<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[165406] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/165406">165406</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-03-10 15:11:35 -0700 (Mon, 10 Mar 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>DFG and FTL should know that comparing anything to Misc is cheap and easy
https://bugs.webkit.org/show_bug.cgi?id=130001
Reviewed by Geoffrey Garen.
- Expand CompareStrictEq(Misc:, Misc:) to work for cases where either side of the
comparison is just Untyped:.
- This obviates the need for CompareStrictEqConstant, so remove it.
- FTL had a thing called "Nully" which is really "Other". Rename it and add
OtherUse.
9% speed-up on box2d.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::isBinaryUseKind):
(JSC::DFG::Node::shouldSpeculateOther):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
(JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
(JSC::FTL::LowerDFGToLLVM::isNotOther):
(JSC::FTL::LowerDFGToLLVM::isOther):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
(JSC::FTL::LowerDFGToLLVM::speculateNotCell):
(JSC::FTL::LowerDFGToLLVM::speculateOther):
(JSC::FTL::LowerDFGToLLVM::speculateMisc):
* tests/stress/compare-strict-eq-integer-to-misc.js: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstresscomparestricteqintegertomiscjs">trunk/Source/JavaScriptCore/tests/stress/compare-strict-eq-integer-to-misc.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -1,5 +1,66 @@
</span><span class="cx"> 2014-03-10 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><ins>+ DFG and FTL should know that comparing anything to Misc is cheap and easy
+ https://bugs.webkit.org/show_bug.cgi?id=130001
+
+ Reviewed by Geoffrey Garen.
+
+ - Expand CompareStrictEq(Misc:, Misc:) to work for cases where either side of the
+ comparison is just Untyped:.
+
+ - This obviates the need for CompareStrictEqConstant, so remove it.
+
+ - FTL had a thing called "Nully" which is really "Other". Rename it and add
+ OtherUse.
+
+ 9% speed-up on box2d.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::isBinaryUseKind):
+ (JSC::DFG::Node::shouldSpeculateOther):
+ * dfg/DFGNodeType.h:
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+ (JSC::DFG::SpeculativeJIT::compare):
+ (JSC::DFG::SpeculativeJIT::compileStrictEq):
+ * dfg/DFGSpeculativeJIT.h:
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+ (JSC::DFG::SpeculativeJIT::compile):
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+ (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+ (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+ (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+ (JSC::FTL::LowerDFGToLLVM::isNotOther):
+ (JSC::FTL::LowerDFGToLLVM::isOther):
+ (JSC::FTL::LowerDFGToLLVM::speculate):
+ (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+ (JSC::FTL::LowerDFGToLLVM::speculateNotCell):
+ (JSC::FTL::LowerDFGToLLVM::speculateOther):
+ (JSC::FTL::LowerDFGToLLVM::speculateMisc):
+ * tests/stress/compare-strict-eq-integer-to-misc.js: Added.
+
+2014-03-10 Filip Pizlo <fpizlo@apple.com>
+
</ins><span class="cx"> Unreviewed, remove unintended change.
</span><span class="cx">
</span><span class="cx"> * dfg/DFGDriver.cpp:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -935,8 +935,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case CompareStrictEq:
- case CompareStrictEqConstant: {
</del><ins>+ case CompareStrictEq: {
</ins><span class="cx"> Node* leftNode = node->child1().node();
</span><span class="cx"> Node* rightNode = node->child2().node();
</span><span class="cx"> JSValue left = forNode(leftNode).value();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -718,16 +718,6 @@
</span><span class="cx"> return node->isStronglyProvedConstantIn(inlineCallFrame());
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // Our codegen for constant strict equality performs a bitwise comparison,
- // so we can only select values that have a consistent bitwise identity.
