ChangeLog

2013-11-18  Filip Pizlo  <fpizlo@apple.com>

        Infer constant global variables

        https://bugs.webkit.org/show_bug.cgi?id=124464

        Reviewed by NOBODY (OOPS!).

        All global variables that are candidates for watchpoint-based constant inference (i.e.

        not 'const' variables) will now have WatchpointSet's associated with them and those

        are used to drive the inference by tracking three states of each variable:

        Uninitialized: the variable's value is Undefined and the WatchpointSet state is

            ClearWatchpoint.

        Initialized: the variable's value was set to something (could even be explicitly set

            to Undefined) and the WatchpointSet state is IsWatching.

        Invalidated: the variable's value was set to something else (could even be the same

            thing as before but the point is that a put operation did execute again) and the

            WatchpointSet is IsInvalidated.

        If the compiler tries to compile a GetGlobalVar and the WatchpointSet state is

        IsWatching, then the current value of the variable can be folded in place of the get,

        and a watchpoint on the variable can be registered.

        We handle race conditions between the mutator and compiler by mandating that:

        - The mutator changes the WatchpointSet state after executing the put.

        - The compiler checks the WatchpointSet state prior to reading the value.

        The concrete algorithm used by the mutator is:

            1. Store the new value into the variable.

            --- Execute a store-store fence.

            2. Bump the state (ClearWatchpoing becomes IsWatching, IsWatching becomes

               IsInvalidated)

        The concrete algorithm that the compiler uses is:

            1. Load the state. If it's *not* IsWatching, then give up on constant inference.

            --- Execute a load-load fence.

            2. Load the value of the variable and use that for folding, while also registering

               a DesiredWatchpoint. The various parts of this step can be done in any order.

        The desired watchpoint registration will fail if the watchpoint set is already

        invalidated. Now consider the following interesting interleavings; note that the

        fences are omitted since they are just there to ensure sequential consistency:

        Uninitialized->M1->M2->C1->C2: Compiler sees IsWatching because of the mutator's store

            operation, and the variable is folded. The fencing ensures that C2 sees the value

            stored in M1 - i.e. we fold on the value that will actually be watchpointed. If

            before the compilation is installed the mutator executes another store then we

            will be sure that it will be a complete sequence of M1+M2 since compilations get

            installed at safepoints and never "in the middle" of a put_to_scope. Hence that

            compilation installation will be invalidated. If the M1+M2 sequence happens after

            the code is installed, then the code will be invalidated by triggering a jettison.

        Uninitialized->M1->C1->C2->M2: Compiler sees Uninitialized and will not fold. This is

            a sensible outcome since if the compiler read the variable's value, it would have

            seen Undefined.

        Uninitialized->C1->C2->M1->M2: Compiler sees Uninitialized and will not fold.

        Uninitialized->C1->M1->C2->M2: Compiler sees Uninitialized and will not fold.

        Uninitialized->C1->M1->M2->C2: Compiler sees Uninitialized and will not fold.

        Uninitialized->M1->C1->M2->C2: Compiler sees Uninitialized and will not fold.

        IsWatched->M1->M2->C1->C2: Compiler sees IsInvalidated and will not fold.

        IsWatched->M1->C1->C2->M2: Compiler will fold, but will also register a desired

            watchpoint, and that watchpoint will get invalidated before the code is installed.

        IsWatched->M1->C1->M2->C2: As above, will fold but the code will get invalidated.

        IsWatched->C1->C2->M1->M2: As above, will fold but the code will get invalidated.

        IsWatched->C1->M1->C2->M2: As above, will fold but the code will get invalidated.

        IsWatched->C1->M1->M2->C2: As above, will fold but the code will get invalidated.

        Note that this kind of reasoning shows why having the mutator first bump the state and

        then store the new value would be wrong. If we had done that (M1 = bump state, M2 =

        execute put) then we could have the following deadly interleavings:

        Uninitialized->M1->C1->C2->M2:

        Uninitialized->M1->C1->M2->C2: Mutator bumps the state to IsWatched and then the

            compiler folds Undefined, since M2 hasn't executed yet. Although C2 will set the

            watchpoint, M1 didn't notify it - it mearly initiated watching. M2 then stores a

            value other than Undefined, and you're toast.

        You could fix this sort of thing by making the Desired Watchpoints machinery more

        sophisticated, for example having it track the value that was folded; if the global

        variable's value was later found to be different then we could invalidate the

        compilation. I decided to instead just use the right interleaving.

        This is a 0.5% speed-up on SunSpider, mostly due to a 20% speed-up on math-cordic.

        It's a 0.6% slow-down on LongSpider, mostly due to a 25% slow-down on 3d-cube. This is

        because 3d-cube takes global variable assignment slow paths very often. Note that this

        3d-cube slow-down doesn't manifest as much in SunSpider (only 6% there). This patch is

        also a 1.5% speed-up on V8v7 and a 2.8% speed-up on Octane v1, mostly due to deltablue

        (3.7%), richards (4%), and mandreel (26%). This is a 2% speed-up on Kraken, mostly due

        to a 17.5% speed-up on imaging-gaussian-blur. Something that really illustrates the

        slam-dunk-itude of this patch is the wide range of speed-ups on JSRegress. Casual JS

        programming often leads to global-var-based idioms and those variables tend to be

        assigned once, leading to excellent constant folding opportunities in an optimizing

        JIT. This is very evident in the speed-ups on JSRegress.

        This still needs some porting and build love, but otherwise it's ready to review.

