AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Heap broker for JSCreateLowering::ReduceJSCreateArguments

Browse Source 
Bug: v8:7790
Change-Id: I5e12f49038f569187b751cc07a3bfad5eb904949
Reviewed-on: https://chromium-review.googlesource.com/1121460
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54131}
This commit is contained in:
Jaroslav Sevcik 2018-07-02 12:48:52 +02:00 committed by Commit Bot
parent a383aa33e5
commit 9502913612
4 changed files with 100 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
src/compiler/js-create-lowering.cc
View File

@ -162,14 +162,14 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
}
Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
DisallowHandleDereference disallow_handle_dereference;
DCHECK_EQ(IrOpcode::kJSCreateArguments, node->opcode());
CreateArgumentsType type = CreateArgumentsTypeOf(node->op());
Node* const frame_state = NodeProperties::GetFrameStateInput(node);
Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
Node* const control = graph()->start();
FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
Handle<SharedFunctionInfo> shared =
state_info.shared_info().ToHandleChecked();
SharedFunctionInfoRef shared(state_info.shared_info().ToHandleChecked());
// Use the ArgumentsAccessStub for materializing both mapped and unmapped
// arguments object, but only for non-inlined (i.e. outermost) frames.
@ -177,7 +177,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
switch (type) {
case CreateArgumentsType::kMappedArguments: {
// TODO(mstarzinger): Duplicate parameters are not handled yet.
if (shared->has_duplicate_parameters()) return NoChange();
if (shared.has_duplicate_parameters()) return NoChange();
Node* const callee = NodeProperties::GetValueInput(node, 0);
Node* const context = NodeProperties::GetContextInput(node);
Node* effect = NodeProperties::GetEffectInput(node);
@ -185,7 +185,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->ArgumentsFrame());
Node* const arguments_length = graph()->NewNode(
simplified()->ArgumentsLength(
shared->internal_formal_parameter_count(), false),
shared.internal_formal_parameter_count(), false),
arguments_frame);
// Allocate the elements backing store.
bool has_aliased_arguments = false;
@ -193,11 +193,12 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect, control, context, arguments_frame, arguments_length, shared,
&has_aliased_arguments);
// Load the arguments object map.
Node* const arguments_map = jsgraph()->HeapConstant(
handle(has_aliased_arguments
? native_context()->fast_aliased_arguments_map()
: native_context()->sloppy_arguments_map(),
isolate()));
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map(
js_heap_broker())
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
@ -218,15 +219,16 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->ArgumentsFrame());
Node* const arguments_length = graph()->NewNode(
simplified()->ArgumentsLength(
shared->internal_formal_parameter_count(), false),
shared.internal_formal_parameter_count(), false),
arguments_frame);
// Allocate the elements backing store.
Node* const elements = effect =
graph()->NewNode(simplified()->NewArgumentsElements(0),
arguments_frame, arguments_length, effect);
// Load the arguments object map.
Node* const arguments_map = jsgraph()->HeapConstant(
handle(native_context()->strict_arguments_map(), isolate()));
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().strict_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
@ -246,7 +248,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->ArgumentsFrame());
Node* const rest_length = graph()->NewNode(
simplified()->ArgumentsLength(
shared->internal_formal_parameter_count(), true),
shared.internal_formal_parameter_count(), true),
arguments_frame);
// Allocate the elements backing store. Since NewArgumentsElements
// copies from the end of the arguments adapter frame, this is a suffix
@ -255,8 +257,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->NewArgumentsElements(0),
arguments_frame, rest_length, effect);
// Load the JSArray object map.
Node* const jsarray_map = jsgraph()->HeapConstant(handle(
native_context()->js_array_fast_elements_map_index(), isolate()));
Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
// Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
@ -280,7 +284,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const context = NodeProperties::GetContextInput(node);
Node* effect = NodeProperties::GetEffectInput(node);
// TODO(mstarzinger): Duplicate parameters are not handled yet.
if (shared->has_duplicate_parameters()) return NoChange();
if (shared.has_duplicate_parameters()) return NoChange();
// Choose the correct frame state and frame state info depending on
// whether there conceptually is an arguments adaptor frame in the call
// chain.
@ -299,10 +303,12 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect, control, args_state, context, shared, &has_aliased_arguments);
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map.
Node* const arguments_map = jsgraph()->HeapConstant(handle(
has_aliased_arguments ? native_context()->fast_aliased_arguments_map()
: native_context()->sloppy_arguments_map(),
isolate()));
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map(
js_heap_broker())
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
@ -337,8 +343,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const elements = AllocateArguments(effect, control, args_state);
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map.
Node* const arguments_map = jsgraph()->HeapConstant(
handle(native_context()->strict_arguments_map(), isolate()));
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().strict_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
@ -353,7 +360,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
a.FinishAndChange(node);
return Changed(node);
} else if (type == CreateArgumentsType::kRestParameter) {
int start_index = shared->internal_formal_parameter_count();
int start_index = shared.internal_formal_parameter_count();
// Use inline allocation for all unmapped arguments objects within inlined
// (i.e. non-outermost) frames, independent of the object size.
Node* effect = NodeProperties::GetEffectInput(node);
@ -374,8 +381,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
AllocateRestArguments(effect, control, args_state, start_index);
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the JSArray object map.
Node* const jsarray_map = jsgraph()->HeapConstant(handle(
native_context()->js_array_fast_elements_map_index(), isolate()));
Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
// Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
@ -1502,14 +1511,14 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
// given {context}. Serves as backing store for JSCreateArguments nodes.
Node* JSCreateLowering::AllocateAliasedArguments(
Node* effect, Node* control, Node* frame_state, Node* context,
Handle<SharedFunctionInfo> shared, bool* has_aliased_arguments) {
const SharedFunctionInfoRef& shared, bool* has_aliased_arguments) {
FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
int argument_count = state_info.parameter_count() - 1; // Minus receiver.
if (argument_count == 0) return jsgraph()->EmptyFixedArrayConstant();
// If there is no aliasing, the arguments object elements are not special in
// any way, we can just return an unmapped backing store instead.
int parameter_count = shared->internal_formal_parameter_count();
int parameter_count = shared.internal_formal_parameter_count();
if (parameter_count == 0) {
return AllocateArguments(effect, control, frame_state);
}
@ -1555,11 +1564,11 @@ Node* JSCreateLowering::AllocateAliasedArguments(
// Serves as backing store for JSCreateArguments nodes.
Node* JSCreateLowering::AllocateAliasedArguments(
Node* effect, Node* control, Node* context, Node* arguments_frame,
Node* arguments_length, Handle<SharedFunctionInfo> shared,
Node* arguments_length, const SharedFunctionInfoRef& shared,
bool* has_aliased_arguments) {
// If there is no aliasing, the arguments object elements are not
// special in any way, we can just return an unmapped backing store.
int parameter_count = shared->internal_formal_parameter_count();
int parameter_count = shared.internal_formal_parameter_count();
if (parameter_count == 0) {
return graph()->NewNode(simplified()->NewArgumentsElements(0),
arguments_frame, arguments_length, effect);
@ -1850,6 +1859,10 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
return jsgraph()->simplified();
}
NativeContextRef JSCreateLowering::native_context_ref() const {
return NativeContextRef(native_context());
}
} // namespace compiler
} // namespace internal
} // namespace v8

