.cpp >+++ b/Source/JavaScriptCore/bytecode/AccessCase.cpp >@@ -1214,7 +1214,15 @@ void AccessCase::generateImpl(AccessGenerationState& state) > } > > case StringLength: { >- jit.load32(CCallHelpers::Address(baseGPR, JSString::offsetOfLength()), valueRegs.payloadGPR()); >+ auto isRope = jit.branchIfRope(baseGPR); >+ jit.loadPtr(CCallHelpers::Address(baseGPR, JSString::offsetOfValue()), valueRegs.payloadGPR()); >+ jit.load32(CCallHelpers::Address(valueRegs.payloadGPR(), StringImpl::lengthMemoryOffset()), valueRegs.payloadGPR()); >+ auto done = jit.jump(); >+ >+ isRope.link(&jit); >+ jit.load32(CCallHelpers::Address(baseGPR, JSRopeString::offsetOfLength()), valueRegs.payloadGPR()); >+ >+ done.link(&jit); > jit.boxInt32(valueRegs.payloadGPR(), valueRegs); > state.succeed(); > return; >diff --git a/Source/JavaScriptCore/bytecode/InlineAccess.cpp b/Source/JavaScriptCore/bytecode/InlineAccess.cpp >index b7efc375c52458f77357d9e1667d1fbc56eb65b8..bde38434eb5aaaa0116cbbd7a072932ba8e47eac 100644 >--- a/Source/JavaScriptCore/bytecode/InlineAccess.cpp >+++ b/Source/JavaScriptCore/bytecode/InlineAccess.cpp >@@ -54,7 +54,16 @@ void InlineAccess::dumpCacheSizesAndCrash() > CCallHelpers::NotEqual, > CCallHelpers::Address(base, JSCell::typeInfoTypeOffset()), > CCallHelpers::TrustedImm32(StringType)); >- jit.load32(CCallHelpers::Address(base, JSString::offsetOfLength()), regs.payloadGPR()); >+ >+ auto isRope = jit.branchIfRope(base); >+ jit.loadPtr(CCallHelpers::Address(base, JSString::offsetOfValue()), regs.payloadGPR()); >+ jit.load32(CCallHelpers::Address(regs.payloadGPR(), StringImpl::lengthMemoryOffset()), regs.payloadGPR()); >+ auto done = jit.jump(); >+ >+ isRope.link(&jit); >+ jit.load32(CCallHelpers::Address(base, JSRopeString::offsetOfLength()), regs.payloadGPR()); >+ >+ done.link(&jit); > jit.boxInt32(regs.payloadGPR(), regs); > > dataLog("string length size: ", jit.m_assembler.buffer().codeSize(), "\n"); >@@ -299,7 +308,16 @@ bool InlineAccess::generateStringLength(StructureStubInfo& stubInfo) > CCallHelpers::NotEqual, > CCallHelpers::Address(base, JSCell::typeInfoTypeOffset()), > CCallHelpers::TrustedImm32(StringType)); >- jit.load32(CCallHelpers::Address(base, JSString::offsetOfLength()), value.payloadGPR()); >+ >+ auto isRope = jit.branchIfRope(base); >+ jit.loadPtr(CCallHelpers::Address(base, JSString::offsetOfValue()), value.payloadGPR()); >+ jit.load32(CCallHelpers::Address(value.payloadGPR(), StringImpl::lengthMemoryOffset()), value.payloadGPR()); >+ auto done = jit.jump(); >+ >+ isRope.link(&jit); >+ jit.load32(CCallHelpers::Address(base, JSRopeString::offsetOfLength()), value.payloadGPR()); >+ >+ done.link(&jit); > jit.boxInt32(value.payloadGPR(), value); > > bool linkedCodeInline = linkCodeInline("string length", jit, stubInfo, [&] (LinkBuffer& linkBuffer) { >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >index 51a87afd2be37445140647f9a21b3f4a69f0ee61..a5cb1be4d77cb9056fbcc9e06313ae2a6c826849 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >@@ -1529,6 +1529,8 @@ void SpeculativeJIT::compilePeepHoleBooleanBranch(Node* node, Node* branchNode, > > void SpeculativeJIT::compileStringSlice(Node* node) > { >+ UNUSED_PARAM(node); >+#if 0 > SpeculateCellOperand string(this, node->child1()); > GPRTemporary startIndex(this); > GPRTemporary temp(this); >@@ -1541,6 +1543,47 @@ void SpeculativeJIT::compileStringSlice(Node* node) > > speculateString(node->child1(), stringGPR); > >+ auto emitPopulateSliceIndex = [&] (Edge& target, GPRReg length, GPRReg result) { >+ if (target->isInt32Constant()) { >+ int32_t value = target->asInt32(); >+ if (value == 0) { >+ m_jit.move(TrustedImm32(0), result); >+ return; >+ } >+ >+ MacroAssembler::JumpList done; >+ if (value > 0) { >+ m_jit.move(TrustedImm32(value), result); >+ done.append(m_jit.branch32(MacroAssembler::BelowOrEqual, result, length)); >+ m_jit.move(length, result); >+ } else { >+ ASSERT(value != 0); >+ m_jit.move(length, result); >+ done.append(m_jit.branchAdd32(MacroAssembler::PositiveOrZero, TrustedImm32(value), result)); >+ m_jit.move(TrustedImm32(0), result); >+ } >+ done.link(&m_jit); >+ return; >+ } >+ >+ SpeculateInt32Operand index(this, target); >+ GPRReg indexGPR = index.gpr(); >+ MacroAssembler::JumpList done; >+ >+ auto isPositive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, indexGPR, TrustedImm32(0)); >+ m_jit.move(length, result); >+ done.append(m_jit.branchAdd32(MacroAssembler::PositiveOrZero, indexGPR, result)); >+ m_jit.move(TrustedImm32(0), result); >+ done.append(m_jit.jump()); >+ >+ isPositive.link(&m_jit); >+ m_jit.move(indexGPR, result); >+ done.append(m_jit.branch32(MacroAssembler::BelowOrEqual, result, length)); >+ m_jit.move(length, result); >+ >+ done.link(&m_jit); >+ }; >+ > { > m_jit.load32(JITCompiler::Address(stringGPR, JSString::offsetOfLength()), temp2GPR); > >@@ -1596,6 +1639,7 @@ void SpeculativeJIT::compileStringSlice(Node* node) > > doneCases.link(&m_jit); > cellResult(tempGPR, node); >+#endif > } > > void SpeculativeJIT::compileToLowerCase(Node* node) >@@ -1619,8 +1663,8 @@ void SpeculativeJIT::compileToLowerCase(Node* node) > > m_jit.move(TrustedImmPtr(nullptr), indexGPR); > >+ slowPath.append(m_jit.branchIfRope(stringGPR)); > m_jit.loadPtr(MacroAssembler::Address(stringGPR, JSString::offsetOfValue()), tempGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, tempGPR)); > > slowPath.append(m_jit.branchTest32( > MacroAssembler::Zero, MacroAssembler::Address(tempGPR, StringImpl::flagsOffset()), >@@ -2128,13 +2172,13 @@ void SpeculativeJIT::compileGetCharCodeAt(Node* node) > > ASSERT(speculationChecked(m_state.forNode(node->child1()).m_type, SpecString)); > >- // unsigned comparison so we can filter out negative indices and indices that are too large >- speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, indexReg, MacroAssembler::Address(stringReg, JSString::offsetOfLength()))); >- > GPRTemporary scratch(this); > GPRReg scratchReg = scratch.gpr(); > >+ // unsigned comparison so we can filter out negative indices and indices that are too large > m_jit.loadPtr(MacroAssembler::Address(stringReg, JSString::offsetOfValue()), scratchReg); >+ >+ speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, indexReg, CCallHelpers::Address(scratchReg, StringImpl::lengthMemoryOffset()))); > > // Load the character into scratchReg > JITCompiler::Jump is16Bit = m_jit.branchTest32(MacroAssembler::Zero, MacroAssembler::Address(scratchReg, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIs8Bit())); >@@ -2175,14 +2219,13 @@ void SpeculativeJIT::compileGetByValOnString(Node* node) > ASSERT(ArrayMode(Array::String, Array::Read).alreadyChecked(m_jit.graph(), node, m_state.forNode(m_graph.child(node, 0)))); > > // unsigned comparison so we can filter out negative indices and indices that are too large >+ m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), scratchReg); > JITCompiler::Jump outOfBounds = m_jit.branch32( > MacroAssembler::AboveOrEqual, propertyReg, >- MacroAssembler::Address(baseReg, JSString::offsetOfLength())); >+ MacroAssembler::Address(scratchReg, StringImpl::lengthMemoryOffset())); > if (node->arrayMode().isInBounds()) > speculationCheck(OutOfBounds, JSValueRegs(), 0, outOfBounds); > >- m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), scratchReg); >- > // Load the character into scratchReg > JITCompiler::Jump is16Bit = m_jit.branchTest32(MacroAssembler::Zero, MacroAssembler::Address(scratchReg, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIs8Bit())); > >@@ -4342,6 +4385,7 @@ void SpeculativeJIT::compileMakeRope(Node* node) > GPRTemporary result(this); > GPRTemporary allocator(this); > GPRTemporary scratch(this); >+ GPRTemporary scratch2(this); > > GPRReg opGPRs[3]; > unsigned numOpGPRs; >@@ -4357,41 +4401,70 @@ void SpeculativeJIT::compileMakeRope(Node* node) > GPRReg resultGPR = result.gpr(); > GPRReg allocatorGPR = allocator.gpr(); > GPRReg scratchGPR = scratch.gpr(); >+ GPRReg scratch2GPR = scratch2.gpr(); > > JITCompiler::JumpList slowPath; > Allocator allocatorValue = allocatorForNonVirtualConcurrently<JSRopeString>(*m_jit.vm(), sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists); > emitAllocateJSCell(resultGPR, JITAllocator::constant(allocatorValue), allocatorGPR, TrustedImmPtr(m_jit.graph().registerStructure(m_jit.vm()->stringStructure.get())), scratchGPR, slowPath); >- >+ >+ StructureIDBlob ropeBlob(m_graph.stringStructure->id(), m_graph.stringStructure->indexingModeIncludingHistory(), TypeInfo(StringType, JSRopeString::StructureFlags | TypeInfoPerCellBit)); >+ m_jit.store64(TrustedImm64(ropeBlob.blob()), MacroAssembler::Address(resultGPR, JSCell::structureIDOffset())); > m_jit.storePtr(TrustedImmPtr(nullptr), JITCompiler::Address(resultGPR, JSString::offsetOfValue())); > for (unsigned i = 0; i < numOpGPRs; ++i) > m_jit.storePtr(opGPRs[i], JITCompiler::Address(resultGPR, JSRopeString::offsetOfFibers() + sizeof(WriteBarrier<JSString>) * i)); > for (unsigned i = numOpGPRs; i < JSRopeString::s_maxInternalRopeLength; ++i) > m_jit.storePtr(TrustedImmPtr(nullptr), JITCompiler::Address(resultGPR, JSRopeString::offsetOfFibers() + sizeof(WriteBarrier<JSString>) * i)); >- m_jit.load16(JITCompiler::Address(opGPRs[0], JSString::offsetOfFlags()), scratchGPR); >- m_jit.load32(JITCompiler::Address(opGPRs[0], JSString::offsetOfLength()), allocatorGPR); >- if (!ASSERT_DISABLED) { >- JITCompiler::Jump ok = m_jit.branch32( >- JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0)); >- m_jit.abortWithReason(DFGNegativeStringLength); >- ok.link(&m_jit); >+ >+ { >+ auto isRope = m_jit.branchIfRope(opGPRs[0]); >+ m_jit.loadPtr(JITCompiler::Address(opGPRs[0], JSString::offsetOfValue()), scratch2GPR); >+ m_jit.load32(JITCompiler::Address(scratch2GPR, StringImpl::flagsOffset()), scratchGPR); >+ m_jit.load32(JITCompiler::Address(scratch2GPR, StringImpl::lengthMemoryOffset()), allocatorGPR); >+ auto done = m_jit.jump(); >+ >+ isRope.link(&m_jit); >+ m_jit.load32(JITCompiler::Address(opGPRs[0], JSRopeString::offsetOfFlags()), scratchGPR); >+ m_jit.load32(JITCompiler::Address(opGPRs[0], JSRopeString::offsetOfLength()), allocatorGPR); >+ >+ done.link(&m_jit); >+ >+ if (!ASSERT_DISABLED) { >+ JITCompiler::Jump ok = m_jit.branch32( >+ JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0)); >+ m_jit.abortWithReason(DFGNegativeStringLength); >+ ok.link(&m_jit); >+ } > } >+ > for (unsigned i = 1; i < numOpGPRs; ++i) { >- m_jit.and16(JITCompiler::Address(opGPRs[i], JSString::offsetOfFlags()), scratchGPR); >+ auto isRope = m_jit.branchIfRope(opGPRs[i]); >+ m_jit.loadPtr(JITCompiler::Address(opGPRs[i], JSString::offsetOfValue()), scratch2GPR); >+ m_jit.and32(JITCompiler::Address(scratch2GPR, StringImpl::flagsOffset()), scratchGPR); > speculationCheck( > Uncountable, JSValueSource(), nullptr, > m_jit.branchAdd32( > JITCompiler::Overflow, >- JITCompiler::Address(opGPRs[i], JSString::offsetOfLength()), allocatorGPR)); >+ JITCompiler::Address(scratch2GPR, StringImpl::lengthMemoryOffset()), allocatorGPR)); >+ auto done = m_jit.jump(); >+ >+ isRope.link(&m_jit); >+ m_jit.and32(JITCompiler::Address(opGPRs[i], JSRopeString::offsetOfFlags()), scratchGPR); >+ speculationCheck( >+ Uncountable, JSValueSource(), nullptr, >+ m_jit.branchAdd32( >+ JITCompiler::Overflow, >+ JITCompiler::Address(opGPRs[i], JSRopeString::offsetOfLength()), allocatorGPR)); >+ done.link(&m_jit); > } >- m_jit.and32(JITCompiler::TrustedImm32(JSString::Is8Bit), scratchGPR); >- m_jit.store16(scratchGPR, JITCompiler::Address(resultGPR, JSString::offsetOfFlags())); >+ m_jit.and32(JITCompiler::TrustedImm32(JSRopeString::Is8Bit), scratchGPR); >+ m_jit.store32(scratchGPR, JITCompiler::Address(resultGPR, JSRopeString::offsetOfFlags())); > if (!ASSERT_DISABLED) { > JITCompiler::Jump ok = m_jit.branch32( > JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0)); > m_jit.abortWithReason(DFGNegativeStringLength); > ok.link(&m_jit); > } >- m_jit.store32(allocatorGPR, JITCompiler::Address(resultGPR, JSString::offsetOfLength())); >+ m_jit.store32(allocatorGPR, JITCompiler::Address(resultGPR, JSRopeString::offsetOfLength())); > > m_jit.mutatorFence(*m_jit.vm()); > >@@ -6320,21 +6393,21 @@ void SpeculativeJIT::compileStringEquality( > trueCase.append(fastTrue); > falseCase.append(fastFalse); > >- m_jit.load32(MacroAssembler::Address(leftGPR, JSString::offsetOfLength()), lengthGPR); >+ slowCase.append(m_jit.branchIfRope(leftGPR)); >+ slowCase.append(m_jit.branchIfRope(rightGPR)); >+ >+ m_jit.loadPtr(MacroAssembler::Address(leftGPR, JSString::offsetOfValue()), leftTempGPR); >+ m_jit.loadPtr(MacroAssembler::Address(rightGPR, JSString::offsetOfValue()), rightTempGPR); >+ >+ m_jit.load32(MacroAssembler::Address(leftTempGPR, StringImpl::lengthMemoryOffset()), lengthGPR); > > falseCase.append(m_jit.branch32( > MacroAssembler::NotEqual, >- MacroAssembler::Address(rightGPR, JSString::offsetOfLength()), >+ MacroAssembler::Address(rightTempGPR, StringImpl::lengthMemoryOffset()), > lengthGPR)); > > trueCase.append(m_jit.branchTest32(MacroAssembler::Zero, lengthGPR)); > >- m_jit.loadPtr(MacroAssembler::Address(leftGPR, JSString::offsetOfValue()), leftTempGPR); >- m_jit.loadPtr(MacroAssembler::Address(rightGPR, JSString::offsetOfValue()), rightTempGPR); >- >- slowCase.append(m_jit.branchTestPtr(MacroAssembler::Zero, leftTempGPR)); >- slowCase.append(m_jit.branchTestPtr(MacroAssembler::Zero, rightTempGPR)); >- > slowCase.append(m_jit.branchTest32( > MacroAssembler::Zero, > MacroAssembler::Address(leftTempGPR, StringImpl::flagsOffset()), >@@ -6638,9 +6711,15 @@ void SpeculativeJIT::compileStringZeroLength(Node* node) > GPRTemporary eq(this); > GPRReg eqGPR = eq.gpr(); > >- // Fetch the length field from the string object. >- m_jit.test32(MacroAssembler::Zero, MacroAssembler::Address(strGPR, JSString::offsetOfLength()), MacroAssembler::TrustedImm32(-1), eqGPR); >+ auto isRope = m_jit.branchIfRope(strGPR); >+ m_jit.loadPtr(JITCompiler::Address(strGPR, JSString::offsetOfValue()), eqGPR); >+ m_jit.test32(JITCompiler::Zero, JITCompiler::Address(eqGPR, StringImpl::lengthMemoryOffset()), JITCompiler::TrustedImm32(-1), eqGPR); >+ auto done = m_jit.jump(); >+ >+ isRope.link(&m_jit); >+ m_jit.test32(MacroAssembler::Zero, MacroAssembler::Address(strGPR, JSRopeString::offsetOfLength()), MacroAssembler::TrustedImm32(-1), eqGPR); > >+ done.link(&m_jit); > unblessedBooleanResult(eqGPR, node); > } > >@@ -6655,15 +6734,24 @@ void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node) > GPRReg cellGPR = valueRegs.payloadGPR(); > DFG_TYPE_CHECK( > valueRegs, node->child1(), (~SpecCellCheck) | SpecString, m_jit.branchIfNotString(cellGPR)); >+ >+ CCallHelpers::JumpList doneCases; >+ auto isRope = m_jit.branchIfRope(cellGPR); >+ m_jit.loadPtr(JITCompiler::Address(cellGPR, JSString::offsetOfValue()), tempGPR); >+ m_jit.test32(JITCompiler::Zero, JITCompiler::Address(tempGPR, StringImpl::lengthMemoryOffset()), JITCompiler::TrustedImm32(-1), tempGPR); >+ doneCases.append(m_jit.jump()); >+ >+ isRope.link(&m_jit); > m_jit.test32( >- JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()), >+ JITCompiler::Zero, JITCompiler::Address(cellGPR, JSRopeString::offsetOfLength()), > JITCompiler::TrustedImm32(-1), tempGPR); >- JITCompiler::Jump done = m_jit.jump(); >+ doneCases.append(m_jit.jump()); >+ > notCell.link(&m_jit); > DFG_TYPE_CHECK( > valueRegs, node->child1(), SpecCellCheck | SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR)); > m_jit.move(TrustedImm32(1), tempGPR); >- done.link(&m_jit); >+ doneCases.link(&m_jit); > > unblessedBooleanResult(tempGPR, node); > >@@ -6672,9 +6760,24 @@ void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node) > void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken) > { > SpeculateCellOperand str(this, nodeUse); >- speculateString(nodeUse, str.gpr()); >- branchTest32(JITCompiler::NonZero, MacroAssembler::Address(str.gpr(), JSString::offsetOfLength()), taken); >+ GPRTemporary temp(this); >+ >+ GPRReg strGPR = str.gpr(); >+ GPRReg tempGPR = temp.gpr(); >+ >+ speculateString(nodeUse, strGPR); >+ >+ auto isRope = m_jit.branchIfRope(strGPR); >+ m_jit.loadPtr(JITCompiler::Address(strGPR, JSString::offsetOfValue()), tempGPR); >+ branchTest32( >+ JITCompiler::Zero, JITCompiler::Address(tempGPR, StringImpl::lengthMemoryOffset()), >+ JITCompiler::TrustedImm32(-1), notTaken); >+ jump(taken, ForceJump); >+ >+ isRope.link(&m_jit); >+ branchTest32(JITCompiler::NonZero, MacroAssembler::Address(strGPR, JSRopeString::offsetOfLength()), taken); > jump(notTaken); >+ > noResult(m_currentNode); > } > >@@ -6688,10 +6791,21 @@ void SpeculativeJIT::emitStringOrOtherBranch(Edge nodeUse, BasicBlock* taken, Ba > JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs); > GPRReg cellGPR = valueRegs.payloadGPR(); > DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCellCheck) | SpecString, m_jit.branchIfNotString(cellGPR)); >+ >+ auto isRope = m_jit.branchIfRope(cellGPR); >+ m_jit.loadPtr(JITCompiler::Address(cellGPR, JSString::offsetOfValue()), tempGPR); > branchTest32( >- JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()), >+ JITCompiler::Zero, JITCompiler::Address(tempGPR, StringImpl::lengthMemoryOffset()), > JITCompiler::TrustedImm32(-1), notTaken); > jump(taken, ForceJump); >+ >+ isRope.link(&m_jit); >+ branchTest32( >+ JITCompiler::Zero, JITCompiler::Address(cellGPR, JSRopeString::offsetOfLength()), >+ JITCompiler::TrustedImm32(-1), notTaken); >+ jump(taken, ForceJump); >+ >+ jump(taken, ForceJump); > notCell.link(&m_jit); > DFG_TYPE_CHECK( > valueRegs, nodeUse, SpecCellCheck | SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR)); >@@ -6736,13 +6850,12 @@ void SpeculativeJIT::compileGetIndexedPropertyStorage(Node* node) > > switch (node->arrayMode().type()) { > case Array::String: >- m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), storageReg); >- > addSlowPathGenerator( > slowPathCall( >- m_jit.branchTest32(MacroAssembler::Zero, storageReg), >+ m_jit.branchIfRope(baseReg), > this, operationResolveRope, storageReg, baseReg)); > >+ m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), storageReg); > m_jit.loadPtr(MacroAssembler::Address(storageReg, StringImpl::dataOffset()), storageReg); > break; > >@@ -6998,7 +7111,15 @@ void SpeculativeJIT::compileGetArrayLength(Node* node) > GPRTemporary result(this, Reuse, base); > GPRReg baseGPR = base.gpr(); > GPRReg resultGPR = result.gpr(); >- m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR); >+ auto isRope = m_jit.branchIfRope(baseGPR); >+ m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSString::offsetOfValue()), resultGPR); >+ m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::lengthMemoryOffset()), resultGPR); >+ auto done = m_jit.jump(); >+ >+ isRope.link(&m_jit); >+ m_jit.load32(MacroAssembler::Address(baseGPR, JSRopeString::offsetOfLength()), resultGPR); >+ >+ done.link(&m_jit); > int32Result(resultGPR, node); > break; > } >@@ -10140,13 +10261,13 @@ void SpeculativeJIT::speculateStringOrOther(Edge edge) > void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage) > { > m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage); >- >+ > if (!needsTypeCheck(edge, SpecStringIdent | ~SpecString)) > return; > > speculationCheck( > BadType, JSValueSource::unboxedCell(string), edge, >- m_jit.branchTestPtr(MacroAssembler::Zero, storage)); >+ m_jit.branchIfRope(string)); > speculationCheck( > BadType, JSValueSource::unboxedCell(string), edge, m_jit.branchTest32( > MacroAssembler::Zero, >@@ -10547,19 +10668,18 @@ void SpeculativeJIT::emitSwitchImm(Node* node, SwitchData* data) > void SpeculativeJIT::emitSwitchCharStringJump( > SwitchData* data, GPRReg value, GPRReg scratch, GPRReg scratch2) > { >+ auto isRope = m_jit.branchIfRope(value); >+ >+ m_jit.loadPtr(MacroAssembler::Address(value, JSString::offsetOfValue()), scratch); >+ > addBranch( > m_jit.branch32( > MacroAssembler::NotEqual, >- MacroAssembler::Address(value, JSString::offsetOfLength()), >+ MacroAssembler::Address(scratch, StringImpl::lengthMemoryOffset()), > TrustedImm32(1)), > data->fallThrough.block); > >- m_jit.loadPtr(MacroAssembler::Address(value, JSString::offsetOfValue()), scratch); >- >- addSlowPathGenerator( >- slowPathCall( >- m_jit.branchTestPtr(MacroAssembler::Zero, scratch), >- this, operationResolveRope, scratch, value)); >+ addSlowPathGenerator(slowPathCall(isRope, this, operationResolveRope, scratch, value)); > > m_jit.loadPtr(MacroAssembler::Address(scratch, StringImpl::dataOffset()), value); > >@@ -10806,11 +10926,11 @@ void SpeculativeJIT::emitSwitchStringOnString(SwitchData* data, GPRReg string) > GPRReg lengthGPR = length.gpr(); > GPRReg tempGPR = temp.gpr(); > >- m_jit.load32(MacroAssembler::Address(string, JSString::offsetOfLength()), lengthGPR); >+ MacroAssembler::JumpList slowCases; >+ slowCases.append(m_jit.branchIfRope(string)); > m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), tempGPR); >+ m_jit.load32(MacroAssembler::Address(tempGPR, StringImpl::lengthMemoryOffset()), lengthGPR); > >- MacroAssembler::JumpList slowCases; >- slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, tempGPR)); > slowCases.append(m_jit.branchTest32( > MacroAssembler::Zero, > MacroAssembler::Address(tempGPR, StringImpl::flagsOffset()), >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp >index 4dfe9c92321d753d178148f4ed35f8973f3e6f52..ff8e9b7d15b7f6a23d0d5d73b83438e0c0eb3ecb 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp >@@ -3879,8 +3879,8 @@ void SpeculativeJIT::compile(Node* node) > } > case StringUse: { > speculateString(node->child2(), keyRegs.payloadGPR()); >+ slowPath.append(m_jit.branchIfRope(keyRegs.payloadGPR())); > m_jit.loadPtr(MacroAssembler::Address(keyRegs.payloadGPR(), JSString::offsetOfValue()), implGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR)); > slowPath.append(m_jit.branchTest32( > MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()), > MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic()))); >@@ -3889,8 +3889,8 @@ void SpeculativeJIT::compile(Node* node) > case UntypedUse: { > slowPath.append(m_jit.branchIfNotCell(keyRegs)); > auto isNotString = m_jit.branchIfNotString(keyRegs.payloadGPR()); >+ slowPath.append(m_jit.branchIfRope(keyRegs.payloadGPR())); > m_jit.loadPtr(MacroAssembler::Address(keyRegs.payloadGPR(), JSString::offsetOfValue()), implGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR)); > slowPath.append(m_jit.branchTest32( > MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()), > MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic()))); >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp >index 7f9e381b755d264ca75e3e7dcaca80c8741dde66..537a3f49e871590a639da03a73817f0eb0b85eba 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp >@@ -3999,8 +3999,8 @@ void SpeculativeJIT::compile(Node* node) > isString.link(&m_jit); > } > >+ slowPath.append(m_jit.branchIfRope(inputGPR)); > m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR)); > m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR); > m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR); > slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR)); >@@ -4037,8 +4037,8 @@ void SpeculativeJIT::compile(Node* node) > straightHash.append(m_jit.branchIfNotCell(inputGPR)); > MacroAssembler::JumpList slowPath; > straightHash.append(m_jit.branchIfNotString(inputGPR)); >+ slowPath.append(m_jit.branchIfRope(inputGPR)); > m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR)); > m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR); > m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR); > slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR)); >@@ -4411,8 +4411,8 @@ void SpeculativeJIT::compile(Node* node) > } > case StringUse: { > speculateString(node->child2(), keyGPR); >+ slowPath.append(m_jit.branchIfRope(keyGPR)); > m_jit.loadPtr(MacroAssembler::Address(keyGPR, JSString::offsetOfValue()), implGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR)); > slowPath.append(m_jit.branchTest32( > MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()), > MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic()))); >@@ -4421,8 +4421,8 @@ void SpeculativeJIT::compile(Node* node) > case UntypedUse: { > slowPath.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR))); > auto isNotString = m_jit.branchIfNotString(keyGPR); >+ slowPath.append(m_jit.branchIfRope(keyGPR)); > m_jit.loadPtr(MacroAssembler::Address(keyGPR, JSString::offsetOfValue()), implGPR); >- slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR)); > slowPath.append(m_jit.branchTest32( > MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()), > MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic()))); >diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp >index c035112580c6b8a2958965654bc1c81ed7ae97d5..eba6bf9be193a1d91162698038eeb595e5d960e8 100644 >--- a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp >+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp >@@ -60,8 +60,6 @@ AbstractHeapRepository::AbstractHeapRepository() > , JSCell_freeListNext(JSCell_header) > , ArrayStorage_publicLength(Butterfly_publicLength) > , ArrayStorage_vectorLength(Butterfly_vectorLength) >- , JSBigInt_length(JSBigIntOrString_length) >- , JSString_length(JSBigIntOrString_length) > > #define INDEXED_ABSTRACT_HEAP_INITIALIZATION(name, offset, size) , name(&root, #name, offset, size) > FOR_EACH_INDEXED_ABSTRACT_HEAP(INDEXED_ABSTRACT_HEAP_INITIALIZATION) >@@ -79,8 +77,6 @@ AbstractHeapRepository::AbstractHeapRepository() > RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoFlags.offset()); > RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_cellState.offset()); > >- RELEASE_ASSERT(JSBigInt::offsetOfLength() == JSString::offsetOfLength()); >- > JSCell_structureID.changeParent(&JSCell_header); > JSCell_usefulBytes.changeParent(&JSCell_header); > JSCell_indexingTypeAndMisc.changeParent(&JSCell_usefulBytes); >diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h >index e50541ba526b06682d0053f546bea2de2abd532a..266f67b30b1050a98be31a45ed82b3f848da72c6 100644 >--- a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h >+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h >@@ -64,7 +64,7 @@ namespace JSC { namespace FTL { > macro(JSArrayBufferView_length, JSArrayBufferView::offsetOfLength()) \ > macro(JSArrayBufferView_mode, JSArrayBufferView::offsetOfMode()) \ > macro(JSArrayBufferView_vector, JSArrayBufferView::offsetOfVector()) \ >- macro(JSBigIntOrString_length, JSBigInt::offsetOfLength()) \ >+ macro(JSBigInt_length, JSBigInt::offsetOfLength()) \ > macro(JSCell_cellState, JSCell::cellStateOffset()) \ > macro(JSCell_header, 0) \ > macro(JSCell_indexingTypeAndMisc, JSCell::indexingTypeAndMiscOffset()) \ >@@ -88,8 +88,9 @@ namespace JSC { namespace FTL { > macro(JSPropertyNameEnumerator_endGenericPropertyIndex, JSPropertyNameEnumerator::endGenericPropertyIndexOffset()) \ > macro(JSPropertyNameEnumerator_endStructurePropertyIndex, JSPropertyNameEnumerator::endStructurePropertyIndexOffset()) \ > macro(JSPropertyNameEnumerator_indexLength, JSPropertyNameEnumerator::indexedLengthOffset()) \ >+ macro(JSRopeString_flags, JSRopeString::offsetOfFlags()) \ >+ macro(JSRopeString_length, JSRopeString::offsetOfLength()) \ > macro(JSScope_next, JSScope::offsetOfNext()) \ >- macro(JSString_flags, JSString::offsetOfFlags()) \ > macro(JSString_value, JSString::offsetOfValue()) \ > macro(JSSymbolTableObject_symbolTable, JSSymbolTableObject::offsetOfSymbolTable()) \ > macro(JSWrapperObject_internalValue, JSWrapperObject::internalValueOffset()) \ >@@ -180,8 +181,6 @@ class AbstractHeapRepository { > AbstractHeap& JSCell_freeListNext; > AbstractHeap& ArrayStorage_publicLength; > AbstractHeap& ArrayStorage_vectorLength; >- AbstractHeap& JSBigInt_length; >- AbstractHeap& JSString_length; > > #define INDEXED_ABSTRACT_HEAP_DECLARATION(name, offset, size) IndexedAbstractHeap name; > FOR_EACH_INDEXED_ABSTRACT_HEAP(INDEXED_ABSTRACT_HEAP_DECLARATION) >diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp >index c10ef6d3e823ff3c9c4585a24df51f1780ccfcaa..d0508afa321a95da64b8c6b7aec06adf0e646742 100644 >--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp >+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp >@@ -3649,8 +3649,7 @@ class LowerDFGToB3 { > LValue fastResultValue = m_out.loadPtr(cell, m_heaps.JSString_value); > ValueFromBlock fastResult = m_out.anchor(fastResultValue); > >- m_out.branch( >- m_out.notNull(fastResultValue), usually(continuation), rarely(slowPath)); >+ m_out.branch(isRope(cell, provenType(m_node->child1())), rarely(slowPath), usually(continuation)); > > LBasicBlock lastNext = m_out.appendTo(slowPath, continuation); > >@@ -3822,7 +3821,23 @@ class LowerDFGToB3 { > > case Array::String: { > LValue string = lowCell(m_node->child1()); >- setInt32(m_out.load32NonNegative(string, m_heaps.JSString_length)); >+ >+ LBasicBlock ropePath = m_out.newBlock(); >+ LBasicBlock nonRopePath = m_out.newBlock(); >+ LBasicBlock continuation = m_out.newBlock(); >+ >+ m_out.branch(isRope(string, provenType(m_node->child1())), rarely(ropePath), usually(nonRopePath)); >+ >+ LBasicBlock lastNext = m_out.appendTo(ropePath, nonRopePath); >+ ValueFromBlock ropeLength = m_out.anchor(m_out.load32NonNegative(string, m_heaps.JSRopeString_length)); >+ m_out.jump(continuation); >+ >+ m_out.appendTo(nonRopePath, continuation); >+ ValueFromBlock nonRopeLength = m_out.anchor(m_out.load32NonNegative(m_out.loadPtr(string, m_heaps.JSString_value), m_heaps.StringImpl_length)); >+ m_out.jump(continuation); >+ >+ m_out.appendTo(continuation, lastNext); >+ setInt32(m_out.phi(Int32, ropeLength, nonRopeLength)); > return; > } > >@@ -6455,17 +6470,32 @@ class LowerDFGToB3 { > > void compileMakeRope() > { >+ Edge edges[3] = { >+ m_node->child1(), >+ m_node->child2(), >+ m_node->child3(), >+ }; > LValue kids[3]; >+ LBasicBlock ropeCase[3] = { }; >+ LBasicBlock notRopeCase[3] = { }; >+ LBasicBlock mergeCase[3] = { }; >+ > unsigned numKids; >- kids[0] = lowCell(m_node->child1()); >- kids[1] = lowCell(m_node->child2()); >- if (m_node->child3()) { >- kids[2] = lowCell(m_node->child3()); >+ kids[0] = lowCell(edges[0]); >+ kids[1] = lowCell(edges[1]); >+ if (edges[2]) { >+ kids[2] = lowCell(edges[2]); > numKids = 3; > } else { > kids[2] = 0; > numKids = 2; > } >+ >+ for (unsigned i = 0; i < numKids; ++i) { >+ ropeCase[i] = m_out.newBlock(); >+ notRopeCase[i] = m_out.newBlock(); >+ mergeCase[i] = m_out.newBlock(); >+ } > > LBasicBlock slowPath = m_out.newBlock(); > LBasicBlock continuation = m_out.newBlock(); >@@ -6477,24 +6507,55 @@ class LowerDFGToB3 { > LValue result = allocateCell( > m_out.constIntPtr(allocator.localAllocator()), vm().stringStructure.get(), slowPath); > >+ StructureIDBlob ropeBlob(m_graph.stringStructure->id(), m_graph.stringStructure->indexingModeIncludingHistory(), TypeInfo(StringType, JSRopeString::StructureFlags | TypeInfoPerCellBit)); >+ m_out.store32(m_out.constInt32(ropeBlob.blobExcludingStructureID()), result, m_heaps.JSCell_usefulBytes); > m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSString_value); > for (unsigned i = 0; i < numKids; ++i) > m_out.storePtr(kids[i], result, m_heaps.JSRopeString_fibers[i]); > for (unsigned i = numKids; i < JSRopeString::s_maxInternalRopeLength; ++i) > m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSRopeString_fibers[i]); >- LValue flags = m_out.load16ZeroExt32(kids[0], m_heaps.JSString_flags); >- LValue length = m_out.load32(kids[0], m_heaps.JSString_length); >+ >+ m_out.branch(isRope(kids[0], provenType(edges[0])), unsure(ropeCase[0]), unsure(notRopeCase[0])); >+ >+ m_out.appendTo(ropeCase[0], notRopeCase[0]); >+ ValueFromBlock flagsForRope = m_out.anchor(m_out.load32(kids[0], m_heaps.JSRopeString_flags)); >+ ValueFromBlock lengthForRope = m_out.anchor(m_out.load32(kids[0], m_heaps.JSRopeString_length)); >+ m_out.jump(mergeCase[0]); >+ >+ m_out.appendTo(notRopeCase[0], mergeCase[0]); >+ LValue stringImpl = m_out.loadPtr(kids[0], m_heaps.JSString_value); >+ ValueFromBlock flagsForNonRope = m_out.anchor(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags)); >+ ValueFromBlock lengthForNonRope = m_out.anchor(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags)); >+ m_out.jump(mergeCase[0]); >+ >+ m_out.appendTo(mergeCase[0], ropeCase[1]); >+ LValue flags = m_out.phi(Int32, flagsForRope, flagsForNonRope); >+ LValue length = m_out.phi(Int32, lengthForRope, lengthForNonRope); >+ > for (unsigned i = 1; i < numKids; ++i) { >- flags = m_out.bitAnd(flags, m_out.load16ZeroExt32(kids[i], m_heaps.JSString_flags)); >- CheckValue* lengthCheck = m_out.speculateAdd( >- length, m_out.load32(kids[i], m_heaps.JSString_length)); >+ m_out.branch(isRope(kids[i], provenType(edges[i])), unsure(ropeCase[i]), unsure(notRopeCase[i])); >+ >+ m_out.appendTo(ropeCase[i], notRopeCase[i]); >+ ValueFromBlock flagsForRope = m_out.anchor(m_out.load32(kids[i], m_heaps.JSRopeString_flags)); >+ ValueFromBlock lengthForRope = m_out.anchor(m_out.load32(kids[i], m_heaps.JSRopeString_length)); >+ m_out.jump(mergeCase[i]); >+ >+ m_out.appendTo(notRopeCase[i], mergeCase[i]); >+ LValue stringImpl = m_out.loadPtr(kids[i], m_heaps.JSString_value); >+ ValueFromBlock flagsForNonRope = m_out.anchor(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags)); >+ ValueFromBlock lengthForNonRope = m_out.anchor(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags)); >+ m_out.jump(mergeCase[i]); >+ >+ m_out.appendTo(mergeCase[i], (i + 1 != numKids) ? ropeCase[i + 1] : slowPath); >+ flags = m_out.bitAnd(flags, m_out.phi(Int32, flagsForRope, flagsForNonRope)); >+ CheckValue* lengthCheck = m_out.speculateAdd(length, m_out.phi(Int32, lengthForRope, lengthForNonRope)); > blessSpeculation(lengthCheck, Uncountable, noValue(), nullptr, m_origin); > length = lengthCheck; > } >- m_out.store32As16( >- m_out.bitAnd(m_out.constInt32(JSString::Is8Bit), flags), >- result, m_heaps.JSString_flags); >- m_out.store32(length, result, m_heaps.JSString_length); >+ m_out.store32( >+ m_out.bitAnd(m_out.constInt32(JSRopeString::Is8Bit), flags), >+ result, m_heaps.JSRopeString_flags); >+ m_out.store32(length, result, m_heaps.JSRopeString_length); > > mutatorFence(); > ValueFromBlock fastResult = m_out.anchor(result); >@@ -6541,15 +6602,14 @@ class LowerDFGToB3 { > LBasicBlock slowPath = m_out.newBlock(); > LBasicBlock continuation = m_out.newBlock(); > >+ LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value); > m_out.branch( > m_out.aboveOrEqual( >- index, m_out.load32NonNegative(base, m_heaps.JSString_length)), >+ index, m_out.load32NonNegative(stringImpl, m_heaps.StringImpl_length)), > rarely(slowPath), usually(fastPath)); > > LBasicBlock lastNext = m_out.appendTo(fastPath, slowPath); > >- LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value); >- > LBasicBlock is8Bit = m_out.newBlock(); > LBasicBlock is16Bit = m_out.newBlock(); > LBasicBlock bitsContinuation = m_out.newBlock(); >@@ -6651,12 +6711,12 @@ class LowerDFGToB3 { > LValue index = lowInt32(m_node->child2()); > LValue storage = lowStorage(m_node->child3()); > >+ LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value); >+ > speculate( > Uncountable, noValue(), 0, > m_out.aboveOrEqual( >- index, m_out.load32NonNegative(base, m_heaps.JSString_length))); >- >- LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value); >+ index, m_out.load32NonNegative(stringImpl, m_heaps.StringImpl_length))); > > m_out.branch( > m_out.testIsZero32( >@@ -8955,9 +9015,11 @@ class LowerDFGToB3 { > // among the different lowered branches. > // https://bugs.webkit.org/show_bug.cgi?id=129082 > >+ SpeculatedType provenTypeForString = SpecNone; > switch (m_node->child1().useKind()) { > case StringUse: { > stringValue = lowString(m_node->child1()); >+ provenTypeForString = provenType(m_node->child1()); > break; > } > >@@ -8979,6 +9041,7 @@ class LowerDFGToB3 { > > m_out.appendTo(isStringCase, lastNext); > stringValue = cellValue; >+ provenTypeForString = provenType(m_node->child1()) & SpecString; > break; > } > >@@ -8994,25 +9057,25 @@ class LowerDFGToB3 { > LBasicBlock is16Bit = m_out.newBlock(); > LBasicBlock continuation = m_out.newBlock(); > >+ ValueFromBlock fastValue = m_out.anchor(m_out.loadPtr(stringValue, m_heaps.JSString_value)); >+ m_out.branch( >+ isRope(stringValue, provenTypeForString), >+ rarely(needResolution), usually(resolved)); >+ >+ LBasicBlock lastNext = m_out.appendTo(needResolution, resolved); >+ ValueFromBlock slowValue = m_out.anchor( >+ vmCall(pointerType(), m_out.operation(operationResolveRope), m_callFrame, stringValue)); >+ m_out.jump(resolved); >+ >+ m_out.appendTo(resolved, lengthIs1); >+ LValue value = m_out.phi(pointerType(), fastValue, slowValue); > m_out.branch( > m_out.notEqual( >- m_out.load32NonNegative(stringValue, m_heaps.JSString_length), >+ m_out.load32NonNegative(value, m_heaps.StringImpl_length), > m_out.int32One), > unsure(lowBlock(data->fallThrough.block)), unsure(lengthIs1)); >- >- LBasicBlock lastNext = m_out.appendTo(lengthIs1, needResolution); >- Vector<ValueFromBlock, 2> values; >- LValue fastValue = m_out.loadPtr(stringValue, m_heaps.JSString_value); >- values.append(m_out.anchor(fastValue)); >- m_out.branch(m_out.isNull(fastValue), rarely(needResolution), usually(resolved)); >- >- m_out.appendTo(needResolution, resolved); >- values.append(m_out.anchor( >- vmCall(pointerType(), m_out.operation(operationResolveRope), m_callFrame, stringValue))); >- m_out.jump(resolved); >- >- m_out.appendTo(resolved, is8Bit); >- LValue value = m_out.phi(pointerType(), values); >+ >+ m_out.appendTo(lengthIs1, is8Bit); > LValue characterData = m_out.loadPtr(value, m_heaps.StringImpl_data); > m_out.branch( > m_out.testNonZero32( >@@ -9414,17 +9477,16 @@ class LowerDFGToB3 { > return key; > } > >- LValue mapHashString(LValue string) >+ LValue mapHashString(LValue string, SpeculatedType type = SpecFullTop) > { > LBasicBlock nonEmptyStringCase = m_out.newBlock(); > LBasicBlock slowCase = m_out.newBlock(); > LBasicBlock continuation = m_out.newBlock(); > >- LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value); >- m_out.branch( >- m_out.equal(stringImpl, m_out.constIntPtr(0)), unsure(slowCase), unsure(nonEmptyStringCase)); >+ m_out.branch(isRope(string, type), rarely(slowCase), usually(nonEmptyStringCase)); > > LBasicBlock lastNext = m_out.appendTo(nonEmptyStringCase, slowCase); >+ LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value); > LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount)); > ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash); > m_out.branch(m_out.equal(hash, m_out.constInt32(0)), >@@ -9463,7 +9525,7 @@ class LowerDFGToB3 { > isStringValue, unsure(isString), unsure(notString)); > > LBasicBlock lastNext = m_out.appendTo(isString, notString); >- ValueFromBlock stringResult = m_out.anchor(mapHashString(value)); >+ ValueFromBlock stringResult = m_out.anchor(mapHashString(value, provenType(m_node->child1()) & SpecString)); > m_out.jump(continuation); > > m_out.appendTo(notString, continuation); >@@ -9477,7 +9539,7 @@ class LowerDFGToB3 { > > case StringUse: { > LValue string = lowString(m_node->child1()); >- setInt32(mapHashString(string)); >+ setInt32(mapHashString(string, provenType(m_node->child1()))); > return; > } > >@@ -9504,11 +9566,10 @@ class LowerDFGToB3 { > isString, unsure(isStringCase), unsure(straightHash)); > > m_out.appendTo(isStringCase, nonEmptyStringCase); >- LValue stringImpl = m_out.loadPtr(value, m_heaps.JSString_value); >- m_out.branch( >- m_out.equal(stringImpl, m_out.constIntPtr(0)), rarely(slowCase), usually(nonEmptyStringCase)); >+ m_out.branch(isRope(value), rarely(slowCase), usually(nonEmptyStringCase)); > > m_out.appendTo(nonEmptyStringCase, straightHash); >+ LValue stringImpl = m_out.loadPtr(value, m_heaps.JSString_value); > LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount)); > ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash); > m_out.branch(m_out.equal(hash, m_out.constInt32(0)), >@@ -10106,10 +10167,10 @@ class LowerDFGToB3 { > LBasicBlock isAtomicString = m_out.newBlock(); > > keyAsValue = lowString(m_node->child2()); >- uniquedStringImpl = m_out.loadPtr(keyAsValue, m_heaps.JSString_value); >- m_out.branch(m_out.notNull(uniquedStringImpl), usually(isNonEmptyString), rarely(slowCase)); >+ m_out.branch(isNotRope(keyAsValue), usually(isNonEmptyString), rarely(slowCase)); > > lastNext = m_out.appendTo(isNonEmptyString, isAtomicString); >+ uniquedStringImpl = m_out.loadPtr(keyAsValue, m_heaps.JSString_value); > LValue isNotAtomic = m_out.testIsZero32(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtomic())); > m_out.branch(isNotAtomic, rarely(slowCase), usually(isAtomicString)); > >@@ -10137,11 +10198,11 @@ class LowerDFGToB3 { > m_out.branch(isString(keyAsValue), unsure(isStringCase), unsure(notStringCase)); > > m_out.appendTo(isStringCase, isNonEmptyString); >- LValue implFromString = m_out.loadPtr(keyAsValue, m_heaps.JSString_value); >- ValueFromBlock stringResult = m_out.anchor(implFromString); >- m_out.branch(m_out.notNull(implFromString), usually(isNonEmptyString), rarely(slowCase)); >+ m_out.branch(isNotRope(keyAsValue), usually(isNonEmptyString), rarely(slowCase)); > > m_out.appendTo(isNonEmptyString, notStringCase); >+ LValue implFromString = m_out.loadPtr(keyAsValue, m_heaps.JSString_value); >+ ValueFromBlock stringResult = m_out.anchor(implFromString); > LValue isNotAtomic = m_out.testIsZero32(m_out.load32(implFromString, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtomic())); > m_out.branch(isNotAtomic, rarely(slowCase), usually(hasUniquedStringImpl)); > >@@ -11884,6 +11945,7 @@ class LowerDFGToB3 { > > void compileStringSlice() > { >+#if 0 > LBasicBlock emptyCase = m_out.newBlock(); > LBasicBlock notEmptyCase = m_out.newBlock(); > LBasicBlock oneCharCase = m_out.newBlock(); >@@ -11962,6 +12024,7 @@ class LowerDFGToB3 { > > m_out.appendTo(continuation, lastNext); > setJSValue(m_out.phi(pointerType(), results)); >+#endif > } > > void compileToLowerCase() >@@ -11976,12 +12039,11 @@ class LowerDFGToB3 { > LValue string = lowString(m_node->child1()); > ValueFromBlock startIndex = m_out.anchor(m_out.constInt32(0)); > ValueFromBlock startIndexForCall = m_out.anchor(m_out.constInt32(0)); >- LValue impl = m_out.loadPtr(string, m_heaps.JSString_value); >- m_out.branch(m_out.isZero64(impl), >+ m_out.branch(isRope(string), > unsure(slowPath), unsure(notRope)); > > LBasicBlock lastNext = m_out.appendTo(notRope, is8Bit); >- >+ LValue impl = m_out.loadPtr(string, m_heaps.JSString_value); > m_out.branch( > m_out.testIsZero32( > m_out.load32(impl, m_heaps.StringImpl_hashAndFlags), >@@ -12768,29 +12830,23 @@ class LowerDFGToB3 { > LBasicBlock slowCase = m_out.newBlock(); > LBasicBlock continuation = m_out.newBlock(); > >- LValue length = m_out.load32(leftJSString, m_heaps.JSString_length); >+ m_out.branch(isRope(leftJSString), rarely(slowCase), usually(leftReadyCase)); > >- m_out.branch( >- m_out.notEqual(length, m_out.load32(rightJSString, m_heaps.JSString_length)), >- unsure(falseCase), unsure(notTriviallyUnequalCase)); >- >- LBasicBlock lastNext = m_out.appendTo(notTriviallyUnequalCase, notEmptyCase); >- >- m_out.branch(m_out.isZero32(length), unsure(trueCase), unsure(notEmptyCase)); >- >- m_out.appendTo(notEmptyCase, leftReadyCase); >+ LBasicBlock lastNext = m_out.appendTo(leftReadyCase, rightReadyCase); >+ m_out.branch(isRope(rightJSString), rarely(slowCase), usually(rightReadyCase)); > >+ m_out.appendTo(rightReadyCase, notTriviallyUnequalCase); > LValue left = m_out.loadPtr(leftJSString, m_heaps.JSString_value); > LValue right = m_out.loadPtr(rightJSString, m_heaps.JSString_value); >+ LValue length = m_out.load32(left, m_heaps.StringImpl_length); >+ m_out.branch( >+ m_out.notEqual(length, m_out.load32(right, m_heaps.StringImpl_length)), >+ unsure(falseCase), unsure(notTriviallyUnequalCase)); > >- m_out.branch(m_out.notNull(left), usually(leftReadyCase), rarely(slowCase)); >- >- m_out.appendTo(leftReadyCase, rightReadyCase); >- >- m_out.branch(m_out.notNull(right), usually(rightReadyCase), rarely(slowCase)); >- >- m_out.appendTo(rightReadyCase, left8BitCase); >+ m_out.appendTo(notTriviallyUnequalCase, notEmptyCase); >+ m_out.branch(m_out.isZero32(length), unsure(trueCase), unsure(notEmptyCase)); > >+ m_out.appendTo(notEmptyCase, left8BitCase); > m_out.branch( > m_out.testIsZero32( > m_out.load32(left, m_heaps.StringImpl_hashAndFlags), >@@ -12798,7 +12854,6 @@ class LowerDFGToB3 { > unsure(slowCase), unsure(left8BitCase)); > > m_out.appendTo(left8BitCase, right8BitCase); >- > m_out.branch( > m_out.testIsZero32( > m_out.load32(right, m_heaps.StringImpl_hashAndFlags), >@@ -13521,24 +13576,47 @@ class LowerDFGToB3 { > edge, CellCaseSpeculatesObject, SpeculateNullOrUndefined, > ManualOperandSpeculation)); > case StringUse: { >+ LBasicBlock ropeCase = m_out.newBlock(); >+ LBasicBlock notRopeCase = m_out.newBlock(); >+ LBasicBlock continuation = m_out.newBlock(); >+ > LValue stringValue = lowString(edge); >- LValue length = m_out.load32NonNegative(stringValue, m_heaps.JSString_length); >- return m_out.notEqual(length, m_out.int32Zero); >+ >+ m_out.branch(isRope(stringValue, provenType(edge)), rarely(ropeCase), usually(notRopeCase)); >+ >+ LBasicBlock lastNext = m_out.appendTo(ropeCase, notRopeCase); >+ ValueFromBlock ropeLength = m_out.anchor(m_out.load32NonNegative(stringValue, m_heaps.JSRopeString_length)); >+ m_out.jump(continuation); >+ >+ m_out.appendTo(notRopeCase, continuation); >+ ValueFromBlock nonRopeLength = m_out.anchor(m_out.load32NonNegative(m_out.loadPtr(stringValue, m_heaps.JSString_value), m_heaps.StringImpl_length)); >+ m_out.jump(continuation); >+ >+ m_out.appendTo(continuation, lastNext); >+ return m_out.notEqual(m_out.phi(Int32, ropeLength, nonRopeLength), m_out.int32Zero); > } > case StringOrOtherUse: { > LValue value = lowJSValue(edge, ManualOperandSpeculation); > > LBasicBlock cellCase = m_out.newBlock(); > LBasicBlock notCellCase = m_out.newBlock(); >+ LBasicBlock ropeCase = m_out.newBlock(); >+ LBasicBlock notRopeCase = m_out.newBlock(); > LBasicBlock continuation = m_out.newBlock(); > > m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase)); > >- LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase); >+ LBasicBlock lastNext = m_out.appendTo(cellCase, ropeCase); > > FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCellCheck) | SpecString, isNotString(value)); >- LValue length = m_out.load32NonNegative(value, m_heaps.JSString_length); >- ValueFromBlock cellResult = m_out.anchor(m_out.notEqual(length, m_out.int32Zero)); >+ m_out.branch(isRope(value, provenType(edge)), rarely(ropeCase), usually(notRopeCase)); >+ >+ m_out.appendTo(ropeCase, notRopeCase); >+ ValueFromBlock ropeResult = m_out.anchor(m_out.load32NonNegative(value, m_heaps.JSRopeString_length)); >+ m_out.jump(continuation); >+ >+ m_out.appendTo(notRopeCase, notCellCase); >+ ValueFromBlock notRopeResult = m_out.anchor(m_out.load32NonNegative(m_out.loadPtr(value, m_heaps.JSString_value), m_heaps.StringImpl_length)); > m_out.jump(continuation); > > m_out.appendTo(notCellCase, continuation); >@@ -13548,7 +13626,7 @@ class LowerDFGToB3 { > m_out.jump(continuation); > m_out.appendTo(continuation, lastNext); > >- return m_out.phi(Int32, cellResult, notCellResult); >+ return m_out.phi(Int32, ropeResult, notRopeResult, notCellResult); > } > case UntypedUse: { > LValue value = lowJSValue(edge); >@@ -13571,7 +13649,10 @@ class LowerDFGToB3 { > > LBasicBlock cellCase = m_out.newBlock(); > LBasicBlock notStringCase = m_out.newBlock(); >- LBasicBlock stringOrBigIntCase = m_out.newBlock(); >+ LBasicBlock stringCase = m_out.newBlock(); >+ LBasicBlock ropeCase = m_out.newBlock(); >+ LBasicBlock notRopeCase = m_out.newBlock(); >+ LBasicBlock bigIntCase = m_out.newBlock(); > LBasicBlock notStringOrBigIntCase = m_out.newBlock(); > LBasicBlock notCellCase = m_out.newBlock(); > LBasicBlock int32Case = m_out.newBlock(); >@@ -13587,17 +13668,32 @@ class LowerDFGToB3 { > LBasicBlock lastNext = m_out.appendTo(cellCase, notStringCase); > m_out.branch( > isString(value, provenType(edge) & SpecCell), >- unsure(stringOrBigIntCase), unsure(notStringCase)); >+ unsure(stringCase), unsure(notStringCase)); > >- m_out.appendTo(notStringCase, stringOrBigIntCase); >+ m_out.appendTo(notStringCase, stringCase); > m_out.branch( > isBigInt(value, provenType(edge) & (SpecCell - SpecString)), >- unsure(stringOrBigIntCase), unsure(notStringOrBigIntCase)); >+ unsure(bigIntCase), unsure(notStringOrBigIntCase)); >+ >+ m_out.appendTo(stringCase, ropeCase); >+ m_out.branch(isRope(value, provenType(edge) & SpecString), rarely(ropeCase), usually(notRopeCase)); >+ >+ m_out.appendTo(ropeCase, notRopeCase); >+ LValue nonZeroRope = m_out.notZero32( >+ m_out.load32NonNegative(value, m_heaps.JSRopeString_length)); >+ results.append(m_out.anchor(nonZeroRope)); >+ m_out.jump(continuation); >+ >+ m_out.appendTo(notRopeCase, bigIntCase); >+ LValue nonZeroNonRope = m_out.notZero32( >+ m_out.load32NonNegative(m_out.loadPtr(value, m_heaps.JSString_value), m_heaps.StringImpl_length)); >+ results.append(m_out.anchor(nonZeroNonRope)); >+ m_out.jump(continuation); > >- m_out.appendTo(stringOrBigIntCase, notStringOrBigIntCase); >- LValue nonZeroCell = m_out.notZero32( >- m_out.load32NonNegative(value, m_heaps.JSBigIntOrString_length)); >- results.append(m_out.anchor(nonZeroCell)); >+ m_out.appendTo(bigIntCase, notStringOrBigIntCase); >+ LValue nonZeroBigInt = m_out.notZero32( >+ m_out.load32NonNegative(value, m_heaps.JSBigInt_length)); >+ results.append(m_out.anchor(nonZeroBigInt)); > m_out.jump(continuation); > > m_out.appendTo(notStringOrBigIntCase, notCellCase); >@@ -13884,16 +13980,16 @@ class LowerDFGToB3 { > return; > } > >- LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value); >- LValue length = m_out.load32(string, m_heaps.JSString_length); >- > LBasicBlock hasImplBlock = m_out.newBlock(); > LBasicBlock is8BitBlock = m_out.newBlock(); > LBasicBlock slowBlock = m_out.newBlock(); > >- m_out.branch(m_out.isNull(stringImpl), unsure(slowBlock), unsure(hasImplBlock)); >+ m_out.branch(isRope(string), unsure(slowBlock), unsure(hasImplBlock)); > > LBasicBlock lastNext = m_out.appendTo(hasImplBlock, is8BitBlock); >+ >+ LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value); >+ LValue length = m_out.load32(stringImpl, m_heaps.StringImpl_length); > > m_out.branch( > m_out.testIsZero32( >@@ -15588,6 +15684,26 @@ class LowerDFGToB3 { > m_out.constInt32(vm().stringStructure->id())); > } > >+ LValue isRope(LValue string, SpeculatedType type = SpecFullTop) >+ { >+ if (!((type & SpecString) & ~SpecStringIdent)) >+ return m_out.booleanTrue; >+ >+ return m_out.testNonZero32( >+ m_out.load8ZeroExt32(string, m_heaps.JSCell_typeInfoFlags), >+ m_out.constInt32(TypeInfoPerCellBit)); >+ } >+ >+ LValue isNotRope(LValue string, SpeculatedType type = SpecFullTop) >+ { >+ if (!