        * assembler/MacroAssemblerX86Common.h:

        (JSC::MacroAssemblerX86Common::memoryFence):

        * assembler/MacroAssemblerX86_64.h:

        (JSC::MacroAssemblerX86_64::load8):

        * assembler/X86Assembler.h:

        (JSC::X86Assembler::mfence):

        (JSC::X86Assembler::X86InstructionFormatter::threeByteOp):

        * bytecode/CodeBlock.cpp:

        (JSC::CodeBlock::CodeBlock):

        * bytecode/Watchpoint.cpp:

        (JSC::WatchpointSet::WatchpointSet):

        (JSC::WatchpointSet::add):

        (JSC::WatchpointSet::notifyWriteSlow):

        * bytecode/Watchpoint.h:

        (JSC::WatchpointSet::state):

        (JSC::WatchpointSet::isStillValid):

        (JSC::WatchpointSet::addressOfSetIsNotEmpty):

        * dfg/DFGAbstractInterpreterInlines.h:

        (JSC::DFG::::executeEffects):

        * dfg/DFGByteCodeParser.cpp:

        (JSC::DFG::ByteCodeParser::getJSConstantForValue):

        (JSC::DFG::ByteCodeParser::getJSConstant):

        (JSC::DFG::ByteCodeParser::parseBlock):

        * dfg/DFGClobberize.h:

        (JSC::DFG::clobberize):

        * dfg/DFGFixupPhase.cpp:

        (JSC::DFG::FixupPhase::fixupNode):

        * dfg/DFGNode.h:

        (JSC::DFG::Node::isStronglyProvedConstantIn):

        (JSC::DFG::Node::hasIdentifierNumberForCheck):

        (JSC::DFG::Node::hasRegisterPointer):

        * dfg/DFGNodeFlags.h:

        * dfg/DFGNodeType.h:

        * dfg/DFGOperations.cpp:

        * dfg/DFGOperations.h:

        * dfg/DFGPredictionPropagationPhase.cpp:

        (JSC::DFG::PredictionPropagationPhase::propagate):

        * dfg/DFGSafeToExecute.h:

        (JSC::DFG::safeToExecute):

        * dfg/DFGSpeculativeJIT.cpp:

        (JSC::DFG::SpeculativeJIT::compileNotifyPutGlobalVar):

        * dfg/DFGSpeculativeJIT.h:

        (JSC::DFG::SpeculativeJIT::callOperation):

        * dfg/DFGSpeculativeJIT64.cpp:

        (JSC::DFG::SpeculativeJIT::compile):

        * jit/JIT.h:

        * jit/JITOperations.h:

        * jit/JITPropertyAccess.cpp:

        (JSC::JIT::emitPutGlobalVar):

        (JSC::JIT::emit_op_put_to_scope):

        (JSC::JIT::emitSlow_op_put_to_scope):

        * llint/LowLevelInterpreter64.asm:

        * offlineasm/arm.rb:

        * offlineasm/arm64.rb:

        * offlineasm/cloop.rb:

        * offlineasm/instructions.rb:

        * offlineasm/x86.rb:

        * runtime/JSGlobalObject.cpp:

        (JSC::JSGlobalObject::addGlobalVar):

        * runtime/JSGlobalObject.h:

        (JSC::JSGlobalObject::addVar):

        (JSC::JSGlobalObject::addConst):

        (JSC::JSGlobalObject::addFunction):

        * runtime/JSScope.cpp:

        (JSC::abstractAccess):

        * runtime/SymbolTable.cpp:

        (JSC::SymbolTableEntry::couldBeWatched):

        (JSC::SymbolTableEntry::prepareToWatch):

        (JSC::SymbolTableEntry::notifyWriteSlow):

        * runtime/SymbolTable.h:

2013-11-18  Michael Saboff  <msaboff@apple.com>

        ARM64 CRASH: Debug builds crash in emitPointerValidation()

159479

Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

@@public:

#endif

        m_assembler.movb_rm(src, address.offset, address.base, address.index, address.scale);

    }

    
    void store8(RegisterID src, Address address)

    {

#if CPU(X86)

        // On 32-bit x86 we can only store from the first 4 registers;

        // esp..edi are mapped to the 'h' registers!

        if (src >= 4) {

            // Pick a temporary register.

            RegisterID temp = getUnusedRegister(address);

            // Swap to the temporary register to perform the store.

            swap(src, temp);

            m_assembler.movb_rm(temp, address.offset, address.base);

            swap(src, temp);

            return;

        }

#endif

        m_assembler.movb_rm(src, address.offset, address.base);

    }

    void store16(RegisterID src, BaseIndex address)

    {

@@public:

    {

        m_assembler.nop();

    }

    
    void memoryFence()

    {

        m_assembler.mfence();

    }

    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)

    {

159462

Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h

@@public:

    using MacroAssemblerX86Common::branchAdd32;

    using MacroAssemblerX86Common::or32;

    using MacroAssemblerX86Common::sub32;

50 using MacroAssemblerX86Common::load8;

    using MacroAssemblerX86Common::load32;

    using MacroAssemblerX86Common::store32;

    using MacroAssemblerX86Common::store8;

@@public:

        move(TrustedImmPtr(address.m_ptr), scratchRegister);

        sub32(imm, Address(scratchRegister));

    }

    
    void load8(const void* address, RegisterID dest)

    {

        move(TrustedImmPtr(address), dest);

        load8(dest, dest);

    }

    void load32(const void* address, RegisterID dest)

    {

@@public:

        store8(imm, Address(scratchRegister));

    }

    void store8(RegisterID reg, void* address)

    {

        move(TrustedImmPtr(address), scratchRegister);

        store8(reg, Address(scratchRegister));

