Merge r228950 - [JSC] Implement $vm.ftlTrue function for FTL testing

https://bugs.webkit.org/show_bug.cgi?id=183071

Reviewed by Mark Lam.

JSTests:

* stress/dead-fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/dead-fiat-value-to-int52.js:
(foo):
* stress/dead-osr-entry-value.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/fiat-value-to-int52-then-fail-to-fold.js:
(foo):
* stress/fiat-value-to-int52-then-fold.js:
(foo):
* stress/fiat-value-to-int52.js:
(foo):
* stress/fold-based-on-int32-proof-mul-branch.js:
(foo):
* stress/fold-profiled-call-to-call.js:
(foo):
* stress/fold-to-double-constant-then-exit.js:
(foo):
* stress/fold-to-int52-constant-then-exit.js:
(foo):
* stress/fold-to-primitive-in-cfa.js:
(foo):
* stress/fold-to-primitive-to-identity-in-cfa.js:
(foo):
* stress/has-indexed-property-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/int52-ai-add-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-then-filter-int32.js:
(foo):
* stress/int52-ai-neg-then-filter-int32.js:
(foo):
* stress/int52-ai-sub-then-filter-int32.js:
(foo):
* stress/licm-pre-header-cannot-exit-nested.js:
(foo):
* stress/licm-pre-header-cannot-exit.js:
(foo):
* stress/sparse-array-entry-update-144067.js:
(useMemoryToTriggerGCs):
* stress/test-spec-misc.js:
(foo):
* stress/tricky-array-bounds-checks.js:
(foo):

Source/JavaScriptCore:

Add $vm.ftlTrue, which becomes true if the caller is compiled in FTL.
This is useful for testing whether the caller function is compiled in FTL.

We also remove duplicate DFGTrue function in jsc.cpp. We have $vm.dfgTrue.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* jsc.cpp:
(GlobalObject::finishCreation):
(functionFalse1):
(functionFalse2): Deleted.
* runtime/Intrinsic.cpp:
(JSC::intrinsicName):
* runtime/Intrinsic.h:
* tools/JSDollarVM.cpp:
(JSC::functionFTLTrue):
(JSC::JSDollarVM::finishCreation):

JSTests/ChangeLog

@@ -1,3 +1,69 @@
+2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Implement $vm.ftlTrue function for FTL testing
+        https://bugs.webkit.org/show_bug.cgi?id=183071
+
+        Reviewed by Mark Lam.
+
+        * stress/dead-fiat-value-to-int52-then-exit-not-double.js:
+        (foo):
+        * stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
+        (foo):
+        * stress/dead-fiat-value-to-int52.js:
+        (foo):
+        * stress/dead-osr-entry-value.js:
+        (foo):
+        * stress/fiat-value-to-int52-then-exit-not-double.js:
+        (foo):
+        * stress/fiat-value-to-int52-then-exit-not-int52.js:
+        (foo):
+        * stress/fiat-value-to-int52-then-fail-to-fold.js:
+        (foo):
+        * stress/fiat-value-to-int52-then-fold.js:
+        (foo):
+        * stress/fiat-value-to-int52.js:
+        (foo):
+        * stress/fold-based-on-int32-proof-mul-branch.js:
+        (foo):
+        * stress/fold-profiled-call-to-call.js:
+        (foo):
+        * stress/fold-to-double-constant-then-exit.js:
+        (foo):
+        * stress/fold-to-int52-constant-then-exit.js:
+        (foo):
+        * stress/fold-to-primitive-in-cfa.js:
+        (foo):
+        * stress/fold-to-primitive-to-identity-in-cfa.js:
+        (foo):
+        * stress/has-indexed-property-array-storage-ftl.js: Added.
+        (shouldBe):
+        (test1):
+        (test2):
+        * stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
+        (shouldBe):
+        (test1):
+        (test2):
+        * stress/int52-ai-add-then-filter-int32.js:
+        (foo):
+        * stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
+        (foo):
+        * stress/int52-ai-mul-then-filter-int32.js:
+        (foo):
+        * stress/int52-ai-neg-then-filter-int32.js:
+        (foo):
+        * stress/int52-ai-sub-then-filter-int32.js:
+        (foo):
+        * stress/licm-pre-header-cannot-exit-nested.js:
+        (foo):
+        * stress/licm-pre-header-cannot-exit.js:
+        (foo):
+        * stress/sparse-array-entry-update-144067.js:
+        (useMemoryToTriggerGCs):
+        * stress/test-spec-misc.js:
+        (foo):
+        * stress/tricky-array-bounds-checks.js:
+        (foo):
+
 2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage

JSTests/stress/dead-fiat-value-to-int52-then-exit-not-double.js

@@ -1,5 +1,5 @@
 function foo() {
-    var value = bar(DFGTrue());
+    var value = bar($vm.dfgTrue());
     fiatInt52(value);
     fiatInt52(value);
 }

JSTests/stress/dead-fiat-value-to-int52-then-exit-not-int52.js

@@ -1,5 +1,5 @@
 function foo() {
-    var value = bar(DFGTrue());
+    var value = bar($vm.dfgTrue());
     fiatInt52(value);
     fiatInt52(value);
 }