((type & SpecString) & ~SpecStringIdent)) >+ return m_out.booleanFalse; >+ >+ return m_out.testIsZero32( >+ m_out.load8ZeroExt32(string, m_heaps.JSCell_typeInfoFlags), >+ m_out.constInt32(TypeInfoPerCellBit)); >+ } >+ > LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop) > { > if (LValue proven = isProvenValue(type & SpecCell, ~SpecSymbol)) >@@ -15985,7 +16101,7 @@ class LowerDFGToB3 { > if (!m_interpreter.needsTypeCheck(edge, SpecStringIdent | ~SpecString)) > return; > >- speculate(BadType, jsValueValue(string), edge.node(), m_out.isNull(stringImpl)); >+ speculate(BadType, jsValueValue(string), edge.node(), isRope(string)); > speculate( > BadType, jsValueValue(string), edge.node(), > m_out.testIsZero32( >diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp >index 973fd3ce381b5ecafe37c8fe3727ffc5ad90507f..7f142f0dbff0ee79148dbe0679d5deaa63c3e3aa 100644 >--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp >+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp >@@ -713,8 +713,18 @@ void AssemblyHelpers::emitConvertValueToBoolean(VM& vm, JSValueRegs value, GPRRe > done.append(jump()); > > isString.link(this); >+ auto isRope = branchIfRope(value.payloadGPR()); >+ loadPtr(Address(value.payloadGPR(), JSString::offsetOfValue()), result); >+ load32(Address(result, StringImpl::lengthMemoryOffset()), result); >+ compare32(invert ? Equal : NotEqual, result, TrustedImm32(0), result); >+ done.append(jump()); >+ >+ isRope.link(this); >+ load32(Address(value.payloadGPR(), JSRopeString::offsetOfLength()), result); >+ compare32(invert ? Equal : NotEqual, result, TrustedImm32(0), result); >+ done.append(jump()); >+ > isBigInt.link(this); >- RELEASE_ASSERT(JSString::offsetOfLength() == JSBigInt::offsetOfLength()); > load32(Address(value.payloadGPR(), JSBigInt::offsetOfLength()), result); > compare32(invert ? Equal : NotEqual, result, TrustedImm32(0), result); > done.append(jump()); >@@ -800,8 +810,16 @@ AssemblyHelpers::JumpList AssemblyHelpers::branchIfValue(VM& vm, JSValueRegs val > } > > isString.link(this); >+ auto isRope = branchIfRope(value.payloadGPR()); >+ loadPtr(Address(value.payloadGPR(), JSString::offsetOfValue()), scratch); >+ truthy.append(branchTest32(invert ? Zero : NonZero, Address(scratch, StringImpl::lengthMemoryOffset()))); >+ done.append(jump()); >+ >+ isRope.link(this); >+ truthy.append(branchTest32(invert ? Zero : NonZero, Address(value.payloadGPR(), JSRopeString::offsetOfLength()))); >+ done.append(jump()); >+ > isBigInt.link(this); >- RELEASE_ASSERT(JSString::offsetOfLength() == JSBigInt::offsetOfLength()); > truthy.append(branchTest32(invert ? Zero : NonZero, Address(value.payloadGPR(), JSBigInt::offsetOfLength()))); > done.append(jump()); > >diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h >index 4b90f3aacbd22198cf33bd64d7e8ac82322e5423..1ed0503c162a65d16a108379165dd4782df12551 100644 >--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h >+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h >@@ -1075,6 +1075,16 @@ class AssemblyHelpers : public MacroAssembler { > return branchDouble(DoubleEqual, fpr, fpr); > } > >+ Jump branchIfRope(GPRReg stringGPR) >+ { >+ return branchTest8(NonZero, Address(stringGPR, JSCell::typeInfoFlagsOffset()), TrustedImm32(TypeInfoPerCellBit)); >+ } >+ >+ Jump branchIfNotRope(GPRReg stringGPR) >+ { >+ return branchTest8(Zero, Address(stringGPR, JSCell::typeInfoFlagsOffset()), TrustedImm32(TypeInfoPerCellBit)); >+ } >+ > static Address addressForByteOffset(ptrdiff_t byteOffset) > { > return Address(GPRInfo::callFrameRegister, byteOffset); >diff --git a/Source/JavaScriptCore/jit/JITInlines.h b/Source/JavaScriptCore/jit/JITInlines.h >index e260c11fecf3eb4715d0dcc541b6ab0bd4774dcd..0e9b29a63e6f3375dad172c9e6315df078253416 100644 >--- a/Source/JavaScriptCore/jit/JITInlines.h >+++ b/Source/JavaScriptCore/jit/JITInlines.h >@@ -94,9 +94,9 @@ ALWAYS_INLINE void JIT::emitPutIntToCallFrameHeader(RegisterID from, int entry) > ALWAYS_INLINE void JIT::emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures) > { > failures.append(branchIfNotString(src)); >- failures.append(branch32(NotEqual, MacroAssembler::Address(src, JSString::offsetOfLength()), TrustedImm32(1))); >+ failures.append(branchIfRope(src)); > loadPtr(MacroAssembler::Address(src, JSString::offsetOfValue()), dst); >- failures.append(branchTest32(Zero, dst)); >+ failures.append(branch32(NotEqual, MacroAssembler::Address(dst, StringImpl::lengthMemoryOffset()), TrustedImm32(1))); > loadPtr(MacroAssembler::Address(dst, StringImpl::flagsOffset()), regT1); > loadPtr(MacroAssembler::Address(dst, StringImpl::dataOffset()), dst); > >diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp >index 8630cd662ea3023ca54c15bf8fb550e2a18b3712..522e3b5fbb311ffd3c4878f06a243f6648b37662 100644 >--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp >+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp >@@ -636,9 +636,9 @@ MacroAssemblerCodeRef<JITThunkPtrTag> stringGetByValGenerator(VM* vm) > jit.tagReturnAddress(); > > // Load string length to regT2, and start the process of loading the data pointer into regT0 >- jit.load32(JSInterfaceJIT::Address(stringGPR, JSString::offsetOfLength()), scratchGPR); >+ failures.append(jit.branchIfRope(stringGPR)); > jit.loadPtr(JSInterfaceJIT::Address(stringGPR, JSString::offsetOfValue()), stringGPR); >- failures.append(jit.branchTestPtr(JSInterfaceJIT::Zero, stringGPR)); >+ jit.load32(JSInterfaceJIT::Address(stringGPR, StringImpl::lengthMemoryOffset()), scratchGPR); > > // Do an unsigned compare to simultaneously filter negative indices as well as indices that are too large > failures.append(jit.branch32(JSInterfaceJIT::AboveOrEqual, indexGPR, scratchGPR)); >@@ -675,9 +675,9 @@ static void stringCharLoad(SpecializedThunkJIT& jit) > jit.loadJSStringArgument(SpecializedThunkJIT::ThisArgument, SpecializedThunkJIT::regT0); > > // Load string length to regT2, and start the process of loading the data pointer into regT0 >- jit.load32(MacroAssembler::Address(SpecializedThunkJIT::regT0, JSString::offsetOfLength()), SpecializedThunkJIT::regT2); >+ jit.appendFailure(jit.branchIfRope(SpecializedThunkJIT::regT0)); > jit.loadPtr(MacroAssembler::Address(SpecializedThunkJIT::regT0, JSString::offsetOfValue()), SpecializedThunkJIT::regT0); >- jit.appendFailure(jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0)); >+ jit.load32(MacroAssembler::Address(SpecializedThunkJIT::regT0, StringImpl::lengthMemoryOffset()), SpecializedThunkJIT::regT2); > > // load index > jit.loadInt32Argument(0, SpecializedThunkJIT::regT1); // regT1 contains the index >diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm >index d86857dcf65455f06ac420196730600f0d9926ad..5a1a42b98cdfe472a330a14c1363c0a556d0db67 100644 >--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm >+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm >@@ -462,6 +462,7 @@ const NumberOfTypedArrayTypesExcludingDataView = constexpr NumberOfTypedArrayTyp > # Type flags constants. > const MasqueradesAsUndefined = constexpr MasqueradesAsUndefined > const ImplementsDefaultHasInstance = constexpr ImplementsDefaultHasInstance >+const TypeInfoPerCellBit = constexpr TypeInfoPerCellBit > > # Bytecode operand constants. > const FirstConstantRegisterIndexNarrow = 16 >diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm >index ff1ce5869e3691f44499861712dddb7e6dcfb7f3..9bce5fbfef672abba43187ff4dd09881977183ed 100644 >--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm >+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm >@@ -1788,9 +1788,9 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch) > addp t3, t2 > bineq t1, CellTag, .opSwitchCharFallThrough > bbneq JSCell::m_type[t0], StringType, .opSwitchCharFallThrough >- bineq JSString::m_length[t0], 1, .opSwitchCharFallThrough >+ btbnz JSCell::m_flags[t0], TypeInfoPerCellBit, .opSwitchOnRope > loadp JSString::m_value[t0], t0 >- btpz t0, .opSwitchOnRope >+ bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough > loadp StringImpl::m_data8[t0], t1 > btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit > loadh [t1], t0 >diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm >index 45825401a78b680fae0a8f0962cdc3501599aa1f..9b61aaaa31c7a0e553962fb7f2bbfd5221d7a8ef 100644 >--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm >+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm >@@ -1873,9 +1873,9 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch) > addp t3, t2 > btqnz t1, tagMask, .opSwitchCharFallThrough > bbneq JSCell::m_type[t1], StringType, .opSwitchCharFallThrough >- bineq JSString::m_length[t1], 1, .opSwitchCharFallThrough >+ btbnz JSCell::m_flags[t1], TypeInfoPerCellBit, .opSwitchOnRope > loadp JSString::m_value[t1], t0 >- btpz t0, .opSwitchOnRope >+ bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough > loadp StringImpl::m_data8[t0], t1 > btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit > loadh [t1], t0 >diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp >index d95e25cd02c7d5d32fa312410e97e6c512941298..2d5d12b6e1a0b5bf735dcef1ca25601352dd2075 100644 >--- a/Source/JavaScriptCore/runtime/JSString.cpp >+++ b/Source/JavaScriptCore/runtime/JSString.cpp >@@ -185,7 +185,7 @@ void JSRopeString::resolveRopeToAtomicString(ExecState* exec) const > resolveRope(exec); > RETURN_IF_EXCEPTION(scope, void()); > m_value = AtomicString(m_value); >- setIs8Bit(m_value.impl()->is8Bit()); >+ convertToNonRope(); > return; > } > >@@ -193,14 +193,13 @@ void JSRopeString::resolveRopeToAtomicString(ExecState* exec) const > LChar