    }

    Call call()

    {

        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);

159462

Source/JavaScriptCore/assembler/X86Assembler.h

@@private:

        OP2_MOVD_EdVd       = 0x7E,

        OP2_JCC_rel32       = 0x80,

        OP_SETCC            = 0x90,

270 OP2_3BYTE_ESCAPE = 0xAE,

        OP2_IMUL_GvEv       = 0xAF,

        OP2_MOVZX_GvEb      = 0xB6,

        OP2_MOVSX_GvEb      = 0xBE,

@@private:

        OP2_PSRLQ_UdqIb     = 0x73,

        OP2_POR_VdqWdq      = 0XEB,

    } TwoByteOpcodeID;

    
    typedef enum {

        OP3_MFENCE          = 0xF0,

    } ThreeByteOpcodeID;

    TwoByteOpcodeID jccRel32(Condition cond)

    {

@@public:

        m_formatter.immediate8(imm);

    }

    void movb_rm(RegisterID src, int offset, RegisterID base)

    {

        m_formatter.oneByteOp8(OP_MOV_EbGb, src, base, offset);

    }

    void movb_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)

    {

        m_formatter.oneByteOp8(OP_MOV_EbGb, src, base, index, scale, offset);

@@public:

        m_formatter.prefix(PRE_SSE_F2);

        m_formatter.twoByteOp(OP2_SQRTSD_VsdWsd, (RegisterID)dst, (RegisterID)src);

    }

1876

1886

    // Misc instructions:

    void int3()

@@public:

    {

        m_formatter.prefix(PRE_PREDICT_BRANCH_NOT_TAKEN);

    }

    
    void mfence()

    {

        m_formatter.threeByteOp(OP3_MFENCE);

    }

    // Assembler admin methods:

@@private:

        }

#endif

        void threeByteOp(ThreeByteOpcodeID opcode)

        {

            m_buffer.ensureSpace(maxInstructionSize);

            m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);

            m_buffer.putByteUnchecked(OP2_3BYTE_ESCAPE);

            m_buffer.putByteUnchecked(opcode);

        }

#if CPU(X86_64)

        // Quad-word-sized operands:

        //

@@private:

            registerModRM(reg, rm);

        }

        void oneByteOp8(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)

        {

            m_buffer.ensureSpace(maxInstructionSize);

            emitRexIf(byteRegRequiresRex(reg) || byteRegRequiresRex(base), reg, 0, base);

            m_buffer.putByteUnchecked(opcode);

            memoryModRM(reg, base, offset);

        }

        void oneByteOp8(OneByteOpcodeID opcode, int reg, RegisterID base, RegisterID index, int scale, int offset)

        {

            m_buffer.ensureSpace(maxInstructionSize);

159462

Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@CodeBlock::CodeBlock(ScriptExecutable* o

            if (entry.isNull())

                break;

            // It's likely that we'll write to this var, so notify now and avoid the overhead of doing so at runtime.

            entry.notifyWrite();

            instructions[i + 0] = vm()->interpreter->getOpcode(op_init_global_const);

            instructions[i + 1] = &m_globalObject->registerAt(entry.getIndex());

            break;

159462

Source/JavaScriptCore/bytecode/Watchpoint.cpp

@@Watchpoint::~Watchpoint()

WatchpointSet::WatchpointSet(WatchpointState state)

    : m_state(state)

43 , m_setIsNotEmpty(false)

{

}

@@void WatchpointSet::add(Watchpoint* watc

    if (!watchpoint)

        return;

    m_set.push(watchpoint);

64 m_setIsNotEmpty = true;

    m_state = IsWatched;

}

@@void WatchpointSet::notifyWriteSlow()

{

    ASSERT(state() == IsWatched);

72 WTF::storeStoreFence();

    fireAllWatchpoints();

    m_state = IsInvalidated;

    WTF::storeStoreFence();

159462

Source/JavaScriptCore/bytecode/Watchpoint.h

@@public:

    WatchpointSet(WatchpointState);

    ~WatchpointSet(); // Note that this will not fire any of the watchpoints; if you need to know when a WatchpointSet dies then you need a separate mechanism for this.

62 WatchpointState state() const { return static_cast<WatchpointState>(m_state); }

    // It is safe to call this from another thread. It may return an old

    // state. Guarantees that if *first* read the state() of the thing being

    // watched and it returned IsWatched and *second* you actually read its

    // value then it's safe to assume that if the state being watched changes

    // then also the watchpoint state() will change to IsInvalidated.

    WatchpointState state() const

    {

        WTF::loadLoadFence();

        WatchpointState result = static_cast<WatchpointState>(m_state);

        WTF::loadLoadFence();

        return result;

    }

    
    // It is safe to call this from another thread.  It may return true

    // even if the set actually had been invalidated, but that ought to happen

@@public:

    // issuing a load-load fence prior to querying the state.

    bool isStillValid() const

    {

72 WTF::loadLoadFence();

        return state() != IsInvalidated;

    }

    // Like isStillValid(), may be called from another thread.

@@public:

    }

    int8_t* addressOfState() { return &m_state; }

112 int8_t* addressOfSetIsNotEmpty() { return &m_setIsNotEmpty; }

    
    JS_EXPORT_PRIVATE void notifyWriteSlow(); // Call only if you've checked isWatched.

