Attachment 341845 Details for Bug 186200 – Patch

[patch] Patch

bug-186200-20180602222353.patch (text/plain), 33.14 KB, created by Yusuke Suzuki on 2018-06-02 06:23:54 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2018-06-02 06:23:54 PDT

Size: 33.14 KB

patch

obsolete

>Subversion Revision: 232434
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 92185c85dc0048570d539a674b2cc31dbe8e33ac..61556a457c0d4d512eb54e9f3f852e5edbf0ec74 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,66 @@
>+2018-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
>+
>+        [JSC] Object.create should have intrinsic
>+        https://bugs.webkit.org/show_bug.cgi?id=186200
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Object.create is used in various JS code. `Object.create(null)` is particularly used
>+        to create empty plain object with null [[Prototype]]. We can find `Object.create(null)`
>+        call in ARES-6/Babylon code.
>+
>+        This patch adds ObjectCreateIntrinsic to JSC. DFG recognizes it and produces ObjectCreate
>+        DFG node. DFG AI and constant folding attempt to convert it to NewObject when prototype
>+        object is null. It offers significant performance boost for `Object.create(null)`.
>+
>+                                                         baseline                  patched
>+
>+        object-create-null                           53.7940+-1.5297     ^     19.8846+-0.6584        ^ definitely 2.7053x faster
>+        object-create-unknown-object-prototype       38.9977+-1.1364     ^     37.2207+-0.6143        ^ definitely 1.0477x faster
>+        object-create-untyped-prototype              22.5632+-0.6917           22.2539+-0.6876          might be 1.0139x faster
>+
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
>+        * dfg/DFGClobberize.h:
>+        (JSC::DFG::clobberize):
>+        * dfg/DFGConstantFoldingPhase.cpp:
>+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
>+        * dfg/DFGDoesGC.cpp:
>+        (JSC::DFG::doesGC):
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGNode.h:
>+        (JSC::DFG::Node::convertToNewObject):
>+        * dfg/DFGNodeType.h:
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileObjectCreate):
>+        * dfg/DFGSpeculativeJIT.h:
>+        * dfg/DFGSpeculativeJIT32_64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * ftl/FTLCapabilities.cpp:
>+        (JSC::FTL::canCompile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileObjectCreate):
>+        * runtime/Intrinsic.cpp:
>+        (JSC::intrinsicName):
>+        * runtime/Intrinsic.h:
>+        * runtime/JSGlobalObject.cpp:
>+        (JSC::JSGlobalObject::init):
>+        (JSC::JSGlobalObject::visitChildren):
>+        * runtime/JSGlobalObject.h:
>+        (JSC::JSGlobalObject::nullPrototypeObjectStructure const):
>+        * runtime/ObjectConstructor.cpp:
>+
> 2018-06-01  Wenson Hsieh  <wenson_hsieh@apple.com>
> 
>         Fix the watchOS build after r232385
>diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>index d490d421b0e8ed2ba6629a462660a251b10a6692..dae05fdc70d0c682458248c29f6d9fc1e85651c0 100644
>--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>@@ -2368,6 +2368,26 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>         setForNode(node, node->structure());
>         break;
> 
>+    case ObjectCreate: {
>+        if (JSValue base = forNode(node->child1()).m_value) {
>+            if (base.isNull()) {
>+                JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
>+                m_state.setFoundConstants(true);
>+                if (node->child1().useKind() == UntypedUse)
>+                    didFoldClobberWorld();
>+                setForNode(node, globalObject->nullPrototypeObjectStructure());
>+                break;
>+            }
>+            // FIXME: We should get a structure for a constant prototype. We need to allow concurrent
>+            // access to StructureCache from compiler threads.