6
src/compiler/js-create-lowering.h
View File

@ -80,11 +80,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
Node* AllocateRestArguments(Node* effect, Node* control, Node* frame_state,
int start_index);
Node* AllocateAliasedArguments(Node* effect, Node* control, Node* frame_state,
Node* context, Handle<SharedFunctionInfo>,
Node* context,
const SharedFunctionInfoRef& shared,
bool* has_aliased_arguments);
Node* AllocateAliasedArguments(Node* effect, Node* control, Node* context,
Node* arguments_frame, Node* arguments_length,
Handle<SharedFunctionInfo>,
const SharedFunctionInfoRef& shared,
bool* has_aliased_arguments);
Node* AllocateElements(Node* effect, Node* control,
ElementsKind elements_kind, int capacity,
@ -110,6 +111,7 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
JSGraph* jsgraph() const { return jsgraph_; }
Isolate* isolate() const;
Handle<Context> native_context() const { return native_context_; }
NativeContextRef native_context_ref() const;
CommonOperatorBuilder* common() const;
SimplifiedOperatorBuilder* simplified() const;
CompilationDependencies* dependencies() const { return dependencies_; }

38
src/compiler/js-heap-broker.cc
View File

@ -450,6 +450,44 @@ double FixedDoubleArrayRef::get_scalar(int i) const {
return object<FixedDoubleArray>()->get_scalar(i);
}
int SharedFunctionInfoRef::internal_formal_parameter_count() const {
AllowHandleDereference allow_handle_dereference;
return object<SharedFunctionInfo>()->internal_formal_parameter_count();
}
bool SharedFunctionInfoRef::has_duplicate_parameters() const {
AllowHandleDereference allow_handle_dereference;
return object<SharedFunctionInfo>()->has_duplicate_parameters();
}
MapRef NativeContextRef::fast_aliased_arguments_map(
const JSHeapBroker* broker) const {
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->fast_aliased_arguments_map(),
broker->isolate()));
}
MapRef NativeContextRef::sloppy_arguments_map(
const JSHeapBroker* broker) const {
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->sloppy_arguments_map(), broker->isolate()));
}
MapRef NativeContextRef::strict_arguments_map(
const JSHeapBroker* broker) const {
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->strict_arguments_map(), broker->isolate()));
}
MapRef NativeContextRef::js_array_fast_elements_map_index(
const JSHeapBroker* broker) const {
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(),
broker->isolate()));
}
} // namespace compiler
} // namespace internal
} // namespace v8

16
src/compiler/js-heap-broker.h
View File

@ -69,6 +69,7 @@ class HeapObjectType {
V(Name) \
V(NativeContext) \
V(ScriptContextTable) \
V(SharedFunctionInfo) \
V(Map)
#define HEAP_BROKER_KIND_LIST(V) \
@ -194,7 +195,13 @@ class ContextRef : public HeapObjectRef {
class NativeContextRef : public ContextRef {
public:
explicit NativeContextRef(Handle<Object> object);
ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const;
MapRef sloppy_arguments_map(const JSHeapBroker* broker) const;
MapRef strict_arguments_map(const JSHeapBroker* broker) const;
MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const;
};
class NameRef : public HeapObjectRef {
@ -282,6 +289,15 @@ class JSArrayRef : public JSObjectRef {
ObjectRef length(const JSHeapBroker* broker) const;
};
class SharedFunctionInfoRef : public HeapObjectRef {
public:
explicit SharedFunctionInfoRef(Handle<Object> object)
: HeapObjectRef(object) {}
int internal_formal_parameter_count() const;
bool has_duplicate_parameters() const;
};
} // namespace compiler
} // namespace internal
} // namespace v8