OLD | NEW |
1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/compiler/access-builder.h" | 5 #include "src/compiler/access-builder.h" |
6 #include "src/compiler/graph-inl.h" | 6 #include "src/compiler/graph-inl.h" |
7 #include "src/compiler/js-builtin-reducer.h" | 7 #include "src/compiler/js-builtin-reducer.h" |
8 #include "src/compiler/js-typed-lowering.h" | 8 #include "src/compiler/js-typed-lowering.h" |
9 #include "src/compiler/node-aux-data-inl.h" | 9 #include "src/compiler/node-aux-data-inl.h" |
10 #include "src/compiler/node-properties-inl.h" | 10 #include "src/compiler/node-properties-inl.h" |
(...skipping 515 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
526 return NoChange(); | 526 return NoChange(); |
527 } | 527 } |
528 | 528 |
529 | 529 |
530 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) { | 530 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) { |
531 Node* key = NodeProperties::GetValueInput(node, 1); | 531 Node* key = NodeProperties::GetValueInput(node, 1); |
532 Node* base = NodeProperties::GetValueInput(node, 0); | 532 Node* base = NodeProperties::GetValueInput(node, 0); |
533 Type* key_type = NodeProperties::GetBounds(key).upper; | 533 Type* key_type = NodeProperties::GetBounds(key).upper; |
534 Type* base_type = NodeProperties::GetBounds(base).upper; | 534 Type* base_type = NodeProperties::GetBounds(base).upper; |
535 // TODO(mstarzinger): This lowering is not correct if: | 535 // TODO(mstarzinger): This lowering is not correct if: |
536 // a) The typed array or it's buffer is neutered. | 536 // a) The typed array turns external (i.e. MaterializeArrayBuffer) |
537 // b) The index is out of bounds. | 537 // b) The typed array or it's buffer is neutered. |
| 538 // c) The index is out of bounds. |
538 if (base_type->IsConstant() && key_type->Is(Type::Integral32()) && | 539 if (base_type->IsConstant() && key_type->Is(Type::Integral32()) && |
539 base_type->AsConstant()->Value()->IsJSTypedArray()) { | 540 base_type->AsConstant()->Value()->IsJSTypedArray()) { |
540 // JSLoadProperty(typed-array, int32) | 541 // JSLoadProperty(typed-array, int32) |
541 Handle<JSTypedArray> array = | 542 JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value()); |
542 Handle<JSTypedArray>::cast(base_type->AsConstant()->Value()); | 543 ElementsKind elements_kind = array->map()->elements_kind(); |
543 if (IsExternalArrayElementsKind(array->map()->elements_kind())) { | 544 ExternalArrayType type = array->type(); |
544 Handle<JSArrayBuffer> buffer = | 545 uint32_t length; |
545 handle(JSArrayBuffer::cast(array->buffer())); | 546 CHECK(array->length()->ToUint32(&length)); |
546 ExternalArrayType type = array->type(); | 547 ElementAccess element_access; |
547 uint32_t length; | 548 Node* elements = graph()->NewNode( |
548 CHECK(array->length()->ToUint32(&length)); | 549 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, |
549 Node* elements = | 550 NodeProperties::GetEffectInput(node)); |
550 graph()->NewNode(simplified()->LoadField( | 551 if (IsExternalArrayElementsKind(elements_kind)) { |
551 AccessBuilder::ForJSArrayBufferBackingStore()), | 552 elements = graph()->NewNode( |
552 jsgraph()->HeapConstant(buffer), graph()->start()); | 553 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), |
553 Node* effect = NodeProperties::GetEffectInput(node); | 554 elements, NodeProperties::GetEffectInput(node)); |
554 Node* control = NodeProperties::GetControlInput(node); | 555 element_access = AccessBuilder::ForTypedArrayElement(type, true); |
555 node->set_op(simplified()->LoadElement( | 556 } else { |
556 AccessBuilder::ForTypedArrayElement(type, true))); | 557 DCHECK(IsFixedTypedArrayElementsKind(elements_kind)); |
557 node->ReplaceInput(0, elements); | 558 element_access = AccessBuilder::ForTypedArrayElement(type, false); |
558 node->ReplaceInput(2, jsgraph()->Uint32Constant(length)); | |
559 node->ReplaceInput(3, effect); | |
560 node->ReplaceInput(4, control); | |
561 node->TrimInputCount(5); | |
562 return Changed(node); | |
563 } | 559 } |
| 560 Node* value = graph()->NewNode( |
| 561 simplified()->LoadElement(element_access), elements, key, |
| 562 jsgraph()->Uint32Constant(length), NodeProperties::GetEffectInput(node), |
| 563 NodeProperties::GetControlInput(node)); |
| 564 return ReplaceEagerly(node, value); |
564 } | 565 } |
565 return NoChange(); | 566 return NoChange(); |
566 } | 567 } |
567 | 568 |
568 | 569 |
569 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) { | 570 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) { |
