From 4b86fea5308b12fa369038dc60c0aabd13870ec5 Mon Sep 17 00:00:00 2001 From: Benedikt Meurer Date: Mon, 27 May 2019 15:55:03 +0200 Subject: [PATCH] [typedarray] Move external/data pointer to JSTypedArray. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As the next step in supporting huge typed arrays in V8, this moves the external/data pointer from the FixedTypedArrayBase backing store to the JSTypedArray instance itself, and replaces the special backing stores with a plain ByteArray (removing all the code for the FixedTypedArrayBase class hierarchy). By doing so, we can drastically simplify the system around typed arrays. Note: Several places in the code base used to check the instance type of the elements backing store of a JSTypedArray instead of checking the elements kind on the JSTypedArray map directly. Those had to be fixed, since the backing store is now always a ByteArray. Drive-by-fix: Move all the typed elements access related code into the elements.cc file to properly encapsulate the accesses. Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183 Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646 Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535 Commit-Queue: Benedikt Meurer Reviewed-by: Peter Marshall Reviewed-by: Ulan Degenbaev Reviewed-by: Simon Zünd Cr-Commit-Position: refs/heads/master@{#61855} --- src/api/api.cc | 4 +- src/builtins/array-join.tq | 22 +- src/builtins/base.tq | 57 +- src/builtins/builtins-array-gen.cc | 56 +- .../builtins-sharedarraybuffer-gen.cc | 136 ++-- src/builtins/builtins-typed-array-gen.cc | 141 +--- src/builtins/builtins-typed-array-gen.h | 5 - src/builtins/builtins-typed-array.cc | 4 +- src/builtins/typed-array-createtypedarray.tq | 30 +- src/builtins/typed-array.tq | 117 ++-- src/codegen/code-stub-assembler.cc | 213 +++--- src/codegen/code-stub-assembler.h | 36 +- src/compiler/access-builder.cc | 48 +- src/compiler/access-builder.h | 12 +- src/compiler/code-assembler.h | 3 + src/compiler/js-call-reducer.cc | 24 +- src/compiler/js-heap-broker.cc | 15 +- src/compiler/js-heap-broker.h | 2 +- .../js-native-context-specialization.cc | 69 +- src/compiler/types.cc | 5 - src/diagnostics/objects-debug.cc | 31 +- src/diagnostics/objects-printer.cc | 65 +- src/heap/factory.cc | 210 ++---- src/heap/factory.h | 30 +- src/heap/heap.cc | 5 +- src/heap/objects-visiting.h | 12 +- src/heap/setup-heap-internal.cc | 39 -- src/ic/accessor-assembler.cc | 391 +++++------ src/ic/accessor-assembler.h | 2 +- src/ic/ic.cc | 10 +- src/objects/elements-kind.cc | 6 +- src/objects/elements-kind.h | 7 +- src/objects/elements.cc | 636 ++++++++++++------ src/objects/fixed-array-inl.h | 398 +---------- src/objects/fixed-array.h | 135 ---- src/objects/instance-type-inl.h | 13 +- src/objects/instance-type.h | 16 - src/objects/js-array-buffer-inl.h | 23 +- src/objects/js-array-buffer.cc | 41 +- src/objects/js-array-buffer.h | 29 +- src/objects/js-array-inl.h | 2 +- src/objects/js-objects-inl.h | 11 +- src/objects/js-objects.cc | 19 +- src/objects/js-objects.h | 2 +- src/objects/lookup.cc | 2 +- src/objects/map-inl.h | 9 +- src/objects/map-updater.cc | 2 +- src/objects/map.cc | 19 +- src/objects/map.h | 4 +- src/objects/object-list-macros.h | 12 - src/objects/objects-body-descriptors-inl.h | 28 +- src/objects/objects-definitions.h | 12 - src/objects/objects-inl.h | 