- bool isConstantForCompareStrictEq(Node* node)
- {
- if (!node->isConstant())
- return false;
- JSValue value = valueOfJSConstant(node);
- return value.isBoolean() || value.isUndefinedOrNull();
- }
-
</del><span class="cx"> BranchData* branchData(unsigned taken, unsigned notTaken)
</span><span class="cx"> {
</span><span class="cx"> BranchData* data = m_graph.m_branchData.add();
</span><span class="lines">@@ -2608,12 +2598,7 @@
</span><span class="cx"> getJSConstantForValue(jsBoolean(JSValue::strictEqual(m_codeBlock->globalObject()->globalExec(), a, b))));
</span><span class="cx"> NEXT_OPCODE(op_stricteq);
</span><span class="cx"> }
</span><del>- if (isConstantForCompareStrictEq(op1))
- set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareStrictEqConstant, op2, op1));
- else if (isConstantForCompareStrictEq(op2))
- set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareStrictEqConstant, op1, op2));
- else
- set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareStrictEq, op1, op2));
</del><ins>+ set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareStrictEq, op1, op2));
</ins><span class="cx"> NEXT_OPCODE(op_stricteq);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2648,12 +2633,7 @@
</span><span class="cx"> NEXT_OPCODE(op_nstricteq);
</span><span class="cx"> }
</span><span class="cx"> Node* invertedResult;
</span><del>- if (isConstantForCompareStrictEq(op1))
- invertedResult = addToGraph(CompareStrictEqConstant, op2, op1);
- else if (isConstantForCompareStrictEq(op2))
- invertedResult = addToGraph(CompareStrictEqConstant, op1, op2);
- else
- invertedResult = addToGraph(CompareStrictEq, op1, op2);
</del><ins>+ invertedResult = addToGraph(CompareStrictEq, op1, op2);
</ins><span class="cx"> set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(LogicalNot, invertedResult));
</span><span class="cx"> NEXT_OPCODE(op_nstricteq);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -116,7 +116,6 @@
</span><span class="cx"> case StringCharCodeAt:
</span><span class="cx"> case StringFromCharCode:
</span><span class="cx"> case CompareEqConstant:
</span><del>- case CompareStrictEqConstant:
</del><span class="cx"> case CompareStrictEq:
</span><span class="cx"> case IsUndefined:
</span><span class="cx"> case IsBoolean:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -391,10 +391,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case CompareStrictEqConstant: {
- break;
- }
-
</del><span class="cx"> case CompareStrictEq: {
</span><span class="cx"> if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
</span><span class="cx"> fixEdge<BooleanUse>(node->child1());
</span><span class="lines">@@ -432,8 +428,11 @@
</span><span class="cx"> fixEdge<ObjectUse>(node->child2());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- if (node->child1()->shouldSpeculateMisc() && node->child2()->shouldSpeculateMisc()) {
</del><ins>+ if (node->child1()->shouldSpeculateMisc()) {
</ins><span class="cx"> fixEdge<MiscUse>(node->child1());
</span><ins>+ break;
+ }
+ if (node->child2()->shouldSpeculateMisc()) {
</ins><span class="cx"> fixEdge<MiscUse>(node->child2());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -772,7 +771,7 @@
</span><span class="cx"> case ToThis: {
</span><span class="cx"> ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->isStrictMode() ? StrictMode : NotStrictMode;
</span><span class="cx">
</span><del>- if (isOtherSpeculation(node->child1()->prediction())) {
</del><ins>+ if (node->child1()->shouldSpeculateOther()) {
</ins><span class="cx"> if (ecmaMode == StrictMode) {
</span><span class="cx"> fixEdge<OtherUse>(node->child1());
</span><span class="cx"> node->convertToIdentity();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -1331,9 +1331,14 @@
</span><span class="cx"> return child1().useKind();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool isBinaryUseKind(UseKind left, UseKind right)
+ {
+ return child1().useKind() == left && child2().useKind() == right;
+ }
+
</ins><span class="cx"> bool isBinaryUseKind(UseKind useKind)
</span><span class="cx"> {
</span><del>- return child1().useKind() == useKind && child2().useKind() == useKind;
</del><ins>+ return isBinaryUseKind(useKind, useKind);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SpeculatedType prediction()
</span><span class="lines">@@ -1401,6 +1406,11 @@
</span><span class="cx"> return isBooleanSpeculation(prediction());
