Skip to content

Commit 10716de

Browse files
marjakhV8 LUCI CQ
marjakh
authored and
V8 LUCI CQ
committed
Revert JSTypedArray length removal
This reverts the following commits: "Reland [typed arrays] Remove the `length` field, use only byte length" "[postmortem] remove JSTypedArray.kRawLengthOffset extra accessor" Bug: 40070746, 385167059 Change-Id: I85c78d52754a42aad19dbd060a8cb4eb46317b55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6148590 Commit-Queue: Marja Hölttä <[email protected]> Reviewed-by: Leszek Swirski <[email protected]> Cr-Commit-Position: refs/heads/main@{#97958}
1 parent d1e4973 commit 10716de

22 files changed

+133
-121
lines changed

‎src/builtins/typed-array-createtypedarray.tq‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ extern runtime GrowableSharedArrayBufferByteLength(
2323
transitioning macro AllocateTypedArray(
2424
implicit context: Context)(isOnHeap: constexpr bool, map: Map,
2525
buffer: JSArrayBuffer, byteOffset: uintptr, byteLength: uintptr,
26-
isLengthTracking: bool): JSTypedArray {
26+
length: uintptr, isLengthTracking: bool): JSTypedArray {
2727
let elements: ByteArray;
2828
if constexpr (isOnHeap) {
2929
dcheck(!IsResizableArrayBuffer(buffer));
@@ -60,8 +60,10 @@ transitioning macro AllocateTypedArray(
6060
// Set the byte_length and length fields of length-tracking TAs to zero, so
6161
// that we won't accidentally use them and access invalid data.
6262
typedArray.byte_length = 0;
63+
typedArray.length = 0;
6364
} else {
6465
typedArray.byte_length = byteLength;
66+
typedArray.length = length;
6567
}
6668
typedArray.bit_field.is_length_tracking = isLengthTracking;
6769
typedArray.bit_field.is_backed_by_rab =
@@ -97,7 +99,8 @@ transitioning macro TypedArrayInitialize(
9799
const isOnHeap: constexpr bool = true;
98100
const isLengthTracking: constexpr bool = false;
99101
const typedArray = AllocateTypedArray(
100-
isOnHeap, map, buffer, byteOffset, byteLength, isLengthTracking);
102+
isOnHeap, map, buffer, byteOffset, byteLength, length,
103+
isLengthTracking);
101104

102105
if constexpr (initialize) {
103106
const backingStore = typedArray.data_ptr;
@@ -117,7 +120,8 @@ transitioning macro TypedArrayInitialize(
117120
const isOnHeap: constexpr bool = false;
118121
const isLengthTracking: constexpr bool = false;
119122
return AllocateTypedArray(
120-
isOnHeap, map, buffer, byteOffset, byteLength, isLengthTracking);
123+
isOnHeap, map, buffer, byteOffset, byteLength, length,
124+
isLengthTracking);
121125
}
122126
}
123127

@@ -311,7 +315,8 @@ transitioning macro ConstructByArrayBuffer(
311315

312316
const isOnHeap: constexpr bool = false;
313317
return AllocateTypedArray(
314-
isOnHeap, map, buffer, offset, newByteLength, isLengthTracking);
318+
isOnHeap, map, buffer, offset, newByteLength, newLength,
319+
isLengthTracking);
315320
} label IfInvalidAlignment(problemString: String) deferred {
316321
ThrowInvalidTypedArrayAlignment(map, problemString);
317322
} label IfInvalidLength deferred {

‎src/codegen/code-stub-assembler.cc‎

Lines changed: 21 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -16547,11 +16547,12 @@ void CodeStubAssembler::StoreJSArrayBufferViewByteOffset(
1654716547