buffer[maxLengthForOnStackResolve]; > resolveRopeInternal8(buffer); > m_value = AtomicString(buffer, length()); >- setIs8Bit(m_value.impl()->is8Bit()); > } else { > UChar buffer[maxLengthForOnStackResolve]; > resolveRopeInternal16(buffer); > m_value = AtomicString(buffer, length()); >- setIs8Bit(m_value.impl()->is8Bit()); > } > >+ convertToNonRope(); > clearFibers(); > > // If we resolved a string that didn't previously exist, notify the heap that we've grown. >@@ -220,7 +219,7 @@ RefPtr<AtomicStringImpl> JSRopeString::resolveRopeToExistingAtomicString(ExecSta > resolveRope(exec); > if (RefPtr<AtomicStringImpl> existingAtomicString = AtomicStringImpl::lookUp(m_value.impl())) { > m_value = *existingAtomicString; >- setIs8Bit(m_value.impl()->is8Bit()); >+ convertToNonRope(); > clearFibers(); > return existingAtomicString; > } >@@ -232,7 +231,7 @@ RefPtr<AtomicStringImpl> JSRopeString::resolveRopeToExistingAtomicString(ExecSta > resolveRopeInternal8(buffer); > if (RefPtr<AtomicStringImpl> existingAtomicString = AtomicStringImpl::lookUp(buffer, length())) { > m_value = *existingAtomicString; >- setIs8Bit(m_value.impl()->is8Bit()); >+ convertToNonRope(); > clearFibers(); > return existingAtomicString; > } >@@ -241,7 +240,7 @@ RefPtr<AtomicStringImpl> JSRopeString::resolveRopeToExistingAtomicString(ExecSta > resolveRopeInternal16(buffer); > if (RefPtr<AtomicStringImpl> existingAtomicString = AtomicStringImpl::lookUp(buffer, length())) { > m_value = *existingAtomicString; >- setIs8Bit(m_value.impl()->is8Bit()); >+ convertToNonRope(); > clearFibers(); > return existingAtomicString; > } >@@ -257,6 +256,7 @@ void JSRopeString::resolveRope(ExecState* nullOrExecForOOM) const > if (isSubstring()) { > ASSERT(!substringBase()->isRope()); > m_value = substringBase()->m_value.substringSharingImpl(substringOffset(), length()); >+ convertToNonRope(); > substringBase().clear(); > return; > } >@@ -271,6 +271,7 @@ void JSRopeString::resolveRope(ExecState* nullOrExecForOOM) const > return; > } > resolveRopeInternal8NoSubstring(buffer); >+ convertToNonRope(); > clearFibers(); > ASSERT(!isRope()); > return; >@@ -286,6 +287,7 @@ void JSRopeString::resolveRope(ExecState* nullOrExecForOOM) const > } > > resolveRopeInternal16NoSubstring(buffer); >+ convertToNonRope(); > clearFibers(); > ASSERT(!isRope()); > } >diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h >index 8b4d2091364236480ee62748b2706f1d3239b11d..6782ea6b2ce636ba8c96450dcd1dec8fbc7d464b 100644 >--- a/Source/JavaScriptCore/runtime/JSString.h >+++ b/Source/JavaScriptCore/runtime/JSString.h >@@ -115,18 +115,16 @@ class JSString : public JSCell { > > void finishCreation(VM& vm, unsigned length) > { >+ UNUSED_PARAM(length); > ASSERT(!m_value.isNull()); > Base::finishCreation(vm); >- setLength(length); >- setIs8Bit(m_value.impl()->is8Bit()); > } > > void finishCreation(VM& vm, unsigned length, size_t cost) > { >+ UNUSED_PARAM(length); > ASSERT(!m_value.isNull()); > Base::finishCreation(vm); >- setLength(length); >- setIs8Bit(m_value.impl()->is8Bit()); > vm.heap.reportExtraMemoryAllocated(cost); > } > >@@ -134,8 +132,6 @@ class JSString : public JSCell { > void finishCreation(VM& vm) > { > Base::finishCreation(vm); >- setLength(0); >- setIs8Bit(true); > } > > public: >@@ -165,7 +161,7 @@ class JSString : public JSCell { > const String& value(ExecState*) const; > inline const String& tryGetValue() const; > const StringImpl* tryGetValueImpl() const; >- ALWAYS_INLINE unsigned length() const { return m_length; } >+ ALWAYS_INLINE unsigned length() const; > > JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const; > bool toBoolean() const { return !!length(); } >@@ -182,8 +178,6 @@ class JSString : public JSCell { > > static Structure* createStructure(VM&, JSGlobalObject*, JSValue); > >- static size_t offsetOfLength() { return OBJECT_OFFSETOF(JSString, m_length); } >- static size_t offsetOfFlags() { return OBJECT_OFFSETOF(JSString, m_flags); } > static size_t offsetOfValue() { return OBJECT_OFFSETOF(JSString, m_value); } > > DECLARE_EXPORT_INFO; >@@ -192,37 +186,15 @@ class JSString : public JSCell { > static size_t estimatedSize(JSCell*, VM&); > static void visitChildren(JSCell*, SlotVisitor&); > >- enum { >- Is8Bit = 1u >- }; >- > protected: > friend class JSValue; > > JS_EXPORT_PRIVATE bool equalSlowCase(ExecState*, JSString* other) const; >- bool isRope() const { return m_value.isNull(); } >+ bool isRope() const { return perCellBit(); } > bool isSubstring() const; >- bool is8Bit() const { return m_flags & Is8Bit; } >- void setIs8Bit(bool flag) const >- { >- if (flag) >- m_flags |= Is8Bit; >- else >- m_flags &= ~Is8Bit; >- } >- >- ALWAYS_INLINE void setLength(unsigned length) >- { >- ASSERT(length <= MaxLength); >- m_length = length; >- } >+ bool is8Bit() const; > > private: >- // A string is represented either by a String or a rope of fibers. >- unsigned m_length { 0 }; >- mutable uint16_t m_flags { 0 }; >- // The poison is strategically placed and holds a value such that the first >- // 64 bits of JSString look like a double JSValue. > mutable String m_value; > > friend class LLIntOffsetsExtractor; >@@ -294,10 +266,35 @@ class JSRopeString final : public JSString { > size_t m_index; > }; > >+ static constexpr unsigned Is8Bit = StringImpl::flagIs8Bit(); >+ >+ inline bool is8Bit() const { return m_flags & Is8Bit; } >+ inline unsigned length() const { return m_length; } >+ > private: >+ void convertToNonRope() const >+ { >+ const_cast<JSRopeString*>(this)->setPerCellBit(false); >+ } >+ >+ void setIs8Bit(bool flag) const >+ { >+ if (flag) >+ m_flags |= Is8Bit; >+ else >+ m_flags &= ~Is8Bit; >+ } >+ >+ ALWAYS_INLINE void setLength(unsigned length) >+ { >+ ASSERT(length <= MaxLength); >+ m_length = length; >+ } >+ > ALWAYS_INLINE JSRopeString(VM& vm) > : JSString(vm) > { >+ setPerCellBit(true); > } > > void finishCreation(VM& vm, JSString* s1, JSString* s2) >@@ -403,6 +400,9 @@ class JSRopeString final : public JSString { > return createSubstringOfResolved(vm, nullptr, base, offset, length); > } > >+ static size_t offsetOfLength() { return OBJECT_OFFSETOF(JSRopeString, m_length); } >+ static size_t offsetOfFlags() { return OBJECT_OFFSETOF(JSRopeString, m_flags); } >+ > void visitFibers(SlotVisitor&); > > static ptrdiff_t offsetOfFibers() { return OBJECT_OFFSETOF(JSRopeString, u); } >@@ -479,6 +479,9 @@ class JSRopeString final : public JSString { > u[0].number = isSubstring ? substringSentinel() : notSubstringSentinel(); > } > >+ unsigned m_length { 0 }; >+ mutable unsigned m_flags { Is8Bit }; >+ > mutable union { > uintptr_t number; > WriteBarrierBase<JSString> string; >@@ -492,6 +495,16 @@ class JSRopeString final : public JSString { > > JS_EXPORT_PRIVATE JSString* jsStringWithCacheSlowCase(VM&, StringImpl&); > >+inline bool JSString::is8Bit() const >+{ >+ return isRope() ? static_cast<const JSRopeString*>(this)->is8Bit() : m_value.is8Bit(); >+} >+ >+ALWAYS_INLINE unsigned JSString::length() const >+{ >+ return isRope() ? static_cast<const JSRopeString*>(this)->length() : m_value.length(); >+} >+ > inline const StringImpl* JSString::tryGetValueImpl() const > { > return m_value.impl(); >diff --git a/Source/WTF/wtf/text/StringImpl.h b/Source/WTF/wtf/text/StringImpl.h >index bd01f2c268599dd1100ff1572c51aaad606f3d9c..8b1134d7f4ba6cca0e5909e934915091c189acb3 100644 >--- a/Source/WTF/wtf/text/StringImpl.h >+++ b/Source/WTF/wtf/text/StringImpl.h >@@ -258,10 +258,10 @@ class StringImpl : private StringImplShape { > static Expected<Ref<StringImpl>, UTF8ConversionError> tryReallocate(Ref<StringImpl>&& originalString, unsigned length, UChar*& data); > > static unsigned flagsOffset() { return OBJECT_OFFSETOF(StringImpl, m_hashAndFlags); } >- static unsigned flagIs8Bit() { return s_hashFlag8BitBuffer; } >- static unsigned flagIsAtomic() { return s_hashFlagStringKindIsAtomic; } >- static unsigned flagIsSymbol() { return s_hashFlagStringKindIsSymbol; } >- static unsigned maskStringKind() { return s_hashMaskStringKind; } >+ static constexpr unsigned flagIs8Bit() { return s_hashFlag8BitBuffer; } >+ static constexpr unsigned flagIsAtomic() { return s_hashFlagStringKindIsAtomic; } >+ static constexpr unsigned flagIsSymbol() { return s_hashFlagStringKindIsSymbol; } >+ static constexpr unsigned maskStringKind() { return s_hashMaskStringKind; } > static unsigned dataOffset() { return OBJECT_OFFSETOF(StringImpl, m_data8); } > > template<typename CharacterType, size_t inlineCapacity, typename OverflowHandler, size_t minCapacity>
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=361495">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 193546
:
360424
| 361495