git.saurik.com Git - apple/javascriptcore.git/blob

1 /*

3 *

4 * Redistribution and use in source and binary forms, with or without

5 * modification, are permitted provided that the following conditions

6 * are met:

7 * 1. Redistributions of source code must retain the above copyright

8 * notice, this list of conditions and the following disclaimer.

9 * 2. Redistributions in binary form must reproduce the above copyright

10 * notice, this list of conditions and the following disclaimer in the

11 * documentation and/or other materials provided with the distribution.

12 *

13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

24 */

26 #include "config.h"

27 #include "PutByIdStatus.h"

29 #include "AccessorCallJITStubRoutine.h"

30 #include "CodeBlock.h"

31 #include "ComplexGetStatus.h"

32 #include "LLIntData.h"

33 #include "LowLevelInterpreter.h"

34 #include "JSCInlines.h"

35 #include "PolymorphicPutByIdList.h"

36 #include "Structure.h"

37 #include "StructureChain.h"

38 #include <wtf/ListDump.h>

40 namespace JSC {

 bool PutByIdStatus::appendVariant(const PutByIdVariant& variant)

43 {

     for (unsigned i = 0; i < m_variants.size(); ++i) {

         if (m_variants[i].attemptToMerge(variant))

46 return true;

47 }

     for (unsigned i = 0; i < m_variants.size(); ++i) {

         if (m_variants[i].oldStructure().overlaps(variant.oldStructure()))

50 return false;

51 }

52 m_variants.append(variant);

53 return true;

54 }

56 #if ENABLE(DFG_JIT)

 bool PutByIdStatus::hasExitSite(const ConcurrentJITLocker& locker, CodeBlock* profiledBlock, unsigned bytecodeIndex)

58 {

     return profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadCache))

         || profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadConstantCache));

62 }

63 #endif

 PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, UniquedStringImpl* uid)

66 {

67 UNUSED_PARAM(profiledBlock);

68 UNUSED_PARAM(bytecodeIndex);

69 UNUSED_PARAM(uid);

     Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;

     Structure* structure = instruction[4].u.structure.get();

73 if (!structure)

74 return PutByIdStatus(NoInformation);

     if (instruction[0].u.opcode == LLInt::getOpcode(op_put_by_id)

         || instruction[0].u.opcode == LLInt::getOpcode(op_put_by_id_out_of_line)) {

         PropertyOffset offset = structure->getConcurrently(uid);

         if (!isValidOffset(offset))

80 return PutByIdStatus(NoInformation);

         return PutByIdVariant::replace(structure, offset);

83 }

     ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());

     ASSERT(instruction[0].u.opcode == LLInt::getOpcode(op_put_by_id_transition_direct)

         || instruction[0].u.opcode == LLInt::getOpcode(op_put_by_id_transition_normal)

         || instruction[0].u.opcode == LLInt::getOpcode(op_put_by_id_transition_direct_out_of_line)

         || instruction[0].u.opcode == LLInt::getOpcode(op_put_by_id_transition_normal_out_of_line));

     Structure* newStructure = instruction[6].u.structure.get();

     StructureChain* chain = instruction[7].u.structureChain.get();

94 ASSERT(newStructure);

95 ASSERT(chain);

     PropertyOffset offset = newStructure->getConcurrently(uid);

     if (!isValidOffset(offset))

99 return PutByIdStatus(NoInformation);

100

101 RefPtr<IntendedStructureChain> intendedChain;

102 if (chain)

         intendedChain = adoptRef(new IntendedStructureChain(profiledBlock, structure, chain));

104

     return PutByIdVariant::transition(structure, newStructure, intendedChain.get(), offset);

106 }

107

 PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, StubInfoMap& map, unsigned bytecodeIndex, UniquedStringImpl* uid)

109 {

110 ConcurrentJITLocker locker(profiledBlock->m_lock);

111

112 UNUSED_PARAM(profiledBlock);

113 UNUSED_PARAM(bytecodeIndex);

114 UNUSED_PARAM(uid);

115 #if ENABLE(DFG_JIT)

     if (hasExitSite(locker, profiledBlock, bytecodeIndex))

