| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2015 the V8 project authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include <ostream> | |
| 6 | |
| 7 #include "src/accessors.h" | |
| 8 #include "src/compilation-dependencies.h" | |
| 9 #include "src/compiler/property-access-info.h" | |
| 10 #include "src/field-index-inl.h" | |
| 11 #include "src/objects-inl.h" // TODO(mstarzinger): Temporary cycle breaker! | |
| 12 #include "src/type-cache.h" | |
| 13 #include "src/types-inl.h" | |
| 14 | |
| 15 namespace v8 { | |
| 16 namespace internal { | |
| 17 namespace compiler { | |
| 18 | |
| 19 std::ostream& operator<<(std::ostream& os, PropertyAccessMode access_mode) { | |
| 20 switch (access_mode) { | |
| 21 case PropertyAccessMode::kLoad: | |
| 22 return os << "Load"; | |
| 23 case PropertyAccessMode::kStore: | |
| 24 return os << "Store"; | |
| 25 } | |
| 26 UNREACHABLE(); | |
| 27 return os; | |
| 28 } | |
| 29 | |
| 30 | |
| 31 // static | |
| 32 PropertyAccessInfo PropertyAccessInfo::NotFound(Type* receiver_type, | |
| 33 MaybeHandle<JSObject> holder) { | |
| 34 return PropertyAccessInfo(holder, receiver_type); | |
| 35 } | |
| 36 | |
| 37 | |
| 38 // static | |
| 39 PropertyAccessInfo PropertyAccessInfo::DataConstant( | |
| 40 Type* receiver_type, Handle<Object> constant, | |
| 41 MaybeHandle<JSObject> holder) { | |
| 42 return PropertyAccessInfo(holder, constant, receiver_type); | |
| 43 } | |
| 44 | |
| 45 | |
| 46 // static | |
| 47 PropertyAccessInfo PropertyAccessInfo::DataField( | |
| 48 Type* receiver_type, FieldIndex field_index, Type* field_type, | |
| 49 MaybeHandle<JSObject> holder, MaybeHandle<Map> transition_map) { | |
| 50 return PropertyAccessInfo(holder, transition_map, field_index, field_type, | |
| 51 receiver_type); | |
| 52 } | |
| 53 | |
| 54 | |
| 55 PropertyAccessInfo::PropertyAccessInfo() | |
| 56 : kind_(kInvalid), receiver_type_(Type::None()), field_type_(Type::Any()) {} | |
| 57 | |
| 58 | |
| 59 PropertyAccessInfo::PropertyAccessInfo(MaybeHandle<JSObject> holder, | |
| 60 Type* receiver_type) | |
| 61 : kind_(kNotFound), | |
| 62 receiver_type_(receiver_type), | |
| 63 holder_(holder), | |
| 64 field_type_(Type::Any()) {} | |
| 65 | |
| 66 | |
| 67 PropertyAccessInfo::PropertyAccessInfo(MaybeHandle<JSObject> holder, | |
| 68 Handle<Object> constant, | |
| 69 Type* receiver_type) | |
| 70 : kind_(kDataConstant), | |
| 71 receiver_type_(receiver_type), | |
| 72 constant_(constant), | |
| 73 holder_(holder), | |
| 74 field_type_(Type::Any()) {} | |
| 75 | |
| 76 | |
| 77 PropertyAccessInfo::PropertyAccessInfo(MaybeHandle<JSObject> holder, | |
| 78 MaybeHandle<Map> transition_map, | |
| 79 FieldIndex field_index, Type* field_type, | |
| 80 Type* receiver_type) | |
| 81 : kind_(kDataField), | |
| 82 receiver_type_(receiver_type), | |
| 83 transition_map_(transition_map), | |
| 84 holder_(holder), | |
| 85 field_index_(field_index), | |
| 86 field_type_(field_type) {} | |
| 87 | |
| 88 | |
| 89 PropertyAccessInfoFactory::PropertyAccessInfoFactory( | |
| 90 CompilationDependencies* dependencies, Handle<Context> native_context, | |
| 91 Zone* zone) | |
| 92 : dependencies_(dependencies), | |
| 93 native_context_(native_context), | |
| 94 isolate_(native_context->GetIsolate()), | |
| 95 type_cache_(TypeCache::Get()), | |
| 96 zone_(zone) {} | |
| 97 | |
| 98 | |
| 99 namespace { | |
| 100 | |
| 101 bool CanInlinePropertyAccess(Handle<Map> map) { | |
| 102 // TODO(bmeurer): Do something about the number stuff. | |
| 103 if (map->instance_type() == HEAP_NUMBER_TYPE) return false; | |
| 104 if (map->instance_type() < FIRST_NONSTRING_TYPE) return true; | |
| 105 return map->IsJSObjectMap() && !map->is_dictionary_map() && | |
| 106 !map->has_named_interceptor() && | |
| 107 // TODO(verwaest): Whitelist contexts to which we have access. | |
| 108 !map->is_access_check_needed(); | |
