Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
implement dynamic scope accesses in the DFG/FTL
https://bugs.webkit.org/show_bug.cgi?id=156567 Reviewed by Geoffrey Garen. This patch adds dynamic scope operations to the DFG/FTL. This patch adds three new DFG nodes: ResolveScope, PutDynamicVar and GetDynamicVar. When we encounter a Dynamic/UnresolvedProperty/UnresolvedPropertyWithVarInjectionChecks resolve type, we will compile dynamic scope resolution nodes. When we encounter a resolve type that needs var injection checks and the var injection watchpoint has already been fired, we will compile dynamic scope resolution nodes. This patch also adds a new value to the InitializationMode enum: ConstInitialization. There was a subtle bug where we used to never compile the var injection variant of the resolve type for an eval that injected a var where there was also a global lexical variable with the same name. For example, the store compiled in this eval("var foo = 20;") wouldn't be compiled with var injection checks if there was global let/const variable named "foo". So there was the potential for the injected var to store to the GlobalLexicalObject. I found this bug because my initial implementation in the DFG/FTL ran into it. The reason this bug existed is because when we compile a const initialization, we never need a var injections check. The const initialization always knows where to store its value. This same logic leaked into the above eval's "var foo = 20" store. This new enum value allows us to distinguish const initialization stores from non-const initialization stores. (I also changed InitializationMode to be an enum class instead of an enum). * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::generate): (JSC::BytecodeGenerator::BytecodeGenerator): (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack): (JSC::BytecodeGenerator::initializeBlockScopedFunctions): (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary): (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration): (JSC::BytecodeGenerator::emitGetFromScope): (JSC::BytecodeGenerator::initializeVariable): (JSC::BytecodeGenerator::emitInstanceOf): (JSC::BytecodeGenerator::emitPushFunctionNameScope): (JSC::BytecodeGenerator::pushScopedControlFlowContext): (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope): (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope): (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope): * bytecompiler/NodesCodegen.cpp: (JSC::PostfixNode::emitResolve): (JSC::PrefixNode::emitResolve): (JSC::ReadModifyResolveNode::emitBytecode): (JSC::initializationModeForAssignmentContext): (JSC::AssignResolveNode::emitBytecode): (JSC::EmptyLetExpression::emitBytecode): (JSC::ForInNode::emitLoopHeader): (JSC::ForOfNode::emitBytecode): (JSC::ClassExprNode::emitBytecode): (JSC::BindingNode::bindValue): (JSC::AssignmentElementNode::bindValue): (JSC::RestParameterNode::emit): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::noticeArgumentsUse): (JSC::DFG::ByteCodeParser::promoteToConstant): (JSC::DFG::ByteCodeParser::needsDynamicLookup): (JSC::DFG::ByteCodeParser::planLoad): (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGNode.h: (JSC::DFG::Node::hasIdentifier): (JSC::DFG::Node::identifierNumber): (JSC::DFG::Node::hasGetPutInfo): (JSC::DFG::Node::getPutInfo): (JSC::DFG::Node::hasAccessorAttributes): * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate): * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById): (JSC::DFG::SpeculativeJIT::compileResolveScope): (JSC::DFG::SpeculativeJIT::compileGetDynamicVar): (JSC::DFG::SpeculativeJIT::compilePutDynamicVar): (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal): * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::callOperation): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compare): (JSC::FTL::DFG::LowerDFGToB3::compileResolveScope): (JSC::FTL::DFG::LowerDFGToB3::compileGetDynamicVar): (JSC::FTL::DFG::LowerDFGToB3::compilePutDynamicVar): (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject): * jit/CCallHelpers.h: (JSC::CCallHelpers::setupArgumentsWithExecState): * jit/JITOperations.cpp: * jit/JITOperations.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): * llint/LLIntData.cpp: (JSC::LLInt::Data::performAssertions): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: * runtime/GetPutInfo.h: (JSC::resolveModeName): (JSC::initializationModeName): (JSC::isInitialization): (JSC::makeType): (JSC::GetPutInfo::GetPutInfo): * runtime/JSScope.cpp: (JSC::abstractAccess): Canonical link: https://commits.webkit.org/174834@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information
Showing
with
636 additions
and 85 deletions.
- +135 −0 Source/JavaScriptCore/ChangeLog
- +4 −4 Source/JavaScriptCore/bytecode/CodeBlock.cpp
- +13 −13 Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
- +26 −13 Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
- +15 −0 Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
- +79 −16 Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
- +3 −17 Source/JavaScriptCore/dfg/DFGCapabilities.cpp
- +3 −0 Source/JavaScriptCore/dfg/DFGClobberize.h
- +3 −0 Source/JavaScriptCore/dfg/DFGDoesGC.cpp
- +7 −0 Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
- +20 −0 Source/JavaScriptCore/dfg/DFGNode.h
- +3 −0 Source/JavaScriptCore/dfg/DFGNodeType.h
- +72 −0 Source/JavaScriptCore/dfg/DFGOperations.cpp
- +4 −0 Source/JavaScriptCore/dfg/DFGOperations.h
- +11 −0 Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
- +3 −0 Source/JavaScriptCore/dfg/DFGSafeToExecute.h
- +52 −0 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
- +30 −0 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
- +15 −0 Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
- +15 −0 Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
- +3 −0 Source/JavaScriptCore/ftl/FTLCapabilities.cpp
- +30 −0 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
- +51 −0 Source/JavaScriptCore/jit/CCallHelpers.h
- +2 −2 Source/JavaScriptCore/jit/JITOperations.cpp
- +3 −0 Source/JavaScriptCore/jit/JITOperations.h
- +3 −3 Source/JavaScriptCore/jit/JITPropertyAccess.cpp
- +3 −3 Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
- +1 −1 Source/JavaScriptCore/llint/LLIntData.cpp
- +2 −2 Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
- +1 −1 Source/JavaScriptCore/llint/LowLevelInterpreter.asm
- +1 −1 Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
- +20 −6 Source/JavaScriptCore/runtime/GetPutInfo.h
- +3 −3 Source/JavaScriptCore/runtime/JSScope.cpp
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.