13 +- src/objects/objects.cc | 21 +- src/roots/roots-inl.h | 20 - src/roots/roots.cc | 42 -- src/roots/roots.h | 35 - src/runtime/runtime-array.cc | 2 +- src/runtime/runtime-internal.cc | 8 + src/runtime/runtime-typedarray.cc | 9 +- src/runtime/runtime.h | 1 + src/snapshot/deserializer.cc | 27 +- src/snapshot/serializer.cc | 14 +- test/cctest/test-api.cc | 197 ++---- test/cctest/test-code-stub-assembler.cc | 6 +- test/cctest/test-serialize.cc | 1 - .../compiler/simplified-operator-unittest.cc | 19 +- tools/gen-postmortem-metadata.py | 1 - tools/v8heapconst.py | 471 ++++++------- 69 files changed, 1581 insertions(+), 2526 deletions(-) diff --git a/src/api/api.cc b/src/api/api.cc index f564adc14e..74fc41ae49 100644 --- a/src/api/api.cc +++ b/src/api/api.cc @@ -7237,9 +7237,7 @@ size_t v8::ArrayBufferView::CopyContents(void* dest, size_t byte_length) { DCHECK(self->IsJSTypedArray()); i::Handle typed_array(i::JSTypedArray::cast(*self), isolate); - i::Handle fixed_array( - i::FixedTypedArrayBase::cast(typed_array->elements()), isolate); - source = reinterpret_cast(fixed_array->DataPtr()); + source = reinterpret_cast(typed_array->DataPtr()); } memcpy(dest, source + byte_offset, bytes_to_copy); } diff --git a/src/builtins/array-join.tq b/src/builtins/array-join.tq index bc123937f8..72e1a3661e 100644 --- a/src/builtins/array-join.tq +++ b/src/builtins/array-join.tq @@ -383,31 +383,31 @@ namespace array_join { if (IsElementsKindGreaterThan(kind, UINT32_ELEMENTS)) { if (kind == INT32_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == FLOAT32_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == FLOAT64_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == UINT8_CLAMPED_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == BIGUINT64_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == BIGINT64_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else { unreachable; } } else { if (kind == UINT8_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == INT8_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == UINT16_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == INT16_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else if (kind == UINT32_ELEMENTS) { - loadFn = LoadJoinTypedElement; + loadFn = LoadJoinTypedElement; } else { unreachable; } diff --git a/src/builtins/base.tq b/src/builtins/base.tq index 5e5f506dc3..16216611c3 100644 --- a/src/builtins/base.tq +++ b/src/builtins/base.tq @@ -533,16 +533,9 @@ extern class JSBoundFunction extends JSObject { type Callable = JSFunction | JSBoundFunction | JSProxy; -extern class FixedTypedArrayBase extends FixedArrayBase { - base_pointer: Smi; - external_pointer: RawPtr; -} extern operator '.length_intptr' macro LoadAndUntagFixedArrayBaseLength( FixedArrayBase): intptr; -type FixedTypedArray extends FixedTypedArrayBase - generates 'TNode'; - type SloppyArgumentsElements extends FixedArray; type NumberDictionary extends HeapObject generates 'TNode'; @@ -611,8 +604,7 @@ extern class JSArrayBufferView extends JSObject { } extern class JSTypedArray extends JSArrayBufferView { - AttachOffHeapBuffer(buffer: JSArrayBuffer, map: Map, byteOffset: uintptr): - void { + AttachOffHeapBuffer(buffer: JSArrayBuffer, byteOffset: uintptr): void { const basePointer: Smi = 0; // The max byteOffset is 8 * MaxSmi on the particular platform. 