Skip to content

Commit b807f03

Browse files
ConstellationConstellation
committed
[JSC] Support @@species in ArrayBuffer / SharedArrayBuffer slice
https://bugs.webkit.org/show_bug.cgi?id=218697 Reviewed by Ross Kirsling. JSTests: * test262/expectations.yaml: Source/JavaScriptCore: This patch adds support for @@species in ArrayBuffer/SharedArrayBuffer.prototype.slice. We leverage the mechanism similar to Array's @@species handling: adding fast path with watchpoint. When we found that some of critical properties (e.g. %Prototype%.constructor, %Constructor%[@@species]) are modified, watchpoint is fired and we go to the slow path. Until that, we use fast path that is basically the same to the code before this patch. * runtime/ArrayBuffer.cpp: (JSC::ArrayBuffer::slice const): (JSC::ArrayBuffer::sliceWithClampedIndex const): (JSC::ArrayBuffer::sliceImpl const): Deleted. * runtime/ArrayBuffer.h: * runtime/ArrayBufferSharingMode.h: * runtime/ArrayPrototype.cpp: (JSC::speciesWatchpointIsValid): * runtime/JSArrayBufferPrototype.cpp: (JSC::speciesWatchpointIsValid): (JSC::arrayBufferSlice): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::JSGlobalObject): (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildren): (JSC::JSGlobalObject::tryInstallSpeciesWatchpoint): (JSC::JSGlobalObject::tryInstallArraySpeciesWatchpoint): (JSC::JSGlobalObject::tryInstallArrayBufferSpeciesWatchpoint): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::arrayBufferSpeciesWatchpointSet): (JSC::JSGlobalObject::arrayBufferPrototype const): (JSC::JSGlobalObject::arrayBufferStructure const): (JSC::JSGlobalObject::arrayBufferConstructor const): Source/WTF: Remove ENABLE(SHARED_ARRAY_BUFFER) flag. We use Options::useSharedArrayBuffer() runtime flag instead. * wtf/PlatformEnable.h: Canonical link: https://commits.webkit.org/231365@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269574 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent cfd7395 commit b807f03

12 files changed

Lines changed: 317 additions & 143 deletions

File tree

‎JSTests/ChangeLog‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
2020-11-08 Yusuke Suzuki <ysuzuki@apple.com>
2+
3+
[JSC] Support @@species in ArrayBuffer / SharedArrayBuffer slice
4+
https://bugs.webkit.org/show_bug.cgi?id=218697
5+
6+
Reviewed by Ross Kirsling.
7+
8+
* test262/expectations.yaml:
9+
110
2020-11-06 Dmitry Bezhetskov <dbezhetskov@igalia.com>
211