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool shouldSpeculateOther()
+ {
+ return isOtherSpeculation(prediction());
+ }
+
</ins><span class="cx"> bool shouldSpeculateMisc()
</span><span class="cx"> {
</span><span class="cx"> return isMiscSpeculation(prediction());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -217,7 +217,6 @@
</span><span class="cx"> macro(CompareEq, NodeResultBoolean | NodeMustGenerate | NodeClobbersWorld) \
</span><span class="cx"> macro(CompareEqConstant, NodeResultBoolean) \
</span><span class="cx"> macro(CompareStrictEq, NodeResultBoolean) \
</span><del>- macro(CompareStrictEqConstant, NodeResultBoolean) \
</del><span class="cx"> \
</span><span class="cx"> /* Calls. */\
</span><span class="cx"> macro(Call, NodeResultJS | NodeMustGenerate | NodeHasVarArgs | NodeClobbersWorld) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -345,7 +345,6 @@
</span><span class="cx"> case CompareEq:
</span><span class="cx"> case CompareEqConstant:
</span><span class="cx"> case CompareStrictEq:
</span><del>- case CompareStrictEqConstant:
</del><span class="cx"> case InstanceOf:
</span><span class="cx"> case IsUndefined:
</span><span class="cx"> case IsBoolean:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -185,7 +185,6 @@
</span><span class="cx"> case CompareEq:
</span><span class="cx"> case CompareEqConstant:
</span><span class="cx"> case CompareStrictEq:
</span><del>- case CompareStrictEqConstant:
</del><span class="cx"> case Call:
</span><span class="cx"> case Construct:
</span><span class="cx"> case NewObject:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -1281,9 +1281,9 @@
</span><span class="cx"> compilePeepHoleBooleanBranch(node, branchNode, condition);
</span><span class="cx"> else if (node->isBinaryUseKind(ObjectUse))
</span><span class="cx"> compilePeepHoleObjectEquality(node, branchNode);
</span><del>- else if (node->child1().useKind() == ObjectUse && node->child2().useKind() == ObjectOrOtherUse)
</del><ins>+ else if (node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse))
</ins><span class="cx"> compilePeepHoleObjectToObjectOrOtherEquality(node->child1(), node->child2(), branchNode);
</span><del>- else if (node->child1().useKind() == ObjectOrOtherUse && node->child2().useKind() == ObjectUse)
</del><ins>+ else if (node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse))
</ins><span class="cx"> compilePeepHoleObjectToObjectOrOtherEquality(node->child2(), node->child1(), branchNode);
</span><span class="cx"> else {
</span><span class="cx"> nonSpeculativePeepholeBranch(node, branchNode, condition, operation);
</span><span class="lines">@@ -3621,12 +3621,12 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (node->child1().useKind() == ObjectUse && node->child2().useKind() == ObjectOrOtherUse) {
</del><ins>+ if (node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse)) {
</ins><span class="cx"> compileObjectToObjectOrOtherEquality(node->child1(), node->child2());
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (node->child1().useKind() == ObjectOrOtherUse && node->child2().useKind() == ObjectUse) {
</del><ins>+ if (node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse)) {
</ins><span class="cx"> compileObjectToObjectOrOtherEquality(node->child2(), node->child1());
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="lines">@@ -3636,82 +3636,9 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-bool SpeculativeJIT::compileStrictEqForConstant(Node* node, Edge value, JSValue constant)
-{
- JSValueOperand op1(this, value);
-
- unsigned branchIndexInBlock = detectPeepHoleBranch();
- if (branchIndexInBlock != UINT_MAX) {
- Node* branchNode = m_block->at(branchIndexInBlock);
- BasicBlock* taken = branchNode->branchData()->taken.block;
- BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
- MacroAssembler::RelationalCondition condition = MacroAssembler::Equal;
-
- // The branch instruction will branch to the taken block.
- // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
- if (taken == nextBlock()) {
- condition = MacroAssembler::NotEqual;
- BasicBlock* tmp = taken;
- taken = notTaken;
- notTaken = tmp;
- }
-
-#if USE(JSVALUE64)
- branch64(condition, op1.gpr(), MacroAssembler::TrustedImm64(JSValue::encode(constant)), taken);
-#else
- GPRReg payloadGPR = op1.payloadGPR();
- GPRReg tagGPR = op1.tagGPR();
- if (condition == MacroAssembler::Equal) {
- // Drop down if not equal, go elsewhere if equal.