@@private:

    
    SentinelLinkedList<Watchpoint, BasicRawSentinelNode<Watchpoint>> m_set;

    int8_t m_state;

123 int8_t m_setIsNotEmpty;

};

// InlineWatchpointSet is a low-overhead, non-copyable watchpoint set in which

159462

Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@bool AbstractInterpreter<AbstractStateTy

        break;

    case PutGlobalVar:

1514 case NotifyPutGlobalVar:

        break;

    case CheckHasInstance:

159462

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@private:

    // constant folding. I.e. creating constants using this if we had constant

    // field inference would be a bad idea, since the bytecode parser's folding

    // doesn't handle liveness preservation.

519 Node* getJSConstantForValue(JSValue constantValue)

519 Node* getJSConstantForValue(JSValue constantValue, NodeFlags flags = NodeIsStaticConstant)

    {

        unsigned constantIndex;

        if (!m_codeBlock->findConstant(constantValue, constantIndex)) {

@@private:

        
        ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

529 return getJSConstant(constantIndex);

529 return getJSConstant(constantIndex, flags);

530530 }

531531

532 Node* getJSConstant(unsigned constant)

532 Node* getJSConstant(unsigned constant, NodeFlags flags = NodeIsStaticConstant)

    {

        Node* node = m_constants[constant].asJSValue;

        if (node)

            return node;

        Node* result = addToGraph(JSConstant, OpInfo(constant));

539 result->mergeFlags(flags);

        m_constants[constant].asJSValue = result;

        return result;

    }

@@bool ByteCodeParser::parseBlock(unsigned

                addToGraph(GlobalVarWatchpoint, OpInfo(operand), OpInfo(identifierNumber));

                JSValue specificValue = globalObject->registerAt(entry.getIndex()).get();

3103 set(VirtualRegister(dst), cellConstant(specificValue.asCell()));

                if (specificValue.isCell())

                    set(VirtualRegister(dst), cellConstant(specificValue.asCell()));

                else

                    set(VirtualRegister(dst), getJSConstantForValue(specificValue, 0));

                break;

            }

            case ClosureVar:

@@bool ByteCodeParser::parseBlock(unsigned

            ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();

            StringImpl* uid = m_graph.identifiers()[identifierNumber];

3126 Structure* structure;

3130 Structure* structure = 0;

3131 WatchpointSet* watchpoints = 0;

            uintptr_t operand;

            {

                ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

                if (resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks)

3131 structur~~e = 0~~;

3136 watchpoints = currentInstruction[5].u.watchpointSet;

                else

                    structure = currentInstruction[5].u.structure.get();

                operand = reinterpret_cast<uintptr_t>(currentInstruction[6].u.pointer);

@@bool ByteCodeParser::parseBlock(unsigned

            }

            case GlobalVar:

            case GlobalVarWithVarInjectionChecks: {

3156 addToGraph(Phantom, get(VirtualRegister(scope)));

31573161 SymbolTableEntry entry = globalObject->symbolTable()->get(uid);

3158 ASSERT(~~!entry.couldBeWatched() || !m_graph.~~watchpoints~~().isStillValid(~~entry.watchpointSet()));

3162 ASSERT(watchpoints == entry.watchpointSet());

31593163 addToGraph(PutGlobalVar, OpInfo(operand), get(VirtualRegister(value)));

3164 if (watchpoints->state() != IsInvalidated)

3165 addToGraph(NotifyPutGlobalVar, OpInfo(operand), OpInfo(identifierNumber));

                // Keep scope alive until after put.

                addToGraph(Phantom, get(VirtualRegister(scope)));

                break;

159462

Source/JavaScriptCore/dfg/DFGClobberize.h

@@void clobberize(Graph& graph, Node* node

    case InvalidationPoint:

        write(SideState);

        return;

        
    case NotifyPutGlobalVar:

        write(Watchpoint_fire);

        return;

    case CreateActivation:

    case CreateArguments:

159462

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@private:

        case GetClosureVar:

        case GetGlobalVar:

        case PutGlobalVar:

906 case NotifyPutGlobalVar:

        case GlobalVarWatchpoint:

        case VarInjectionWatchpoint:

        case AllocationProfileWatchpoint:

159462

Source/JavaScriptCore/dfg/DFGNode.h

@@struct Node {

    
    bool isStronglyProvedConstantIn(InlineCallFrame* inlineCallFrame)

    {

362 return isConstant() && codeOrigin.inlineCallFrame == inlineCallFrame;

362 return !!(flags() & NodeIsStaticConstant)

363 && codeOrigin.inlineCallFrame == inlineCallFrame;

    }

    bool isStronglyProvedConstantIn(const CodeOrigin& codeOrigin)

@@struct Node {

    
    bool hasIdentifierNumberForCheck()

    {

752 return op() == GlobalVarWatchpoint;

753 return op() == GlobalVarWatchpoint || op() == NotifyPutGlobalVar;

    }

    unsigned identifierNumberForCheck()

@@struct Node {

    
    bool hasRegisterPointer()

    {

763 return op() == GetGlobalVar || op() == PutGlobalVar || op() == GlobalVarWatchpoint;

764 return op() == GetGlobalVar || op() == PutGlobalVar || op() == GlobalVarWatchpoint || op() == NotifyPutGlobalVar;

    }

    WriteBarrier<Unknown>* registerPointer()

159462

Source/JavaScriptCore/dfg/DFGNodeFlags.h

@@namespace JSC { namespace DFG {

#define NodeExitsForward                 0x8000

73#define NodeIsStaticConstant 0x10000 // Used only by the parser, to determine if a constant arose statically and hence could be folded at parse-time.