JSTests/stress/dead-fiat-value-to-int52.js

@@ -1,5 +1,5 @@
 function foo() {
-    var value = bar(DFGTrue());
+    var value = bar($vm.dfgTrue());
     fiatInt52(value);
     fiatInt52(value);
 }

JSTests/stress/dead-osr-entry-value.js

@@ -3,7 +3,7 @@ function foo() {
     var result = 0;
     OSRExit();
     for (var i = 0; i < 10000; ++i) {
-        if (!DFGTrue())
+        if (!$vm.dfgTrue())
             result += o.f;
     }
     return result;

JSTests/stress/fiat-value-to-int52-then-exit-not-double.js

@@ -1,5 +1,5 @@
 function foo() {
-    return fiatInt52(bar(DFGTrue())) + 1;
+    return fiatInt52(bar($vm.dfgTrue())) + 1;
 }
 
 var thingy = false;

JSTests/stress/fiat-value-to-int52-then-exit-not-int52.js

@@ -1,5 +1,5 @@
 function foo() {
-    return fiatInt52(bar(DFGTrue())) + 1;
+    return fiatInt52(bar($vm.dfgTrue())) + 1;
 }
 
 var thingy = false;

JSTests/stress/fiat-value-to-int52-then-fail-to-fold.js

@@ -1,5 +1,5 @@
 function foo() {
-    return fiatInt52(DFGTrue() ? 5.5 : 42) + 1;
+    return fiatInt52($vm.dfgTrue() ? 5.5 : 42) + 1;
 }
 
 noInline(foo);

JSTests/stress/fiat-value-to-int52-then-fold.js

@@ -1,5 +1,5 @@
 function foo() {
-    return fiatInt52(DFGTrue() ? 42 : 5.5) + 1;
+    return fiatInt52($vm.dfgTrue() ? 42 : 5.5) + 1;
 }
 
 noInline(foo);

JSTests/stress/fiat-value-to-int52.js

@@ -1,5 +1,5 @@
 function foo() {
-    return fiatInt52(bar(DFGTrue())) + 1;
+    return fiatInt52(bar($vm.dfgTrue())) + 1;
 }
 
 function bar(p) {

JSTests/stress/fold-based-on-int32-proof-mul-branch.js

@@ -1,8 +1,8 @@
 function foo(a, b) {
-    var value = DFGTrue() ? -0 : "foo";
+    var value = $vm.dfgTrue() ? -0 : "foo";
     if (a * b == value)
-        return [DFGTrue(), true];
-    return [DFGTrue(), false];
+        return [$vm.dfgTrue(), true];
+    return [$vm.dfgTrue(), false];
 }
 noInline(foo);
 

JSTests/stress/fold-profiled-call-to-call.js

@@ -1,5 +1,5 @@
 function foo(f) {
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         f = bar;
     return f().f;
 }

JSTests/stress/fold-to-double-constant-then-exit.js

@@ -1,5 +1,5 @@
 function foo(a, b) {
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         a = b = 5.4;
     var c = a + b;
     if (isFinalTier())

JSTests/stress/fold-to-int52-constant-then-exit.js

@@ -1,5 +1,5 @@
 function foo(a, b) {
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         a = b = 2000000000;
     var c = a + b;
     if (isFinalTier())

JSTests/stress/fold-to-primitive-in-cfa.js

@@ -1,5 +1,5 @@
 function foo(x) {
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         x = "hello";
     return x + " world";
 }

JSTests/stress/fold-to-primitive-to-identity-in-cfa.js

@@ -1,5 +1,5 @@
 function foo(x, p) {
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         x = p ? "hello" : "bar";
     return x + " world";
 }

JSTests/stress/has-indexed-property-array-storage-ftl.js

@@ -0,0 +1,48 @@
+//@ runFTLNoCJIT
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+var didFTLCompile = false;
+var ftlTrue = $vm.ftlTrue;
+function test1(array)
+{
+    didFTLCompile = ftlTrue();
+    return 2 in array;
+}
+noInline(test1);
+
+var array = [1, 2, 3, 4];
+ensureArrayStorage(array);
+didFTLCompile = false;
+for (var i = 0; i < 1e5; ++i)
+    shouldBe(test1(array), true);
+shouldBe(didFTLCompile, true);
+
+var array = [1, 2, , 4];
+ensureArrayStorage(array);
+shouldBe(test1(array), false);
+
+var array = [];
+ensureArrayStorage(array);
+shouldBe(test1(array), false);
+
+function test2(array)
+{
+    didFTLCompile = ftlTrue();
+    return 2 in array;
+}
+noInline(test2);
+
+var array1 = [1, 2, 3, 4];
+ensureArrayStorage(array1);
+var array2 = [1, 2];
+ensureArrayStorage(array2);
+didFTLCompile = false;
+for (var i = 0; i < 1e5; ++i)
+    shouldBe(test2(array2), false);
+shouldBe(didFTLCompile, true);
+shouldBe(test2(array2), false);
+shouldBe(test2(array1), true);