| 109 } | |
| 110 | |
| 111 } // namespace | |
| 112 | |
| 113 | |
| 114 bool PropertyAccessInfoFactory::ComputePropertyAccessInfo( | |
| 115 Handle<Map> map, Handle<Name> name, PropertyAccessMode access_mode, | |
| 116 PropertyAccessInfo* access_info) { | |
| 117 // Check if it is safe to inline property access for the {map}. | |
| 118 if (!CanInlinePropertyAccess(map)) return false; | |
| 119 | |
| 120 // Compute the receiver type. | |
| 121 Handle<Map> receiver_map = map; | |
| 122 | |
| 123 // We support fast inline cases for certain JSObject getters. | |
| 124 if (access_mode == PropertyAccessMode::kLoad && | |
| 125 LookupSpecialFieldAccessor(map, name, access_info)) { | |
| 126 return true; | |
| 127 } | |
| 128 | |
| 129 MaybeHandle<JSObject> holder; | |
| 130 do { | |
| 131 // Lookup the named property on the {map}. | |
| 132 Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate()); | |
| 133 int const number = descriptors->SearchWithCache(*name, *map); | |
| 134 if (number != DescriptorArray::kNotFound) { | |
| 135 PropertyDetails const details = descriptors->GetDetails(number); | |
| 136 if (access_mode == PropertyAccessMode::kStore) { | |
| 137 // Don't bother optimizing stores to read-only properties. | |
| 138 if (details.IsReadOnly()) { | |
| 139 return false; | |
| 140 } | |
| 141 // Check for store to data property on a prototype. | |
| 142 if (details.kind() == kData && !holder.is_null()) { | |
| 143 // Store to property not found on the receiver but on a prototype, we | |
| 144 // need to transition to a new data property. | |
| 145 // Implemented according to ES6 section 9.1.9 [[Set]] (P, V, Receiver) | |
| 146 return LookupTransition(receiver_map, name, holder, access_info); | |
| 147 } | |
| 148 } | |
| 149 if (details.type() == DATA_CONSTANT) { | |
| 150 *access_info = PropertyAccessInfo::DataConstant( | |
| 151 Type::Class(receiver_map, zone()), | |
| 152 handle(descriptors->GetValue(number), isolate()), holder); | |
| 153 return true; | |
| 154 } else if (details.type() == DATA) { | |
| 155 int index = descriptors->GetFieldIndex(number); | |
| 156 Representation field_representation = details.representation(); | |
| 157 FieldIndex field_index = FieldIndex::ForPropertyIndex( | |
| 158 *map, index, field_representation.IsDouble()); | |
| 159 Type* field_type = Type::Tagged(); | |
| 160 if (field_representation.IsSmi()) { | |
| 161 field_type = type_cache_.kSmi; | |
| 162 } else if (field_representation.IsDouble()) { | |
| 163 field_type = type_cache_.kFloat64; | |
| 164 } else if (field_representation.IsHeapObject()) { | |
| 165 // Extract the field type from the property details (make sure its | |
| 166 // representation is TaggedPointer to reflect the heap object case). | |
| 167 field_type = Type::Intersect( | |
| 168 Type::Convert<HeapType>( | |
| 169 handle(descriptors->GetFieldType(number), isolate()), zone()), | |
| 170 Type::TaggedPointer(), zone()); | |
| 171 if (field_type->Is(Type::None())) { | |
| 172 // Store is not safe if the field type was cleared. | |
| 173 if (access_mode == PropertyAccessMode::kStore) return false; | |
| 174 | |
| 175 // The field type was cleared by the GC, so we don't know anything | |
| 176 // about the contents now. | |
| 177 // TODO(bmeurer): It would be awesome to make this saner in the | |
| 178 // runtime/GC interaction. | |
| 179 field_type = Type::TaggedPointer(); | |
| 180 } else if (!Type::Any()->Is(field_type)) { | |
| 181 // Add proper code dependencies in case of stable field map(s). | |
| 182 Handle<Map> field_owner_map(map->FindFieldOwner(number), isolate()); | |
| 183 dependencies()->AssumeFieldType(field_owner_map); | |
| 184 } | |
| 185 DCHECK(field_type->Is(Type::TaggedPointer())); | |
| 186 } | |
| 187 *access_info = PropertyAccessInfo::DataField( | |
| 188 Type::Class(receiver_map, zone()), field_index, field_type, holder); | |