570 Node* key = NodeProperties::GetValueInput(node, 1); | 571 Node* key = NodeProperties::GetValueInput(node, 1); |
571 Node* base = NodeProperties::GetValueInput(node, 0); | 572 Node* base = NodeProperties::GetValueInput(node, 0); |
572 Node* value = NodeProperties::GetValueInput(node, 2); | 573 Node* value = NodeProperties::GetValueInput(node, 2); |
573 Type* key_type = NodeProperties::GetBounds(key).upper; | 574 Type* key_type = NodeProperties::GetBounds(key).upper; |
574 Type* base_type = NodeProperties::GetBounds(base).upper; | 575 Type* base_type = NodeProperties::GetBounds(base).upper; |
575 // TODO(mstarzinger): This lowering is not correct if: | 576 // TODO(mstarzinger): This lowering is not correct if: |
576 // a) The typed array or its buffer is neutered. | 577 // a) The typed array turns external (i.e. MaterializeArrayBuffer) |
| 578 // b) The typed array or its buffer is neutered. |
577 if (key_type->Is(Type::Integral32()) && base_type->IsConstant() && | 579 if (key_type->Is(Type::Integral32()) && base_type->IsConstant() && |
578 base_type->AsConstant()->Value()->IsJSTypedArray()) { | 580 base_type->AsConstant()->Value()->IsJSTypedArray()) { |
579 // JSStoreProperty(typed-array, int32, value) | 581 // JSStoreProperty(typed-array, int32, value) |
580 Handle<JSTypedArray> array = | 582 JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value()); |
581 Handle<JSTypedArray>::cast(base_type->AsConstant()->Value()); | 583 ElementsKind elements_kind = array->map()->elements_kind(); |
582 if (IsExternalArrayElementsKind(array->map()->elements_kind())) { | 584 ExternalArrayType type = array->type(); |
583 Handle<JSArrayBuffer> buffer = | 585 uint32_t length; |
584 handle(JSArrayBuffer::cast(array->buffer())); | 586 CHECK(array->length()->ToUint32(&length)); |
585 ExternalArrayType type = array->type(); | 587 ElementAccess element_access; |
586 uint32_t length; | 588 Node* elements = graph()->NewNode( |
587 CHECK(array->length()->ToUint32(&length)); | 589 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), base, |
588 Node* elements = | 590 NodeProperties::GetEffectInput(node)); |
589 graph()->NewNode(simplified()->LoadField( | 591 if (IsExternalArrayElementsKind(elements_kind)) { |
590 AccessBuilder::ForJSArrayBufferBackingStore()), | 592 elements = graph()->NewNode( |
591 jsgraph()->HeapConstant(buffer), graph()->start()); | 593 simplified()->LoadField(AccessBuilder::ForExternalArrayPointer()), |
592 Node* effect = NodeProperties::GetEffectInput(node); | 594 elements, NodeProperties::GetEffectInput(node)); |
593 Node* control = NodeProperties::GetControlInput(node); | 595 element_access = AccessBuilder::ForTypedArrayElement(type, true); |
594 node->set_op(simplified()->StoreElement( | 596 } else { |
595 AccessBuilder::ForTypedArrayElement(type, true))); | 597 DCHECK(IsFixedTypedArrayElementsKind(elements_kind)); |
596 node->ReplaceInput(0, elements); | 598 element_access = AccessBuilder::ForTypedArrayElement(type, false); |
597 node->ReplaceInput(2, jsgraph()->Uint32Constant(length)); | |
598 node->ReplaceInput(3, value); | |
599 node->ReplaceInput(4, effect); | |
600 node->ReplaceInput(5, control); | |
601 node->TrimInputCount(6); | |
602 return Changed(node); | |
603 } | 599 } |
| 600 Node* store = |
| 601 graph()->NewNode(simplified()->StoreElement(element_access), elements, |
| 602 key, jsgraph()->Uint32Constant(length), value, |
| 603 NodeProperties::GetEffectInput(node), |
| 604 NodeProperties::GetControlInput(node)); |
| 605 return ReplaceEagerly(node, store); |
604 } | 606 } |
605 return NoChange(); | 607 return NoChange(); |
606 } | 608 } |
607 | 609 |
608 | 610 |
609 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) { | 611 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) { |
610 if (reduction.Changed()) { | 612 if (reduction.Changed()) { |
611 NodeProperties::ReplaceWithValue(node, reduction.replacement()); | 613 NodeProperties::ReplaceWithValue(node, reduction.replacement()); |
612 return reduction; | 614 return reduction; |
613 } | 615 } |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
697 return JSBuiltinReducer(jsgraph()).Reduce(node); | 699 return JSBuiltinReducer(jsgraph()).Reduce(node); |
698 default: | 700 default: |
699 break; | 701 break; |
700 } | 702 } |
701 return NoChange(); | 703 return NoChange(); |
702 } | 704 } |
703 | 705 |
704 } // namespace compiler | 706 } // namespace compiler |
705 } // namespace internal | 707 } // namespace internal |
706 } // namespace v8 | 708 } // namespace v8 |
OLD | NEW |