32 bit @@ -630,16 +622,15 @@ extern class JSTypedArray extends JSArrayBufferView { IsMockArrayBufferAllocatorFlag() || Convert(externalPointer) >= Convert(backingStore)); + this.elements = kEmptyByteArray; this.buffer = buffer; - this.elements = new FixedTypedArrayBase{ - map, - length: 0, - base_pointer: basePointer, - external_pointer: externalPointer - }; + this.external_pointer = externalPointer; + this.base_pointer = basePointer; } length: uintptr; + external_pointer: RawPtr; + base_pointer: ByteArray | Smi; } @noVerifier @@ -746,7 +737,7 @@ extern class PropertyCell extends HeapObject { dependent_code: DependentCode; } -extern class JSDataView extends JSArrayBufferView {} +extern class JSDataView extends JSArrayBufferView { data_pointer: RawPtr; } type ElementsKind generates 'TNode' constexpr 'ElementsKind'; type LanguageMode extends Smi constexpr 'LanguageMode'; @@ -955,18 +946,6 @@ const kWithSlackTracking: constexpr SlackTrackingMode const kNoSlackTracking: constexpr SlackTrackingMode generates 'SlackTrackingMode::kNoSlackTracking'; -type FixedUint8Array extends FixedTypedArray; -type FixedInt8Array extends FixedTypedArray; -type FixedUint16Array extends FixedTypedArray; -type FixedInt16Array extends FixedTypedArray; -type FixedUint32Array extends FixedTypedArray; -type FixedInt32Array extends FixedTypedArray; -type FixedFloat32Array extends FixedTypedArray; -type FixedFloat64Array extends FixedTypedArray; -type FixedUint8ClampedArray extends FixedTypedArray; -type FixedBigUint64Array extends FixedTypedArray; -type FixedBigInt64Array extends FixedTypedArray; - const kFixedDoubleArrays: constexpr ExtractFixedArrayFlags generates 'CodeStubAssembler::ExtractFixedArrayFlag::kFixedDoubleArrays'; const kAllFixedArrays: constexpr ExtractFixedArrayFlags @@ -978,6 +957,8 @@ const kFixedArrayMapRootIndex: constexpr RootIndex generates 'RootIndex::kFixedArrayMap'; const kFixedCOWArrayMapRootIndex: constexpr RootIndex generates 'RootIndex::kFixedCOWArrayMap'; +const kEmptyByteArrayRootIndex: + constexpr RootIndex generates 'RootIndex::kEmptyByteArray'; const kEmptyFixedArrayRootIndex: constexpr RootIndex generates 'RootIndex::kEmptyFixedArray'; const kTheHoleValueRootIndex: @@ -1020,8 +1001,8 @@ const kPropertyNotFunction: constexpr MessageTemplate const kMaxArrayIndex: constexpr uint32 generates 'JSArray::kMaxArrayIndex'; -const kTypedArrayMaxByteLength: - constexpr uintptr generates 'FixedTypedArrayBase::kMaxByteLength'; +const kArrayBufferMaxByteLength: + constexpr uintptr generates 'JSArrayBuffer::kMaxByteLength'; const V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP: constexpr int31 generates 'V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP'; const kMaxSafeInteger: constexpr float64 generates 'kMaxSafeInteger'; @@ -1030,8 +1011,6 @@ const kSmiMax: uintptr = kSmiMaxValue; const kStringMaxLength: constexpr int31 generates 'String::kMaxLength'; const kFixedArrayMaxLength: constexpr int31 generates 'FixedArray::kMaxLength'; -const kFixedTypedArrayBaseHeaderSize: constexpr intptr - generates 'FixedTypedArrayBase::kHeaderSize'; const kObjectAlignmentMask: constexpr intptr generates 'kObjectAlignmentMask'; const kMinAddedElementsCapacity: @@ -1438,7 +1417,6 @@ extern transitioning runtime TransitionElementsKindWithKind( extern macro LoadBufferObject(RawPtr, constexpr int32): Object; extern macro