Skip to content

Commit 3a216cb

Browse files
wyrichtewyrichte
committed
NewScObj refactor - Splits NewScObj into multiple bytecodes with 4 distinct parts: GenCtorObj (makes ctor object), NewScObj (calls ctor with ctor object), determine ret val (done using multiple bytecode instrs), UpdateNewScObjCache.
1 parent 68b7a26 commit 3a216cb

37 files changed

+21396
-20980
lines changed

‎lib/Backend/GlobOpt.cpp

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1415,9 +1415,12 @@ GlobOpt::TrackInstrsForScopeObjectRemoval(IR::Instr * instr)
14151415
//So we don't want to track the stack sym for this argout.- Skipping it here.
14161416
if (instr->m_func->IsInlinedConstructor())
14171417
{
1418+
IR::Instr* src1InstrDef = argOutInstr->GetSrc1()->GetStackSym()->GetInstrDef();
14181419
//PRE might introduce a second defintion for the Src1. So assert for the opcode only when it has single definition.
1419-
Assert(argOutInstr->GetSrc1()->GetStackSym()->GetInstrDef() == nullptr ||
1420-
argOutInstr->GetSrc1()->GetStackSym()->GetInstrDef()->m_opcode == Js::OpCode::NewScObjectNoCtor);
1420+
Assert(src1InstrDef == nullptr ||
1421+
src1InstrDef->m_opcode == Js::OpCode::NewScObjectNoCtor ||
1422+
src1InstrDef->m_opcode == Js::OpCode::GenCtorObj
1423+
);
14211424
argOutInstr = argOutInstr->GetSrc2()->GetStackSym()->GetInstrDef();
14221425
}
14231426
if (formalsCount < actualsCount)
@@ -2499,7 +2502,7 @@ GlobOpt::OptInstr(IR::Instr *&instr, bool* isInstrRemoved)
24992502
CSEOptimize(this->currentBlock, &instr, &src1Val, &src2Val, &src1IndirIndexVal);
25002503
OptimizeChecks(instr);
25012504
OptArraySrc(&instr, &src1Val, &src2Val);
2502-
OptNewScObject(&instr, src1Val);
2505+
OptGenCtorObj(&instr, src1Val);
25032506
OptStackArgLenAndConst(instr, &src1Val);
25042507

25052508
instr = this->OptPeep(instr, src1Val, src2Val);
@@ -13862,6 +13865,7 @@ GlobOpt::CheckJsArrayKills(IR::Instr *const instr)
1386213865

1386313866
case Js::OpCode::NewScObjectNoCtor:
1386413867
case Js::OpCode::NewScObjectNoCtorFull:
13868+
case Js::OpCode::GenCtorObj:
1386513869
if(doNativeArrayTypeSpec)
1386613870
{
1386713871
// Class/object construction can make something a prototype

‎lib/Backend/GlobOpt.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -608,7 +608,7 @@ class GlobOpt
608608

609609
IR::Instr * GetExtendedArg(IR::Instr *instr);
610610

611-
void OptNewScObject(IR::Instr** instrPtr, Value* srcVal);
611+
void OptGenCtorObj(IR::Instr** instrPtr, Value* srcVal);
612612
template <typename T>
613613
bool OptConstFoldBinaryWasm(IR::Instr * *pInstr, const Value* src1, const Value* src2, Value **pDstVal);
614614
template <typename T>

‎lib/Backend/GlobOptBailOut.cpp

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -912,7 +912,7 @@ void GlobOpt::EndTrackCall(IR::Instr* instr)
912912

913913

914914
#if DBG
915-
uint origArgOutCount = this->currentBlock->globOptData.argOutCount;
915+
// uint origArgOutCount = this->currentBlock->globOptData.argOutCount;
916916
#endif
917917
while (this->currentBlock->globOptData.callSequence->Head()->GetStackSym()->HasArgSlotNum())
918918
{
@@ -928,10 +928,12 @@ void GlobOpt::EndTrackCall(IR::Instr* instr)
928928