74

typedef uint32_t NodeFlags;

static inline bool bytecodeUsesAsNumber(NodeFlags flags)

159462

Source/JavaScriptCore/dfg/DFGNodeType.h

@@namespace JSC { namespace DFG {

    macro(PutClosureVar, NodeMustGenerate) \

    macro(GetGlobalVar, NodeResultJS) \

    macro(PutGlobalVar, NodeMustGenerate) \

187 macro(NotifyPutGlobalVar, NodeMustGenerate) \

    macro(GlobalVarWatchpoint, NodeMustGenerate) \

    macro(VarInjectionWatchpoint, NodeMustGenerate) \

    macro(CheckFunction, NodeMustGenerate) \

159462

Source/JavaScriptCore/dfg/DFGOperations.cpp

@@char* JIT_OPERATION operationSwitchStrin

    return static_cast<char*>(exec->codeBlock()->stringSwitchJumpTable(tableIndex).ctiForValue(string->value(exec).impl()).executableAddress());

}

void JIT_OPERATION operationNotifyWrite(ExecState* exec, WatchpointSet* set)

{

    VM& vm = exec->vm();

    NativeCallFrameTracer tracer(&vm, exec);

    set->notifyWrite();

}

double JIT_OPERATION operationFModOnInts(int32_t a, int32_t b)

{

    return fmod(a, b);

159462

Source/JavaScriptCore/dfg/DFGOperations.h

@@JSCell* JIT_OPERATION operationMakeRope2

JSCell* JIT_OPERATION operationMakeRope3(ExecState*, JSString*, JSString*, JSString*);

char* JIT_OPERATION operationFindSwitchImmTargetForDouble(ExecState*, EncodedJSValue, size_t tableIndex);

char* JIT_OPERATION operationSwitchString(ExecState*, size_t tableIndex, JSString*);

128void JIT_OPERATION operationNotifyWrite(ExecState*, WatchpointSet*);

#if ENABLE(FTL_JIT)

// FIXME: Make calls work well. Currently they're a pure regression.

159462

Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@private:

        case CheckTierUpInLoop:

        case CheckTierUpAtReturn:

        case CheckTierUpAndOSREnter:

518 case InvalidationPoint: {

        case InvalidationPoint:

        case Int52ToValue:

        case Int52ToDouble: {

            // This node should never be visible at this stage of compilation. It is

            // inserted by fixup(), which follows this phase.

            RELEASE_ASSERT_NOT_REACHED();

@@private:

        case CheckWatchdogTimer:

        case Unreachable:

        case LoopHint:

583 case Int52ToValue:

584 case Int52ToDouble:

585 case NotifyPutGlobalVar:

            break;

        // This gets ignored because it already has a prediction.

159462

Source/JavaScriptCore/dfg/DFGSafeToExecute.h

@@bool safeToExecute(AbstractStateType& st

    case Int52ToDouble:

    case Int52ToValue:

    case InvalidationPoint:

245 case NotifyPutGlobalVar:

        return true;

    case GetByVal:

159462

Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@void SpeculativeJIT::compile(Node* node)

        noResult(node);

        break;

    }

        
    case NotifyPutGlobalVar: {

        compileNotifyPutGlobalVar(node);

        break;

    }

    case VarInjectionWatchpoint: {

        noResult(node);

159462

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@void SpeculativeJIT::emitSwitch(Node* no

    RELEASE_ASSERT_NOT_REACHED();

}

void SpeculativeJIT::compileNotifyPutGlobalVar(Node* node)

{

    WatchpointSet* set = m_jit.globalObjectFor(node->codeOrigin)->symbolTable()->get(

        m_jit.graph().identifiers()[node->identifierNumberForCheck()]).watchpointSet();

    GPRTemporary temp(this);

    GPRReg tempGPR = temp.gpr();

    m_jit.load8(set->addressOfState(), tempGPR);

    JITCompiler::JumpList ready;

    ready.append(m_jit.branch32(JITCompiler::Equal, tempGPR, TrustedImm32(IsInvalidated)));

    if (set->state() == ClearWatchpoint) {

        JITCompiler::Jump isWatched =

            m_jit.branch32(JITCompiler::NotEqual, tempGPR, TrustedImm32(ClearWatchpoint));

        m_jit.store8(TrustedImm32(IsWatched), set->addressOfState());

        ready.append(m_jit.jump());

        isWatched.link(&m_jit);

    }

    JITCompiler::Jump slowCase = m_jit.branchTest8(

        JITCompiler::NonZero, JITCompiler::AbsoluteAddress(set->addressOfSetIsNotEmpty()));

    m_jit.store8(TrustedImm32(IsInvalidated), set->addressOfState());

    ready.link(&m_jit);

    addSlowPathGenerator(

        slowPathCall(slowCase, this, operationNotifyWrite, NoResult, set));

    m_jit.memoryFence();

    noResult(node);

}

void SpeculativeJIT::addBranch(const MacroAssembler::JumpList& jump, BasicBlock* destination)

{

    for (unsigned i = jump.jumps().size(); i--;)

159462

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@public:

        return appendCallWithExceptionCheck(operation);

    }

1087 JITCompiler::Call callOperation(V_JITOperation_W operation, WatchpointSet* watchpointSet)

1087 JITCompiler::Call callOperation(V_JITOperation_EW operation, WatchpointSet* watchpointSet)

10881088 {

1089 m_jit.setupArguments(TrustedImmPtr(watchpointSet));

1089 m_jit.setupArgumentsWithExecState(TrustedImmPtr(watchpointSet));

        return appendCall(operation);

    }

@@public:

    void compileNewFunctionExpression(Node*);

    bool compileRegExpExec(Node*);

2048 void compileNotifyPutGlobalVar(Node*);

2049

    // size can be an immediate or a register, and must be in bytes. If size is a register,

    // it must be a different register than resultGPR. Emits code that place a pointer to

    // the end of the allocation. The returned jump is the jump to the slow path.