| 189 return true; | |
| 190 } else { | |
| 191 // TODO(bmeurer): Add support for accessors. | |
| 192 return false; | |
| 193 } | |
| 194 } | |
| 195 | |
| 196 // Don't search on the prototype chain for special indices in case of | |
| 197 // integer indexed exotic objects (see ES6 section 9.4.5). | |
| 198 if (map->IsJSTypedArrayMap() && name->IsString() && | |
| 199 IsSpecialIndex(isolate()->unicode_cache(), String::cast(*name))) { | |
| 200 return false; | |
| 201 } | |
| 202 | |
| 203 // Don't lookup private symbols on the prototype chain. | |
| 204 if (name->IsPrivate()) return false; | |
| 205 | |
| 206 // Walk up the prototype chain. | |
| 207 if (!map->prototype()->IsJSObject()) { | |
| 208 // Perform the implicit ToObject for primitives here. | |
| 209 // Implemented according to ES6 section 7.3.2 GetV (V, P). | |
| 210 Handle<JSFunction> constructor; | |
| 211 if (Map::GetConstructorFunction(map, native_context()) | |
| 212 .ToHandle(&constructor)) { | |
| 213 map = handle(constructor->initial_map(), isolate()); | |
| 214 DCHECK(map->prototype()->IsJSObject()); | |
| 215 } else if (map->prototype()->IsNull()) { | |
| 216 // Store to property not found on the receiver or any prototype, we need | |
| 217 // to transition to a new data property. | |
| 218 // Implemented according to ES6 section 9.1.9 [[Set]] (P, V, Receiver) | |
| 219 if (access_mode == PropertyAccessMode::kStore) { | |
| 220 return LookupTransition(receiver_map, name, holder, access_info); | |
| 221 } | |
| 222 // The property was not found, return undefined or throw depending | |
| 223 // on the language mode of the load operation. | |
| 224 // Implemented according to ES6 section 9.1.8 [[Get]] (P, Receiver) | |
| 225 *access_info = PropertyAccessInfo::NotFound( | |
| 226 Type::Class(receiver_map, zone()), holder); | |
| 227 return true; | |
| 228 } else { | |
| 229 return false; | |
| 230 } | |
| 231 } | |
| 232 Handle<JSObject> map_prototype(JSObject::cast(map->prototype()), isolate()); | |
| 233 if (map_prototype->map()->is_deprecated()) { | |
| 234 // Try to migrate the prototype object so we don't embed the deprecated | |
| 235 // map into the optimized code. | |
| 236 JSObject::TryMigrateInstance(map_prototype); | |
| 237 } | |
| 238 map = handle(map_prototype->map(), isolate()); | |
| 239 holder = map_prototype; | |
| 240 } while (CanInlinePropertyAccess(map)); | |
| 241 return false; | |
| 242 } | |
| 243 | |
| 244 | |
| 245 bool PropertyAccessInfoFactory::ComputePropertyAccessInfos( | |
| 246 MapHandleList const& maps, Handle<Name> name, | |
| 247 PropertyAccessMode access_mode, | |
| 248 ZoneVector<PropertyAccessInfo>* access_infos) { | |
| 249 for (Handle<Map> map : maps) { | |
| 250 if (Map::TryUpdate(map).ToHandle(&map)) { | |
| 251 PropertyAccessInfo access_info; | |
| 252 if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) { | |
| 253 return false; | |
| 254 } | |
| 255 access_infos->push_back(access_info); | |
| 256 } | |
| 257 } | |
| 258 return true; | |
| 259 } | |
| 260 | |
| 261 | |
| 262 bool PropertyAccessInfoFactory::LookupSpecialFieldAccessor( | |
| 263 Handle<Map> map, Handle<Name> name, PropertyAccessInfo* access_info) { | |
| 264 // Check for special JSObject field accessors. | |
| 265 int offset; | |
| 266 if (Accessors::IsJSObjectFieldAccessor(map, name, &offset)) { | |
| 267 FieldIndex field_index = FieldIndex::ForInObjectOffset(offset); | |
| 268 Type* field_type = Type::Tagged(); | |
| 269 if (map->IsStringMap()) { | |
| 270 DCHECK(Name::Equals(factory()->length_string(), name)); | |
| 271 // The String::length property is always a smi in the range | |
| 272 // [0, String::kMaxLength]. | |
| 273 field_type = type_cache_.kStringLengthType; | |
| 274 } else if (map->IsJSArrayMap()) { | |
| 275 DCHECK(Name::Equals(factory()->length_string(), name)); | |
| 276 // The JSArray::length property is a smi in the range | |