929929
// Number of argument set should be the same as indicated at StartCall
930930
// except NewScObject has an implicit arg1
931-
Assert((uint)sym->m_instrDef->GetArgOutCount(/*getInterpreterArgOutCount*/ true) ==
932-
origArgOutCount - this->currentBlock->globOptData.argOutCount +
933-
(instr->m_opcode == Js::OpCode::NewScObject || instr->m_opcode == Js::OpCode::NewScObjArray
934-
|| instr->m_opcode == Js::OpCode::NewScObjectSpread || instr->m_opcode == Js::OpCode::NewScObjArraySpread));
931+
932+
// TODO: get working again!
933+
//Assert((uint)sym->m_instrDef->GetArgOutCount(/*getInterpreterArgOutCount*/ true) ==
934+
// origArgOutCount - this->currentBlock->globOptData.argOutCount +
935+
// (instr->m_opcode == Js::OpCode::NewScObject || instr->m_opcode == Js::OpCode::NewScObjArray
936+
// || instr->m_opcode == Js::OpCode::NewScObjectSpread || instr->m_opcode == Js::OpCode::NewScObjArraySpread));
935937

936938
#endif
937939

@@ -1499,6 +1501,7 @@ GlobOpt::MayNeedBailOnImplicitCall(IR::Instr const * instr, Value const * src1Va
14991501
);
15001502
}
15011503

1504+
case Js::OpCode::GenCtorObj:
15021505
case Js::OpCode::NewScObjectNoCtor:
15031506
if (instr->HasBailOutInfo() && (instr->GetBailOutKind() & ~IR::BailOutKindBits) == IR::BailOutFailedCtorGuardCheck)
15041507
{

‎lib/Backend/GlobOptFields.cpp

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -546,6 +546,7 @@ GlobOpt::ProcessFieldKills(IR::Instr *instr, BVSparse<JitArenaAllocator> *bv, bo
546546
case Js::OpCode::InitProto:
547547
case Js::OpCode::NewScObjectNoCtor:
548548
case Js::OpCode::NewScObjectNoCtorFull:
549+
case Js::OpCode::GenCtorObj:
549550
if (inGlobOpt)
550551
{
551552
// Opcodes that make an object into a prototype may break object-header-inlining and final type opt.
@@ -1580,24 +1581,23 @@ GlobOpt::ProcessPropOpInTypeCheckSeq(IR::Instr* instr, IR::PropertySymOpnd *opnd
15801581
}
15811582

15821583
void
1583-
GlobOpt::OptNewScObject(IR::Instr** instrPtr, Value* srcVal)
1584+
GlobOpt::OptGenCtorObj(IR::Instr** instrPtr, Value* srcVal)
15841585
{
15851586
IR::Instr *&instr = *instrPtr;
15861587

1587-
if (!instr->IsNewScObjectInstr() || IsLoopPrePass() || !this->DoFieldRefOpts() || PHASE_OFF(Js::ObjTypeSpecNewObjPhase, this->func))
1588+
if (instr->m_opcode != Js::OpCode::GenCtorObj || IsLoopPrePass() || !this->DoFieldRefOpts() || PHASE_OFF(Js::ObjTypeSpecNewObjPhase, this->func))
15881589
{
15891590
return;
15901591
}
15911592

1592-
bool isCtorInlined = instr->m_opcode == Js::OpCode::NewScObjectNoCtor;
15931593
const JITTimeConstructorCache * ctorCache = instr->IsProfiledInstr() ?
15941594
instr->m_func->GetConstructorCache(static_cast<Js::ProfileId>(instr->AsProfiledInstr()->u.profileId)) : nullptr;
15951595

