Skip to content

Commit db4dea1

Browse files
ConstellationConstellation
committed
Unreviewed, relanding 266364@main
https://bugs.webkit.org/show_bug.cgi?id=259549 rdar://112958954 Just adding missing prediction propagation rules which gets clobbered during the last patch's rebaseline. * Source/JavaScriptCore/assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::or16): * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::or16): * Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::or16): * Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h: (JSC::MacroAssemblerX86_64::or16): * Source/JavaScriptCore/bytecode/ArithProfile.cpp: (JSC::ArithProfile<BitfieldType>::emitObserveResult): (JSC::ArithProfile<BitfieldType>::emitSetDouble const): (JSC::ArithProfile<BitfieldType>::emitUnconditionalSet const): * Source/JavaScriptCore/bytecode/ArithProfile.h: (JSC::UnaryArithProfile::observedNumberBits): (JSC::UnaryArithProfile::observedNonNumberBits): * Source/JavaScriptCore/bytecode/BytecodeList.rb: * Source/JavaScriptCore/bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::binaryArithProfileForPC): (JSC::CodeBlock::unaryArithProfileForPC): * Source/JavaScriptCore/bytecode/Opcode.h: * Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitUnaryOp): (JSC::BytecodeGenerator::emitToNumber): (JSC::BytecodeGenerator::emitToNumeric): * Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::makeSafe): (JSC::DFG::ByteCodeParser::parseBlock): * Source/JavaScriptCore/dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupToNumberOrToNumericOrCallNumberConstructor): * Source/JavaScriptCore/dfg/DFGNode.h: (JSC::DFG::Node::hasHeapPrediction): * Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp: * Source/JavaScriptCore/jit/JITAddGenerator.cpp: (JSC::JITAddGenerator::generateFastPath): * Source/JavaScriptCore/jit/JITNegGenerator.cpp: (JSC::JITNegGenerator::generateFastPath): * Source/JavaScriptCore/jit/JITOpcodes.cpp: (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): * Source/JavaScriptCore/jit/JITSubGenerator.cpp: (JSC::JITSubGenerator::generateFastPath): * Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm: * Source/JavaScriptCore/llint/LowLevelInterpreter64.asm: * Source/JavaScriptCore/runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * Source/JavaScriptCore/runtime/FileBasedFuzzerAgent.cpp: (JSC::FileBasedFuzzerAgent::getPredictionInternal): * Source/JavaScriptCore/runtime/PredictionFileCreatingFuzzerAgent.cpp: (JSC::PredictionFileCreatingFuzzerAgent::getPredictionInternal): Canonical link: https://commits.webkit.org/266376@main
1 parent 2fe6aa9 commit db4dea1

23 files changed

Lines changed: 180 additions & 74 deletions

‎Source/JavaScriptCore/assembler/MacroAssemblerARM64.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1073,6 +1073,13 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
10731073
}
10741074
}
10751075

1076+
void or16(RegisterID mask, AbsoluteAddress address)
1077+
{
1078+
load16(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
1079+
m_assembler.orr<32>(dataTempRegister, dataTempRegister, mask);
1080+
store16(dataTempRegister, address.m_ptr);
1081+
}
1082+
10761083
void or32(RegisterID src, RegisterID dest)
10771084
{
10781085
or32(dest, src, dest);

‎Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,6 +453,13 @@ class MacroAssemblerARMv7 : public AbstractMacroAssembler<Assembler> {
453453
}
454454
}
455455

456+
void or16(RegisterID mask, AbsoluteAddress dest)
457+
{
458+
load16(setupArmAddress(dest), dataTempRegister);
459+
m_assembler.orr(dataTempRegister, dataTempRegister, mask);
460+
store16(dataTempRegister, Address(addressTempRegister));
461+
}
462+
456463
void or32(RegisterID src, RegisterID dest)
457464
{
458465
m_assembler.orr(dest, dest, src);

‎Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,13 @@ class MacroAssemblerMIPS : public AbstractMacroAssembler<Assembler> {
515515
}
516516
}
517517