>+            // https://bugs.webkit.org/show_bug.cgi?id=186199
>+        }
>+        if (node->child1().useKind() == UntypedUse)
>+            clobberWorld();
>+        setTypeForNode(node, SpecFinalObject);
>+        break;
>+    }
>+
>     case ToObject:
>     case CallObjectConstructor: {
>         AbstractValue& source = forNode(node->child1());
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index d9bd8503bc0912442edf07d5cd852bd4fd0e46aa..caf9f05363064d3e27d60b3b3d7d7f7471624108 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -2642,6 +2642,15 @@ bool ByteCodeParser::handleIntrinsicCall(Node* callee, int resultOperand, Intrin
>         return true;
>     }
> 
>+    case ObjectCreateIntrinsic: {
>+        if (argumentCountIncludingThis != 2)
>+            return false;
>+
>+        insertChecks();
>+        set(VirtualRegister(resultOperand), addToGraph(ObjectCreate, get(virtualRegisterForArgument(1, registerOffset))));
>+        return true;
>+    }
>+
>     case ObjectGetPrototypeOfIntrinsic: {
>         if (argumentCountIncludingThis != 2)
>             return false;
>diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
>index f781b15987ba04278333f848811e1a6c5c788d20..e19c749912e3ca5a71e19a37d55e7d8e96423621 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
>+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
>@@ -1489,6 +1489,23 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
>         return;
>     }
> 
>+    case ObjectCreate: {
>+        switch (node->child1().useKind()) {
>+        case ObjectUse:
>+            read(HeapObjectCount);
>+            write(HeapObjectCount);
>+            return;
>+        case UntypedUse:
>+            read(World);
>+            write(Heap);
>+            return;
>+        default:
>+            RELEASE_ASSERT_NOT_REACHED();
>+            return;
>+        }
>+    }
>+
>+
>     case NewObject:
>     case NewRegexp:
>     case NewStringObject:
>diff --git a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
>index 99976e00254c7ba5f7900dcc59c4fce6358ca805..74cf85d2f9e630867117220f7680ab8012724e51 100644
>--- a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
>@@ -737,6 +737,21 @@ class ConstantFoldingPhase : public Phase {
>                 break;
>             }
> 
>+            case ObjectCreate: {
>+                if (JSValue base = m_state.forNode(node->child1()).m_value) {
>+                    if (base.isNull()) {
>+                        JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
>+                        node->convertToNewObject(m_graph.registerStructure(globalObject->nullPrototypeObjectStructure()));
>+                        changed = true;
>+                        break;
>+                    }
>+                    // FIXME: We should get a structure for a constant prototype. We need to allow concurrent
>+                    // access to StructureCache from compiler threads.
>+                    // https://bugs.webkit.org/show_bug.cgi?id=186199
>+                }
>+                break;
>+            }
>+
>             case ToNumber: {
>                 if (m_state.forNode(node->child1()).m_type & ~SpecBytecodeNumber)
>                     break;
>diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>index e08d21ae4e123be93399d693512e6c561f9985b6..20bffecc9bc239ae686af197daf7eb27016b5c84 100644
>--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>@@ -324,6 +324,7 @@ bool doesGC(Graph& graph, Node* node)
>     case ToObject:
>     case ToThis:
>     case CreateThis:
>+    case ObjectCreate:
>     case AllocatePropertyStorage:
>     case ReallocatePropertyStorage:
>     case Arrayify:
>diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>index cd73ce298adcd726349a700c6cbbb59755ffe17e..2a7acc49560130e566cb3e98475cf41efc587474 100644
>--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>@@ -1446,6 +1446,15 @@ class FixupPhase : public Phase {
>             break;
>         }
> 
>+        case ObjectCreate: {