159462

Source/JavaScriptCore/jit/JIT.h

@@namespace JSC {

        void emitGetGlobalVar(uintptr_t operand);

        void emitGetClosureVar(int scope, uintptr_t operand);

        void emitPutGlobalProperty(uintptr_t* operandSlot, int value);

616 void emitPutGlobalVar(uintptr_t operand, int value);

616 void emitPutGlobalVar(uintptr_t operand, int value, WatchpointSet*);

        void emitPutClosureVar(int scope, uintptr_t operand, int value);

        void emitInitRegister(int dst);

159462

Source/JavaScriptCore/jit/JITOperations.h

@@typedef void JIT_OPERATION (*V_JITOperat

typedef void JIT_OPERATION (*V_JITOperation_EPc)(ExecState*, Instruction*);

typedef void JIT_OPERATION (*V_JITOperation_EPZJ)(ExecState*, void*, int32_t, EncodedJSValue);

typedef void JIT_OPERATION (*V_JITOperation_ESsiJJI)(ExecState*, StructureStubInfo*, EncodedJSValue, EncodedJSValue, StringImpl*);

157 typedef void JIT_OPERATION (*V_JITOperation_W)(WatchpointSet*);

157typedef void JIT_OPERATION (*V_JITOperation_EW)(ExecState*, WatchpointSet*);

typedef void JIT_OPERATION (*V_JITOperation_EZ)(ExecState*, int32_t);

typedef void JIT_OPERATION (*V_JITOperation_EVm)(ExecState*, VM*);

typedef char* JIT_OPERATION (*P_JITOperation_E)(ExecState*);

159462

Source/JavaScriptCore/jit/JITPropertyAccess.cpp

@@void JIT::emitPutGlobalProperty(uintptr_

    storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));

}

774 void JIT::emitPutGlobalVar(uintptr_t operand, int value)

774void JIT::emitPutGlobalVar(uintptr_t operand, int value, WatchpointSet* set)

775775{

    if (set && set->state() != IsInvalidated) {

        load8(set->addressOfState(), regT1);

        JumpList ready;

        ready.append(branch32(Equal, regT1, TrustedImm32(IsInvalidated)));

        if (set->state() == ClearWatchpoint) {

            Jump isWatched = branch32(NotEqual, regT1, TrustedImm32(ClearWatchpoint));

            move(TrustedImm32(IsWatched), regT1);

            ready.append(jump());

            isWatched.link(this);

        }

        addSlowCase(branchTest8(NonZero, AbsoluteAddress(set->addressOfSetIsNotEmpty())));

        move(TrustedImm32(IsInvalidated), regT1);

        ready.link(this);

    }

776797 emitGetVirtualRegister(value, regT0);

777798 storePtr(regT0, reinterpret_cast<void*>(operand));

    
    if (set && set->state() != IsInvalidated) {

        memoryFence();

        store8(regT1, set->addressOfState());

    }

}

void JIT::emitPutClosureVar(int scope, uintptr_t operand, int value)

@@void JIT::emit_op_put_to_scope(Instructi

    case GlobalVar:

    case GlobalVarWithVarInjectionChecks:

        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));

805 emitPutGlobalVar(*operandSlot, value);

831 emitPutGlobalVar(*operandSlot, value, currentInstruction[5].u.watchpointSet);

        break;

    case ClosureVar:

    case ClosureVarWithVarInjectionChecks:

@@void JIT::emit_op_put_to_scope(Instructi

void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();

821 if (resolveType == GlobalVar || resolveType == ClosureVar)

    unsigned linkCount = 0;

    if (resolveType != GlobalVar && resolveType != ClosureVar)

        linkCount++;

    if ((resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks)

        && currentInstruction[5].u.watchpointSet->state() != IsInvalidated)

        linkCount++;

    if (!linkCount)

822854 return;

823

824 linkSlowCase(iter);

855 while (linkCount--)

856 linkSlowCase(iter);

    callOperation(operationPutToScope, currentInstruction);

}

159462

Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@macro putProperty()

end

macro putGlobalVar()

    loadpFromInstruction(5, t2)

    loadb WatchpointSet::m_state[t2], t3

    bieq t3, IsInvalidated, .ready

    bineq t3, ClearWatchpoint, .needToInvalidate

    move IsWatched, t3

    jmp .ready

.needToInvalidate:

    btbnz WatchpointSet::m_setIsNotEmpty[t2], .pDynamic

    move IsInvalidated, t3

.ready:

    loadisFromInstruction(3, t0)

    loadConstantOrVariable(t0, t1)

    loadpFromInstruction(6, t0)

    storeq t1, [t0]

1972 memfence

1973 storeb t3, WatchpointSet::m_state[t2]

end

macro putClosureVar()

159462

Source/JavaScriptCore/offlineasm/arm64.rb

@@class Instruction

            operands[0].arm64EmitLea(operands[1], :ptr)

        when "smulli"

            $asm.puts "smaddl #{operands[2].arm64Operand(:ptr)}, #{operands[0].arm64Operand(:int)}, #{operands[1].arm64Operand(:int)}, xzr"

810 when "memfence"

811 $asm.puts "dmb sy"

        else

            lowerDefault

        end

159462

Source/JavaScriptCore/offlineasm/arm.rb

@@class Instruction

        when "smulli"

            raise "Wrong number of arguments to smull in #{self.inspect} at #{codeOriginString}" unless operands.length == 4

