From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Fri, 2 Feb 2018 04:16:08 -0500 Subject: Add m-esr52 at 52.6.0 --- .../TypedObject-ObjectIsTypeDescr-multi.js | 41 +++++++++++++++++++ .../TypedObject-ObjectIsTypeDescr-unknown.js | 39 ++++++++++++++++++ .../TypedObject-ObjectIsTypeDescr-wrong-multi.js | 41 +++++++++++++++++++ .../TypedObject-ObjectIsTypeDescr-wrong.js | 39 ++++++++++++++++++ .../ion/inlining/TypedObject-ObjectIsTypeDescr.js | 39 ++++++++++++++++++ .../TypedObject-ObjectIsTypedObject-multi.js | 44 ++++++++++++++++++++ .../TypedObject-ObjectIsTypedObject-unknown.js | 47 ++++++++++++++++++++++ .../inlining/TypedObject-ObjectIsTypedObject.js | 43 ++++++++++++++++++++ .../inlining/TypedObject-TypeDescrIsSimpleType.js | 43 ++++++++++++++++++++ .../ion/inlining/TypedObject-storage-opaque.js | 36 +++++++++++++++++ .../inlining/TypedObject-storage-transparent.js | 36 +++++++++++++++++ .../ion/inlining/TypedObject-storage-unknown.js | 39 ++++++++++++++++++ .../ion/inlining/TypedObject-storage-wrong.js | 35 ++++++++++++++++ js/src/jit-test/tests/ion/inlining/array-pop.js | 17 ++++++++ js/src/jit-test/tests/ion/inlining/array-push.js | 37 +++++++++++++++++ js/src/jit-test/tests/ion/inlining/bug705251.js | 10 +++++ .../ion/inlining/inline-callarg-bailout-phi.js | 29 +++++++++++++ .../tests/ion/inlining/inline-callarg-bailout.js | 26 ++++++++++++ .../inlining/inline-callarg-ubench-no-double2.js | 27 +++++++++++++ .../inline-istypedarray-on-nontypedarray.js | 6 +++ .../jit-test/tests/ion/inlining/isFiniteInline.js | 15 +++++++ js/src/jit-test/tests/ion/inlining/isNaNInline.js | 15 +++++++ .../typedarray-data-inlining-neuter-samedata.js | 28 +++++++++++++ .../tests/ion/inlining/typedarray-large-length.js | 10 +++++ .../inlining/typedarray-length-inlining-neuter.js | 22 ++++++++++ 25 files changed, 764 insertions(+) create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js create mode 100644 js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js create mode 100644 js/src/jit-test/tests/ion/inlining/array-pop.js create mode 100644 js/src/jit-test/tests/ion/inlining/array-push.js create mode 100644 js/src/jit-test/tests/ion/inlining/bug705251.js create mode 100644 js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js create mode 100644 js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js create mode 100644 js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js create mode 100644 js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js create mode 100644 js/src/jit-test/tests/ion/inlining/isFiniteInline.js create mode 100644 js/src/jit-test/tests/ion/inlining/isNaNInline.js create mode 100644 js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js create mode 100644 js/src/jit-test/tests/ion/inlining/typedarray-large-length.js create mode 100644 js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js (limited to 'js/src/jit-test/tests/ion/inlining') diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js new file mode 100644 index 000000000..9d31c0eab --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js @@ -0,0 +1,41 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests + * internal to Type.toSource(). + * + * In this case the argument type is always a type descriptor object + * (though not a unique one), so ObjectIsTypeDescr resolves to true + * and there should be no exceptions. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypeDescr far + * down in the graph for pass00, with a call to DescrToSource in a + * subsequent block (all of this is at the mercy of the way the code + * is currently written). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; +var ST1 = new T.StructType({x:T.int32}); +var ST2 = new T.StructType({x:T.float64}); + +function check(v) { + return v.toSource(); +} + +function test() { + var a = [ ST1, ST2 ]; + for ( var i=0 ; i < 1000 ; i++ ) + check(a[i%2]); + return check(a[0]); +} + +print(test()); + + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js new file mode 100644 index 000000000..92d1333bc --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js @@ -0,0 +1,39 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests + * internal to Type.toSource(). + * + * In this case the argument type is never a type descriptor object, + * so ObjectIsTypeDescr resolves to false (and we have to catch + * exceptions). + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypeDescr far + * down in the graph for pass00, with a call to DescrToSource in a + * subsequent block (all of this is at the mercy of the way the code + * is currently written). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; +var ST = new T.StructType({x:T.int32}); + +function check(v) { + return v.toSource(); +} + +function test() { + var fake = { toSource: ST.toSource }; + var a = [ ST, fake ]; + for ( var i=0 ; i < 1000 ; i++ ) + try { check(a[i%2]); } catch (e) {} + try { return check(a[0]); } catch (e) { return "Thrown" } +} + +print(test()); diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js new file mode 100644 index 000000000..f00186adf --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js @@ -0,0 +1,41 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests + * internal to Type.toSource(). + * + * In this case the argument type is never a type descriptor object + * (though not a unique non-type-descriptor), so ObjectIsTypeDescr + * resolves to false (and we have to catch exceptions). + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypeDescr far + * down in the graph for pass00, with a call to DescrToSource in a + * subsequent block (all of this is at the mercy of the way the code + * is currently written). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; +var ST = new T.StructType({x:T.int32}); + +function check(v) { + return v.toSource(); +} + +function test() { + var fake1 = { toSource: ST.toSource }; + var fake2 = []; fake2.toSource = ST.toSource; + var a = [ fake1, fake2 ]; + for ( var i=0 ; i < 1000 ; i++ ) + try { check(a[i%2]); } catch (e) {} + try { return check(a[0]); } catch (e) { return "Thrown" } +} + +print(test()); + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js new file mode 100644 index 000000000..6696b2d2d --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js @@ -0,0 +1,39 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests + * internal to Type.toSource(). + * + * In this case the argument type is never a type descriptor object, + * so ObjectIsTypeDescr resolves to false (and we have to catch + * exceptions). + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypeDescr far + * down in the graph for pass00, with a call to DescrToSource in a + * subsequent block (all of this is at the mercy of the way the code + * is currently written). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; +var ST = new T.StructType({x:T.int32}); + +function check(v) { + return v.toSource(); +} + +function test() { + var fake = { toSource: ST.toSource }; + for ( var i=0 ; i < 1000 ; i++ ) + try { check(fake); } catch (e) {} + try { return check(fake); } catch (e) { return "Thrown" } +} + +print(test()); + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js new file mode 100644 index 000000000..08f5bf47b --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js @@ -0,0 +1,39 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests + * internal to Type.toSource(). + * + * In this case the argument type is always a type descriptor object, + * so ObjectIsTypeDescr resolves to true and there should be no + * exceptions. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypeDescr far + * down in the graph for pass00, with a call to DescrToSource in a + * subsequent block (all of this is at the mercy of the way the code + * is currently written). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; +var ST = new T.StructType({x:T.int32}); + +function check(v) { + return v.toSource(); +} + +function test() { + for ( var i=0 ; i < 1000 ; i++ ) + check(ST); + return check(ST); +} + +print(test()); + + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js new file mode 100644 index 000000000..b83656007 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js @@ -0,0 +1,44 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypedObject tests + * used in the TO.objectType() method, among other places. + * + * In this case the argument type is always a TypedObject (though not + * a unique one), so ObjectIsTypedObject resolves to true and there + * should be no exceptions. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypedObject far + * down in the graph for pass00, with a subgraph before it that looks + * like it's comparing something to a string and to null (this is the + * inlining of IsObject). (All of this is at the mercy of the way the + * code is currently written.) + */ + +if (!this.TypedObject) { + print("No TypedObject, skipping"); + quit(); +} + +var T = TypedObject; +var ST1 = new T.StructType({x:T.int32}); +var ST2 = new T.StructType({f:T.float64}); +var v1 = new ST1({x:10}); +var v2 = new ST2({f:3.14159}); + +function check(v) { + return T.objectType(v); +} + +function test() { + var a = [ v1, v2 ]; + for ( var i=0 ; i < 1000 ; i++ ) + assertEq(check(a[i%2]), ((i%2)==0 ? ST1 : ST2)); + return check(a[i%2]); +} + +print("Done"); diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js new file mode 100644 index 000000000..a008e65ae --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js @@ -0,0 +1,47 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypedObject tests + * used in the TO.objectType() method, among other places. + * + * In this case the argument type is sometimes a TypedObject, + * sometimes not, so ObjectIsTypedObject must be a run-time check and + * sometimes it resolves to "false" and takes a more expensive path. + * There should be no exceptions: the operation is defined also on + * non-TypedObjects. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypedObject far + * down in the graph for pass00, with a subgraph before it that looks + * like it's comparing something to a string and to null (this is the + * inlining of IsObject). (All of this is at the mercy of the way the + * code is currently written.) + */ + +if (!this.TypedObject) { + print("No TypedObject, skipping"); + quit(); +} + +var T = TypedObject; +var ST1 = new T.StructType({x:T.int32}); +var v1 = new ST1({x:10}); + +function check(v) { + return T.objectType(v); +} + +function test() { + var v2 = { tag: "Hello, world!" }; + var a = [ v1, v2 ]; + for ( var i=0 ; i < 1000 ; i++ ) + assertEq(check(a[i%2]), (i%2) == 0 ? ST1 : T.Object); + return check(a[i%2]); +} + +print("Done"); + + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js new file mode 100644 index 000000000..7618f278d --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js @@ -0,0 +1,43 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the ObjectIsTypedObject tests + * used in the TO.objectType() method, among other places. + * + * In this case the argument type is always a TypedObject, so + * ObjectIsTypedObject resolves to true and there should be no + * exceptions. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. You're looking for a smallish function within the + * "self-hosted" domain. Look for a call to ObjectIsTypedObject far + * down in the graph for pass00, with a subgraph before it that looks + * like it's comparing something to a string and to null (this is the + * inlining of IsObject). (All of this is at the mercy of the way the + * code is currently written.) + */ + +if (!this.TypedObject) { + print("No TypedObject, skipping"); + quit(); +} + +var T = TypedObject; +var ST = new T.StructType({x:T.int32}); +var v = new ST({x:10}); + +function check(v) { + return T.objectType(v); +} + +function test() { + for ( var i=0 ; i < 1000 ; i++ ) + assertEq(check(v), ST); + return check(v); +} + +print("Done"); + + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js b/js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js new file mode 100644 index 000000000..7536c4218 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js @@ -0,0 +1,43 @@ +/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Testing TypeDescrIsSimpleType() is tricky because it's not exposed. + * However, the implementation of .build() must use it. + * + * This basically asserts that build() works, and thus that the code is + * at least not broken. + * + * To verify that inlining happens: + * + * Run this with IONFLAGS=logs, generate pdfs with iongraph, and then + * try running "pdfgrep TypeDescrIsSimpleType func*pass00*.pdf", this + * might net a couple of functions that are likely candidates for + * manual inspection. + */ + +if (!this.TypedObject) { + print("No TypedObject, skipping"); + quit(); +} + +var T = TypedObject; +var AT = new T.ArrayType(T.uint32, 100); + +function check() { + return AT.build(x => x+1); +} + +function test() { + var w; + for ( var i=0 ; i < 100 ; i++ ) + w = check(); + return w; +} + +var w = test(); +assertEq(w.length, 100); +assertEq(w[99], 100); +print("Done"); + diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js new file mode 100644 index 000000000..7bf882e48 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js @@ -0,0 +1,36 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the transparent/opaque type + * tests internal to storage(). + * + * In this case the argument type is always an opaque object, so + * ObjectIsOpaqueTypedObject resolves to true and + * ObjectIsTransparentTypedObject resolves to false. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. func01 will likely be the one we want (look for calls to + * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the + * graph for pass00). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; + +function check(v) { + return T.storage(v); +} + +function test() { + var AT = new T.ArrayType(T.Any,10); + var v = new AT(); + for ( var i=0 ; i < 1000 ; i++ ) + check(v); + return check(v); +} + +test(); diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js new file mode 100644 index 000000000..e4faf1128 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js @@ -0,0 +1,36 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the transparent/opaque type + * tests internal to storage(). + * + * In this case the argument type is always a transparent object, so + * ObjectIsOpaqueTypedObject resolves to false and + * ObjectIsTransparentTypedObject resolves to true. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. func01 will likely be the one we want (look for calls to + * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the + * graph for pass00). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; + +function check(v) { + return T.storage(v); +} + +function test() { + var AT = new T.ArrayType(T.int32, 10); + var v = new AT(); + for ( var i=0 ; i < 1000 ; i++ ) + check(v); + return check(v); +} + +test(); diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js new file mode 100644 index 000000000..fe1aaa0d4 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js @@ -0,0 +1,39 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the transparent/opaque type + * tests internal to storage(). + * + * In this case the argument type is variable and thus unknown to the + * JIT, so both ObjectIsOpaqueTypedObject and + * ObjectIsTransparentTypedObject are resolved as uses of the + * "HasClass" primitive. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. func01 will likely be the one we want (look for calls to + * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the + * graph for pass00). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; + +function check(v) { + return T.storage(v); +} + +function test() { + var AT = new T.ArrayType(T.int32,10); + var v = new Object; // Not actually a typed object + var w = new AT(); // Actually a typed object + var a = [v,w]; + for ( var i=0 ; i < 1000 ; i++ ) + try { check(a[i%2]); } catch (e) {} + try { return check(a[1]); } catch (e) {} +} + +test(); diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js new file mode 100644 index 000000000..2e454c273 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js @@ -0,0 +1,35 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Used to verify that the JIT resolves the transparent/opaque type + * tests internal to storage(). + * + * In this case the argument type is always a non-TypedObject, so both + * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject + * resolve to false. + * + * Load this into the js shell with IONFLAGS=logs, then exit and run + * iongraph. func01 will likely be the one we want (look for calls to + * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the + * graph for pass00). + */ + +if (!this.TypedObject) + quit(); + +var T = TypedObject; + +function check(v) { + return T.storage(v); +} + +function test() { + var v = new Object; // Not actually a typed object + for ( var i=0 ; i < 1000 ; i++ ) + try { check(v); } catch (e) {} + try { return check(v); } catch (e) {} +} + +test(); diff --git a/js/src/jit-test/tests/ion/inlining/array-pop.js b/js/src/jit-test/tests/ion/inlining/array-pop.js new file mode 100644 index 000000000..007b1dc8e --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/array-pop.js @@ -0,0 +1,17 @@ +function f(arr) { + var x; + for (var i=0; i<100; i++) { + x = arr.pop(); + } + return x; +} + +var arr = []; +for (var i=0; i<130; i++) { + arr.push({i: i}); +} + +assertEq(f(arr).i, 30); +assertEq(arr.length, 30); +assertEq(f(arr), undefined); +assertEq(arr.length, 0); diff --git a/js/src/jit-test/tests/ion/inlining/array-push.js b/js/src/jit-test/tests/ion/inlining/array-push.js new file mode 100644 index 000000000..3e7ac159e --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/array-push.js @@ -0,0 +1,37 @@ +function test1() { + function push(arr, x) { + return arr.push(x); + } + var arr = []; + for (var i=0; i<100; i++) { + assertEq(push(arr, i), i + 1); + } +} +test1(); + +function test2() { + var arr; + for (var i=0; i<60; i++) { + arr = []; + assertEq(arr.push(3.3), 1); + assertEq(arr.push(undefined), 2); + assertEq(arr.push(true), 3); + assertEq(arr.push(Math), 4); + assertEq(arr.toString(), "3.3,,true,[object Math]"); + } +} +test2(); + +function test3() { + function push(arr, v) { + arr.push(v); + } + for (var i=0; i<60; i++) { + var arr = []; + push(arr, null); + push(arr, 3.14); + push(arr, {}); + assertEq(arr.toString(), ",3.14,[object Object]"); + } +} +test3(); diff --git a/js/src/jit-test/tests/ion/inlining/bug705251.js b/js/src/jit-test/tests/ion/inlining/bug705251.js new file mode 100644 index 000000000..19f639d7a --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/bug705251.js @@ -0,0 +1,10 @@ +function bitsinbyte() { + var c = 0; + while (false) c = c * 2; +} +function TimeFunc(func) { + for(var y=0; y<11000; y++) + func(); +} +for (var i=0; i<50; i++) + TimeFunc(bitsinbyte); diff --git a/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js new file mode 100644 index 000000000..06bc1f6ef --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js @@ -0,0 +1,29 @@ +function add(x, y) { + if (x & 0x1) + return x + y; + else + return y + x; +} + +function runBinop(binop, lhs, rhs) { + return binop(lhs, rhs); +} + +//dis(run_binop); + +// Get the add function to compile. +var accum = 0; +for (var i = 0; i < 1000; ++i) + accum += add(1, 1); +assertEq(accum, 2000); + +// Get the runBinop function to compile and inline the add function. +var accum = 0; +for (var i = 0; i < 11000; ++i) + accum = runBinop(add, i, i); +assertEq(accum, 21998); + +var t30 = 1 << 30; +var t31 = t30 + t30; +var result = runBinop(add, t31, t31); +assertEq(result, Math.pow(2, 32)); diff --git a/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js new file mode 100644 index 000000000..fad2c1a3b --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js @@ -0,0 +1,26 @@ +function add(x, y) { + return x + y; +} + +function runBinop(binop, lhs, rhs) { + return binop(lhs, rhs); +} + +//dis(run_binop); + +// Get the add function to compile. +var accum = 0; +for (var i = 0; i < 1000; ++i) + accum += add(1, 1); +assertEq(accum, 2000); + +// Get the runBinop function to compile and inline the add function. +var accum = 0; +for (var i = 0; i < 10100; ++i) + accum = runBinop(add, i, i); +assertEq(accum, 20198); + +var t30 = 1 << 30; +var t31 = t30 + t30; +var result = runBinop(add, t31, t31); +assertEq(result, Math.pow(2, 32)); diff --git a/js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js b/js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js new file mode 100644 index 000000000..385ea1a02 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js @@ -0,0 +1,27 @@ +function lameFunc(x, y) { + var lsw = (x & 0xFFFF) + (y & 0xFFFF); + var msw = (x >> 16) + (y >> 16) + (lsw >> 16); + return (msw << 16) | (lsw & 0xFFFF); +} + +function runSomeTimes(func, iters) { + var result; + for (var i = 0; i < iters; ++i) { + result = func(42, 42); + result = func(42, 42); + } + return result; +} + +// First, run the inner function to get TI information. +for (var i = 0; i < 100; ++i) + lameFunc(42, 42); + +// Then, run the outer function with the inner function as a CALLARG to get it +// to Ion compile with inlining. +for (var i = 0; i < 11000; ++i) + runSomeTimes(lameFunc, 1); + +// Lastly, now that we're all inlined and compiled, perform the test! +var iterations = 100; +assertEq(84, runSomeTimes(lameFunc, iterations)); diff --git a/js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js