117 return PutByIdStatus(TakesSlowPath);

118

     StructureStubInfo* stubInfo = map.get(CodeOrigin(bytecodeIndex));

120 PutByIdStatus result = computeForStubInfo(

121 locker, profiledBlock, stubInfo, uid,

         CallLinkStatus::computeExitSiteData(locker, profiledBlock, bytecodeIndex));

123 if (!result)

         return computeFromLLInt(profiledBlock, bytecodeIndex, uid);

125

126 return result;

127 #else // ENABLE(JIT)

128 UNUSED_PARAM(map);

129 return PutByIdStatus(NoInformation);

130 #endif // ENABLE(JIT)

131 }

132

133 #if ENABLE(JIT)

134 PutByIdStatus PutByIdStatus::computeForStubInfo(

     const ConcurrentJITLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo,

     UniquedStringImpl* uid, CallLinkStatus::ExitSiteData callExitSiteData)

137 {

138 if (!stubInfo)

139 return PutByIdStatus();

140

141 if (stubInfo->tookSlowPath)

142 return PutByIdStatus(TakesSlowPath);

143

144 if (!stubInfo->seen)

145 return PutByIdStatus();

146

147 switch (stubInfo->accessType) {

148 case access_unset:

149 // If the JIT saw it but didn't optimize it, then assume that this takes slow path.

150 return PutByIdStatus(TakesSlowPath);

151

152 case access_put_by_id_replace: {

153 PropertyOffset offset =

             stubInfo->u.putByIdReplace.baseObjectStructure->getConcurrently(uid);

         if (isValidOffset(offset)) {

             return PutByIdVariant::replace(

                 stubInfo->u.putByIdReplace.baseObjectStructure.get(), offset);

158 }

159 return PutByIdStatus(TakesSlowPath);

160 }

161

162 case access_put_by_id_transition_normal:

163 case access_put_by_id_transition_direct: {

         ASSERT(stubInfo->u.putByIdTransition.previousStructure->transitionWatchpointSetHasBeenInvalidated());

165 PropertyOffset offset =

             stubInfo->u.putByIdTransition.structure->getConcurrently(uid);

         if (isValidOffset(offset)) {

168 RefPtr<IntendedStructureChain> chain;

             if (stubInfo->u.putByIdTransition.chain) {

                 chain = adoptRef(new IntendedStructureChain(

                     profiledBlock, stubInfo->u.putByIdTransition.previousStructure.get(),

                     stubInfo->u.putByIdTransition.chain.get()));

173 }

             return PutByIdVariant::transition(

                 stubInfo->u.putByIdTransition.previousStructure.get(),

                 stubInfo->u.putByIdTransition.structure.get(),

177 chain.get(), offset);

178 }

179 return PutByIdStatus(TakesSlowPath);

180 }

181

182 case access_put_by_id_list: {

         PolymorphicPutByIdList* list = stubInfo->u.putByIdList.list;

184

185 PutByIdStatus result;

186 result.m_state = Simple;

187

188 State slowPathState = TakesSlowPath;

         for (unsigned i = 0; i < list->size(); ++i) {

             const PutByIdAccess& access = list->at(i);

191

             switch (access.type()) {

193 case PutByIdAccess::Setter:

194 case PutByIdAccess::CustomSetter:

195 slowPathState = MakesCalls;

196 break;

197 default:

198 break;

199 }

200 }

201

         for (unsigned i = 0; i < list->size(); ++i) {

             const PutByIdAccess& access = list->at(i);

204

205 PutByIdVariant variant;

206

             switch (access.type()) {

208 case PutByIdAccess::Replace: {

                 Structure* structure = access.structure();

                 PropertyOffset offset = structure->getConcurrently(uid);

                 if (!isValidOffset(offset))

212 return PutByIdStatus(slowPathState);

                 variant = PutByIdVariant::replace(structure, offset);

214 break;