1654816548
TNode<UintPtrT> CodeStubAssembler::LoadJSTypedArrayLength(
1654916549
TNode<JSTypedArray> typed_array) {
16550-
TNode<UintPtrT> byte_length = LoadBoundedSizeFromObject(
16551-
typed_array, JSTypedArray::kRawByteLengthOffset);
16552-
TNode<IntPtrT> element_size =
16553-
ElementsKindToElementByteSize(LoadElementsKind(typed_array));
16554-
return Unsigned(IntPtrDiv(Signed(byte_length), element_size));
16550+
return LoadBoundedSizeFromObject(typed_array, JSTypedArray::kRawLengthOffset);
16551+
}
16552+
16553+
void CodeStubAssembler::StoreJSTypedArrayLength(TNode<JSTypedArray> typed_array,
16554+
TNode<UintPtrT> value) {
16555+
StoreBoundedSizeToObject(typed_array, JSTypedArray::kRawLengthOffset, value);
1655516556
}
1655616557

1655716558
TNode<UintPtrT> CodeStubAssembler::LoadJSTypedArrayLengthAndCheckDetached(
@@ -16589,7 +16590,7 @@ TNode<UintPtrT> CodeStubAssembler::LoadVariableLengthJSTypedArrayLength(
1658916590
TNode<UintPtrT> byte_length = LoadVariableLengthJSArrayBufferViewByteLength(
1659016591
array, buffer, detached_or_out_of_bounds);
1659116592
TNode<IntPtrT> element_size =
16592-
ElementsKindToElementByteSize(LoadElementsKind(array));
16593+
RabGsabElementsKindToElementByteSize(LoadElementsKind(array));
1659316594
return Unsigned(IntPtrDiv(Signed(byte_length), element_size));
1659416595
}
1659516596

@@ -16745,7 +16746,7 @@ TNode<UintPtrT> CodeStubAssembler::LoadVariableLengthJSTypedArrayByteLength(
1674516746
TNode<UintPtrT> length =
1674616747
LoadVariableLengthJSTypedArrayLength(array, buffer, &miss);
1674716748
TNode<IntPtrT> element_size =
16748-
ElementsKindToElementByteSize(LoadElementsKind(array));
16749+
RabGsabElementsKindToElementByteSize(LoadElementsKind(array));
1674916750
// Conversion to signed is OK since length < JSArrayBuffer::kMaxByteLength.
1675016751
TNode<IntPtrT> byte_length = IntPtrMul(Signed(length), element_size);
1675116752
result = Unsigned(byte_length);
@@ -16759,44 +16760,25 @@ TNode<UintPtrT> CodeStubAssembler::LoadVariableLengthJSTypedArrayByteLength(
1675916760
return result.value();
1676016761
}
1676116762