b/js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js new file mode 100644 index 000000000..e1c540d19 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js @@ -0,0 +1,6 @@ +(new Int8Array(3)).join(); +[Math.abs, Math.abs].forEach(x => { + try { + Int8Array.prototype.join.call(x); + } catch(e) {} +}); diff --git a/js/src/jit-test/tests/ion/inlining/isFiniteInline.js b/js/src/jit-test/tests/ion/inlining/isFiniteInline.js new file mode 100644 index 000000000..c61191ee5 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/isFiniteInline.js @@ -0,0 +1,15 @@ +/* Test inlining of Number.isFinite() */ + +for (var i = 0; i < 200000; i++) { + assertEq(Number.isFinite(NaN), false); + assertEq(Number.isFinite(-NaN), false); + assertEq(Number.isFinite(+Infinity), false); + assertEq(Number.isFinite(-Infinity), false); + assertEq(Number.isFinite(3), true); + assertEq(Number.isFinite(3.141592654), true); + assertEq(Number.isFinite(+0), true); + assertEq(Number.isFinite(-0), true); + assertEq(Number.isFinite(-3), true); + assertEq(Number.isFinite(-3.141592654), true); + assertEq(Number.isFinite({}), false); +} diff --git a/js/src/jit-test/tests/ion/inlining/isNaNInline.js b/js/src/jit-test/tests/ion/inlining/isNaNInline.js new file mode 100644 index 000000000..f8c92e075 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/isNaNInline.js @@ -0,0 +1,15 @@ +/* Test inlining of Number.isNaN() */ + +for (var i = 0; i < 200000; i++) { + assertEq(Number.isNaN(NaN), true); + assertEq(Number.isNaN(-NaN), true); + assertEq(Number.isNaN(+Infinity), false); + assertEq(Number.isNaN(-Infinity), false); + assertEq(Number.isNaN(3.14159), false); + assertEq(Number.isNaN(-3.14159), false); + assertEq(Number.isNaN(3), false); + assertEq(Number.isNaN(-3), false); + assertEq(Number.isNaN(+0), false); + assertEq(Number.isNaN(-0), false); + assertEq(Number.isNaN({}), false); +} diff --git a/js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js b/js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js new file mode 100644 index 000000000..16478e0a0 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js @@ -0,0 +1,28 @@ +var NONINLINABLE_AMOUNT = 40; +var SIZEOF_INT32 = 4; + +var INLINABLE_INT8_AMOUNT = 4; + +// Large arrays with non-inline data + +var ab1 = new ArrayBuffer(NONINLINABLE_AMOUNT * SIZEOF_INT32); +var ta1 = new Int32Array(ab1); +for (var i = 0; i < ta1.length; i++) + ta1[i] = i + 43; +function q1() { return ta1[NONINLINABLE_AMOUNT - 1]; } +assertEq(q1(), NONINLINABLE_AMOUNT - 1 + 43); +assertEq(q1(), NONINLINABLE_AMOUNT - 1 + 43); +detachArrayBuffer(ab1); +assertEq(q1(), undefined); + +// Small arrays with inline data + +var ab2 = new ArrayBuffer(INLINABLE_INT8_AMOUNT); +var ta2 = new Int8Array(ab2); +for (var i = 0; i < ta2.length; i++) + ta2[i] = i + 13; +function q2() { return ta2[INLINABLE_INT8_AMOUNT - 1]; } +assertEq(q2(), INLINABLE_INT8_AMOUNT - 1 + 13); +assertEq(q2(), INLINABLE_INT8_AMOUNT - 1 + 13); +detachArrayBuffer(ab2); +assertEq(q2(), undefined); diff --git a/js/src/jit-test/tests/ion/inlining/typedarray-large-length.js b/js/src/jit-test/tests/ion/inlining/typedarray-large-length.js new file mode 100644 index 000000000..9e6d67d3b --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/typedarray-large-length.js @@ -0,0 +1,10 @@ +var SINGLETON_BYTE_LENGTH = 1024 * 1024 * 10; + +for (var i = 0; i < 2000; i++) { + if (i == 1500) + len = SINGLETON_BYTE_LENGTH >> 3; + else + len = i % 64; + var arr = new Float64Array(len); + assertEq(arr[0], len ? 0 : undefined); +} diff --git a/js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js b/js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js new file mode 100644 index 000000000..520dd1a38 --- /dev/null +++ b/js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js @@ -0,0 +1,22 @@ +var INLINE_INT8_AMOUNT = 4; +var OUT_OF_LINE_INT8_AMOUNT = 237; + +// Small and inline + +var ab1 = new ArrayBuffer(INLINE_INT8_AMOUNT); +var ta1 = new Int8Array(ab1); +function q1() { return ta1.length; } +q1(); +q1(); +detachArrayBuffer(ab1); +assertEq(q1(), 0); + +// Large and out-of-line + +var ab2 = new ArrayBuffer(OUT_OF_LINE_INT8_AMOUNT); +var ta2 = new Int8Array(ab2); +function q2() { return ta2.length; } +q2(); +q2(); +detachArrayBuffer(ab2); +assertEq(q2(), 0); -- cgit v1.2.3