nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dom/domjit-accessor-licm-expect...

9 lines
171 B
Plaintext
Raw Permalink Normal View History

[DOMJIT] Add a way for DOMJIT::Patchpoint to express effects https://bugs.webkit.org/show_bug.cgi?id=163657 Reviewed by Saam Barati. Source/JavaScriptCore: This patch introduces DOMJIT::Effect. It describes the side effects of the DOMJIT::CallDOMPatchpoint. DOMJIT::CallDOMPatchpoint can use this feature to teach the compilers about the effects. And the compilers will perform CSE based on the reported effects. As the same to B3's HeapRange, the effects are represented as a pair of integers. [begin, end) pair will represents the range of the abstract heap. We encode the abstract heap hierarchy into these pairs. Like, Root: [0, 32) Child1: [0, 20) Child2: [20, 32) Child11: [0, 4) Child12: [4, 20) This simplifies the representation of the abstract heap. And WebCore just tells pairs of integers and it does not tell any detailed hierarchy. So, DFG and FTL can optimize DOM operations without deep knowledge of the DOM abstract heap hierarchy. For example, WebCore will tell that firstChild will read Node_firstChild abstract heap. But this information is encoded to the pair and DFG does not know the details. But still DFG can understand the abstract heap hierarchy and can query whether the given abstract heap overlaps with some abstract heap. The heap range told by the WebCore is represented as DOMJIT::HeapRange. DFG will handle this under the DOMState abstract heap. DOMJIT::HeapRange is stored in DFG::AbstractHeap's Payload. We maintain the hierarchy by DOMJIT::HeapRange in the DOMState abstract heap. We add a necessary handling in DFG's AbstractHeap and ClobberSet. And we also introduce DOMStateLoc for HeapLocation. It is combined with DOMState AbstractHeap with DOMJIT::HeapRange. For example, we can represent Node.firstChild as `read(DOMState:Node_firstChild)` and `def(HeapLocation(node, DOMState:Node_firstChild))` thingy. This allows us to perform CSE onto DOM getters that will read some of DOM heap! For simplicity, we convert CallDOM from NodeVarArgs to the normal one. CallDOM is now just used for DOMJIT getter. So its children is at most 2. It may have either 1 or 2 children. If the global object is required by CallDOMPatchpoint, it has 2 children. And we changed the order of the children to further simplify the code. Before this change, the order is 1: globalObject 2: base. After this patch, the order becomes 1: base, and 2: globalObject. And the child2 may not exists if the global object is not required. We changed all the existing DOMJIT patchpoint to this form. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/PolymorphicAccess.cpp: (JSC::AccessCase::emitDOMJITGetter): * dfg/DFGAbstractHeap.cpp: (JSC::DFG::AbstractHeap::dump): * dfg/DFGAbstractHeap.h: (JSC::DFG::AbstractHeap::isStrictSubtypeOf): (JSC::DFG::AbstractHeap::overlaps): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::blessCallDOM): (JSC::DFG::ByteCodeParser::handleDOMJITGetter): * dfg/DFGClobberSet.cpp: (JSC::DFG::ClobberSet::overlaps): * dfg/DFGClobberSet.h: * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGGraph.h: * dfg/DFGHeapLocation.cpp: (WTF::printInternal): * dfg/DFGHeapLocation.h: * dfg/DFGNode.h: (JSC::DFG::Node::hasCallDOMData): (JSC::DFG::Node::callDOMData): (JSC::DFG::Node::hasCallDOMPatchpoint): Deleted. (JSC::DFG::Node::callDOMPatchpoint): Deleted. * dfg/DFGNodeType.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileCallDOM): * domjit/DOMJITAbstractHeap.cpp: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. (JSC::DOMJIT::AbstractHeap::compute): (JSC::DOMJIT::AbstractHeap::dump): (JSC::DOMJIT::AbstractHeap::shallowDump): (JSC::DOMJIT::AbstractHeap::deepDump): * domjit/DOMJITAbstractHeap.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. (JSC::DOMJIT::AbstractHeap::AbstractHeap): (JSC::DOMJIT::AbstractHeap::setParent): (JSC::DOMJIT::AbstractHeap::isRoot): (JSC::DOMJIT::AbstractHeap::isComputed): (JSC::DOMJIT::AbstractHeap::range): * domjit/DOMJITCallDOMPatchpoint.h: * domjit/DOMJITEffect.