16762-
TNode<IntPtrT> CodeStubAssembler::ElementsKindToElementByteSize(
16763+
TNode<IntPtrT> CodeStubAssembler::RabGsabElementsKindToElementByteSize(
1676316764
TNode<Int32T> elements_kind) {
1676416765
TVARIABLE(IntPtrT, result);
1676516766
Label elements_8(this), elements_16(this), elements_32(this),
1676616767
elements_64(this), not_found(this), end(this);
16767-
int32_t elements_kinds[] = {UINT8_ELEMENTS,
16768-
UINT8_CLAMPED_ELEMENTS,
16769-
INT8_ELEMENTS,
16770-
UINT16_ELEMENTS,
16771-
INT16_ELEMENTS,
16772-
FLOAT16_ELEMENTS,
16773-
UINT32_ELEMENTS,
16774-
INT32_ELEMENTS,
16775-
FLOAT32_ELEMENTS,
16776-
FLOAT64_ELEMENTS,
16777-
BIGINT64_ELEMENTS,
16778-
BIGUINT64_ELEMENTS,
16779-
RAB_GSAB_UINT8_ELEMENTS,
16780-
RAB_GSAB_UINT8_CLAMPED_ELEMENTS,
16781-
RAB_GSAB_INT8_ELEMENTS,
16782-
RAB_GSAB_UINT16_ELEMENTS,
16783-
RAB_GSAB_INT16_ELEMENTS,
16784-
RAB_GSAB_FLOAT16_ELEMENTS,
16785-
RAB_GSAB_UINT32_ELEMENTS,
16786-
RAB_GSAB_INT32_ELEMENTS,
16787-
RAB_GSAB_FLOAT32_ELEMENTS,
16788-
RAB_GSAB_FLOAT64_ELEMENTS,
16789-
RAB_GSAB_BIGINT64_ELEMENTS,
16790-
RAB_GSAB_BIGUINT64_ELEMENTS};
16791-
Label* elements_kind_labels[] = {
16792-
&elements_8, &elements_8, &elements_8, &elements_16, &elements_16,
16793-
&elements_16, &elements_32, &elements_32, &elements_32, &elements_64,
16794-
&elements_64, &elements_64, &elements_8, &elements_8, &elements_8,
16795-
&elements_16, &elements_16, &elements_16, &elements_32, &elements_32,
16796-
&elements_32, &elements_64, &elements_64, &elements_64};
16768+
int32_t elements_kinds[] = {
16769+
RAB_GSAB_UINT8_ELEMENTS, RAB_GSAB_UINT8_CLAMPED_ELEMENTS,
16770+
RAB_GSAB_INT8_ELEMENTS, RAB_GSAB_UINT16_ELEMENTS,
16771+
RAB_GSAB_INT16_ELEMENTS, RAB_GSAB_FLOAT16_ELEMENTS,
16772+
RAB_GSAB_UINT32_ELEMENTS, RAB_GSAB_INT32_ELEMENTS,
16773+
RAB_GSAB_FLOAT32_ELEMENTS, RAB_GSAB_FLOAT64_ELEMENTS,
16774+
RAB_GSAB_BIGINT64_ELEMENTS, RAB_GSAB_BIGUINT64_ELEMENTS};
16775+
Label* elements_kind_labels[] = {&elements_8, &elements_8, &elements_8,
16776+
&elements_16, &elements_16, &elements_16,
16777+
&elements_32, &elements_32, &elements_32,
16778+
&elements_64, &elements_64, &elements_64};
1679716779
const size_t kTypedElementsKindCount =
1679816780
LAST_RAB_GSAB_FIXED_TYPED_ARRAY_ELEMENTS_KIND -
16799-
FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND + 1;
16781+
FIRST_RAB_GSAB_FIXED_TYPED_ARRAY_ELEMENTS_KIND + 1;
1680016782
DCHECK_EQ(kTypedElementsKindCount, arraysize(elements_kinds));
1680116783
DCHECK_EQ(kTypedElementsKindCount, arraysize(elements_kind_labels));
1680216784
Switch(elements_kind, &not_found, elements_kinds, elements_kind_labels,

‎src/codegen/code-stub-assembler.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4059,6 +4059,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
40594059

40604060
// JSTypedArray helpers
40614061
TNode<UintPtrT> LoadJSTypedArrayLength(TNode<JSTypedArray> typed_array);
4062+
void StoreJSTypedArrayLength(TNode<JSTypedArray> typed_array,
4063+
TNode<UintPtrT> value);
40624064
TNode<UintPtrT> LoadJSTypedArrayLengthAndCheckDetached(
40634065
TNode<JSTypedArray> typed_array, Label* detached);
40644066
// Helper for length tracking JSTypedArrays and JSTypedArrays backed by
@@ -4086,7 +4088,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
40864088
TNode<UintPtrT> index,
40874089
Label* detached_or_out_of_bounds);
40884090

4089-
TNode<IntPtrT> ElementsKindToElementByteSize(TNode<Int32T> elementsKind);
4091+
TNode<IntPtrT> RabGsabElementsKindToElementByteSize(
4092+
TNode<Int32T> elementsKind);
40904093
TNode<RawPtrT> LoadJSTypedArrayDataPtr(TNode<JSTypedArray> typed_array);
40914094
TNode<JSArrayBuffer> GetTypedArrayBuffer(TNode<Context> context,
40924095
TNode<JSTypedArray> array);

‎src/compiler/access-builder.cc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -546,6 +546,22 @@ FieldAccess AccessBuilder::ForJSArrayBufferViewBitField() {
546546
return access;
547547
}
548548

