OLD | NEW |
1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/compiler/access-builder.h" | 5 #include "src/compiler/access-builder.h" |
6 #include "src/compiler/graph-inl.h" | 6 #include "src/compiler/graph-inl.h" |
7 #include "src/compiler/js-builtin-reducer.h" | 7 #include "src/compiler/js-builtin-reducer.h" |
8 #include "src/compiler/js-typed-lowering.h" | 8 #include "src/compiler/js-typed-lowering.h" |
9 #include "src/compiler/node-aux-data-inl.h" | 9 #include "src/compiler/node-aux-data-inl.h" |
10 #include "src/compiler/node-properties-inl.h" | 10 #include "src/compiler/node-properties-inl.h" |
(...skipping 515 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
526 return NoChange(); | 526 return NoChange(); |
527 } | 527 } |
528 | 528 |
529 | 529 |
530 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) { | 530 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) { |
531 Node* key = NodeProperties::GetValueInput(node, 1); | 531 Node* key = NodeProperties::GetValueInput(node, 1); |
532 Node* base = NodeProperties::GetValueInput(node, 0); | 532 Node* base = NodeProperties::GetValueInput(node, 0); |
533 Type* key_type = NodeProperties::GetBounds(key).upper; | 533 Type* key_type = NodeProperties::GetBounds(key).upper; |
534 Type* base_type = NodeProperties::GetBounds(base).upper; | 534 Type* base_type = NodeProperties::GetBounds(base).upper; |
535 // TODO(mstarzinger): This lowering is not correct if: | 535 // TODO(mstarzinger): This lowering is not correct if: |
536 // a) The typed array turns external (i.e. MaterializeArrayBuffer) | 536 // a) The typed array or it's buffer is neutered. |
537 // b) The typed array or it's buffer is neutered. | 537 // b) The index is out of bounds. |
538 // c) The index is out of bounds. | |
539 if (base_type->IsConstant() && key_type->Is(Type::Integral32()) && | 538 if (base_type->IsConstant() && key_type->Is(Type::Integral32()) && |
540 base_type->AsConstant()->Value()->IsJSTypedArray()) { | 539 base_type->AsConstant()->Value()->IsJSTypedArray()) { |
541 // JSLoadProperty(typed-array, int32) | 540 // JSLoadProperty(typed-array, int32) |
542 JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value()); | 541 Handle<JSTypedArray> array = |
543 ElementsKind elements_kind = array->map()->elements_kind(); | 542 Handle<JSTypedArray>::cast(base_type->AsConstant()->Value()); |
544 ExternalArrayType type = array->type(); | 543 if (IsExternalArrayElementsKind(array->map()->elements_kind())) { |
545 uint32_t length; | 544 ExternalArrayType type = array->type(); |
546 CHECK(array->length()->ToUint32(&length)); | 545 uint32_t length; |
547 ElementAccess element_access; | 546 CHECK(array->length()->ToUint32(&length)); |
548 Node* elements = graph()->NewNode( | 547 Node* elements = graph()->NewNode( |
549 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, | 548 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, |
550 NodeProperties::GetEffectInput(node)); | 549 graph()->start()); |
551 if (IsExternalArrayElementsKind(elements_kind)) { | 550 Node* pointer = graph()->NewNode( |
552 elements = graph()->NewNode( | |
553 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), | 551 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), |
554 elements, NodeProperties::GetEffectInput(node)); | 552 elements, elements); |
555 element_access = AccessBuilder::ForTypedArrayElement(type, true); | 553 Node* effect = NodeProperties::GetEffectInput(node); |
556 } else { | 554 Node* control = NodeProperties::GetControlInput(node); |
557 DCHECK(IsFixedTypedArrayElementsKind(elements_kind)); | 555 Node* load = graph()->NewNode( |
558 element_access = AccessBuilder::ForTypedArrayElement(type, false); | 556 simplified()->LoadElement( |
| 557 AccessBuilder::ForTypedArrayElement(type, true)), |
| 558 pointer, key, jsgraph()->Uint32Constant(length), effect, control); |
| 559 return ReplaceEagerly(node, load); |
559 } | 560 } |
560 Node* value = graph()->NewNode( | |
561 simplified()->LoadElement(element_access), elements, key, | |
562 jsgraph()->Uint32Constant(length), NodeProperties::GetEffectInput(node), | |
563 NodeProperties::GetControlInput(node)); | |
564 return ReplaceEagerly(node, value); | |
565 } | 561 } |
566 return NoChange(); | 562 return NoChange(); |
567 } | 563 } |
568 | 564 |
569 | 565 |
570 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) { | 566 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) { |