- MacroAssembler::Jump notEqual = m_jit.branch32(MacroAssembler::NotEqual, tagGPR, MacroAssembler::Imm32(constant.tag()));
- branch32(MacroAssembler::Equal, payloadGPR, MacroAssembler::Imm32(constant.payload()), taken);
- notEqual.link(&m_jit);
- } else {
- // Drop down if equal, go elsehwere if not equal.
- branch32(MacroAssembler::NotEqual, tagGPR, MacroAssembler::Imm32(constant.tag()), taken);
- branch32(MacroAssembler::NotEqual, payloadGPR, MacroAssembler::Imm32(constant.payload()), taken);
- }
-#endif
-
- jump(notTaken);
-
- use(node->child1());
- use(node->child2());
- m_indexInBlock = branchIndexInBlock;
- m_currentNode = branchNode;
- return true;
- }
-
- GPRTemporary result(this);
-
-#if USE(JSVALUE64)
- GPRReg op1GPR = op1.gpr();
- GPRReg resultGPR = result.gpr();
- m_jit.move(MacroAssembler::TrustedImm64(ValueFalse), resultGPR);
- MacroAssembler::Jump notEqual = m_jit.branch64(MacroAssembler::NotEqual, op1GPR, MacroAssembler::TrustedImm64(JSValue::encode(constant)));
- m_jit.or32(MacroAssembler::TrustedImm32(1), resultGPR);
- notEqual.link(&m_jit);
- jsValueResult(resultGPR, node, DataFormatJSBoolean);
-#else
- GPRReg op1PayloadGPR = op1.payloadGPR();
- GPRReg op1TagGPR = op1.tagGPR();
- GPRReg resultGPR = result.gpr();
- m_jit.move(TrustedImm32(0), resultGPR);
- MacroAssembler::JumpList notEqual;
- notEqual.append(m_jit.branch32(MacroAssembler::NotEqual, op1TagGPR, MacroAssembler::Imm32(constant.tag())));
- notEqual.append(m_jit.branch32(MacroAssembler::NotEqual, op1PayloadGPR, MacroAssembler::Imm32(constant.payload())));
- m_jit.move(TrustedImm32(1), resultGPR);
- notEqual.link(&m_jit);
- booleanResult(resultGPR, node);
-#endif
-
- return false;
-}
-
</del><span class="cx"> bool SpeculativeJIT::compileStrictEq(Node* node)
</span><span class="cx"> {
</span><del>- switch (node->binaryUseKind()) {
- case BooleanUse: {
</del><ins>+ if (node->isBinaryUseKind(BooleanUse)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -3726,7 +3653,7 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int32Use: {
</del><ins>+ if (node->isBinaryUseKind(Int32Use)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -3742,7 +3669,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ if (node->isBinaryUseKind(MachineIntUse)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -3757,8 +3684,8 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><del>-
- case NumberUse: {
</del><ins>+
+ if (node->isBinaryUseKind(NumberUse)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -3772,18 +3699,18 @@
</span><span class="cx"> compileDoubleCompare(node, MacroAssembler::DoubleEqual);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><del>-
- case StringUse: {
</del><ins>+
+ if (node->isBinaryUseKind(StringUse)) {
</ins><span class="cx"> compileStringEquality(node);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><del>-
- case StringIdentUse: {
</del><ins>+
+ if (node->isBinaryUseKind(StringIdentUse)) {
</ins><span class="cx"> compileStringIdentEquality(node);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><del>-
- case ObjectUse: {
</del><ins>+
+ if (node->isBinaryUseKind(ObjectUse)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -3797,20 +3724,15 @@
</span><span class="cx"> compileObjectEquality(node);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><del>-
- case MiscUse: {
</del><ins>+
+ if (node->isBinaryUseKind(MiscUse, UntypedUse)
+ || node->isBinaryUseKind(UntypedUse, MiscUse)) {
</ins><span class="cx"> compileMiscStrictEq(node);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><del>-
- case UntypedUse: {
- return nonSpeculativeStrictEq(node);
- }
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return false;
- }
</del><ins>+
+ RELEASE_ASSERT(node->isBinaryUseKind(UntypedUse));
+ return nonSpeculativeStrictEq(node);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void SpeculativeJIT::compileBooleanCompare(Node* node, MacroAssembler::RelationalCondition condition)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -2025,8 +2025,6 @@