>+            if (node->child1()->shouldSpeculateObject()) {
>+                fixEdge<ObjectUse>(node->child1());
>+                node->clearFlags(NodeMustGenerate);
>+                break;
>+            }
>+            break;
>+        }
>+
>         case CheckStringIdent: {
>             fixEdge<StringIdentUse>(node->child1());
>             break;
>diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
>index 10b51fef423e28ec69c81434d781df714a1b0344..eee5e773be4b2f6ccade245be9ec7f3453af969a 100644
>--- a/Source/JavaScriptCore/dfg/DFGNode.h
>+++ b/Source/JavaScriptCore/dfg/DFGNode.h
>@@ -733,7 +733,7 @@ struct Node {
> 
>     void convertToNewObject(RegisteredStructure structure)
>     {
>-        ASSERT(m_op == CallObjectConstructor || m_op == CreateThis);
>+        ASSERT(m_op == CallObjectConstructor || m_op == CreateThis || m_op == ObjectCreate);
>         setOpAndDefaultFlags(NewObject);
>         children.reset();
>         m_opInfo = structure;
>diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
>index 52b7bb9f82896ea46ffb129f5b49293d64eff316..6164c7fa16098bbcfa76b1405a531685a55a0c44 100644
>--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
>+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
>@@ -255,6 +255,7 @@ namespace JSC { namespace DFG {
>     macro(CheckSubClass, NodeMustGenerate) \
>     macro(ParseInt, NodeMustGenerate | NodeResultJS) \
>     macro(GetPrototypeOf, NodeMustGenerate | NodeResultJS) \
>+    macro(ObjectCreate, NodeMustGenerate | NodeResultJS) \
>     \
>     /* Atomics object functions. */\
>     macro(AtomicsAdd, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>index 7777368d6babb7683fe2fef3d4d59527e2eaa074..26de11188561b5cd1bb900381a6f412c48a87fc6 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>@@ -248,6 +248,34 @@ EncodedJSValue JIT_OPERATION operationToThisStrict(ExecState* exec, EncodedJSVal
>     return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, StrictMode));
> }
> 
>+JSCell* JIT_OPERATION operationObjectCreate(ExecState* exec, EncodedJSValue encodedPrototype)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    JSValue prototype = JSValue::decode(encodedPrototype);
>+
>+    if (!prototype.isObject() && !prototype.isNull()) {
>+        throwVMTypeError(exec, scope, ASCIILiteral("Object prototype may only be an Object or null."));
>+        return nullptr;
>+    }
>+
>+    if (prototype.isObject()) {
>+        scope.release();
>+        return constructEmptyObject(exec, asObject(prototype));
>+    }
>+    scope.release();
>+    return constructEmptyObject(exec, exec->lexicalGlobalObject()->nullPrototypeObjectStructure());
>+}
>+
>+JSCell* JIT_OPERATION operationObjectCreateObject(ExecState* exec, JSObject* prototype)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+    return constructEmptyObject(exec, prototype);
>+}
>+
> JSCell* JIT_OPERATION operationCreateThis(ExecState* exec, JSObject* constructor, uint32_t inlineCapacity)
> {
>     VM& vm = exec->vm();
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
>index 6309ec38d8b5190a3afa6e26cae9c6775f0f455a..35bf6bceadb644d004c76c985f631d5233d007cd 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.h
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
>@@ -43,6 +43,8 @@ EncodedJSValue JIT_OPERATION operationStringFromCharCodeUntyped(ExecState*, Enco
> // These routines provide callbacks out to C++ implementations of operations too complex to JIT.
> JSCell* JIT_OPERATION operationCallObjectConstructor(ExecState*, JSGlobalObject*, EncodedJSValue encodedTarget) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationToObject(ExecState*, JSGlobalObject*, EncodedJSValue encodedTarget, UniquedStringImpl*) WTF_INTERNAL;
>+JSCell* JIT_OPERATION operationObjectCreate(ExecState*, EncodedJSValue) WTF_INTERNAL;
>+JSCell* JIT_OPERATION operationObjectCreateObject(ExecState*, JSObject*) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationCreateThis(ExecState*, JSObject* constructor, uint32_t inlineCapacity) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