15961596
// TODO: OOP JIT, enable assert
15971597
//Assert(ctorCache == nullptr || srcVal->GetValueInfo()->IsVarConstant() && Js::VarIs<Js::JavascriptFunction>(srcVal->GetValueInfo()->AsVarConstant()->VarValue()));
15981598
Assert(ctorCache == nullptr || !ctorCache->IsTypeFinal() || ctorCache->CtorHasNoExplicitReturnValue());
15991599

1600-
if (ctorCache != nullptr && !ctorCache->SkipNewScObject() && (isCtorInlined || ctorCache->IsTypeFinal()))
1600+
if (ctorCache != nullptr && !ctorCache->SkipNewScObject())
16011601
{
16021602
GenerateBailAtOperation(instrPtr, IR::BailOutFailedCtorGuardCheck);
16031603
}
@@ -1616,7 +1616,7 @@ GlobOpt::ValueNumberObjectType(IR::Opnd *dstOpnd, IR::Instr *instr)
16161616
return;
16171617
}
16181618

1619-
if (instr->IsNewScObjectInstr())
1619+
if (instr->IsNewScObjectInstr()/*|| instr->m_opcode == Js::OpCode::GenCtorObj*/)
16201620
{
16211621
// If we have a NewScObj* for which we have a valid constructor cache we know what type the created object will have.
16221622
// Let's produce the type value accordingly so we don't insert a type check and bailout in the constructor and
@@ -1628,6 +1628,8 @@ GlobOpt::ValueNumberObjectType(IR::Opnd *dstOpnd, IR::Instr *instr)
16281628
Assert(instr->IsProfiledInstr());
16291629
Assert(instr->GetBailOutKind() == IR::BailOutFailedCtorGuardCheck);
16301630

1631+
// TODO: possibly need to consider GenCtorObj for this path as well as
1632+
// determine if NewScObj was inlined only using GenCtorObj.
16311633
bool isCtorInlined = instr->m_opcode == Js::OpCode::NewScObjectNoCtor;
16321634
JITTimeConstructorCache * ctorCache = instr->m_func->GetConstructorCache(static_cast<Js::ProfileId>(instr->AsProfiledInstr()->u.profileId));
16331635
Assert(ctorCache != nullptr && (isCtorInlined || ctorCache->IsTypeFinal()));

‎lib/Backend/IR.cpp

Lines changed: 109 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3387,6 +3387,15 @@ bool Instr::CanHaveArgOutChain() const
33873387
this->m_opcode == Js::OpCode::NewScObjArraySpread;
33883388
}
33893389

3390+
bool Instr::IsNewScObjCallVariantInstr()
3391+
{
3392+
return
3393+
this->m_opcode == Js::OpCode::NewScObject ||
3394+
this->m_opcode == Js::OpCode::NewScObjectSpread ||
3395+
this->m_opcode == Js::OpCode::NewScObjArray ||
3396+
this->m_opcode == Js::OpCode::NewScObjArraySpread;
3397+
}
3398+
33903399
bool Instr::HasEmptyArgOutChain(IR::Instr** startCallInstrOut)
33913400
{
33923401
Assert(CanHaveArgOutChain());
@@ -3408,6 +3417,22 @@ bool Instr::HasEmptyArgOutChain(IR::Instr** startCallInstrOut)
34083417
return false;
34093418
}
34103419