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. (JSC::DOMJIT::Effect::forReadWrite): (JSC::DOMJIT::Effect::forPure): (JSC::DOMJIT::Effect::forDef): (JSC::DOMJIT::Effect::mustGenerate): * domjit/DOMJITHeapRange.cpp: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. (JSC::DOMJIT::HeapRange::dump): * domjit/DOMJITHeapRange.h: Added. (JSC::DOMJIT::HeapRange::HeapRange): (JSC::DOMJIT::HeapRange::fromRaw): (JSC::DOMJIT::HeapRange::begin): (JSC::DOMJIT::HeapRange::end): (JSC::DOMJIT::HeapRange::rawRepresentation): (JSC::DOMJIT::HeapRange::operator bool): (JSC::DOMJIT::HeapRange::operator==): (JSC::DOMJIT::HeapRange::top): (JSC::DOMJIT::HeapRange::none): (JSC::DOMJIT::HeapRange::isStrictSubtypeOf): (JSC::DOMJIT::HeapRange::isSubtypeOf): (JSC::DOMJIT::HeapRange::overlaps): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM): * jsc.cpp: Source/WebCore: CallDOMPatchpoint now has the way to tell its effects to DFG and FTL compilers. WebCore DOMJIT::AbstractHeapRepository will construct the hierarchy of the abstract heap. And then it encodes these information into the pairs of the integers. And this patch also changes the DOMJIT::PatchpointParams' parameter order. So we change them in all the DOMJIT::CallDOMPatchpoint sites. * CMakeLists.txt: * ForwardingHeaders/domjit/DOMJITAbstractHeap.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. * ForwardingHeaders/domjit/DOMJITEffect.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. * ForwardingHeaders/domjit/DOMJITHeapRange.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. * WebCore.xcodeproj/project.pbxproj: * domjit/DOMJITAbstractHeapRepository.cpp: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. (WebCore::DOMJIT::AbstractHeapRepository::AbstractHeapRepository): (WebCore::DOMJIT::AbstractHeapRepository::instance): * domjit/DOMJITAbstractHeapRepository.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h. * domjit/DOMJITHelpers.h: (WebCore::DOMJITHelpers::branchIfNotWorldIsNormal): Deleted. (WebCore::DOMJITHelpers::branchIfNotWeakIsLive): Deleted. (WebCore::DOMJITHelpers::tryLookUpWrapperCache): Deleted. (WebCore::DOMJITHelpers::toWrapper): Deleted. (WebCore::DOMJITHelpers::branchIfDOMWrapper): Deleted. (WebCore::DOMJITHelpers::branchIfNotDOMWrapper): Deleted. (WebCore::DOMJITHelpers::branchIfNode): Deleted. (WebCore::DOMJITHelpers::branchIfNotNode): Deleted. (WebCore::DOMJITHelpers::branchIfElement): Deleted. (WebCore::DOMJITHelpers::branchIfNotElement): Deleted. (WebCore::DOMJITHelpers::branchIfDocumentWrapper): Deleted. (WebCore::DOMJITHelpers::branchIfNotDocumentWrapper): Deleted. * domjit/JSNodeDOMJIT.cpp: (WebCore::createCallDOMForOffsetAccess): (WebCore::checkNode): (WebCore::NodeFirstChildDOMJIT::checkDOM): (WebCore::NodeFirstChildDOMJIT::callDOM): (WebCore::NodeLastChildDOMJIT::checkDOM): (WebCore::NodeLastChildDOMJIT::callDOM): (WebCore::NodeNextSiblingDOMJIT::checkDOM): (WebCore::NodeNextSiblingDOMJIT::callDOM): (WebCore::NodePreviousSiblingDOMJIT::checkDOM): (WebCore::NodePreviousSiblingDOMJIT::callDOM): (WebCore::NodeParentNodeDOMJIT::checkDOM): (WebCore::NodeParentNodeDOMJIT::callDOM): (WebCore::NodeNodeTypeDOMJIT::checkDOM): (WebCore::NodeNodeTypeDOMJIT::callDOM): Source/WTF: Simplify nonEmptyRangesOverlap. * wtf/MathExtras.h: (WTF::nonEmptyRangesOverlap): LayoutTests: * js/dom/domjit-accessor-different-effect-expected.txt: Added. * js/dom/domjit-accessor-different-effect.html: Added. * js/dom/domjit-accessor-effect-expected.txt: Added. * js/dom/domjit-accessor-effect-should-overlap-with-call-expected.txt: Added. * js/dom/domjit-accessor-effect-should-overlap-with-call.html: Added. * js/dom/domjit-accessor-effect.html: Added. * js/dom/domjit-accessor-licm-expected.txt: Added. * js/dom/domjit-accessor-licm.html: Added. * js/dom/domjit-accessor-node-type-effect-should-not-overlap-with-call-since-pure-expected.txt: Added. * js/dom/domjit-accessor-node-type-effect-should-not-overlap-with-call-since-pure.html: Added. Canonical link: https://commits.webkit.org/181648@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@207787 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-10-24 23:34:32 +00:00
Test DOMJIT accessor will be LICM-ed.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS successfullyParsed is true
TEST COMPLETE