            $asm.puts "smull #{operands[2].armOperand}, #{operands[3].armOperand}, #{operands[0].armOperand}, #{operands[1].armOperand}"

600 when "memfence"

601 $asm.puts "dmb sy"

        else

            lowerDefault

        end

159462

Source/JavaScriptCore/offlineasm/cloop.rb

@@class Instruction

            cloopEmitOpAndBranch(operands, "|", :int32, "== 0")

        when "borrinz"

            cloopEmitOpAndBranch(operands, "|", :int32, "!= 0")

1094

1095 when "memfence"

        when "pushCalleeSaves"

        when "popCalleeSaves"

159462

Source/JavaScriptCore/offlineasm/instructions.rb

@@MACRO_INSTRUCTIONS =

     "leai",

     "leap",

     "pushCalleeSaves",

253 "popCalleeSaves"

253 "popCalleeSaves",

254 "memfence"

    ]

X86_INSTRUCTIONS =

159462

Source/JavaScriptCore/offlineasm/x86.rb

@@class Instruction

            $asm.puts "leal #{operands[0].x86AddressOperand(:int)}, #{operands[1].x86Operand(:int)}"

        when "leap"

            $asm.puts "lea#{x86Suffix(:ptr)} #{operands[0].x86AddressOperand(:ptr)}, #{operands[1].x86Operand(:ptr)}"

1366 when "memfence"

1367 $asm.puts "mfence"

        else

            lowerDefault

        end

159462

Source/JavaScriptCore/runtime/JSGlobalObject.cpp

@@bool JSGlobalObject::defineOwnProperty(J

    return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);

}

213 int JSGlobalObject::addGlobalVar(const Identifier& ident, ConstantMode constantMode, ~~Function~~Mode ~~function~~Mode)

213int JSGlobalObject::addGlobalVar(const Identifier& ident, ConstantMode constantMode, VarAddMode varAddMode)

{

    ConcurrentJITLocker locker(symbolTable()->m_lock);

    int index = symbolTable()->size(locker);

    SymbolTableEntry newEntry(index, (constantMode == IsConstant) ? ReadOnly : 0);

218 if (~~functi~~onMode == Is~~FunctionToSpec~~ia~~liz~~e)

219 newEntry.~~attempt~~ToWatch();

218 if (constantMode == IsVariable)

219 newEntry.prepareToWatch(SymbolTableEntry::NotInitialized);

    SymbolTable::Map::AddResult result = symbolTable()->add(locker, ident.impl(), newEntry);

    if (result.isNewEntry)

        addRegisters(1);

223 else {

224 result.iterator->value.notifyWrite();

223 else

225224 index = result.iterator->value.getIndex();

226 }

225 if (constantMode == IsVariable && varAddMode == AddToInitialize)

226 result.iterator->value.notifyWrite();

    return index;

}

159462

Source/JavaScriptCore/runtime/JSGlobalObject.h

@@protected:

    }

    enum ConstantMode { IsConstant, IsVariable };

292 enum ~~Function~~Mode { ~~IsFu~~nc~~tionToSpec~~ialize~~, N~~o~~tFunctionOrNotSpec~~ializ~~abl~~e };

293 int addGlobalVar(const Identifier&, ConstantMode, ~~Function~~Mode);

292 enum VarAddMode { AddUninitialized, AddToInitialize };

293 int addGlobalVar(const Identifier&, ConstantMode, VarAddMode);

public:

    JS_EXPORT_PRIVATE ~JSGlobalObject();

@@public:

    void addVar(ExecState* exec, const Identifier& propertyName)

    {

        if (!hasProperty(exec, propertyName))

318 addGlobalVar(propertyName, IsVariable, No~~tFunctionOrNotSpec~~ializ~~abl~~e);

318 addGlobalVar(propertyName, IsVariable, AddUninitialized);

    }

    void addConst(ExecState* exec, const Identifier& propertyName)

    {

        if (!hasProperty(exec, propertyName))

323 addGlobalVar(propertyName, IsConstant, No~~tFunctionOrNotSpec~~ializ~~abl~~e);

323 addGlobalVar(propertyName, IsConstant, AddUninitialized);

    }

    void addFunction(ExecState* exec, const Identifier& propertyName, JSValue value)

    {

327 ~~bool propertyDidExist =~~ removeDirect(exec->vm(), propertyName); // Newly declared functions overwrite existing properties.

328 int index = addGlobalVar(propertyName, IsVariable, ~~!propertyDidExist ? IsFunctionToSpec~~ialize ~~: NotFunctionOrNotSpecializable~~);

327 removeDirect(exec->vm(), propertyName); // Newly declared functions overwrite existing properties.

328 int index = addGlobalVar(propertyName, IsVariable, AddToInitialize);

        registerAt(index).set(exec->vm(), this, value);

    }

159462

Source/JavaScriptCore/runtime/JSScope.cpp

@@static inline bool abstractAccess(ExecSt

    if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(scope)) {

        SymbolTableEntry entry = globalObject->symbolTable()->get(ident.impl());

        if (!entry.isNull()) {

            if (getOrPut == Put) {

                if (entry.isReadOnly()) {

                    // We know the property will be at global scope, but we don't know how to cache it.

                    op = ResolveOp(Dynamic, 0, 0, 0, 0);

                    return true;

                }

                // It's likely that we'll write to this var, so notify now and avoid the overhead of doing so at runtime.

                entry.notifyWrite();

            if (getOrPut == Put && entry.isReadOnly()) {

                // We know the property will be at global scope, but we don't know how to cache it.