312
[WASM-References] Rename anyref to externref

‎JSTests/test262/expectations.yaml‎

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -603,30 +603,6 @@ test/annexB/language/global-code/switch-dflt-global-skip-early-err-try.js:
603603
default: 'Test262Error: An initialized binding is not created prior to evaluation Expected a ReferenceError to be thrown but no exception was thrown at all'
604604
test/annexB/language/global-code/switch-dflt-global-skip-early-err.js:
605605
default: "SyntaxError: Cannot declare a function that shadows a let/const/class/function variable 'f' in strict mode."
606-
test/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-not-object.js:
607-
default: 'Test262Error: `constructor` value is null Expected a TypeError to be thrown but no exception was thrown at all'
608-
strict mode: 'Test262Error: `constructor` value is null Expected a TypeError to be thrown but no exception was thrown at all'
609-
test/built-ins/ArrayBuffer/prototype/slice/species-is-not-constructor.js:
610-
default: 'Test262Error: `constructor[Symbol.species]` value is Object Expected a TypeError to be thrown but no exception was thrown at all'
611-
strict mode: 'Test262Error: `constructor[Symbol.species]` value is Object Expected a TypeError to be thrown but no exception was thrown at all'
612-
test/built-ins/ArrayBuffer/prototype/slice/species-is-not-object.js:
613-
default: 'Test262Error: `constructor[Symbol.species]` value is Boolean Expected a TypeError to be thrown but no exception was thrown at all'
614-
strict mode: 'Test262Error: `constructor[Symbol.species]` value is Boolean Expected a TypeError to be thrown but no exception was thrown at all'
615-
test/built-ins/ArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js:
616-
default: 'Test262Error: Expected SameValue(«8», «10») to be true'
617-
strict mode: 'Test262Error: Expected SameValue(«8», «10») to be true'
618-
test/built-ins/ArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js:
619-
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
620-
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
621-
test/built-ins/ArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js:
622-
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
623-
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
624-
test/built-ins/ArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js:
625-
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
626-
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
627-
test/built-ins/ArrayBuffer/prototype/slice/species.js:
628-
default: 'Test262Error: Expected SameValue(«[object ArrayBuffer]», «undefined») to be true'
629-
strict mode: 'Test262Error: Expected SameValue(«[object ArrayBuffer]», «undefined») to be true'
630606
test/built-ins/Date/UTC/fp-evaluation-order.js:
631607
default: 'Test262Error: order of operations / precision in MakeTime Expected SameValue(«NaN», «29312») to be true'
632608
strict mode: 'Test262Error: order of operations / precision in MakeTime Expected SameValue(«NaN», «29312») to be true'
@@ -847,30 +823,6 @@ test/built-ins/RegExp/prototype/exec/u-lastindex-adv.js:
847823
test/built-ins/RegExp/quantifier-integer-limit.js:
848824
default: 'SyntaxError: Invalid regular expression: number too large in {} quantifier'
849825
strict mode: 'SyntaxError: Invalid regular expression: number too large in {} quantifier'
850-
test/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js:
851-
default: 'Test262Error: `constructor` value is null Expected a TypeError to be thrown but no exception was thrown at all'
852-
strict mode: 'Test262Error: `constructor` value is null Expected a TypeError to be thrown but no exception was thrown at all'
853-
test/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js:
854-
default: 'Test262Error: `constructor[Symbol.species]` value is Object Expected a TypeError to be thrown but no exception was thrown at all'
855-
strict mode: 'Test262Error: `constructor[Symbol.species]` value is Object Expected a TypeError to be thrown but no exception was thrown at all'
856-
test/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js:
857-
default: 'Test262Error: `constructor[Symbol.species]` value is Boolean Expected a TypeError to be thrown but no exception was thrown at all'
858-
strict mode: 'Test262Error: `constructor[Symbol.species]` value is Boolean Expected a TypeError to be thrown but no exception was thrown at all'
859-
test/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js:
860-
default: 'Test262Error: Expected SameValue(«8», «10») to be true'
861-
strict mode: 'Test262Error: Expected SameValue(«8», «10») to be true'
862-
test/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js:
863-
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
864-
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
865-
test/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js:
866-
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
867-
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
868-
test/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js:
869-
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
870-
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
871-
test/built-ins/SharedArrayBuffer/prototype/slice/species.js:
872-
default: 'Test262Error: Expected SameValue(«[object SharedArrayBuffer]», «undefined») to be true'
873-
strict mode: 'Test262Error: Expected SameValue(«[object SharedArrayBuffer]», «undefined») to be true'
874826
test/built-ins/TypedArray/prototype/every/callbackfn-detachbuffer.js:
875827
default: 'Test262Error: Expected a TypeError but got a Test262Error (Testing with Float64Array.)'
876828
strict mode: 'Test262Error: Expected a TypeError but got a Test262Error (Testing with Float64Array.)'
@@ -2745,9 +2697,6 @@ test/language/statements/class/method/forbidden-ext/b2/cls-decl-meth-forbidden-e
27452697
default: 'TypeError: Function.caller used to retrieve strict caller'
27462698
test/language/statements/class/method/forbidden-ext/b2/cls-decl-meth-forbidden-ext-indirect-access-prop-caller.js:
27472699
default: 'TypeError: Function.caller used to retrieve strict caller'
2748-
test/language/statements/class/subclass/builtin-objects/ArrayBuffer/regular-subclassing.js:
2749-
default: 'Test262Error: Expected true but got false'
2750-
strict mode: 'Test262Error: Expected true but got false'
27512700
test/language/statements/const/dstr/ary-init-iter-get-err-array-prototype.js:
27522701
default: 'TypeError: Spread syntax requires ...iterable[Symbol.iterator] to be a function'
27532702
strict mode: 'TypeError: Spread syntax requires ...iterable[Symbol.iterator] to be a function'