> EncodedJSValue JIT_OPERATION operationToThisStrict(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index 5a6addb3c5acdf0de88c1c8de4588ac5d007e175..0119a25c4257d1addef405cf2898277d2780cb33 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -906,6 +906,7 @@ class PredictionPropagationPhase : public Phase {
>             break;
>         }
>             
>+        case ObjectCreate:
>         case CreateThis:
>         case NewObject: {
>             setPrediction(SpecFinalObject);
>diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>index b35078fd7033586b4e3cf719da83a6cff0e3caaf..93916d8fe21713f6e823532ddaed2e81b08a141c 100644
>--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>@@ -171,6 +171,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node, bool igno
>     case IdentityWithProfile:
>     case ToThis:
>     case CreateThis:
>+    case ObjectCreate:
>     case GetCallee:
>     case SetCallee:
>     case GetArgumentCountIncludingThis:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 73cee6a32369fc825309bce03a91b836a38c0b3d..6996d42ec53e7f92dd5de1686bbbefd270a10b7a 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -12172,6 +12172,47 @@ void SpeculativeJIT::compileToThis(Node* node)
>     jsValueResult(tempRegs, node);
> }
> 
>+void SpeculativeJIT::compileObjectCreate(Node* node)
>+{
>+    switch (node->child1().useKind()) {
>+    case ObjectUse: {
>+        SpeculateCellOperand prototype(this, node->child1());
>+
>+        GPRReg prototypeGPR = prototype.gpr();
>+
>+        speculateObject(node->child1(), prototypeGPR);
>+
>+        flushRegisters();
>+        GPRFlushedCallResult result(this);
>+        GPRReg resultGPR = result.gpr();
>+        callOperation(operationObjectCreateObject, resultGPR, prototypeGPR);
>+        m_jit.exceptionCheck();
>+
>+        cellResult(resultGPR, node);
>+        break;
>+    }
>+
>+    case UntypedUse: {
>+        JSValueOperand prototype(this, node->child1());
>+
>+        JSValueRegs prototypeRegs = prototype.jsValueRegs();
>+
>+        flushRegisters();
>+        GPRFlushedCallResult result(this);
>+        GPRReg resultGPR = result.gpr();
>+        callOperation(operationObjectCreate, resultGPR, prototypeRegs);
>+        m_jit.exceptionCheck();
>+
>+        cellResult(resultGPR, node);
>+        break;
>+    }
>+
>+    default:
>+        RELEASE_ASSERT_NOT_REACHED();
>+        break;
>+    }
>+}
>+
> void SpeculativeJIT::compileCreateThis(Node* node)
> {
>     // Note that there is not so much profit to speculate here. The only things we
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index 8b0419417ca7da205629949e861c59f45db4bfc5..848fd3bc144487fe8f33d9f5c70f0c9ccf387248 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -1472,6 +1472,7 @@ class SpeculativeJIT {
>     void compileNewArrayWithSize(Node*);
>     void compileNewTypedArray(Node*);
>     void compileToThis(Node*);
>+    void compileObjectCreate(Node*);
>     void compileCreateThis(Node*);
>     void compileNewObject(Node*);
>     void compileToPrimitive(Node*);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>index ac73b7bb45b6694554662cada849b0a1d87e44d9..a8967d2317ed801788a326fd038f799265c9a9a9 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>@@ -3132,6 +3132,11 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ObjectCreate: {
>+        compileObjectCreate(node);
>+        break;
>+    }
>+
>     case CreateThis: {
>         compileCreateThis(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index db193475f5a4d98d68655989bf4e591888983697..b70c211011e908d80e3389a1e81fb85ee04fe762 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -3382,6 +3382,11 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ObjectCreate: {
>+        compileObjectCreate(node);
>+        break;
>+    }
>+
>     case CreateThis: {
>         compileCreateThis(node);
>         break;
>diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>index 7b44b66eb621467acc348b422939b6b18ef516e0..dc6b68628db06b698337cc676bb7fdd32dcd3fe0 100644