                op = ResolveOp(Dynamic, 0, 0, 0, 0);

                return true;

            }

            op = ResolveOp(

159462

Source/JavaScriptCore/runtime/JSSymbolTableObject.h

@@inline bool symbolTablePut(

    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(object));

    WriteBarrierBase<Unknown>* reg;

126 WatchpointSet* set = 0;

    {

        SymbolTable& symbolTable = *object->symbolTable();

        GCSafeConcurrentJITLocker locker(symbolTable.m_lock, exec->vm().heap);

@@inline bool symbolTablePut(

                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);

            return true;

        }

140 if (UNLIKELY(wasFat))

141 iter->value.notifyWrite();

141 set = iter->value.watchpointSet();

        reg = &object->registerAt(fastEntry.getIndex());

    }

    // I'd prefer we not hold lock while executing barriers, since I prefer to reserve

    // the right for barriers to be able to trigger GC. And I don't want to hold VM

    // locks while GC'ing.

    reg->set(vm, object, value);

148 if (set)

149 set->notifyWrite();

    return true;

}

@@inline bool symbolTablePutWithAttributes

    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(object));

    WriteBarrierBase<Unknown>* reg;

161 WatchpointSet* set = 0;

    {

        SymbolTable& symbolTable = *object->symbolTable();

        ConcurrentJITLocker locker(symbolTable.m_lock);

@@inline bool symbolTablePutWithAttributes

            return false;

        SymbolTableEntry& entry = iter->value;

        ASSERT(!entry.isNull());

167 entry.no~~tifyWri~~te();

170 set = entry.watchpointSet();

        entry.setAttributes(attributes);

        reg = &object->registerAt(entry.getIndex());

    }

    reg->set(vm, object, value);

175 if (set)

176 set->notifyWrite();

    return true;

}

159462

Source/JavaScriptCore/runtime/SymbolTable.cpp

@@bool SymbolTableEntry::couldBeWatched()

    WatchpointSet* watchpoints = fatEntry()->m_watchpoints.get();

    if (!watchpoints)

        return false;

68 return watchpoints->isS~~tillValid~~();

68 return watchpoints->state() == IsWatched;

6969}

7070

71 void SymbolTableEntry::~~attempt~~ToWatch()

71void SymbolTableEntry::prepareToWatch(WatchState state)

7272{

7373 FatEntry* entry = inflate();

74 if (!entry->m_watchpoints)

75 entry->m_watchpoints = adoptRef(new WatchpointSet(IsWatched));

    ASSERT(!entry->m_watchpoints);

    entry->m_watchpoints = adoptRef(

        new WatchpointSet(state == AlreadyInitialized ? IsWatched : ClearWatchpoint));

}

void SymbolTableEntry::addWatchpoint(Watchpoint* watchpoint)

@@void SymbolTableEntry::notifyWriteSlow()

    WatchpointSet* watchpoints = fatEntry()->m_watchpoints.get();

    if (!watchpoints)

        return;

    
    if (watchpoints->state() == ClearWatchpoint) {

        watchpoints->startWatching();

        return;

    }

    watchpoints->notifyWrite();

}

159462

Source/JavaScriptCore/runtime/SymbolTable.h

@@struct SymbolTableEntry {

    
    bool couldBeWatched();

    // Notify an opportunity to create a watchpoint for a variable. This is

    // idempotent and fail-silent. It is idempotent in the sense that if

    // a watchpoint set had already been created, then another one will not

    // be created. Hence two calls to this method have the same effect as

    // one call. It is also fail-silent, in the sense that if a watchpoint

    // set had been created and had already been invalidated, then this will

    // just return. This means that couldBeWatched() may return false even

    // immediately after a call to attemptToWatch().

    void attemptToWatch();

223 enum WatchState { NotInitialized, AlreadyInitialized };

224 void prepareToWatch(WatchState);

    
    void addWatchpoint(Watchpoint*);

159462

LayoutTests/ChangeLog

2013-11-18  Filip Pizlo  <fpizlo@apple.com>

        Infer constant global variables

        https://bugs.webkit.org/show_bug.cgi?id=124464

        Reviewed by NOBODY (OOPS!).

        * js/regress/global-var-const-infer-expected.txt: Added.

        * js/regress/global-var-const-infer.html: Added.

        * js/regress/script-tests/global-var-const-infer.js: Added.

        (foo):

        (check):

2013-11-18  Sun-woo Nam  <sunny.nam@samsung.com>

        [EFL] Layout tests need to be rebaselined.

159479

LayoutTests/js/regress/global-var-const-infer-expected.txt

JSRegress/global-var-const-infer

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

PASS no exception thrown

PASS successfullyParsed is true

TEST COMPLETE

0

LayoutTests/js/regress/global-var-const-infer.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">

<html>

<head>

<script src="../resources/js-test-pre.js"></script>

</head>

<body>

<script src="resources/regress-pre.js"></script>

<script src="script-tests/global-var-const-infer.js"></script>

<script src="resources/regress-post.js"></script>

<script src="../resources/js-test-post.js"></script>

</body>

</html>

0

LayoutTests/js/regress/script-tests/global-var-const-infer.js

function foo() {

    return a + b;

}

noInline(foo);

var a = 4;

var b = 5;

function check(actual, expected) {

    if (actual == expected)

        return;

    throw "Error: expected " + expected + " but got " + actual;

}

for (var i = 0; i < 100; ++i)

    check(foo(), 9);

a = 6;

for (var i = 0; i < 1000; ++i)

    check(foo(), 11);

b = 7;

for (var i = 0; i < 10000; ++i)

    check(foo(), 13);

0