Skip to content
Permalink
Browse files
[JSC] Implement $vm.ftlTrue function for FTL testing
https://bugs.webkit.org/show_bug.cgi?id=183071

Reviewed by Mark Lam.

JSTests:

* stress/dead-fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/dead-fiat-value-to-int52.js:
(foo):
* stress/dead-osr-entry-value.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/fiat-value-to-int52-then-fail-to-fold.js:
(foo):
* stress/fiat-value-to-int52-then-fold.js:
(foo):
* stress/fiat-value-to-int52.js:
(foo):
* stress/fold-based-on-int32-proof-mul-branch.js:
(foo):
* stress/fold-profiled-call-to-call.js:
(foo):
* stress/fold-to-double-constant-then-exit.js:
(foo):
* stress/fold-to-int52-constant-then-exit.js:
(foo):
* stress/fold-to-primitive-in-cfa.js:
(foo):
* stress/fold-to-primitive-to-identity-in-cfa.js:
(foo):
* stress/has-indexed-property-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/int52-ai-add-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-then-filter-int32.js:
(foo):
* stress/int52-ai-neg-then-filter-int32.js:
(foo):
* stress/int52-ai-sub-then-filter-int32.js:
(foo):
* stress/licm-pre-header-cannot-exit-nested.js:
(foo):
* stress/licm-pre-header-cannot-exit.js:
(foo):
* stress/sparse-array-entry-update-144067.js:
(useMemoryToTriggerGCs):
* stress/test-spec-misc.js:
(foo):
* stress/tricky-array-bounds-checks.js:
(foo):

Source/JavaScriptCore:

Add $vm.ftlTrue, which becomes true if the caller is compiled in FTL.
This is useful for testing whether the caller function is compiled in FTL.

We also remove duplicate DFGTrue function in jsc.cpp. We have $vm.dfgTrue.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* jsc.cpp:
(GlobalObject::finishCreation):
(functionFalse1):
(functionFalse2): Deleted.
* runtime/Intrinsic.cpp:
(JSC::intrinsicName):
* runtime/Intrinsic.h:
* tools/JSDollarVM.cpp:
(JSC::functionFTLTrue):
(JSC::JSDollarVM::finishCreation):

Canonical link: https://commits.webkit.org/198817@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@228950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Constellation committed Feb 23, 2018
1 parent 1cc68af commit f84f0335d86424df7d2ba55f1b693864e5c56481
Showing with 248 additions and 34 deletions.
  1. +66 −0 JSTests/ChangeLog
  2. +1 −1 JSTests/stress/dead-fiat-value-to-int52-then-exit-not-double.js
  3. +1 −1 JSTests/stress/dead-fiat-value-to-int52-then-exit-not-int52.js
  4. +1 −1 JSTests/stress/dead-fiat-value-to-int52.js
  5. +1 −1 JSTests/stress/dead-osr-entry-value.js
  6. +1 −1 JSTests/stress/fiat-value-to-int52-then-exit-not-double.js
  7. +1 −1 JSTests/stress/fiat-value-to-int52-then-exit-not-int52.js
  8. +1 −1 JSTests/stress/fiat-value-to-int52-then-fail-to-fold.js
  9. +1 −1 JSTests/stress/fiat-value-to-int52-then-fold.js
  10. +1 −1 JSTests/stress/fiat-value-to-int52.js
  11. +3 −3 JSTests/stress/fold-based-on-int32-proof-mul-branch.js
  12. +1 −1 JSTests/stress/fold-profiled-call-to-call.js
  13. +1 −1 JSTests/stress/fold-to-double-constant-then-exit.js
  14. +1 −1 JSTests/stress/fold-to-int52-constant-then-exit.js
  15. +1 −1 JSTests/stress/fold-to-primitive-in-cfa.js
  16. +1 −1 JSTests/stress/fold-to-primitive-to-identity-in-cfa.js
  17. +48 −0 JSTests/stress/has-indexed-property-array-storage-ftl.js
  18. +61 −0 JSTests/stress/has-indexed-property-slow-put-array-storage-ftl.js
  19. +1 −1 JSTests/stress/int52-ai-add-then-filter-int32.js
  20. +1 −1 JSTests/stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js
  21. +1 −1 JSTests/stress/int52-ai-mul-then-filter-int32.js
  22. +1 −1 JSTests/stress/int52-ai-neg-then-filter-int32.js
  23. +1 −1 JSTests/stress/int52-ai-sub-then-filter-int32.js
  24. +1 −1 JSTests/stress/licm-pre-header-cannot-exit-nested.js
  25. +1 −1 JSTests/stress/licm-pre-header-cannot-exit.js
  26. +1 −1 JSTests/stress/sparse-array-entry-update-144067.js
  27. +1 −1 JSTests/stress/test-spec-misc.js
  28. +2 −2 JSTests/stress/tricky-array-bounds-checks.js
  29. +25 −0 Source/JavaScriptCore/ChangeLog
  30. +6 −0 Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
  31. +3 −6 Source/JavaScriptCore/jsc.cpp
  32. +2 −0 Source/JavaScriptCore/runtime/Intrinsic.cpp
  33. +1 −0 Source/JavaScriptCore/runtime/Intrinsic.h
  34. +8 −0 Source/JavaScriptCore/tools/JSDollarVM.cpp
@@ -1,3 +1,69 @@
2018-02-23 Yusuke Suzuki <utatane.tea@gmail.com>