</span><span class="cx"> void compileBooleanCompare(Node*, MacroAssembler::RelationalCondition);
</span><span class="cx"> void compileDoubleCompare(Node*, MacroAssembler::DoubleCondition);
</span><span class="cx">
</span><del>- bool compileStrictEqForConstant(Node*, Edge value, JSValue constant);
-
</del><span class="cx"> bool compileStrictEq(Node*);
</span><span class="cx">
</span><span class="cx"> void compileAllocatePropertyStorage(Node*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -620,8 +620,10 @@
</span><span class="cx"> JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
</span><span class="cx"> GPRTemporary result(this);
</span><span class="cx">
</span><del>- speculateMisc(node->child1(), op1.jsValueRegs());
- speculateMisc(node->child2(), op2.jsValueRegs());
</del><ins>+ if (node->child1().useKind() == MiscUse)
+ speculateMisc(node->child1(), op1.jsValueRegs());
+ if (node->child2().useKind() == MiscUse)
+ speculateMisc(node->child2(), op2.jsValueRegs());
</ins><span class="cx">
</span><span class="cx"> m_jit.move(TrustedImm32(0), result.gpr());
</span><span class="cx"> JITCompiler::Jump notEqual = m_jit.branch32(JITCompiler::NotEqual, op1.tagGPR(), op2.tagGPR());
</span><span class="lines">@@ -2269,11 +2271,6 @@
</span><span class="cx"> return;
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case CompareStrictEqConstant:
- if (compileStrictEqForConstant(node, node->child1(), valueOfJSConstant(node->child2().node())))
- return;
- break;
-
</del><span class="cx"> case CompareStrictEq:
</span><span class="cx"> if (compileStrictEq(node))
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -656,10 +656,12 @@
</span><span class="cx"> JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
</span><span class="cx"> GPRTemporary result(this);
</span><span class="cx">
</span><del>- speculateMisc(node->child1(), op1.jsValueRegs());
- speculateMisc(node->child2(), op2.jsValueRegs());
</del><ins>+ if (node->child1().useKind() == MiscUse)
+ speculateMisc(node->child1(), op1.jsValueRegs());
+ if (node->child2().useKind() == MiscUse)
+ speculateMisc(node->child2(), op2.jsValueRegs());
</ins><span class="cx">
</span><del>- m_jit.compare32(JITCompiler::Equal, op1.gpr(), op2.gpr(), result.gpr());
</del><ins>+ m_jit.compare64(JITCompiler::Equal, op1.gpr(), op2.gpr(), result.gpr());
</ins><span class="cx"> m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
</span><span class="cx"> jsValueResult(result.gpr(), node, DataFormatJSBoolean);
</span><span class="cx"> }
</span><span class="lines">@@ -2629,11 +2631,6 @@
</span><span class="cx"> return;
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case CompareStrictEqConstant:
- if (compileStrictEqForConstant(node, node->child1(), valueOfJSConstant(node->child2().node())))
- return;
- break;
-
</del><span class="cx"> case CompareStrictEq:
</span><span class="cx"> if (compileStrictEq(node))
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -91,7 +91,6 @@
</span><span class="cx"> case UInt32ToNumber:
</span><span class="cx"> case Int32ToDouble:
</span><span class="cx"> case CompareEqConstant:
</span><del>- case CompareStrictEqConstant:
</del><span class="cx"> case Jump:
</span><span class="cx"> case ForceOSRExit:
</span><span class="cx"> case Phi:
</span><span class="lines">@@ -238,11 +237,9 @@
</span><span class="cx"> break;
</span><span class="cx"> if (node->isBinaryUseKind(BooleanUse))
</span><span class="cx"> break;
</span><del>- if (node->child1().useKind() == ObjectUse
- && node->child2().useKind() == ObjectOrOtherUse)
</del><ins>+ if (node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse))
</ins><span class="cx"> break;
</span><del>- if (node->child1().useKind() == ObjectOrOtherUse
- && node->child2().useKind() == ObjectUse)
</del><ins>+ if (node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse))