215 }

216

217 case PutByIdAccess::Transition: {

218 PropertyOffset offset =

                     access.newStructure()->getConcurrently(uid);

                 if (!isValidOffset(offset))

221 return PutByIdStatus(slowPathState);

222 RefPtr<IntendedStructureChain> chain;

                 if (access.chain()) {

                     chain = adoptRef(new IntendedStructureChain(

                         profiledBlock, access.oldStructure(), access.chain()));

                     if (!chain->isStillValid())

227 continue;

228 }

                 variant = PutByIdVariant::transition(

                     access.oldStructure(), access.newStructure(), chain.get(), offset);

231 break;

232 }

233

234 case PutByIdAccess::Setter: {

                 Structure* structure = access.structure();

236

                 ComplexGetStatus complexGetStatus = ComplexGetStatus::computeFor(

                     profiledBlock, structure, access.chain(), access.chainCount(), uid);

239

                 switch (complexGetStatus.kind()) {

241 case ComplexGetStatus::ShouldSkip:

242 continue;

243

244 case ComplexGetStatus::TakesSlowPath:

245 return PutByIdStatus(slowPathState);

246

247 case ComplexGetStatus::Inlineable: {

                     AccessorCallJITStubRoutine* stub = static_cast<AccessorCallJITStubRoutine*>(

249 access.stubRoutine());

                     std::unique_ptr<CallLinkStatus> callLinkStatus =

251 std::make_unique<CallLinkStatus>(

252 CallLinkStatus::computeFor(

                                 locker, profiledBlock, *stub->m_callLinkInfo, callExitSiteData));

254

                     variant = PutByIdVariant::setter(

                         structure, complexGetStatus.offset(), complexGetStatus.chain(),

                         WTF::move(callLinkStatus));

258 } }

259 break;

260 }

261

262 case PutByIdAccess::CustomSetter:

263 return PutByIdStatus(MakesCalls);

264

265 default:

266 return PutByIdStatus(slowPathState);

267 }

268

             if (!result.appendVariant(variant))

270 return PutByIdStatus(slowPathState);

271 }

272

273 return result;

274 }

275

276 default:

277 return PutByIdStatus(TakesSlowPath);

278 }

279 }

280 #endif

281

 PutByIdStatus PutByIdStatus::computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin codeOrigin, UniquedStringImpl* uid)

283 {

284 #if ENABLE(DFG_JIT)

285 if (dfgBlock) {

286 CallLinkStatus::ExitSiteData exitSiteData;

287 {

288 ConcurrentJITLocker locker(baselineBlock->m_lock);

             if (hasExitSite(locker, baselineBlock, codeOrigin.bytecodeIndex))

290 return PutByIdStatus(TakesSlowPath);

             exitSiteData = CallLinkStatus::computeExitSiteData(

292 locker, baselineBlock, codeOrigin.bytecodeIndex);

293 }

294

295 PutByIdStatus result;

296 {

297 ConcurrentJITLocker locker(dfgBlock->m_lock);

298 result = computeForStubInfo(

                 locker, dfgBlock, dfgMap.get(codeOrigin), uid, exitSiteData);

300 }

301

302 // We use TakesSlowPath in some cases where the stub was unset. That's weird and

303 // it would be better not to do that. But it means that we have to defend

304 // ourselves here.

         if (result.isSimple())

306 return result;

307 }

308 #else

309 UNUSED_PARAM(dfgBlock);

310 UNUSED_PARAM(dfgMap);

311 #endif

312

     return computeFor(baselineBlock, baselineMap, codeOrigin.bytecodeIndex, uid);

314 }

315

 PutByIdStatus PutByIdStatus::computeFor(JSGlobalObject* globalObject, const StructureSet& set, UniquedStringImpl* uid, bool isDirect)

317 {

     if (parseIndex(*uid))

319 return PutByIdStatus(TakesSlowPath);

320

     if (set.isEmpty())

322 return PutByIdStatus();

323

324 PutByIdStatus result;

325 result.m_state = Simple;

     for (unsigned i = 0; i < set.size(); ++i) {

327 Structure* structure = set[i];

328

         if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)