518+
void or16(RegisterID mask, AbsoluteAddress dest)
519+
{
520+
load16(dest.m_ptr, immTempRegister);
521+
or32(mask, immTempRegister);
522+
store16(immTempRegister, dest.m_ptr);
523+
}
524+
518525
void or32(RegisterID src, RegisterID dest)
519526
{
520527
m_assembler.orInsn(dest, dest, src);

‎Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,12 @@ class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
9797
or16(imm, Address(scratchRegister()));
9898
}
9999

100+
void or16(RegisterID mask, AbsoluteAddress address)
101+
{
102+
move(TrustedImmPtr(address.m_ptr), scratchRegister());
103+
or16(mask, Address(scratchRegister()));
104+
}
105+
100106
void sub32(TrustedImm32 imm, AbsoluteAddress address)
101107
{
102108
move(TrustedImmPtr(address.m_ptr), scratchRegister());

‎Source/JavaScriptCore/bytecode/ArithProfile.cpp‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ void ArithProfile<BitfieldType>::emitObserveResult(CCallHelpers& jit, JSValueReg
4343

4444
done.append(jit.branchIfInt32(regs, mode));
4545
CCallHelpers::Jump notDouble = jit.branchIfNotDoubleKnownNotInt32(regs, mode);
46-
emitSetDouble(jit);
46+
emitSetDouble(jit, tempGPR);
4747
done.append(jit.jump());
4848

4949
notDouble.link(&jit);
@@ -76,10 +76,17 @@ bool ArithProfile<BitfieldType>::shouldEmitSetDouble() const
7676
}
7777

7878
template<typename BitfieldType>
79-
void ArithProfile<BitfieldType>::emitSetDouble(CCallHelpers& jit) const
79+
void ArithProfile<BitfieldType>::emitSetDouble(CCallHelpers& jit, GPRReg scratchGPR) const
8080
{
81-
if (shouldEmitSetDouble())
81+
if (shouldEmitSetDouble()) {
82+
#if CPU(ARM64)
83+
jit.move(CCallHelpers::TrustedImm32(ObservedResults::Int32Overflow | ObservedResults::Int52Overflow | ObservedResults::NegZeroDouble | ObservedResults::NonNegZeroDouble), scratchGPR);
84+
emitUnconditionalSet(jit, scratchGPR);
85+
#else
86+
UNUSED_PARAM(scratchGPR);
8287
emitUnconditionalSet(jit, ObservedResults::Int32Overflow | ObservedResults::Int52Overflow | ObservedResults::NegZeroDouble | ObservedResults::NonNegZeroDouble);
88+
#endif
89+
}
8390
}
8491

8592
template<typename BitfieldType>
@@ -137,6 +144,12 @@ void ArithProfile<BitfieldType>::emitUnconditionalSet(CCallHelpers& jit, Bitfiel
137144
jit.or16(CCallHelpers::TrustedImm32(mask), CCallHelpers::AbsoluteAddress(addressOfBits()));
138145
}
139146

147+
template<typename BitfieldType>
148+
void ArithProfile<BitfieldType>::emitUnconditionalSet(CCallHelpers& jit, GPRReg mask) const
149+
{
150+
jit.or16(mask, CCallHelpers::AbsoluteAddress(addressOfBits()));
151+
}
152+
140153
// Generate the implementations of the functions above for UnaryArithProfile/BinaryArithProfile
141154
// If changing the size of either, add the corresponding lines here.
142155
template class ArithProfile<uint16_t>;

‎Source/JavaScriptCore/bytecode/ArithProfile.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ class ArithProfile {
153153

154154
// Sets (Int32Overflow | Int52Overflow | NonNegZeroDouble | NegZeroDouble).
155155
bool shouldEmitSetDouble() const;
156-
void emitSetDouble(CCallHelpers&) const;
156+
void emitSetDouble(CCallHelpers&, GPRReg scratchGPR) const;
157157

158158
void emitSetNonNumeric(CCallHelpers&) const;
159159
bool shouldEmitSetNonNumeric() const;
@@ -167,6 +167,7 @@ class ArithProfile {
167167
#endif
168168