</ins><span class="cx"> break;
</span><span class="cx"> return CannotCompile;
</span><span class="cx"> case CompareStrictEq:
</span><span class="lines">@@ -254,10 +251,12 @@
</span><span class="cx"> break;
</span><span class="cx"> if (node->isBinaryUseKind(ObjectUse))
</span><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(MiscUse))
- break;
</del><span class="cx"> if (node->isBinaryUseKind(BooleanUse))
</span><span class="cx"> break;
</span><ins>+ if (node->isBinaryUseKind(MiscUse, UntypedUse))
+ break;
+ if (node->isBinaryUseKind(UntypedUse, MiscUse))
+ break;
</ins><span class="cx"> return CannotCompile;
</span><span class="cx"> case CompareLess:
</span><span class="cx"> case CompareLessEq:
</span><span class="lines">@@ -350,6 +349,7 @@
</span><span class="cx"> case StringOrStringObjectUse:
</span><span class="cx"> case FinalObjectUse:
</span><span class="cx"> case NotCellUse:
</span><ins>+ case OtherUse:
</ins><span class="cx"> case MiscUse:
</span><span class="cx"> // These are OK.
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (165405 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-03-10 22:09:07 UTC (rev 165405)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -525,9 +525,6 @@
</span><span class="cx"> case CompareStrictEq:
</span><span class="cx"> compileCompareStrictEq();
</span><span class="cx"> break;
</span><del>- case CompareStrictEqConstant:
- compileCompareStrictEqConstant();
- break;
</del><span class="cx"> case CompareLess:
</span><span class="cx"> compileCompareLess();
</span><span class="cx"> break;
</span><span class="lines">@@ -3378,14 +3375,12 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->child1().useKind() == ObjectUse
- && m_node->child2().useKind() == ObjectOrOtherUse) {
</del><ins>+ if (m_node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse)) {
</ins><span class="cx"> compareEqObjectOrOtherToObject(m_node->child2(), m_node->child1());
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->child1().useKind() == ObjectOrOtherUse
- && m_node->child2().useKind() == ObjectUse) {
</del><ins>+ if (m_node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse)) {
</ins><span class="cx"> compareEqObjectOrOtherToObject(m_node->child1(), m_node->child2());
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="lines">@@ -3442,11 +3437,12 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->isBinaryUseKind(MiscUse)) {
</del><ins>+ if (m_node->isBinaryUseKind(MiscUse, UntypedUse)
+ || m_node->isBinaryUseKind(UntypedUse, MiscUse)) {
+ speculate(m_node->child1());
+ speculate(m_node->child2());
</ins><span class="cx"> LValue left = lowJSValue(m_node->child1(), ManualOperandSpeculation);
</span><span class="cx"> LValue right = lowJSValue(m_node->child2(), ManualOperandSpeculation);
</span><del>- FTL_TYPE_CHECK(jsValueValue(left), m_node->child1(), SpecMisc, isNotMisc(left));
- FTL_TYPE_CHECK(jsValueValue(right), m_node->child2(), SpecMisc, isNotMisc(right));
</del><span class="cx"> setBoolean(m_out.equal(left, right));
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="lines">@@ -3996,7 +3992,7 @@
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(leftNotCellCase, continuation);
</span><span class="cx"> FTL_TYPE_CHECK(
</span><del>- jsValueValue(leftValue), leftChild, SpecOther | SpecCell, isNotNully(leftValue));
</del><ins>+ jsValueValue(leftValue), leftChild, SpecOther | SpecCell, isNotOther(leftValue));
</ins><span class="cx"> ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
</span><span class="cx"> m_out.jump(continuation);
</span><span class="cx">
</span><span class="lines">@@ -4334,11 +4330,11 @@
</span><span class="cx"> primitiveResult = m_out.equal(value, m_out.constInt64(ValueUndefined));
</span><span class="cx"> break;
</span><span class="cx"> case EqualNullOrUndefined:
</span><del>- primitiveResult = isNully(value);
</del><ins>+ primitiveResult = isOther(value);
</ins><span class="cx"> break;