549+
// static
550+
FieldAccess AccessBuilder::ForJSTypedArrayLength() {
551+
FieldAccess access = {kTaggedBase,
552+
JSTypedArray::kRawLengthOffset,
553+
MaybeHandle<Name>(),
554+
OptionalMapRef(),
555+
TypeCache::Get()->kJSTypedArrayLengthType,
556+
MachineType::UintPtr(),
557+
kNoWriteBarrier,
558+
"JSTypedArrayLength"};
559+
#ifdef V8_ENABLE_SANDBOX
560+
access.is_bounded_size_access = true;
561+
#endif
562+
return access;
563+
}
564+
549565
// static
550566
FieldAccess AccessBuilder::ForJSTypedArrayBasePointer() {
551567
FieldAccess access = {kTaggedBase, JSTypedArray::kBasePointerOffset,

‎src/compiler/access-builder.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
171171
// Provides access to JSArrayBufferView::bitfield() field
172172
static FieldAccess ForJSArrayBufferViewBitField();
173173

174+
// Provides access to JSTypedArray::length() field.
175+
static FieldAccess ForJSTypedArrayLength();
176+
174177
// Provides access to JSTypedArray::byteLength() field.
175178
static FieldAccess ForJSTypedArrayByteLength() {
176179
return ForJSArrayBufferViewByteLength();

‎src/compiler/graph-assembler.cc‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -615,16 +615,8 @@ class ArrayBufferViewAccessBuilder {
615615
// Case 1: Normal (backed by AB/SAB) or non-length tracking backed by GSAB
616616
// (can't go oob once constructed)
617617
auto GsabFixedOrNormal = [&]() {
618-
TNode<UintPtrT> byte_length = MachineLoadField<UintPtrT>(
619-
AccessBuilder::ForJSArrayBufferViewByteLength(), view,
620-
UseInfo::Word());
621-
622-
TNode<Map> typed_array_map = a.LoadField<Map>(
623-
AccessBuilder::ForMap(WriteBarrierKind::kNoWriteBarrier), view);
624-
TNode<Uint32T> elements_kind = a.LoadElementsKind(typed_array_map);
625-
TNode<Uint32T> element_size =
626-
a.LookupByteSizeForElementsKind(elements_kind);
627-
return a.UintPtrDiv(byte_length, a.ChangeUint32ToUintPtr(element_size));
618+
return MachineLoadField<UintPtrT>(AccessBuilder::ForJSTypedArrayLength(),
619+
view, UseInfo::Word());
628620
};
629621

630622
// If we statically know we cannot have rab/gsab backed, we can simply

‎src/compiler/heap-refs.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1809,10 +1809,10 @@ bool JSTypedArrayRef::is_on_heap() const {
18091809
return object()->is_on_heap(kAcquireLoad);
18101810
}
18111811

1812-
size_t JSTypedArrayRef::byte_length() const {
1812+
size_t JSTypedArrayRef::length() const {
18131813
CHECK(!is_on_heap());
18141814
// Immutable after initialization.
1815-
return object()->byte_length();
1815+
return object()->length();
18161816
}
18171817

18181818
HeapObjectRef JSTypedArrayRef::buffer(JSHeapBroker* broker) const {

‎src/compiler/heap-refs.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1186,7 +1186,7 @@ class JSTypedArrayRef : public JSObjectRef {
11861186
IndirectHandle<JSTypedArray> object() const;
11871187

11881188
bool is_on_heap() const;
1189-
size_t byte_length() const;
1189+
size_t length() const;
11901190
void* data_ptr() const;
11911191
HeapObjectRef buffer(JSHeapBroker* broker) const;
11921192
};