169169
void emitUnconditionalSet(CCallHelpers&, BitfieldType) const;
170+
void emitUnconditionalSet(CCallHelpers&, GPRReg) const;
170171
#endif // ENABLE(JIT)
171172

172173
constexpr uint32_t bits() const { return m_bits; }
@@ -214,6 +215,12 @@ class UnaryArithProfile : public ArithProfile<UnaryArithProfileBase> {
214215
constexpr UnaryArithProfileBase bits = observedNumber.bits() << argObservedTypeShift;
215216
return bits;
216217
}
218+
static constexpr UnaryArithProfileBase observedNonNumberBits()
219+
{
220+
constexpr ObservedType observedNumber { ObservedType().withNonNumber() };
221+
constexpr UnaryArithProfileBase bits = observedNumber.bits() << argObservedTypeShift;
222+
return bits;
223+
}
217224

218225
constexpr ObservedType argObservedType() const { return ObservedType((m_bits >> argObservedTypeShift) & observedTypeMask); }
219226
void setArgObservedType(ObservedType type)

‎Source/JavaScriptCore/bytecode/BytecodeList.rb‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -278,19 +278,6 @@
278278
profile: ValueProfile,
279279
}
280280

281-
op_group :ValueProfiledUnaryOp,
282-
[
283-
:to_number,
284-
:to_numeric,
285-
],
286-
args: {
287-
dst: VirtualRegister,
288-
operand: VirtualRegister,
289-
},
290-
metadata: {
291-
profile: ValueProfile,
292-
}
293-
294281
op :tail_call,
295282
args: {
296283
dst: VirtualRegister,
@@ -1380,6 +1367,17 @@
13801367
flags: unsigned,
13811368
}
13821369

1370+
op_group :ProfiledUnaryOp,
1371+
[
1372+
:to_number,
1373+
:to_numeric,
1374+
],
1375+
args: {
1376+
dst: VirtualRegister,
1377+
operand: VirtualRegister,
1378+
profileIndex: unsigned,
1379+
}
1380+
13831381
end_section :Bytecode
13841382

13851383
begin_section :CLoopHelpers,

‎Source/JavaScriptCore/bytecode/CodeBlock.cpp‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -477,8 +477,6 @@ bool CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, Unlink
477477
LINK(OpGetByValWithThis, profile)
478478
LINK(OpGetPrototypeOf, profile)
479479
LINK(OpGetFromArguments, profile)
480-
LINK(OpToNumber, profile)
481-
LINK(OpToNumeric, profile)
482480
LINK(OpToObject, profile)
483481
LINK(OpGetArgument, profile)
484482
LINK(OpGetInternalField, profile)
@@ -3298,14 +3296,15 @@ UnaryArithProfile* CodeBlock::unaryArithProfileForBytecodeIndex(BytecodeIndex by
32983296
BinaryArithProfile* CodeBlock::binaryArithProfileForPC(const JSInstruction* pc)
32993297
{
33003298
switch (pc->opcodeID()) {
3301-
case op_add:
3302-
return &unlinkedCodeBlock()->binaryArithProfile(pc->as<OpAdd>().m_profileIndex);
3303-
case op_mul:
3304-
return &unlinkedCodeBlock()->binaryArithProfile(pc->as<OpMul>().m_profileIndex);
3305-
case op_sub:
3306-
return &unlinkedCodeBlock()->binaryArithProfile(pc->as<OpSub>().m_profileIndex);
3307-
case op_div:
3308-
return &unlinkedCodeBlock()->binaryArithProfile(pc->as<OpDiv>().m_profileIndex);
3299+
3300+
#define CASE(Op) \
3301+
case Op::opcodeID: \
3302+
return &unlinkedCodeBlock()->binaryArithProfile(pc->as<Op>().m_profileIndex);
3303+
3304+
FOR_EACH_OPCODE_WITH_BINARY_ARITH_PROFILE(CASE)
3305+
3306+
#undef CASE
3307+
33093308
default:
33103309
break;
33113310
}
@@ -3316,17 +3315,19 @@ BinaryArithProfile* CodeBlock::binaryArithProfileForPC(const JSInstruction* pc)
33163315
UnaryArithProfile* CodeBlock::unaryArithProfileForPC(const JSInstruction* pc)
33173316
{
33183317
switch (pc->opcodeID()) {
3319-
case op_negate:
3320-
return &unlinkedCodeBlock()->unaryArithProfile(pc->as<OpNegate>().m_profileIndex);
3321-
case op_inc:
3322-
return &unlinkedCodeBlock()->unaryArithProfile(pc->as<OpInc>().m_profileIndex);
3323-
case op_dec:
3324-
return &unlinkedCodeBlock()->unaryArithProfile(pc->as<OpDec>().m_profileIndex);
3318+
3319+
#define CASE(Op) \
3320+
case Op::opcodeID: \
3321+
return &unlinkedCodeBlock()->unaryArithProfile(pc->as<Op>().m_profileIndex);
3322+
3323+
FOR_EACH_OPCODE_WITH_UNARY_ARITH_PROFILE(CASE)
3324+
3325+
#undef CASE
3326+
33253327
default:
3326-
break;
3327-
}
3328+
return nullptr;
33283329

