Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(354)

Side by Side Diff: src/compiler/js-typed-lowering.cc

Issue 621863002: [turbofan] Fix lowering of typed loads/stores. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Fix comment Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « src/compiler/access-builder.cc ('k') | src/compiler/simplified-operator.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 the V8 project authors. All rights reserved. 1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/compiler/access-builder.h" 5 #include "src/compiler/access-builder.h"
6 #include "src/compiler/graph-inl.h" 6 #include "src/compiler/graph-inl.h"
7 #include "src/compiler/js-builtin-reducer.h" 7 #include "src/compiler/js-builtin-reducer.h"
8 #include "src/compiler/js-typed-lowering.h" 8 #include "src/compiler/js-typed-lowering.h"
9 #include "src/compiler/node-aux-data-inl.h" 9 #include "src/compiler/node-aux-data-inl.h"
10 #include "src/compiler/node-properties-inl.h" 10 #include "src/compiler/node-properties-inl.h"
(...skipping 515 matching lines...) Expand 10 before | Expand all | Expand 10 after
526 return NoChange(); 526 return NoChange();
527 } 527 }
528 528
529 529
530 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) { 530 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
531 Node* key = NodeProperties::GetValueInput(node, 1); 531 Node* key = NodeProperties::GetValueInput(node, 1);
532 Node* base = NodeProperties::GetValueInput(node, 0); 532 Node* base = NodeProperties::GetValueInput(node, 0);
533 Type* key_type = NodeProperties::GetBounds(key).upper; 533 Type* key_type = NodeProperties::GetBounds(key).upper;
534 Type* base_type = NodeProperties::GetBounds(base).upper; 534 Type* base_type = NodeProperties::GetBounds(base).upper;
535 // TODO(mstarzinger): This lowering is not correct if: 535 // TODO(mstarzinger): This lowering is not correct if:
536 // a) The typed array turns external (i.e. MaterializeArrayBuffer) 536 // a) The typed array or it's buffer is neutered.
537 // b) The typed array or it's buffer is neutered. 537 // b) The index is out of bounds.
538 // c) The index is out of bounds.
539 if (base_type->IsConstant() && key_type->Is(Type::Integral32()) && 538 if (base_type->IsConstant() && key_type->Is(Type::Integral32()) &&
540 base_type->AsConstant()->Value()->IsJSTypedArray()) { 539 base_type->AsConstant()->Value()->IsJSTypedArray()) {
541 // JSLoadProperty(typed-array, int32) 540 // JSLoadProperty(typed-array, int32)
542 JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value()); 541 Handle<JSTypedArray> array =
543 ElementsKind elements_kind = array->map()->elements_kind(); 542 Handle<JSTypedArray>::cast(base_type->AsConstant()->Value());
544 ExternalArrayType type = array->type(); 543 if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
545 uint32_t length; 544 Handle<JSArrayBuffer> buffer =
546 CHECK(array->length()->ToUint32(&length)); 545 handle(JSArrayBuffer::cast(array->buffer()));
547 ElementAccess element_access; 546 ExternalArrayType type = array->type();
548 Node* elements = graph()->NewNode( 547 uint32_t length;
549 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, 548 CHECK(array->length()->ToUint32(&length));
550 NodeProperties::GetEffectInput(node)); 549 Node* elements =
551 if (IsExternalArrayElementsKind(elements_kind)) { 550 graph()->NewNode(simplified()->LoadField(
552 elements = graph()->NewNode( 551 AccessBuilder::ForJSArrayBufferBackingStore()),
553 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), 552 jsgraph()->HeapConstant(buffer), graph()->start());
554 elements, NodeProperties::GetEffectInput(node)); 553 Node* effect = NodeProperties::GetEffectInput(node);
555 element_access = AccessBuilder::ForTypedArrayElement(type, true); 554 Node* control = NodeProperties::GetControlInput(node);
556 } else { 555 node->set_op(simplified()->LoadElement(
557 DCHECK(IsFixedTypedArrayElementsKind(elements_kind)); 556 AccessBuilder::ForTypedArrayElement(type, true)));
558 element_access = AccessBuilder::ForTypedArrayElement(type, false); 557 node->ReplaceInput(0, elements);
558 node->ReplaceInput(2, jsgraph()->Uint32Constant(length));
559 node->ReplaceInput(3, effect);
560 node->ReplaceInput(4, control);
561 node->TrimInputCount(5);
562 return Changed(node);
559 } 563 }
560 Node* value = graph()->NewNode(
561 simplified()->LoadElement(element_access), elements, key,
562 jsgraph()->Uint32Constant(length), NodeProperties::GetEffectInput(node),
563 NodeProperties::GetControlInput(node));
564 return ReplaceEagerly(node, value);
565 } 564 }
566 return NoChange(); 565 return NoChange();
567 } 566 }
568 567
569 568
570 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) { 569 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
571 Node* key = NodeProperties::GetValueInput(node, 1); 570 Node* key = NodeProperties::GetValueInput(node, 1);
572 Node* base = NodeProperties::GetValueInput(node, 0); 571 Node* base = NodeProperties::GetValueInput(node, 0);
573 Node* value = NodeProperties::GetValueInput(node, 2); 572 Node* value = NodeProperties::GetValueInput(node, 2);
574 Type* key_type = NodeProperties::GetBounds(key).upper; 573 Type* key_type = NodeProperties::GetBounds(key).upper;
575 Type* base_type = NodeProperties::GetBounds(base).upper; 574 Type* base_type = NodeProperties::GetBounds(base).upper;
576 // TODO(mstarzinger): This lowering is not correct if: 575 // TODO(mstarzinger): This lowering is not correct if:
577 // a) The typed array turns external (i.e. MaterializeArrayBuffer) 576 // a) The typed array or its buffer is neutered.