[JSC] Implement $vm.ftlTrue function for FTL testing
https://bugs.webkit.org/show_bug.cgi?id=183071

Reviewed by Mark Lam.

* stress/dead-fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/dead-fiat-value-to-int52.js:
(foo):
* stress/dead-osr-entry-value.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/fiat-value-to-int52-then-fail-to-fold.js:
(foo):
* stress/fiat-value-to-int52-then-fold.js:
(foo):
* stress/fiat-value-to-int52.js:
(foo):
* stress/fold-based-on-int32-proof-mul-branch.js:
(foo):
* stress/fold-profiled-call-to-call.js:
(foo):
* stress/fold-to-double-constant-then-exit.js:
(foo):
* stress/fold-to-int52-constant-then-exit.js:
(foo):
* stress/fold-to-primitive-in-cfa.js:
(foo):
* stress/fold-to-primitive-to-identity-in-cfa.js:
(foo):
* stress/has-indexed-property-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/int52-ai-add-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-then-filter-int32.js:
(foo):
* stress/int52-ai-neg-then-filter-int32.js:
(foo):
* stress/int52-ai-sub-then-filter-int32.js:
(foo):
* stress/licm-pre-header-cannot-exit-nested.js:
(foo):
* stress/licm-pre-header-cannot-exit.js:
(foo):
* stress/sparse-array-entry-update-144067.js:
(useMemoryToTriggerGCs):
* stress/test-spec-misc.js:
(foo):
* stress/tricky-array-bounds-checks.js:
(foo):

2018-02-22 Yusuke Suzuki <utatane.tea@gmail.com>

[FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
@@ -1,5 +1,5 @@
function foo() {
var value = bar(DFGTrue());
var value = bar($vm.dfgTrue());
fiatInt52(value);
fiatInt52(value);
}
@@ -1,5 +1,5 @@
function foo() {
var value = bar(DFGTrue());
var value = bar($vm.dfgTrue());
fiatInt52(value);
fiatInt52(value);
}
@@ -1,5 +1,5 @@
function foo() {
var value = bar(DFGTrue());
var value = bar($vm.dfgTrue());
fiatInt52(value);
fiatInt52(value);
}
@@ -3,7 +3,7 @@ function foo() {
var result = 0;
OSRExit();
for (var i = 0; i < 10000; ++i) {
if (!DFGTrue())
if (!$vm.dfgTrue())
result += o.f;
}
return result;
@@ -1,5 +1,5 @@
function foo() {
return fiatInt52(bar(DFGTrue())) + 1;
return fiatInt52(bar($vm.dfgTrue())) + 1;
}