>--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>@@ -191,6 +191,7 @@ inline CapabilityLevel canCompile(Node* node)
>     case ToObject:
>     case CallObjectConstructor:
>     case CallStringConstructor:
>+    case ObjectCreate:
>     case MakeRope:
>     case NewArrayWithSize:
>     case TryGetById:
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 71354b3ca822e91a0ebd4ea53f3c66a80d140390..56bfad5cf9f123446935d977ea96ce5cf9ec59db 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -838,6 +838,9 @@ class LowerDFGToB3 {
>         case CreateClonedArguments:
>             compileCreateClonedArguments();
>             break;
>+        case ObjectCreate:
>+            compileObjectCreate();
>+            break;
>         case NewObject:
>             compileNewObject();
>             break;
>@@ -5353,6 +5356,21 @@ class LowerDFGToB3 {
>         m_out.appendTo(continuation, lastNext);
>         setInt32(m_out.phi(Int32, zeroLengthResult, nonZeroLengthResult));
>     }
>+
>+    void compileObjectCreate()
>+    {
>+        switch (m_node->child1().useKind()) {
>+        case ObjectUse:
>+            setJSValue(vmCall(Int64, m_out.operation(operationObjectCreateObject), m_callFrame, lowObject(m_node->child1())));
>+            break;
>+        case UntypedUse:
>+            setJSValue(vmCall(Int64, m_out.operation(operationObjectCreate), m_callFrame, lowJSValue(m_node->child1())));
>+            break;
>+        default:
>+            RELEASE_ASSERT_NOT_REACHED();
>+            break;
>+        }
>+    }
>     
>     void compileNewObject()
>     {
>diff --git a/Source/JavaScriptCore/runtime/Intrinsic.cpp b/Source/JavaScriptCore/runtime/Intrinsic.cpp
>index 6652de04467b4615cd80ff753bf2da5cb990d980..801ed5493853fcaf37bf164d57afbf2dcc4f9ae7 100644
>--- a/Source/JavaScriptCore/runtime/Intrinsic.cpp
>+++ b/Source/JavaScriptCore/runtime/Intrinsic.cpp
>@@ -113,6 +113,8 @@ const char* intrinsicName(Intrinsic intrinsic)
>         return "RegExpTestFastIntrinsic";
>     case RegExpMatchFastIntrinsic:
>         return "RegExpMatchFastIntrinsic";
>+    case ObjectCreateIntrinsic:
>+        return "ObjectCreateIntrinsic";
>     case ObjectGetPrototypeOfIntrinsic:
>         return "ObjectGetPrototypeOfIntrinsic";
>     case ObjectIsIntrinsic:
>diff --git a/Source/JavaScriptCore/runtime/Intrinsic.h b/Source/JavaScriptCore/runtime/Intrinsic.h
>index 61fe0bd7f2580f265652167ff82bceaabbe76a00..757df0547b13c36c74f926033616ac5ed329cfcf 100644
>--- a/Source/JavaScriptCore/runtime/Intrinsic.h
>+++ b/Source/JavaScriptCore/runtime/Intrinsic.h
>@@ -69,6 +69,7 @@ enum Intrinsic {
>     RegExpTestIntrinsic,
>     RegExpTestFastIntrinsic,
>     RegExpMatchFastIntrinsic,
>+    ObjectCreateIntrinsic,
>     ObjectGetPrototypeOfIntrinsic,
>     ObjectIsIntrinsic,
>     ReflectGetPrototypeOfIntrinsic,
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>index 14ee14704c1f66a43552bda5cd7cbe3f0ff6933d..b4045e29360f354d675deb83581c0e12be080ce9 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>@@ -537,10 +537,7 @@ void JSGlobalObject::init(VM& vm)
>             init.set(JSWithScope::createStructure(init.vm, init.owner, jsNull()));
>         });
>     
>-    m_nullPrototypeObjectStructure.initLater(
>-        [] (const Initializer<Structure>& init) {
>-            init.set(JSFinalObject::createStructure(init.vm, init.owner, jsNull(), JSFinalObject::defaultInlineCapacity()));
>-        });
>+    m_nullPrototypeObjectStructure.set(vm, this, JSFinalObject::createStructure(vm, this, jsNull(), JSFinalObject::defaultInlineCapacity()));
>     
>     m_callbackFunctionStructure.initLater(
>         [] (const Initializer<Structure>& init) {
>@@ -1394,7 +1391,7 @@ void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
>     thisObject->m_glibCallbackFunctionStructure.visit(visitor);
>     thisObject->m_glibWrapperObjectStructure.visit(visitor);
> #endif
>-    thisObject->m_nullPrototypeObjectStructure.visit(visitor);