578 // b) The typed array or its buffer is neutered.
579 if (key_type->Is(Type::Integral32()) && base_type->IsConstant() && 577 if (key_type->Is(Type::Integral32()) && base_type->IsConstant() &&
580 base_type->AsConstant()->Value()->IsJSTypedArray()) { 578 base_type->AsConstant()->Value()->IsJSTypedArray()) {
581 // JSStoreProperty(typed-array, int32, value) 579 // JSStoreProperty(typed-array, int32, value)
582 JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value()); 580 Handle<JSTypedArray> array =
583 ElementsKind elements_kind = array->map()->elements_kind(); 581 Handle<JSTypedArray>::cast(base_type->AsConstant()->Value());
584 ExternalArrayType type = array->type(); 582 if (IsExternalArrayElementsKind(array->map()->elements_kind())) {
585 uint32_t length; 583 Handle<JSArrayBuffer> buffer =
586 CHECK(array->length()->ToUint32(&length)); 584 handle(JSArrayBuffer::cast(array->buffer()));
587 ElementAccess element_access; 585 ExternalArrayType type = array->type();
588 Node* elements = graph()->NewNode( 586 uint32_t length;
589 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, 587 CHECK(array->length()->ToUint32(&length));
590 NodeProperties::GetEffectInput(node)); 588 Node* elements =
591 if (IsExternalArrayElementsKind(elements_kind)) { 589 graph()->NewNode(simplified()->LoadField(
592 elements = graph()->NewNode( 590 AccessBuilder::ForJSArrayBufferBackingStore()),
593 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), 591 jsgraph()->HeapConstant(buffer), graph()->start());
594 elements, NodeProperties::GetEffectInput(node)); 592 Node* effect = NodeProperties::GetEffectInput(node);
595 element_access = AccessBuilder::ForTypedArrayElement(type, true); 593 Node* control = NodeProperties::GetControlInput(node);
596 } else { 594 node->set_op(simplified()->StoreElement(
597 DCHECK(IsFixedTypedArrayElementsKind(elements_kind)); 595 AccessBuilder::ForTypedArrayElement(type, true)));
598 element_access = AccessBuilder::ForTypedArrayElement(type, false); 596 node->ReplaceInput(0, elements);
597 node->ReplaceInput(2, jsgraph()->Uint32Constant(length));
598 node->ReplaceInput(3, value);
599 node->ReplaceInput(4, effect);
600 node->ReplaceInput(5, control);
601 node->TrimInputCount(6);
602 return Changed(node);
599 } 603 }
600 Node* store =
601 graph()->NewNode(simplified()->StoreElement(element_access), elements,
602 key, jsgraph()->Uint32Constant(length), value,
603 NodeProperties::GetEffectInput(node),
604 NodeProperties::GetControlInput(node));
605 return ReplaceEagerly(node, store);
606 } 604 }
607 return NoChange(); 605 return NoChange();
608 } 606 }
609 607
610 608
611 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) { 609 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) {
612 if (reduction.Changed()) { 610 if (reduction.Changed()) {
613 NodeProperties::ReplaceWithValue(node, reduction.replacement()); 611 NodeProperties::ReplaceWithValue(node, reduction.replacement());
614 return reduction; 612 return reduction;
615 } 613 }
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after
699 return JSBuiltinReducer(jsgraph()).Reduce(node); 697 return JSBuiltinReducer(jsgraph()).Reduce(node);
700 default: 698 default:
701 break; 699 break;
702 } 700 }
703 return NoChange(); 701 return NoChange();
704 } 702 }
705 703
706 } // namespace compiler 704 } // namespace compiler
707 } // namespace internal 705 } // namespace internal
708 } // namespace v8 706 } // namespace v8
OLDNEW
« no previous file with comments | « src/compiler/access-builder.cc ('k') | src/compiler/simplified-operator.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698