571 Node* key = NodeProperties::GetValueInput(node, 1); | 567 Node* key = NodeProperties::GetValueInput(node, 1); |
572 Node* base = NodeProperties::GetValueInput(node, 0); | 568 Node* base = NodeProperties::GetValueInput(node, 0); |
573 Node* value = NodeProperties::GetValueInput(node, 2); | 569 Node* value = NodeProperties::GetValueInput(node, 2); |
574 Type* key_type = NodeProperties::GetBounds(key).upper; | 570 Type* key_type = NodeProperties::GetBounds(key).upper; |
575 Type* base_type = NodeProperties::GetBounds(base).upper; | 571 Type* base_type = NodeProperties::GetBounds(base).upper; |
576 // TODO(mstarzinger): This lowering is not correct if: | 572 // TODO(mstarzinger): This lowering is not correct if: |
577 // a) The typed array turns external (i.e. MaterializeArrayBuffer) | 573 // a) The typed array or its buffer is neutered. |
578 // b) The typed array or its buffer is neutered. | |
579 if (key_type->Is(Type::Integral32()) && base_type->IsConstant() && | 574 if (key_type->Is(Type::Integral32()) && base_type->IsConstant() && |
580 base_type->AsConstant()->Value()->IsJSTypedArray()) { | 575 base_type->AsConstant()->Value()->IsJSTypedArray()) { |
581 // JSStoreProperty(typed-array, int32, value) | 576 // JSStoreProperty(typed-array, int32, value) |
582 JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value()); | 577 Handle<JSTypedArray> array = |
583 ElementsKind elements_kind = array->map()->elements_kind(); | 578 Handle<JSTypedArray>::cast(base_type->AsConstant()->Value()); |
584 ExternalArrayType type = array->type(); | 579 if (IsExternalArrayElementsKind(array->map()->elements_kind())) { |
585 uint32_t length; | 580 ExternalArrayType type = array->type(); |
586 CHECK(array->length()->ToUint32(&length)); | 581 uint32_t length; |
587 ElementAccess element_access; | 582 CHECK(array->length()->ToUint32(&length)); |
588 Node* elements = graph()->NewNode( | 583 Node* elements = graph()->NewNode( |
589 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, | 584 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, |
590 NodeProperties::GetEffectInput(node)); | 585 graph()->start()); |
591 if (IsExternalArrayElementsKind(elements_kind)) { | 586 Node* pointer = graph()->NewNode( |
592 elements = graph()->NewNode( | |
593 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), | 587 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), |
594 elements, NodeProperties::GetEffectInput(node)); | 588 elements, elements); |
595 element_access = AccessBuilder::ForTypedArrayElement(type, true); | 589 Node* effect = NodeProperties::GetEffectInput(node); |
596 } else { | 590 Node* control = NodeProperties::GetControlInput(node); |
597 DCHECK(IsFixedTypedArrayElementsKind(elements_kind)); | 591 Node* store = |
598 element_access = AccessBuilder::ForTypedArrayElement(type, false); | 592 graph()->NewNode(simplified()->StoreElement( |
| 593 AccessBuilder::ForTypedArrayElement(type, true)), |
| 594 pointer, key, jsgraph()->Uint32Constant(length), |
| 595 value, effect, control); |
| 596 return ReplaceEagerly(node, store); |
599 } | 597 } |
600 Node* store = | |
601 graph()->NewNode(simplified()->StoreElement(element_access), elements, | |
602 key, jsgraph()->Uint32Constant(length), value, | |
603 NodeProperties::GetEffectInput(node), | |
604 NodeProperties::GetControlInput(node)); | |
605 return ReplaceEagerly(node, store); | |
606 } | 598 } |
607 return NoChange(); | 599 return NoChange(); |
608 } | 600 } |
609 | 601 |
610 | 602 |
611 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) { | 603 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) { |
612 if (reduction.Changed()) { | 604 if (reduction.Changed()) { |
613 NodeProperties::ReplaceWithValue(node, reduction.replacement()); | 605 NodeProperties::ReplaceWithValue(node, reduction.replacement()); |
614 return reduction; | 606 return reduction; |
615 } | 607 } |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
699 return JSBuiltinReducer(jsgraph()).Reduce(node); | 691 return JSBuiltinReducer(jsgraph()).Reduce(node); |
700 default: | 692 default: |
701 break; | 693 break; |
702 } | 694 } |
703 return NoChange(); | 695 return NoChange(); |
704 } | 696 } |
705 | 697 |
706 } // namespace compiler | 698 } // namespace compiler |
707 } // namespace internal | 699 } // namespace internal |
708 } // namespace v8 | 700 } // namespace v8 |
OLD | NEW |