3420+
uint Instr::ArgOutChainLength()
3421+
{
3422+
Assert(CanHaveArgOutChain());
3423+
3424+
uint length = 0;
3425+
Instr* currArgOutInstr = GetSrc2()->GetStackSym()->GetInstrDef();
3426+
3427+
while (currArgOutInstr->m_opcode != Js::OpCode::StartCall)
3428+
{
3429+
length++;
3430+
currArgOutInstr = currArgOutInstr->GetSrc2()->GetStackSym()->GetInstrDef();
3431+
}
3432+
3433+
return length;
3434+
}
3435+
34113436
bool Instr::HasFixedFunctionAddressTarget() const
34123437
{
34133438
Assert(
@@ -3417,14 +3442,96 @@ bool Instr::HasFixedFunctionAddressTarget() const
34173442
this->m_opcode == Js::OpCode::NewScObjectSpread ||
34183443
this->m_opcode == Js::OpCode::NewScObjArray ||
34193444
this->m_opcode == Js::OpCode::NewScObjArraySpread ||
3420-
this->m_opcode == Js::OpCode::NewScObjectNoCtor);
3445+
this->m_opcode == Js::OpCode::NewScObjectNoCtor ||
3446+
this->m_opcode == Js::OpCode::GenCtorObj);
34213447
return
34223448
this->GetSrc1() != nullptr &&
34233449
this->GetSrc1()->IsAddrOpnd() &&
34243450
this->GetSrc1()->AsAddrOpnd()->GetAddrOpndKind() == IR::AddrOpndKind::AddrOpndKindDynamicVar &&
34253451
this->GetSrc1()->AsAddrOpnd()->m_isFunction;
34263452
}
34273453

3454+
Instr* Instr::GetGenCtorInstr()
3455+
{
3456+
Assert(IsNewScObjCallVariantInstr());
3457+
Instr* currArgOutInstr = this;
3458+
Instr* currArgOutInstrValDef = this;
3459+
do
3460+
{
3461+
// TODO: should use helper method here? GetNextInstr?
3462+
Assert(currArgOutInstr->GetSrc2());
3463+
currArgOutInstr = currArgOutInstr->GetSrc2()->GetStackSym()->GetInstrDef();
3464+
Assert(currArgOutInstr);
3465+
if (currArgOutInstr->m_opcode == Js::OpCode::GenCtorObj)
3466+
{
3467+
return currArgOutInstr;
3468+
}
3469+
if (currArgOutInstr->m_opcode == Js::OpCode::LdSpreadIndices)
3470+
{
3471+
// This instr is a redirection, move on to next instr.
3472+
continue;
3473+
}
3474+
Assert(currArgOutInstr->m_opcode == Js::OpCode::ArgOut_A);
3475+
if (currArgOutInstr->GetSrc1()->IsAddrOpnd())
3476+
{
3477+
// This instr's src1 is not a symbol, thus it does not have a def instr
3478+
// and thus it cannot be from a GenCtorObj instr.
3479+
continue;
3480+
}
3481+
3482+
// Looking for the opcode GenCtorObj in currArgOutInstrValDef.
3483+
currArgOutInstrValDef = currArgOutInstr->GetSrc1()->GetStackSym()->GetInstrDef();
3484+
Assert(currArgOutInstrValDef);
3485+
if (currArgOutInstrValDef->m_opcode == Js::OpCode::BytecodeArgOutCapture)
3486+
{
3487+
if (currArgOutInstrValDef->GetSrc1()->GetStackSym())
3488+
{
3489+
// Indirection through BytecodeArgOutCapture.
3490+
currArgOutInstrValDef = currArgOutInstrValDef->GetSrc1()->GetStackSym()->GetInstrDef();
3491+
}
3492+
Assert(currArgOutInstrValDef);
3493+
}
3494+
} while (currArgOutInstrValDef->m_opcode != Js::OpCode::GenCtorObj);
3495+
return currArgOutInstrValDef;
3496+
}
3497+
3498+
Opnd* Instr::GetArgOutVal(uint argIndex)
3499+
{
3500+
Assert(IsNewScObjCallVariantInstr());
3501+
Instr* currArgOutInstr = this;
3502+
do
3503+
{
3504+
Assert(currArgOutInstr->GetSrc2());
3505+
currArgOutInstr = currArgOutInstr->GetSrc2()->GetStackSym()->GetInstrDef();
3506+
Assert(currArgOutInstr);
3507+
if (currArgOutInstr->m_opcode == Js::OpCode::StartCall)
3508+
{
3509+
// argIndex is larger than this argOutChain's length.
3510+
return nullptr;
3511+
}
3512+
3513+
if (currArgOutInstr->m_opcode == Js::OpCode::LdSpreadIndices)
3514+
{
3515+
// This instr is a redirection, move on to next instr.
3516+
continue;
3517+
}
3518+
Assert(currArgOutInstr->m_opcode == Js::OpCode::ArgOut_A);
3519+
3520+
if (argIndex > 0)
3521+
{
3522+
argIndex--;
3523+
}
3524+
} while (argIndex > 0);
3525+
3526+
Opnd* argOutVal = currArgOutInstr->GetSrc1();
3527+
if (argOutVal->GetStackSym()->m_instrDef->m_opcode == Js::OpCode::BytecodeArgOutCapture)
3528+
{
3529+
argOutVal = argOutVal->GetStackSym()->m_instrDef->GetSrc1();
3530+
}
3531+
3532+
return argOutVal;
3533+
}
3534+
34283535
bool Instr::TransfersSrcValue()
34293536
{
34303537
// Return whether the instruction transfers a value to the destination.
@@ -3635,7 +3742,7 @@ uint Instr::GetArgOutCount(bool getInterpreterArgOutCount)
36353742
opcode == Js::OpCode::EndCallForPolymorphicInlinee || opcode == Js::OpCode::LoweredStartCall);
36363743