>+    visitor.append(thisObject->m_nullPrototypeObjectStructure);
>     visitor.append(thisObject->m_errorStructure);
>     visitor.append(thisObject->m_calleeStructure);
>     visitor.append(thisObject->m_strictFunctionStructure);
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
>index d42caabe34e0d1dadabf8c94b4fde49ff06b6b15..fe330dea8a15759b7be4a45e639f58107a9b427c 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
>@@ -339,7 +339,7 @@ class JSGlobalObject : public JSSegmentedVariableObject {
>     LazyProperty<JSGlobalObject, Structure> m_glibCallbackFunctionStructure;
>     LazyProperty<JSGlobalObject, Structure> m_glibWrapperObjectStructure;
> #endif
>-    LazyProperty<JSGlobalObject, Structure> m_nullPrototypeObjectStructure;
>+    WriteBarrier<Structure> m_nullPrototypeObjectStructure;
>     WriteBarrier<Structure> m_calleeStructure;
>     WriteBarrier<Structure> m_strictFunctionStructure;
>     WriteBarrier<Structure> m_arrowFunctionStructure;
>@@ -654,7 +654,7 @@ class JSGlobalObject : public JSSegmentedVariableObject {
>     Structure* glibWrapperObjectStructure() const { return m_glibWrapperObjectStructure.get(this); }
> #endif
>     Structure* dateStructure() const { return m_dateStructure.get(this); }
>-    Structure* nullPrototypeObjectStructure() const { return m_nullPrototypeObjectStructure.get(this); }
>+    Structure* nullPrototypeObjectStructure() const { return m_nullPrototypeObjectStructure.get(); }
>     Structure* errorStructure() const { return m_errorStructure.get(); }
>     Structure* calleeStructure() const { return m_calleeStructure.get(); }
>     Structure* strictFunctionStructure() const { return m_strictFunctionStructure.get(); }
>diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
>index 8152be7b3aae63e54ad8ce1053931041ca3b5238..f55dc296e9acae5b8083f19eadaff636144153e4 100644
>--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
>+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
>@@ -76,7 +76,7 @@ const ClassInfo ObjectConstructor::s_info = { "Function", &InternalFunction::s_i
>   keys                      objectConstructorKeys                       DontEnum|Function 1
>   defineProperty            objectConstructorDefineProperty             DontEnum|Function 3
>   defineProperties          objectConstructorDefineProperties           DontEnum|Function 2
>-  create                    objectConstructorCreate                     DontEnum|Function 2
>+  create                    objectConstructorCreate                     DontEnum|Function 2 ObjectCreateIntrinsic
>   seal                      objectConstructorSeal                       DontEnum|Function 1
>   freeze                    objectConstructorFreeze                     DontEnum|Function 1
>   preventExtensions         objectConstructorPreventExtensions          DontEnum|Function 1
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index e37f8dbde18a69a059aa8c937fa29589ecfd92e4..9e6cf3ac430209edb35e2bd7afed29fde17248a2 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,34 @@
>+2018-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
>+
>+        [JSC] Object.create should have intrinsic
>+        https://bugs.webkit.org/show_bug.cgi?id=186200
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * microbenchmarks/object-create-null.js: Added.
>+        (test):
>+        * microbenchmarks/object-create-unknown-object-prototype.js: Added.
>+        (test):
>+        * microbenchmarks/object-create-untyped-prototype.js: Added.
>+        (test):
>+        * stress/get-by-pname-only-prototype-properties.js: Added.
>+        (foo):
>+        * stress/object-create-define.js: Added.
>+        (shouldBe):
>+        (test):
>+        * stress/object-create-null-external.js: Added.
>+        (shouldBe):
>+        (test):
>+        * stress/object-create-null.js: Added.
>+        (shouldBe):
>+        (test):
>+        * stress/object-create-prototype.js: Added.
>+        (shouldBe):
>+        (test):
>+        * stress/object-create-undefined.js: Added.
