- Revision
- 239141
- Author
- yusukesuz...@slowstart.org
- Date
- 2018-12-12 18:01:37 -0800 (Wed, 12 Dec 2018)
Log Message
[BigInt] Implement DFG/FTL typeof for BigInt
https://bugs.webkit.org/show_bug.cgi?id=192619
Reviewed by Keith Miller.
JSTests:
* stress/big-int-boolean-proven-type.js: Added.
(assert):
(bool):
* stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
(assert):
(typeOf):
(i.switch):
* stress/big-int-type-of-proven-type-non-constant.js: Added.
(assert):
(typeOf):
* stress/big-int-type-of.js:
(typeOf):
(func):
Source/_javascript_Core:
This patch implements typeof for BigInt in DFG and FTL. Our DFG and FTL tiers now correctly consider about BigInt
in the code generated for typeof.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::boolify): We add (SpecCell - SpecString) type filter for proven type since isString
check is already performed here.
(JSC::FTL::DFG::LowerDFGToB3::buildTypeOf): We use (SpecCell - SpecObject - SpecString) type filter for proven type
since String and Object are already checked here. If we know the proven type does not include Symbol type here, we
can omit the code for Symbol type.
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::emitTypeOf):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (239140 => 239141)
--- trunk/JSTests/ChangeLog 2018-12-13 01:32:58 UTC (rev 239140)
+++ trunk/JSTests/ChangeLog 2018-12-13 02:01:37 UTC (rev 239141)
@@ -1,3 +1,24 @@
+2018-12-12 Yusuke Suzuki <yusukesuz...@slowstart.org>
+
+ [BigInt] Implement DFG/FTL typeof for BigInt
+ https://bugs.webkit.org/show_bug.cgi?id=192619
+
+ Reviewed by Keith Miller.
+
+ * stress/big-int-boolean-proven-type.js: Added.
+ (assert):
+ (bool):
+ * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
+ (assert):
+ (typeOf):
+ (i.switch):
+ * stress/big-int-type-of-proven-type-non-constant.js: Added.
+ (assert):
+ (typeOf):
+ * stress/big-int-type-of.js:
+ (typeOf):
+ (func):
+
2018-12-10 Mark Lam <mark....@apple.com>
PropertyAttribute needs a CustomValue bit.
Added: trunk/JSTests/stress/big-int-boolean-proven-type.js (0 => 239141)
--- trunk/JSTests/stress/big-int-boolean-proven-type.js (rev 0)
+++ trunk/JSTests/stress/big-int-boolean-proven-type.js 2018-12-13 02:01:37 UTC (rev 239141)
@@ -0,0 +1,21 @@
+//@ runBigIntEnabled
+
+function assert(a) {
+ if (!a)
+ throw new Error("Bad assertion");
+}
+
+function bool(n) {
+ var value = "string";
+ if (n & 0x1)
+ value = 0n;
+ return !!value;
+}
+noInline(bool);
+
+for (let i = 0; i < 1e6; i++) {
+ if (i & 0x1)
+ assert(bool(i) === false);
+ else
+ assert(bool(i) === true);
+}
Added: trunk/JSTests/stress/big-int-type-of-proven-type-non-constant-including-symbol.js (0 => 239141)
--- trunk/JSTests/stress/big-int-type-of-proven-type-non-constant-including-symbol.js (rev 0)
+++ trunk/JSTests/stress/big-int-type-of-proven-type-non-constant-including-symbol.js 2018-12-13 02:01:37 UTC (rev 239141)
@@ -0,0 +1,33 @@
+//@ runBigIntEnabled
+
+function assert(a) {
+ if (!a)
+ throw new Error("Bad assertion");
+}
+
+function typeOf(n) {
+ var value = "string";
+ var dispatcher = n % 3;
+ if (dispatcher === 0)
+ value = 1n;
+ else if (dispatcher === 1)
+ value = "string";
+ else
+ value = Symbol("symbol");
+ return typeof value;
+}
+noInline(typeOf);
+
+for (let i = 0; i < 1e6; i++) {
+ switch (i % 3) {
+ case 0:
+ assert(typeOf(i) === "bigint");
+ break;
+ case 1:
+ assert(typeOf(i) === "string");
+ break;
+ case 2:
+ assert(typeOf(i) === "symbol");
+ break;
+ }
+}
Added: trunk/JSTests/stress/big-int-type-of-proven-type-non-constant.js (0 => 239141)
--- trunk/JSTests/stress/big-int-type-of-proven-type-non-constant.js (rev 0)
+++ trunk/JSTests/stress/big-int-type-of-proven-type-non-constant.js 2018-12-13 02:01:37 UTC (rev 239141)
@@ -0,0 +1,21 @@
+//@ runBigIntEnabled
+
+function assert(a) {
+ if (!a)
+ throw new Error("Bad assertion");
+}
+
+function typeOf(n) {
+ var value = "string";
+ if (n & 0x1)
+ value = 1n;
+ return typeof value;
+}
+noInline(typeOf);
+
+for (let i = 0; i < 1e6; i++) {
+ if (i & 0x1)
+ assert(typeOf(i) === "bigint");
+ else
+ assert(typeOf(i) === "string");
+}
Modified: trunk/JSTests/stress/big-int-type-of.js (239140 => 239141)
--- trunk/JSTests/stress/big-int-type-of.js 2018-12-13 01:32:58 UTC (rev 239140)
+++ trunk/JSTests/stress/big-int-type-of.js 2018-12-13 02:01:37 UTC (rev 239141)
@@ -8,3 +8,27 @@
assert(typeof 0n === "bigint");
assert(typeof 1n !== "object");
+function typeOf(value)
+{
+ return typeof value;
+}
+noInline(typeOf);
+
+var object = {};
+var func = function () { };
+var bigInt = 1n;
+var number = 0;
+var string = "String";
+var symbol = Symbol("Symbol");
+
+for (var i = 0; i < 1e6; ++i) {
+ assert(typeOf(object) === "object");
+ assert(typeOf(func) === "function");
+ assert(typeOf(bigInt) === "bigint");
+ assert(typeOf(number) === "number");
+ assert(typeOf(string) === "string");
+ assert(typeOf(symbol) === "symbol");
+ assert(typeOf(null) === "object");
+ assert(typeOf(undefined) === "undefined");
+ assert(typeOf(true) === "boolean");
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (239140 => 239141)
--- trunk/Source/_javascript_Core/ChangeLog 2018-12-13 01:32:58 UTC (rev 239140)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-12-13 02:01:37 UTC (rev 239141)
@@ -1,3 +1,22 @@
+2018-12-12 Yusuke Suzuki <yusukesuz...@slowstart.org>
+
+ [BigInt] Implement DFG/FTL typeof for BigInt
+ https://bugs.webkit.org/show_bug.cgi?id=192619
+
+ Reviewed by Keith Miller.