var thingy = false;
@@ -1,5 +1,5 @@
function foo() {
return fiatInt52(bar(DFGTrue())) + 1;
return fiatInt52(bar($vm.dfgTrue())) + 1;
}

var thingy = false;
@@ -1,5 +1,5 @@
function foo() {
return fiatInt52(DFGTrue() ? 5.5 : 42) + 1;
return fiatInt52($vm.dfgTrue() ? 5.5 : 42) + 1;
}

noInline(foo);
@@ -1,5 +1,5 @@
function foo() {
return fiatInt52(DFGTrue() ? 42 : 5.5) + 1;
return fiatInt52($vm.dfgTrue() ? 42 : 5.5) + 1;
}

noInline(foo);
@@ -1,5 +1,5 @@
function foo() {
return fiatInt52(bar(DFGTrue())) + 1;
return fiatInt52(bar($vm.dfgTrue())) + 1;
}

function bar(p) {
@@ -1,8 +1,8 @@
function foo(a, b) {
var value = DFGTrue() ? -0 : "foo";
var value = $vm.dfgTrue() ? -0 : "foo";
if (a * b == value)
return [DFGTrue(), true];
return [DFGTrue(), false];
return [$vm.dfgTrue(), true];
return [$vm.dfgTrue(), false];
}
noInline(foo);

@@ -1,5 +1,5 @@
function foo(f) {
if (DFGTrue())
if ($vm.dfgTrue())
f = bar;
return f().f;
}
@@ -1,5 +1,5 @@
function foo(a, b) {
if (DFGTrue())
if ($vm.dfgTrue())
a = b = 5.4;
var c = a + b;
if (isFinalTier())
@@ -1,5 +1,5 @@
function foo(a, b) {
if (DFGTrue())
if ($vm.dfgTrue())
a = b = 2000000000;
var c = a + b;
if (isFinalTier())
@@ -1,5 +1,5 @@
function foo(x) {
if (DFGTrue())
if ($vm.dfgTrue())
x = "hello";
return x + " world";
}
@@ -1,5 +1,5 @@
function foo(x, p) {
if (DFGTrue())
if ($vm.dfgTrue())
x = p ? "hello" : "bar";
return x + " world";
}
@@ -0,0 +1,48 @@
//@ runFTLNoCJIT

function shouldBe(actual, expected) {
if (actual !== expected)
throw new Error('bad value: ' + actual);
}

var didFTLCompile = false;
var ftlTrue = $vm.ftlTrue;
function test1(array)
{
didFTLCompile = ftlTrue();
return 2 in array;
}
noInline(test1);

var array = [1, 2, 3, 4];
ensureArrayStorage(array);
didFTLCompile = false;
for (var i = 0; i < 1e5; ++i)
shouldBe(test1(array), true);
shouldBe(didFTLCompile, true);

var array = [1, 2, , 4];
ensureArrayStorage(array);
shouldBe(test1(array), false);

var array = [];
ensureArrayStorage(array);
shouldBe(test1(array), false);

function test2(array)
{
didFTLCompile = ftlTrue();
return 2 in array;
}
noInline(test2);

var array1 = [1, 2, 3, 4];
ensureArrayStorage(array1);
var array2 = [1, 2];
ensureArrayStorage(array2);
didFTLCompile = false;
for (var i = 0; i < 1e5; ++i)
shouldBe(test2(array2), false);
shouldBe(didFTLCompile, true);
shouldBe(test2(array2), false);
shouldBe(test2(array1), true);
@@ -0,0 +1,61 @@
//@ runFTLNoCJIT

function shouldBe(actual, expected) {
if (actual !== expected)
throw new Error('bad value: ' + actual);
}

var didFTLCompile = false;
var ftlTrue = $vm.ftlTrue;
function test1(array)
{
didFTLCompile = ftlTrue();
return 2 in array;
}
noInline(test1);