JSTests/stress/has-indexed-property-slow-put-array-storage-ftl.js

@@ -0,0 +1,61 @@
+//@ runFTLNoCJIT
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+var didFTLCompile = false;
+var ftlTrue = $vm.ftlTrue;
+function test1(array)
+{
+    didFTLCompile = ftlTrue();
+    return 2 in array;
+}
+noInline(test1);
+
+var object = { a: 10 };
+Object.defineProperties(object, {
+    "0": {
+        get: function() { return this.a; },
+        set: function(x) { this.a = x; },
+    },
+});
+
+var array = [1, 2, 3, 4];
+array.__proto__ = object;
+ensureArrayStorage(array);
+didFTLCompile = false;
+for (var i = 0; i < 1e5; ++i)
+    shouldBe(test1(array), true);
+shouldBe(didFTLCompile, true);
+
+var array = [1, 2, , 4];
+array.__proto__ = object;
+ensureArrayStorage(array);
+shouldBe(test1(array), false);
+
+var array = [];
+array.__proto__ = object;
+ensureArrayStorage(array);
+shouldBe(test1(array), false);
+
+function test2(array)
+{
+    didFTLCompile = ftlTrue();
+    return 2 in array;
+}
+noInline(test2);
+
+var array1 = [1, 2, 3, 4];
+array1.__proto__ = object;
+ensureArrayStorage(array1);
+var array2 = [1, 2];
+array2.__proto__ = object;
+ensureArrayStorage(array2);
+didFTLCompile = false;
+for (var i = 0; i < 1e5; ++i)
+    shouldBe(test2(array2), false);
+shouldBe(didFTLCompile, true);
+shouldBe(test2(array2), false);
+shouldBe(test2(array1), true);

JSTests/stress/int52-ai-add-then-filter-int32.js

@@ -1,6 +1,6 @@
 function foo(a, b, c) {
     var o = {f:42};
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         o.f = a + b + c;
     return o.f | 0;
 }

JSTests/stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js

@@ -1,6 +1,6 @@
 function foo(a, b, c) {
     var o = {f:42};
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         o.f = (a * b + 5) * c + 5;
     return o.f | 0;
 }

JSTests/stress/int52-ai-mul-then-filter-int32.js

@@ -1,6 +1,6 @@
 function foo(a, b, c) {
     var o = {f:42};
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         o.f = a * b * c;
     return o.f | 0;
 }

JSTests/stress/int52-ai-neg-then-filter-int32.js

@@ -1,6 +1,6 @@
 function foo(a, b) {
     var o = {f:42};
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         o.f = -(a + b);
     return o.f | 0;
 }

JSTests/stress/int52-ai-sub-then-filter-int32.js

@@ -1,6 +1,6 @@
 function foo(a, b) {
     var o = {f:42};
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         o.f = a - b - 2000000000;
     return o.f | 0;
 }

JSTests/stress/licm-pre-header-cannot-exit-nested.js

@@ -4,7 +4,7 @@ function foo(object, predicate) {
     for (var j = 0; j < 10; ++j) {
         var result = 0;
         var i = 0;
-        if (DFGTrue())
+        if ($vm.dfgTrue())
             predicate = 42;
         while (predicate >= 42) {
             result += object.array[i++];

JSTests/stress/licm-pre-header-cannot-exit.js

@@ -3,7 +3,7 @@
 function foo(object, predicate) {
     var result = 0;
     var i = 0;
-    if (DFGTrue())
+    if ($vm.dfgTrue())
         predicate = 42;
     while (predicate >= 42) {
         result += object.array[i++];

JSTests/stress/sparse-array-entry-update-144067.js

@@ -36,7 +36,7 @@ for (var i = 0; i < 5; i++)
 
 function useMemoryToTriggerGCs() {
     var arr = [];
-    var limit = DFGTrue() ? 10000 : 100;
+    var limit = $vm.dfgTrue() ? 10000 : 100;
     for (var i = 0; i < limit; i++)
         arr[i] = { a: "using" + i, b: "up" + i, c: "memory" + i };
     return arr;

JSTests/stress/test-spec-misc.js

@@ -11,7 +11,7 @@ noInline(getX);
 
 function foo(index) {
     var result = false;
-    var x = getX(DFGTrue());
+    var x = getX($vm.dfgTrue());
 
     x * 2;
 

JSTests/stress/tricky-array-bounds-checks.js

@@ -1,6 +1,6 @@
 function foo(a, i, p) {
-    if (p || !DFGTrue())
-        return [DFGTrue(), a[(i - (DFGTrue() ? 2147483646 : 0)) | 0], a[i], a[(i + (DFGTrue() ? 2147483646 : 0)) | 0], DFGTrue()];
+    if (p || !$vm.dfgTrue())
+        return [$vm.dfgTrue(), a[(i - ($vm.dfgTrue() ? 2147483646 : 0)) | 0], a[i], a[(i + ($vm.dfgTrue() ? 2147483646 : 0)) | 0], $vm.dfgTrue()];
     return [12];
 }