‎src/compiler/js-call-reducer.cc‎

Lines changed: 9 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6596,23 +6596,12 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
65966596
// Load the length of the {iterated_object}. Due to the map checks we
65976597
// already know something about the length here, which we can leverage
65986598
// to generate Word32 operations below without additional checking.
6599-
Node* length;
6600-
if (IsTypedArrayElementsKind(elements_kind)) {
6601-
Node* byte_length = effect = graph()->NewNode(
6602-
simplified()->LoadField(AccessBuilder::ForJSTypedArrayByteLength()),
6603-
iterated_object, effect, control);
6604-
Node* byte_length_shifted = graph()->NewNode(
6605-
jsgraph()->machine()->WordShr(), byte_length,
6606-
jsgraph()->UintPtrConstant(ElementsKindToShiftSize(elements_kind)));
6607-
length = graph()->NewNode(
6608-
common()->ExitMachineGraph(MachineType::PointerRepresentation(),
6609-
TypeCache::Get()->kJSTypedArrayLengthType),
6610-
byte_length_shifted);
6611-
} else {
6612-
length = effect = graph()->NewNode(
6613-
simplified()->LoadField(AccessBuilder::ForJSArrayLength(elements_kind)),
6614-
iterated_object, effect, control);
6615-
}
6599+
FieldAccess length_access =
6600+
IsTypedArrayElementsKind(elements_kind)
6601+
? AccessBuilder::ForJSTypedArrayLength()
6602+
: AccessBuilder::ForJSArrayLength(elements_kind);
6603+
Node* length = effect = graph()->NewNode(
6604+
simplified()->LoadField(length_access), iterated_object, effect, control);
66166605

66176606
// Check whether {index} is within the valid range for the {iterated_object}.
66186607
Node* check = graph()->NewNode(simplified()->NumberLessThan(), index, length);
@@ -7794,9 +7783,9 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeLength(Node* node) {
77947783
Reduction unused_reduction = inference.NoChange();
77957784
USE(unused_reduction);
77967785
// Call default implementation for non-rab/gsab TAs.
7797-
return ReduceArrayBufferViewAccessor(
7798-
node, JS_TYPED_ARRAY_TYPE, AccessBuilder::ForJSTypedArrayByteLength(),
7799-
Builtin::kTypedArrayPrototypeLength);
7786+
return ReduceArrayBufferViewAccessor(node, JS_TYPED_ARRAY_TYPE,
7787+
AccessBuilder::ForJSTypedArrayLength(),
7788+
Builtin::kTypedArrayPrototypeLength);
78007789
}
78017790

78027791
if (!inference.RelyOnMapsViaStability(dependencies())) {
@@ -8382,16 +8371,6 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
83828371
BranchHint::kFalse);
83838372
}
83848373

8385-
if (builtin == Builtin::kTypedArrayPrototypeLength) {
8386-
TNode<UintPtrT> byte_length = value;
8387-
// Divide the byte length by element size.
8388-
TNode<Map> map = a.LoadMap(TNode<HeapObject>::UncheckedCast(receiver));
8389-
TNode<Uint32T> elements_kind = a.LoadElementsKind(map);
8390-
TNode<Uint32T> shift = a.LookupByteShiftForElementsKind(elements_kind);
8391-
value = TNode<UintPtrT>::UncheckedCast(
8392-
a.WordShr(byte_length, a.ChangeUint32ToUintPtr(shift)));
8393-
}
8394-
83958374
TNode<Number> result =
83968375
a.ExitMachineGraph<Number>(value, MachineType::PointerRepresentation(),
83978376
TypeCache::Get()->kJSTypedArrayLengthType);

‎src/compiler/js-native-context-specialization.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3767,8 +3767,8 @@ JSNativeContextSpecialization::
37673767
Node* dead = jsgraph_->Dead();
37683768
return ValueEffectControl{dead, dead, dead};
37693769
} else {
3770-
length = jsgraph()->ConstantNoHole(
3771-
typed_array->byte_length() >> ElementsKindToShiftSize(elements_kind));
3770+
length =
3771+
jsgraph()->ConstantNoHole(static_cast<double>(typed_array->length()));
37723772

37733773
DCHECK(!typed_array->is_on_heap());
37743774
// Load the (known) data pointer for the {receiver} and set

0 commit comments

Comments
 (0)