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,40 @@
1+
2020-11-08 Yusuke Suzuki <ysuzuki@apple.com>
2+
3+
[JSC] Support @@species in ArrayBuffer / SharedArrayBuffer slice
4+
https://bugs.webkit.org/show_bug.cgi?id=218697
5+
6+
Reviewed by Ross Kirsling.
7+
8+
This patch adds support for @@species in ArrayBuffer/SharedArrayBuffer.prototype.slice.
9+
We leverage the mechanism similar to Array's @@species handling: adding fast path with watchpoint.
10+
When we found that some of critical properties (e.g. %Prototype%.constructor, %Constructor%[@@species])
11+
are modified, watchpoint is fired and we go to the slow path. Until that, we use fast path that is
12+
basically the same to the code before this patch.
13+
14+
* runtime/ArrayBuffer.cpp:
15+
(JSC::ArrayBuffer::slice const):
16+
(JSC::ArrayBuffer::sliceWithClampedIndex const):
17+
(JSC::ArrayBuffer::sliceImpl const): Deleted.
18+
* runtime/ArrayBuffer.h:
19+
* runtime/ArrayBufferSharingMode.h:
20+
* runtime/ArrayPrototype.cpp:
21+
(JSC::speciesWatchpointIsValid):
22+
* runtime/JSArrayBufferPrototype.cpp:
23+
(JSC::speciesWatchpointIsValid):
24+
(JSC::arrayBufferSlice):
25+
* runtime/JSGlobalObject.cpp:
26+
(JSC::JSGlobalObject::JSGlobalObject):
27+
(JSC::JSGlobalObject::init):
28+
(JSC::JSGlobalObject::visitChildren):
29+
(JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):
30+
(JSC::JSGlobalObject::tryInstallArraySpeciesWatchpoint):
31+
(JSC::JSGlobalObject::tryInstallArrayBufferSpeciesWatchpoint):
32+
* runtime/JSGlobalObject.h:
33+
(JSC::JSGlobalObject::arrayBufferSpeciesWatchpointSet):
34+
(JSC::JSGlobalObject::arrayBufferPrototype const):
35+
(JSC::JSGlobalObject::arrayBufferStructure const):
36+
(JSC::JSGlobalObject::arrayBufferConstructor const):
37+
138
2020-11-06 Dmitry Bezhetskov <dbezhetskov@igalia.com>
239

340
[WASM-References] Rename anyref to externref

‎Source/JavaScriptCore/runtime/ArrayBuffer.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -311,15 +311,15 @@ unsigned ArrayBuffer::clampIndex(double index) const
311311

312312
RefPtr<ArrayBuffer> ArrayBuffer::slice(double begin, double end) const
313313
{
314-
return sliceImpl(clampIndex(begin), clampIndex(end));
314+
return sliceWithClampedIndex(clampIndex(begin), clampIndex(end));
315315
}
316316

317317
RefPtr<ArrayBuffer> ArrayBuffer::slice(double begin) const
318318
{
319-
return sliceImpl(clampIndex(begin), byteLength());
319+
return sliceWithClampedIndex(clampIndex(begin), byteLength());
320320
}
321321

322-
RefPtr<ArrayBuffer> ArrayBuffer::sliceImpl(unsigned begin, unsigned end) const
322+
RefPtr<ArrayBuffer> ArrayBuffer::sliceWithClampedIndex(unsigned begin, unsigned end) const
323323
{
324324
unsigned size = begin <= end ? end - begin : 0;
325325
auto result = ArrayBuffer::tryCreate(static_cast<const char*>(data()) + begin, size);

‎Source/JavaScriptCore/runtime/ArrayBuffer.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ class ArrayBuffer : public GCIncomingRefCounted<ArrayBuffer> {
137137

138138
JS_EXPORT_PRIVATE RefPtr<ArrayBuffer> slice(double begin, double end) const;
139139
JS_EXPORT_PRIVATE RefPtr<ArrayBuffer> slice(double begin) const;
140+
JS_EXPORT_PRIVATE RefPtr<ArrayBuffer> sliceWithClampedIndex(unsigned begin, unsigned end) const;
140141

141142
inline void pin();
142143
inline void unpin();
@@ -164,7 +165,6 @@ class ArrayBuffer : public GCIncomingRefCounted<ArrayBuffer> {
164165
static Ref<ArrayBuffer> createInternal(ArrayBufferContents&&, const void*, unsigned);
165166
static RefPtr<ArrayBuffer> tryCreate(unsigned numElements, unsigned elementByteSize, ArrayBufferContents::InitializationPolicy);
166167
ArrayBuffer(ArrayBufferContents&&);
167-
RefPtr<ArrayBuffer> sliceImpl(unsigned begin, unsigned end) const;
168168
inline unsigned clampIndex(double index) const;
169169
static inline unsigned clampValue(double x, unsigned left, unsigned right);
170170

‎Source/JavaScriptCore/runtime/ArrayBufferSharingMode.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@
3030

3131
namespace JSC {
3232

33-
enum class ArrayBufferSharingMode {
34-
Default,
33+
enum class ArrayBufferSharingMode : uint8_t {
34+
Default = 0,
3535
Shared
3636
};
3737

‎Source/JavaScriptCore/runtime/ArrayPrototype.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ namespace ArrayPrototypeInternal {
186186
static bool verbose = false;
187187
}
188188

189-
ALWAYS_INLINE bool speciesWatchpointIsValid(VM& vm, JSObject* thisObject)
189+
static ALWAYS_INLINE bool speciesWatchpointIsValid(VM& vm, JSObject* thisObject)
190190
{
191191
JSGlobalObject* globalObject = thisObject->globalObject(vm);
192192
ArrayPrototype* arrayPrototype = globalObject->arrayPrototype();

0 commit comments

Comments
 (0)