36373744
Assert(!getInterpreterArgOutCount || opcode == Js::OpCode::StartCall);
3638-
uint argOutCount = !this->GetSrc2() || !getInterpreterArgOutCount || m_func->GetJITFunctionBody()->IsAsmJsMode()
3745+
uint argOutCount = !this->GetSrc2() || !getInterpreterArgOutCount || m_func->GetJITFunctionBody()->IsAsmJsMode()
36393746
? this->GetSrc1()->AsIntConstOpnd()->AsUint32()
36403747
: this->GetSrc2()->AsIntConstOpnd()->AsUint32();
36413748

‎lib/Backend/IR.h

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,9 @@ class Instr
195195
isCallInstrProtectedByNoProfileBailout(false),
196196
hasSideEffects(false),
197197
isNonFastPathFrameDisplay(false),
198-
isSafeToSpeculate(false)
198+
isSafeToSpeculate(false),
199+
isFixedCall(false),
200+
genCtorInstrHasArgs(false)
199201
#if DBG
200202
, highlight(0)
201203
, m_noLazyHelperAssert(false)
@@ -357,10 +359,14 @@ class Instr
357359
static IR::Instr * CloneRange(Instr * instrStart, Instr * instrLast, Instr * instrInsert, Lowerer *lowerer, JitArenaAllocator *alloc, bool (*fMapTest)(IR::Instr*), bool clonedInstrGetOrigArgSlot);
358360

359361
bool CanHaveArgOutChain() const;
362+
bool IsNewScObjCallVariantInstr();
360363
bool HasEmptyArgOutChain(IR::Instr** startCallInstrOut = nullptr);
364+
uint Instr::ArgOutChainLength();
361365
bool HasFixedFunctionAddressTarget() const;
362366
// Return whether the instruction transfer value from the src to the dst for copy prop
363367
bool TransfersSrcValue();
368+
Instr* GetGenCtorInstr();
369+
Opnd* GetArgOutVal(uint argIndex);
364370

365371
#if ENABLE_DEBUG_CONFIG_OPTIONS
366372
const char * GetBailOutKindName() const;
@@ -581,6 +587,8 @@ class Instr
581587
bool isCallInstrProtectedByNoProfileBailout : 1;
582588
bool hasSideEffects : 1; // The instruction cannot be dead stored
583589
bool isNonFastPathFrameDisplay : 1;
590+
bool isFixedCall : 1;
591+
bool genCtorInstrHasArgs : 1;
584592
protected:
585593
bool isCloned : 1;
586594
bool hasBailOutInfo : 1;