LoadBufferPointer(RawPtr, constexpr int32): RawPtr; extern macro LoadBufferSmi(RawPtr, constexpr int32): Smi; -extern macro LoadFixedTypedArrayOnHeapBackingStore(FixedTypedArrayBase): RawPtr; extern macro LoadRoot(constexpr RootIndex): Object; extern macro StoreRoot(constexpr RootIndex, Object): Object; @@ -1821,12 +1799,6 @@ Cast(o: HeapObject): NumberDictionary goto CastError; } -Cast(o: HeapObject): FixedTypedArrayBase - labels CastError { - if (IsFixedTypedArray(o)) return %RawDownCast(o); - goto CastError; -} - Cast(o: HeapObject): String labels CastError { return HeapObjectToString(o) otherwise CastError; @@ -2282,6 +2254,8 @@ UnsafeCast(o: Object): Object { const kFixedArrayMap: Map = %RawDownCast(LoadRoot(kFixedArrayMapRootIndex)); const kCOWMap: Map = %RawDownCast(LoadRoot(kFixedCOWArrayMapRootIndex)); +const kEmptyByteArray: ByteArray = + %RawDownCast(LoadRoot(kEmptyByteArrayRootIndex)); const kEmptyFixedArray: FixedArray = %RawDownCast(LoadRoot(kEmptyFixedArrayRootIndex)); @@ -2296,8 +2270,8 @@ extern macro IsMockArrayBufferAllocatorFlag(): bool; extern macro IsPrototypeTypedArrayPrototype(implicit context: Context)(Map): bool; -extern operator '.data_ptr' macro TypedArrayBuiltinsAssembler::LoadDataPtr( - JSTypedArray): RawPtr; +extern operator '.data_ptr' macro LoadJSTypedArrayBackingStore(JSTypedArray): + RawPtr; extern operator '.elements_kind' macro LoadMapElementsKind(Map): ElementsKind; extern operator '.elements_kind' macro LoadElementsKind(JSTypedArray): @@ -2701,7 +2675,6 @@ extern macro IsJSFunction(HeapObject): bool; extern macro IsJSObject(HeapObject): bool; extern macro IsJSTypedArray(HeapObject): bool; extern macro IsNumberDictionary(HeapObject): bool; -extern macro IsFixedTypedArray(HeapObject): bool; extern macro IsContext(HeapObject): bool; extern macro IsJSReceiver(HeapObject): bool; extern macro TaggedIsCallable(Object): bool; diff --git a/src/builtins/builtins-array-gen.cc b/src/builtins/builtins-array-gen.cc index 320527b48b..0b52e1f1a7 100644 --- a/src/builtins/builtins-array-gen.cc +++ b/src/builtins/builtins-array-gen.cc @@ -46,8 +46,7 @@ ArrayBuiltinsAssembler::ArrayBuiltinsAssembler( CSA_ASSERT(this, UintPtrLessThanOrEqual(SmiUntag(CAST(len_)), LoadJSTypedArrayLength(a))); fast_typed_array_target_ = - Word32Equal(LoadInstanceType(LoadElements(original_array)), - LoadInstanceType(LoadElements(a))); + Word32Equal(LoadElementsKind(original_array), LoadElementsKind(a)); a_.Bind(a); } @@ -151,8 +150,8 @@ ArrayBuiltinsAssembler::ArrayBuiltinsAssembler( Label throw_not_typed_array(this, Label::kDeferred); GotoIf(TaggedIsSmi(receiver_), &throw_not_typed_array); - GotoIfNot(HasInstanceType(CAST(receiver_), JS_TYPED_ARRAY_TYPE), - &throw_not_typed_array); + TNode typed_array_map = LoadMap(CAST(receiver_)); + GotoIfNot(IsJSTypedArrayMap(typed_array_map), &throw_not_typed_array); TNode typed_array = CAST(receiver_); o_ = typed_array; @@ -179,13 +178,13 @@ ArrayBuiltinsAssembler::ArrayBuiltinsAssembler( BIND(&unexpected_instance_type); Unreachable(); - std::vector instance_types = { -#define INSTANCE_TYPE(Type, type, TYPE, ctype) FIXED_##TYPE##_ARRAY_TYPE, - TYPED_ARRAYS(INSTANCE_TYPE) -#undef INSTANCE_TYPE + std::vector elements_kinds = { +#define ELEMENTS_KIND(Type, type, TYPE, ctype) TYPE##_ELEMENTS, + TYPED_ARRAYS(ELEMENTS_KIND) +#undef ELEMENTS_KIND }; std::list