+
+ This patch implements typeof for BigInt in DFG and FTL. Our DFG and FTL tiers now correctly consider about BigInt
+ in the code generated for typeof.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::boolify): We add (SpecCell - SpecString) type filter for proven type since isString
+ check is already performed here.
+ (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf): We use (SpecCell - SpecObject - SpecString) type filter for proven type
+ since String and Object are already checked here. If we know the proven type does not include Symbol type here, we
+ can omit the code for Symbol type.
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::emitTypeOf):
+
2018-12-11 Yusuke Suzuki <yusukesuz...@slowstart.org>
[BigInt] Simplify boolean context evaluation by leveraging JSString::offsetOfLength() == JSBigInt::offsetOfLength()
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (239140 => 239141)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2018-12-13 01:32:58 UTC (rev 239140)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2018-12-13 02:01:37 UTC (rev 239141)
@@ -13626,7 +13626,7 @@
m_out.appendTo(notStringCase, stringOrBigIntCase);
m_out.branch(
- isBigInt(value, provenType(edge) & SpecCell),
+ isBigInt(value, provenType(edge) & (SpecCell - SpecString)),
unsure(stringOrBigIntCase), unsure(notStringOrBigIntCase));
m_out.appendTo(stringOrBigIntCase, notStringOrBigIntCase);
@@ -14217,6 +14217,8 @@
// }
// } else if (is string) {
// return string
+ // } else if (is bigint) {
+ // return bigint
// } else {
// return symbol
// }
@@ -14229,6 +14231,10 @@
// } else {
// return undefined
// }
+ //
+ // FIXME: typeof Symbol should be more frequently seen than BigInt.
+ // We should change the order of type detection based on this frequency.
+ // https://bugs.webkit.org/show_bug.cgi?id=192650
LBasicBlock cellCase = m_out.newBlock();
LBasicBlock objectCase = m_out.newBlock();
@@ -14239,6 +14245,8 @@
LBasicBlock unreachable = m_out.newBlock();
LBasicBlock notObjectCase = m_out.newBlock();
LBasicBlock stringCase = m_out.newBlock();
+ LBasicBlock notStringCase = m_out.newBlock();
+ LBasicBlock bigIntCase = m_out.newBlock();
LBasicBlock symbolCase = m_out.newBlock();
LBasicBlock notCellCase = m_out.newBlock();
LBasicBlock numberCase = m_out.newBlock();
@@ -14288,10 +14296,18 @@
m_out.appendTo(notObjectCase, stringCase);
m_out.branch(
isString(value, provenType(child) & (SpecCell - SpecObject)),
- unsure(stringCase), unsure(symbolCase));
+ unsure(stringCase), unsure(notStringCase));
- m_out.appendTo(stringCase, symbolCase);
+ m_out.appendTo(stringCase, notStringCase);
functor(TypeofType::String);
+
+ m_out.appendTo(notStringCase, bigIntCase);
+ m_out.branch(
+ isBigInt(value, provenType(child) & (SpecCell - SpecObject - SpecString)),
+ unsure(bigIntCase), unsure(symbolCase));
+
+ m_out.appendTo(bigIntCase, symbolCase);
+ functor(TypeofType::BigInt);
m_out.appendTo(symbolCase, notCellCase);
functor(TypeofType::Symbol);
Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.h (239140 => 239141)
--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2018-12-13 01:32:58 UTC (rev 239140)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2018-12-13 02:01:37 UTC (rev 239141)
@@ -1654,6 +1654,8 @@
// }
// } else if (is string) {
// return string
+ // } else if (is bigint) {
+ // return bigint
// } else {
// return symbol
// }
@@ -1666,6 +1668,10 @@
// } else {
// return undefined
// }
+ //
+ // FIXME: typeof Symbol should be more frequently seen than BigInt.
+ // We should change the order of type detection based on this frequency.
+ // https://bugs.webkit.org/show_bug.cgi?id=192650
Jump notCell = branchIfNotCell(regs);
@@ -1687,7 +1693,13 @@
Jump notString = branchIfNotString(cellGPR);
functor(TypeofType::String, false);
+
notString.link(this);
+
+ Jump notBigInt = branchIfNotBigInt(cellGPR);
+ functor(TypeofType::BigInt, false);
+
+ notBigInt.link(this);
functor(TypeofType::Symbol, false);
notCell.link(this);