>+        (shouldThrow):
>+        (i.shouldThrow):
>+
> 2018-05-29  Yusuke Suzuki  <utatane.tea@gmail.com>
> 
>         [JSC] Add Symbol.prototype.description getter
>diff --git a/JSTests/microbenchmarks/object-create-null.js b/JSTests/microbenchmarks/object-create-null.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..0517d24fe2f977855ad2902a4dc3e95213df6168
>--- /dev/null
>+++ b/JSTests/microbenchmarks/object-create-null.js
>@@ -0,0 +1,8 @@
>+function test()
>+{
>+    return Object.create(null);
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e6; ++i)
>+    test();
>diff --git a/JSTests/microbenchmarks/object-create-unknown-object-prototype.js b/JSTests/microbenchmarks/object-create-unknown-object-prototype.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..28c468e3a6c255540c0da3b54f256a1c1143a518
>--- /dev/null
>+++ b/JSTests/microbenchmarks/object-create-unknown-object-prototype.js
>@@ -0,0 +1,18 @@
>+function test(prototype)
>+{
>+    return Object.create(prototype);
>+}
>+noInline(test);
>+
>+var prototype1 = {};
>+var prototype2 = [];
>+var prototype3 = new Date();
>+var prototype4 = { hello: 42 };
>+var prototype5 = new Map();
>+for (var i = 0; i < 1e5; ++i) {
>+    test(prototype1);
>+    test(prototype2);
>+    test(prototype3);
>+    test(prototype4);
>+    test(prototype5);
>+}
>diff --git a/JSTests/microbenchmarks/object-create-untyped-prototype.js b/JSTests/microbenchmarks/object-create-untyped-prototype.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..78ca4727f2e015ffbb0edfa71dfc1e4db7eeba11
>--- /dev/null
>+++ b/JSTests/microbenchmarks/object-create-untyped-prototype.js
>@@ -0,0 +1,13 @@
>+function test(prototype)
>+{
>+    return Object.create(prototype);
>+}
>+noInline(test);
>+
>+var prototype1 = {};
>+var prototype2 = [];
>+for (var i = 0; i < 1e5; ++i) {
>+    test(prototype1);
>+    test(prototype2);
>+    test(null);
>+}
>diff --git a/JSTests/stress/get-by-pname-only-prototype-properties.js b/JSTests/stress/get-by-pname-only-prototype-properties.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..e1d6ce8248a89f1c9af798a574179564de1a66be
>--- /dev/null
>+++ b/JSTests/stress/get-by-pname-only-prototype-properties.js
>@@ -0,0 +1,50 @@
>+var foo = function (C, A) {
>+    for(var B in (A||{})) {
>+        C[B]=A[B];
>+    }
>+    return C;
>+}
>+
>+var protos = [];
>+for (var i = 0; i < 256; i++) {
>+    var proto = Object.create(null);
>+    protos.push(proto);
>+    proto.aa = 1;
>+    proto.ab = 1;
>+    proto.ac = 1;
>+    proto.ad = 1;
>+    proto.ae = 1;
>+    proto.af = 1;
>+    proto.ag = 1;
>+    proto.ah = 1;
>+    proto.ai = 1;
>+    proto.aj = 1;
>+    proto.ak = 1;
>+    proto.al = 1;
>+    proto.am = 1;
>+    proto.an = 1;
>+    proto.ao = 1;
>+    proto.ap = 1;
>+    proto.aq = 1;
>+    proto.ar = 1;
>+    proto.as = 1;
>+    proto.at = 1;
>+    proto.au = 1;
>+    proto.av = 1;
>+    proto.aw = 1;
>+    proto.ax = 1;
>+    proto.ay = 1;
>+    proto.az = 1;
>+    proto.ba = 1;
>+    proto.bb = 1;
>+    proto.bc = 1;
>+    proto.bd = 1;
>+    proto.be = 1;
>+    proto.bf = 1;
>+    var weirdObject = Object.create(proto);
>+    var result = foo({}, weirdObject);
>+    for (var p in result) {
>+        if (result[p] !== result["" + p])
>+            throw new Error("OUT");
>+    }
>+}
>diff --git a/JSTests/stress/object-create-define.js b/JSTests/stress/object-create-define.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..a3ed990f7eb51ef61c89d2ecad179b0e1a1abba4
>--- /dev/null
>+++ b/JSTests/stress/object-create-define.js
>@@ -0,0 +1,31 @@
>+function shouldBe(actual, expected) {
>+    if (actual !== expected)
>+        throw new Error('bad value: ' + actual);
>+}
>+
>+function test(prototype, data)
>+{
>+    return Object.create(prototype, data);
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e4; ++i) {