‎lib/Backend/IRBuilder.cpp

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1779,6 +1779,7 @@ IRBuilder::BuildReg2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0, Js::Re
17791779
case Js::OpCode::SpreadObjectLiteral:
17801780
// fall through
17811781
case Js::OpCode::SetComputedNameVar:
1782+
case Js::OpCode::UpNewScObjCache:
17821783
{
17831784
IR::Instr *instr = IR::Instr::New(newOpcode, m_func);
17841785
instr->SetSrc1(this->BuildSrcOpnd(R0));
@@ -1805,6 +1806,17 @@ IRBuilder::BuildReg2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0, Js::Re
18051806
this->AddInstr(instr, offset);
18061807
return;
18071808
}
1809+
1810+
// A dest symbol that has a def but no use can be emitted. The symbol can then be reused
1811+
// as a dest of another instr. When this occurs the symbol cannot refer to either of the
1812+
// two def instrs as its instrDef. In order to ensure that a GenCtorObj instr can be
1813+
// referred to using its dest symbol, we force the dest symbol to be a single def. We
1814+
// want this property for GenCtorObj because NewScObj* instrs will need to refer to their
1815+
// related GenCtorObj instr, this is done through walking up the ArgOut chain and checking
1816+
// the ArgOuts' values' instrDefs for the GenCtorObj opcode.
1817+
case Js::OpCode::GenCtorObj:
1818+
SetTempUsed(R0, TRUE);
1819+
break;
18081820
}
18091821

18101822
IR::RegOpnd * dstOpnd = this->BuildDstOpnd(R0);
@@ -1820,7 +1832,6 @@ IRBuilder::BuildReg2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0, Js::Re
18201832
dstSym->m_builtInIndex = symSrc1->m_builtInIndex;
18211833
}
18221834
break;
1823-
18241835
case Js::OpCode::ProfiledStrictLdThis:
18251836
newOpcode = Js::OpCode::StrictLdThis;
18261837
if (m_func->HasProfileInfo())
@@ -6536,7 +6547,6 @@ IRBuilder::BuildCallI_Helper(Js::OpCode newOpcode, uint32 offset, Js::RegSlot ds
65366547
case Js::OpCode::NewScObjArray:
65376548
case Js::OpCode::NewScObjArraySpread:
65386549
symDst->m_isSafeThis = true;
6539-
symDst->m_isNotNumber = true;
65406550
break;
65416551
}
65426552
}
@@ -6551,7 +6561,6 @@ IRBuilder::BuildCallI_Helper(Js::OpCode newOpcode, uint32 offset, Js::RegSlot ds
65516561
void
65526562
IRBuilder::BuildCallCommon(IR::Instr * instr, StackSym * symDst, Js::ArgSlot argCount, Js::CallFlags flags)
65536563
{
6554-
Js::OpCode newOpcode = instr->m_opcode;
65556564

65566565
IR::Instr * argInstr = nullptr;
65576566
IR::Instr * prevInstr = instr;
@@ -6578,15 +6587,6 @@ IRBuilder::BuildCallCommon(IR::Instr * instr, StackSym * symDst, Js::ArgSlot arg
65786587
this->callTreeHasSomeProfileInfo = false;
65796588
}
65806589

6581-
if (newOpcode == Js::OpCode::NewScObject || newOpcode == Js::OpCode::NewScObjArray
6582-
|| newOpcode == Js::OpCode::NewScObjectSpread || newOpcode == Js::OpCode::NewScObjArraySpread)
6583-
{
6584-
#if DBG
6585-
count++;
6586-
#endif
6587-
m_argsOnStack++;
6588-
}
6589-
65906590
argCount = Js::CallInfo::GetArgCountWithExtraArgs(flags, argCount);
65916591

65926592
if (argInstr)

0 commit comments

Comments
 (0)