330 return PutByIdStatus(TakesSlowPath);

331

         if (!structure->propertyAccessesAreCacheable())

333 return PutByIdStatus(TakesSlowPath);

334

335 unsigned attributes;

         PropertyOffset offset = structure->getConcurrently(uid, attributes);

         if (isValidOffset(offset)) {

338 if (attributes & CustomAccessor)

339 return PutByIdStatus(MakesCalls);

340

             if (attributes & (Accessor | ReadOnly))

342 return PutByIdStatus(TakesSlowPath);

343

             WatchpointSet* replaceSet = structure->propertyReplacementWatchpointSet(offset);

             if (!replaceSet || replaceSet->isStillValid()) {

346 // When this executes, it'll create, and fire, this replacement watchpoint set.

347 // That means that this has probably never executed or that something fishy is

348 // going on. Also, we cannot create or fire the watchpoint set from the concurrent

349 // JIT thread, so even if we wanted to do this, we'd need to have a lazy thingy.

350 // So, better leave this alone and take slow path.

351 return PutByIdStatus(TakesSlowPath);

352 }

353

             if (!result.appendVariant(PutByIdVariant::replace(structure, offset)))

355 return PutByIdStatus(TakesSlowPath);

356 continue;

357 }

358

359 // Our hypothesis is that we're doing a transition. Before we prove that this is really

360 // true, we want to do some sanity checks.

361

362 // Don't cache put transitions on dictionaries.

         if (structure->isDictionary())

364 return PutByIdStatus(TakesSlowPath);

365

366 // If the structure corresponds to something that isn't an object, then give up, since

367 // we don't want to be adding properties to strings.

         if (!structure->typeInfo().isObject())

369 return PutByIdStatus(TakesSlowPath);

370

371 RefPtr<IntendedStructureChain> chain;

372 if (!isDirect) {

             chain = adoptRef(new IntendedStructureChain(globalObject, structure));

374

375 // If the prototype chain has setters or read-only properties, then give up.

             if (chain->mayInterceptStoreTo(uid))

377 return PutByIdStatus(TakesSlowPath);

378

379 // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)

380 // then give up. The dictionary case would only happen if this structure has not been

381 // used in an optimized put_by_id transition. And really the only reason why we would

382 // bail here is that I don't really feel like having the optimizing JIT go and flatten

383 // dictionaries if we have evidence to suggest that those objects were never used as

384 // prototypes in a cacheable prototype access - i.e. there's a good chance that some of

385 // the other checks below will fail.

             if (structure->isProxy() || !chain->isNormalized())

387 return PutByIdStatus(TakesSlowPath);

388 }

389

390 // We only optimize if there is already a structure that the transition is cached to.

         Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, offset);

392 if (!transition)

393 return PutByIdStatus(TakesSlowPath);

         ASSERT(isValidOffset(offset));

395

         bool didAppend = result.appendVariant(

             PutByIdVariant::transition(structure, transition, chain.get(), offset));

398 if (!didAppend)

399 return PutByIdStatus(TakesSlowPath);

400 }

401

402 return result;

403 }

404

 bool PutByIdStatus::makesCalls() const

406 {

407 if (m_state == MakesCalls)

408 return true;

409

410 if (m_state != Simple)

411 return false;

412

     for (unsigned i = m_variants.size(); i--;) {

         if (m_variants[i].makesCalls())

415 return true;

416 }

417

418 return false;

419 }

420

 void PutByIdStatus::dump(PrintStream& out) const

422 {

423 switch (m_state) {

424 case NoInformation:

         out.print("(NoInformation)");

426 return;

427

428 case Simple:

         out.print("(", listDump(m_variants), ")");

430 return;

431

432 case TakesSlowPath:

         out.print("(TakesSlowPath)");

434 return;

435 case MakesCalls:

         out.print("(MakesCalls)");

437 return;

438 }

439

440 RELEASE_ASSERT_NOT_REACHED();

441 }

442

443 } // namespace JSC

444