var object = { a: 10 };
Object.defineProperties(object, {
"0": {
get: function() { return this.a; },
set: function(x) { this.a = x; },
},
});

var array = [1, 2, 3, 4];
array.__proto__ = object;
ensureArrayStorage(array);
didFTLCompile = false;
for (var i = 0; i < 1e5; ++i)
shouldBe(test1(array), true);
shouldBe(didFTLCompile, true);

var array = [1, 2, , 4];
array.__proto__ = object;
ensureArrayStorage(array);
shouldBe(test1(array), false);

var array = [];
array.__proto__ = object;
ensureArrayStorage(array);
shouldBe(test1(array), false);

function test2(array)
{
didFTLCompile = ftlTrue();
return 2 in array;
}
noInline(test2);

var array1 = [1, 2, 3, 4];
array1.__proto__ = object;
ensureArrayStorage(array1);
var array2 = [1, 2];
array2.__proto__ = object;
ensureArrayStorage(array2);
didFTLCompile = false;
for (var i = 0; i < 1e5; ++i)
shouldBe(test2(array2), false);
shouldBe(didFTLCompile, true);
shouldBe(test2(array2), false);
shouldBe(test2(array1), true);
@@ -1,6 +1,6 @@
function foo(a, b, c) {
var o = {f:42};
if (DFGTrue())
if ($vm.dfgTrue())
o.f = a + b + c;
return o.f | 0;
}
@@ -1,6 +1,6 @@
function foo(a, b, c) {
var o = {f:42};
if (DFGTrue())
if ($vm.dfgTrue())
o.f = (a * b + 5) * c + 5;
return o.f | 0;
}
@@ -1,6 +1,6 @@
function foo(a, b, c) {
var o = {f:42};
if (DFGTrue())
if ($vm.dfgTrue())
o.f = a * b * c;
return o.f | 0;
}
@@ -1,6 +1,6 @@
function foo(a, b) {
var o = {f:42};
if (DFGTrue())
if ($vm.dfgTrue())
o.f = -(a + b);
return o.f | 0;
}
@@ -1,6 +1,6 @@
function foo(a, b) {
var o = {f:42};
if (DFGTrue())
if ($vm.dfgTrue())
o.f = a - b - 2000000000;
return o.f | 0;
}
@@ -4,7 +4,7 @@ function foo(object, predicate) {
for (var j = 0; j < 10; ++j) {
var result = 0;
var i = 0;
if (DFGTrue())
if ($vm.dfgTrue())
predicate = 42;
while (predicate >= 42) {
result += object.array[i++];
@@ -3,7 +3,7 @@
function foo(object, predicate) {
var result = 0;
var i = 0;
if (DFGTrue())
if ($vm.dfgTrue())
predicate = 42;
while (predicate >= 42) {
result += object.array[i++];
@@ -36,7 +36,7 @@ for (var i = 0; i < 5; i++)

function useMemoryToTriggerGCs() {
var arr = [];
var limit = DFGTrue() ? 10000 : 100;
var limit = $vm.dfgTrue() ? 10000 : 100;
for (var i = 0; i < limit; i++)
arr[i] = { a: "using" + i, b: "up" + i, c: "memory" + i };
return arr;
@@ -11,7 +11,7 @@ noInline(getX);

function foo(index) {
var result = false;
var x = getX(DFGTrue());
var x = getX($vm.dfgTrue());

x * 2;

@@ -1,6 +1,6 @@
function foo(a, i, p) {
if (p || !DFGTrue())
return [DFGTrue(), a[(i - (DFGTrue() ? 2147483646 : 0)) | 0], a[i], a[(i + (DFGTrue() ? 2147483646 : 0)) | 0], DFGTrue()];
if (p || !$vm.dfgTrue())
return [$vm.dfgTrue(), a[(i - ($vm.dfgTrue() ? 2147483646 : 0)) | 0], a[i], a[(i + ($vm.dfgTrue() ? 2147483646 : 0)) | 0], $vm.dfgTrue()];
return [12];
}

0 comments on commit f84f033

Please sign in to comment.