>+    var prototype = { Cocoa: false };
>+    var object = test(prototype, {
>+        Cappuccino: {
>+            value: 42,
>+            enumerable: true,
>+            configurable: true,
>+            writable: true
>+        },
>+        Matcha: {
>+            value: 40,
>+            enumerable: false,
>+            configurable: true,
>+            writable: true
>+        }
>+    });
>+    shouldBe(Object.getPrototypeOf(object), prototype);
>+    shouldBe(JSON.stringify(Object.getOwnPropertyNames(object).sort()), `["Cappuccino","Matcha"]`);
>+    shouldBe(JSON.stringify(Object.keys(object).sort()), `["Cappuccino"]`);
>+}
>diff --git a/JSTests/stress/object-create-null-external.js b/JSTests/stress/object-create-null-external.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..96fd04d77dce65f0f866f4090edd6d78b2776db8
>--- /dev/null
>+++ b/JSTests/stress/object-create-null-external.js
>@@ -0,0 +1,16 @@
>+function shouldBe(actual, expected) {
>+    if (actual !== expected)
>+        throw new Error('bad value: ' + actual);
>+}
>+
>+function test(prototype)
>+{
>+    return Object.create(prototype);
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e4; ++i) {
>+    var object = test(null);
>+    shouldBe(Object.getPrototypeOf(object), null);
>+    shouldBe(JSON.stringify(Object.getOwnPropertyNames(object)), `[]`);
>+}
>diff --git a/JSTests/stress/object-create-null.js b/JSTests/stress/object-create-null.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..0bc968e771350fdb60e5eb7c482eac3e60b1e598
>--- /dev/null
>+++ b/JSTests/stress/object-create-null.js
>@@ -0,0 +1,16 @@
>+function shouldBe(actual, expected) {
>+    if (actual !== expected)
>+        throw new Error('bad value: ' + actual);
>+}
>+
>+function test()
>+{
>+    return Object.create(null);
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e4; ++i) {
>+    var object = test();
>+    shouldBe(Object.getPrototypeOf(object), null);
>+    shouldBe(JSON.stringify(Object.getOwnPropertyNames(object)), `[]`);
>+}
>diff --git a/JSTests/stress/object-create-prototype.js b/JSTests/stress/object-create-prototype.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..0d33fb439e1efacb256a250050e5549aa3cf80ad
>--- /dev/null
>+++ b/JSTests/stress/object-create-prototype.js
>@@ -0,0 +1,17 @@
>+function shouldBe(actual, expected) {
>+    if (actual !== expected)
>+        throw new Error('bad value: ' + actual);
>+}
>+
>+function test(prototype)
>+{
>+    return Object.create(prototype);
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e4; ++i) {
>+    var prototype = { Cocoa: false };
>+    var object = test(prototype);
>+    shouldBe(Object.getPrototypeOf(object), prototype);
>+    shouldBe(JSON.stringify(Object.getOwnPropertyNames(object)), `[]`);
>+}
>diff --git a/JSTests/stress/object-create-undefined.js b/JSTests/stress/object-create-undefined.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..9aa3c21c8dfcc69e556cf57cc46edbaed1fd6efa
>--- /dev/null
>+++ b/JSTests/stress/object-create-undefined.js
>@@ -0,0 +1,26 @@
>+function shouldThrow(func, errorMessage) {
>+    var errorThrown = false;
>+    var error = null;
>+    try {
>+        func();
>+    } catch (e) {
>+        errorThrown = true;
>+        error = e;
>+    }
>+    if (!errorThrown)
>+        throw new Error('not thrown');
>+    if (String(error) !== errorMessage)
>+        throw new Error(`bad error: ${String(error)}`);
>+}
>+
>+function test(value)
>+{
>+    return Object.create(value);
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e4; ++i) {
>+    shouldThrow(() => {
>+        test(undefined);
>+    }, `TypeError: Object prototype may only be an Object or null.`);
>+}

Flags:

fpizlo: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 186200: 341768 | 341769 | 341777 | 341805 | 341845