| 277 // [0, FixedDoubleArray::kMaxLength] in case of fast double | |
| 278 // elements, a smi in the range [0, FixedArray::kMaxLength] | |
| 279 // in case of other fast elements, and [0, kMaxUInt32] in | |
| 280 // case of other arrays. | |
| 281 if (IsFastDoubleElementsKind(map->elements_kind())) { | |
| 282 field_type = type_cache_.kFixedDoubleArrayLengthType; | |
| 283 } else if (IsFastElementsKind(map->elements_kind())) { | |
| 284 field_type = type_cache_.kFixedArrayLengthType; | |
| 285 } else { | |
| 286 field_type = type_cache_.kJSArrayLengthType; | |
| 287 } | |
| 288 } | |
| 289 *access_info = PropertyAccessInfo::DataField(Type::Class(map, zone()), | |
| 290 field_index, field_type); | |
| 291 return true; | |
| 292 } | |
| 293 return false; | |
| 294 } | |
| 295 | |
| 296 | |
| 297 bool PropertyAccessInfoFactory::LookupTransition( | |
| 298 Handle<Map> map, Handle<Name> name, MaybeHandle<JSObject> holder, | |
| 299 PropertyAccessInfo* access_info) { | |
| 300 // Check if the {map} has a data transition with the given {name}. | |
| 301 if (map->unused_property_fields() == 0) return false; | |
| 302 Handle<Map> transition_map; | |
| 303 if (TransitionArray::SearchTransition(map, kData, name, NONE) | |
| 304 .ToHandle(&transition_map)) { | |
| 305 int const number = transition_map->LastAdded(); | |
| 306 PropertyDetails const details = | |
| 307 transition_map->instance_descriptors()->GetDetails(number); | |
| 308 // Don't bother optimizing stores to read-only properties. | |
| 309 if (details.IsReadOnly()) return false; | |
| 310 // TODO(bmeurer): Handle transition to data constant? | |
| 311 if (details.type() != DATA) return false; | |
| 312 int const index = details.field_index(); | |
| 313 Representation field_representation = details.representation(); | |
| 314 FieldIndex field_index = FieldIndex::ForPropertyIndex( | |
| 315 *transition_map, index, field_representation.IsDouble()); | |
| 316 Type* field_type = Type::Tagged(); | |
| 317 if (field_representation.IsSmi()) { | |
| 318 field_type = type_cache_.kSmi; | |
| 319 } else if (field_representation.IsDouble()) { | |
| 320 field_type = type_cache_.kFloat64; | |
| 321 } else if (field_representation.IsHeapObject()) { | |
| 322 // Extract the field type from the property details (make sure its | |
| 323 // representation is TaggedPointer to reflect the heap object case). | |
| 324 field_type = Type::Intersect( | |
| 325 Type::Convert<HeapType>( | |
| 326 handle( | |
| 327 transition_map->instance_descriptors()->GetFieldType(number), | |
| 328 isolate()), | |
| 329 zone()), | |
| 330 Type::TaggedPointer(), zone()); | |
| 331 if (field_type->Is(Type::None())) { | |
| 332 // Store is not safe if the field type was cleared. | |
| 333 return false; | |
| 334 } else if (!Type::Any()->Is(field_type)) { | |
| 335 // Add proper code dependencies in case of stable field map(s). | |
| 336 Handle<Map> field_owner_map(transition_map->FindFieldOwner(number), | |
| 337 isolate()); | |
| 338 dependencies()->AssumeFieldType(field_owner_map); | |
| 339 } | |
| 340 DCHECK(field_type->Is(Type::TaggedPointer())); | |
| 341 } | |
| 342 dependencies()->AssumeMapNotDeprecated(transition_map); | |
| 343 *access_info = | |
| 344 PropertyAccessInfo::DataField(Type::Class(map, zone()), field_index, | |
| 345 field_type, holder, transition_map); | |
| 346 return true; | |
| 347 } | |
| 348 return false; | |
| 349 } | |
| 350 | |
| 351 | |
| 352 Factory* PropertyAccessInfoFactory::factory() const { | |
| 353 return isolate()->factory(); | |
| 354 } | |
| 355 | |
| 356 } // namespace compiler | |
| 357 } // namespace internal | |
| 358 } // namespace v8 | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1418213010:
[turbofan] Initial support for keyed access to fast JSArrays. (Closed)
Base URL: https://chromium.googlesource.com/v8/v8.git@master