</span><span class="cx"> case SpeculateNullOrUndefined:
</span><span class="cx"> FTL_TYPE_CHECK(
</span><del>- jsValueValue(value), edge, SpecCell | SpecOther, isNotNully(value));
</del><ins>+ jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
</ins><span class="cx"> primitiveResult = m_out.booleanTrue;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -5010,13 +5006,13 @@
</span><span class="cx"> value, m_out.constInt64(ValueTrue), m_out.constInt64(ValueFalse));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue isNotNully(LValue value)
</del><ins>+ LValue isNotOther(LValue value)
</ins><span class="cx"> {
</span><span class="cx"> return m_out.notEqual(
</span><span class="cx"> m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
</span><span class="cx"> m_out.constInt64(ValueNull));
</span><span class="cx"> }
</span><del>- LValue isNully(LValue value)
</del><ins>+ LValue isOther(LValue value)
</ins><span class="cx"> {
</span><span class="cx"> return m_out.equal(
</span><span class="cx"> m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
</span><span class="lines">@@ -5075,6 +5071,9 @@
</span><span class="cx"> case NotCellUse:
</span><span class="cx"> speculateNotCell(edge);
</span><span class="cx"> break;
</span><ins>+ case OtherUse:
+ speculateOther(edge);
+ break;
</ins><span class="cx"> case MiscUse:
</span><span class="cx"> speculateMisc(edge);
</span><span class="cx"> break;
</span><span class="lines">@@ -5208,7 +5207,7 @@
</span><span class="cx"> m_out.appendTo(primitiveCase, continuation);
</span><span class="cx">
</span><span class="cx"> FTL_TYPE_CHECK(
</span><del>- jsValueValue(value), edge, SpecCell | SpecOther, isNotNully(value));
</del><ins>+ jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
</ins><span class="cx">
</span><span class="cx"> m_out.jump(continuation);
</span><span class="cx">
</span><span class="lines">@@ -5342,16 +5341,25 @@
</span><span class="cx"> if (!m_interpreter.needsTypeCheck(edge))
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- LValue value = lowJSValue(edge);
</del><ins>+ LValue value = lowJSValue(edge, ManualOperandSpeculation);
</ins><span class="cx"> typeCheck(jsValueValue(value), edge, ~SpecCell, isCell(value));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void speculateOther(Edge edge)
+ {
+ if (!m_interpreter.needsTypeCheck(edge))
+ return;
+
+ LValue value = lowJSValue(edge, ManualOperandSpeculation);
+ typeCheck(jsValueValue(value), edge, SpecOther, isNotOther(value));
+ }
+
</ins><span class="cx"> void speculateMisc(Edge edge)
</span><span class="cx"> {
</span><span class="cx"> if (!m_interpreter.needsTypeCheck(edge))
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- LValue value = lowJSValue(edge);
</del><ins>+ LValue value = lowJSValue(edge, ManualOperandSpeculation);
</ins><span class="cx"> typeCheck(jsValueValue(value), edge, SpecMisc, isNotMisc(value));
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresscomparestricteqintegertomiscjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/compare-strict-eq-integer-to-misc.js (0 => 165406)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/compare-strict-eq-integer-to-misc.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/compare-strict-eq-integer-to-misc.js 2014-03-10 22:11:35 UTC (rev 165406)
</span><span class="lines">@@ -0,0 +1,25 @@
</span><ins>+function foo(thingy) {
+ if (thingy.length === void 0 || thingy.charAt !== void 0)
+ return "yes";
+ return "no";
+}
+
+noInline(foo);
+
+function test(object, expected) {
+ var result = foo(object);
+ if (result != expected)
+ throw new Error("Bad result: " + result);
+}
+
+for (var i = 0; i < 1000; ++i) {
+ test({}, "yes");
+ test([], "no");
+ test("hello", "yes");
+ test((function(){return arguments;})(), "no");
+ var array = [];
+ for (var j = 0; j < 100; ++j) {
+ test(array, "no");
+ array.push(42);
+ }
+}
</ins></span></pre>
</div>
</div>
</body>
</html>