3329-
return nullptr;
3330+
}
33303331
}
33313332

33323333
bool CodeBlock::couldTakeSpecialArithFastCase(BytecodeIndex bytecodeIndex)

‎Source/JavaScriptCore/bytecode/Opcode.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,6 @@ static constexpr unsigned bitWidthForMaxBytecodeStructLength = WTF::getMSBSetCon
110110
macro(OpGetByValWithThis) \
111111
macro(OpGetPrototypeOf) \
112112
macro(OpGetFromArguments) \
113-
macro(OpToNumber) \
114-
macro(OpToNumeric) \
115113
macro(OpToObject) \
116114
macro(OpGetArgument) \
117115
macro(OpGetInternalField) \
@@ -175,6 +173,8 @@ static constexpr unsigned bitWidthForMaxBytecodeStructLength = WTF::getMSBSetCon
175173
macro(OpInc) \
176174
macro(OpDec) \
177175
macro(OpNegate) \
176+
macro(OpToNumber) \
177+
macro(OpToNumeric) \
178178

179179

180180
IGNORE_WARNINGS_BEGIN("type-limits")

‎Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1641,10 +1641,10 @@ RegisterID* BytecodeGenerator::emitUnaryOp(OpcodeID opcodeID, RegisterID* dst, R
16411641
emitUnaryOp<OpBitnot>(dst, src);
16421642
break;
16431643
case op_to_number:
1644-
emitUnaryOp<OpToNumber>(dst, src);
1644+
OpToNumber::emit(this, dst, src, m_codeBlock->addUnaryArithProfile());
16451645
break;
16461646
case op_to_numeric:
1647-
emitUnaryOp<OpToNumeric>(dst, src);
1647+
OpToNumeric::emit(this, dst, src, m_codeBlock->addUnaryArithProfile());
16481648
break;
16491649
default:
16501650
ASSERT_NOT_REACHED();
@@ -1713,12 +1713,14 @@ RegisterID* BytecodeGenerator::emitToObject(RegisterID* dst, RegisterID* src, co
17131713

17141714
RegisterID* BytecodeGenerator::emitToNumber(RegisterID* dst, RegisterID* src)
17151715
{
1716-
return emitUnaryOp<OpToNumber>(dst, src);
1716+
OpToNumber::emit(this, dst, src, m_codeBlock->addUnaryArithProfile());
1717+
return dst;
17171718
}
17181719

17191720
RegisterID* BytecodeGenerator::emitToNumeric(RegisterID* dst, RegisterID* src)
17201721
{
1721-
return emitUnaryOp<OpToNumeric>(dst, src);
1722+
OpToNumeric::emit(this, dst, src, m_codeBlock->addUnaryArithProfile());
1723+
return dst;
17221724
}
17231725

17241726
RegisterID* BytecodeGenerator::emitToString(RegisterID* dst, RegisterID* src)

0 commit comments

Comments
 (0)