<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[167325] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/167325">167325</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-04-15 13:26:16 -0700 (Tue, 15 Apr 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>DFG IR should keep the data flow of doubles and int52's separate from the data flow of JSValue's
https://bugs.webkit.org/show_bug.cgi?id=131423
Reviewed by Geoffrey Garen.
This introduces more static typing into DFG IR. Previously we just had the notion of
JSValues and Storage. This was weird because doubles weren't always convertible to
JSValues, and Int52s weren't always convertible to either doubles or JSValues. We would
sort of insert explicit conversion nodes just for the places where we knew that an
implicit conversion wouldn't have been possible -- but there was no hard and fast rule so
we'd get bugs from forgetting to do the right conversion.
This patch introduces a hard and fast rule: doubles can never be implicitly converted to
anything but doubles, and likewise Int52's can never be implicitly converted. Conversion
nodes are used for all of the conversions. Int52Rep, DoubleRep, and ValueRep are the
conversions. They are like Identity but return the same value using a different
representation. Likewise, constants may now be represented using either JSConstant,
Int52Constant, or DoubleConstant. UseKinds have been adjusted accordingly, as well.
Int52RepUse and DoubleRepUse are node uses that mean "the node must be of Int52 (or
Double) type". They don't imply checks. There is also DoubleRepRealUse, which means that
we speculate DoubleReal and expect Double representation.
In addition to simplifying a bunch of rules in the IR and making the IR more verifiable,
this also makes it easier to introduce optimizations in the future. It's now possible for
AI to model when/how conversion take place. For example if doing a conversion results in
NaN sanitization, then AI can model this and can allow us to sink sanitizations. That's
what https://bugs.webkit.org/show_bug.cgi?id=131419 will be all about.
This was a big change, so I had to do some interesting things, like finally get rid of
the DFG's weird variadic template macro hacks and use real C++11 variadic templates. Also
the ByteCodeParser no longer emits Identity nodes since that was always pointless.
No performance change because this mostly just rationalizes preexisting behavior.
* JavaScriptCore.xcodeproj/project.pbxproj:
* assembler/MacroAssemblerX86.h:
* bytecode/CodeBlock.cpp:
* bytecode/CodeBlock.h:
* dfg/DFGAbstractInterpreter.h:
(JSC::DFG::AbstractInterpreter::setBuiltInConstant):
(JSC::DFG::AbstractInterpreter::setConstant):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::fixTypeForRepresentation):
(JSC::DFG::AbstractValue::checkConsistency):
* dfg/DFGAbstractValue.h:
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGBasicBlock.h:
* dfg/DFGBasicBlockInlines.h:
(JSC::DFG::BasicBlock::appendNode):
(JSC::DFG::BasicBlock::appendNonTerminal):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::constantCSE):
(JSC::DFG::CSEPhase::performNodeCSE):
(JSC::DFG::CSEPhase::int32ToDoubleCSE): Deleted.
* dfg/DFGCapabilities.h:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGDCEPhase.cpp:
(JSC::DFG::DCEPhase::fixupBlock):
* dfg/DFGEdge.h:
(JSC::DFG::Edge::willNotHaveCheck):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixIntEdge):
(JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
(JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
(JSC::DFG::FixupPhase::tryToRelaxRepresentation):
(JSC::DFG::FixupPhase::fixEdgeRepresentation):
(JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
(JSC::DFG::FixupPhase::addRequiredPhantom):
(JSC::DFG::FixupPhase::addPhantomsIfNecessary):
(JSC::DFG::FixupPhase::clearPhantomsAtEnd):
(JSC::DFG::FixupPhase::fixupSetLocalsInBlock): Deleted.
* dfg/DFGFlushFormat.h:
(JSC::DFG::resultFor):
(JSC::DFG::useKindFor):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::addNode):
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::initialize):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertNode):
(JSC::DFG::InsertionSet::insertConstant):
(JSC::DFG::InsertionSet::insertConstantForUse):
* dfg/DFGIntegerCheckCombiningPhase.cpp:
(JSC::DFG::IntegerCheckCombiningPhase::insertAdd):
(JSC::DFG::IntegerCheckCombiningPhase::insertMustAdd):
* dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToIdentity):
(WTF::printInternal):
* dfg/DFGNode.h:
(JSC::DFG::Node::Node):
(JSC::DFG::Node::setResult):
(JSC::DFG::Node::result):
(JSC::DFG::Node::isConstant):
(JSC::DFG::Node::hasConstant):
(JSC::DFG::Node::convertToConstant):
(JSC::DFG::Node::valueOfJSConstant):
(JSC::DFG::Node::hasResult):
(JSC::DFG::Node::hasInt32Result):
(JSC::DFG::Node::hasInt52Result):
(JSC::DFG::Node::hasNumberResult):
(JSC::DFG::Node::hasDoubleResult):
(JSC::DFG::Node::hasJSResult):
(JSC::DFG::Node::hasBooleanResult):
(JSC::DFG::Node::hasStorageResult):
(JSC::DFG::Node::defaultUseKind):
(JSC::DFG::Node::defaultEdge):
(JSC::DFG::Node::convertToIdentity): Deleted.
* dfg/DFGNodeFlags.cpp:
(JSC::DFG::dumpNodeFlags):
* dfg/DFGNodeFlags.h:
(JSC::DFG::canonicalResultRepresentation):
* dfg/DFGNodeType.h:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGResurrectionForValidationPhase.cpp:
(JSC::DFG::ResurrectionForValidationPhase::run):
* dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
(JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
(JSC::DFG::JSValueRegsTemporary::~JSValueRegsTemporary):
(JSC::DFG::JSValueRegsTemporary::regs):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileDoubleRep):
(JSC::DFG::SpeculativeJIT::compileValueRep):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compileAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileArithMul):
(JSC::DFG::SpeculativeJIT::compileArithDiv):
(JSC::DFG::SpeculativeJIT::compileArithMod):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculateNumber):
(JSC::DFG::SpeculativeJIT::speculateDoubleReal):
(JSC::DFG::SpeculativeJIT::speculate):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble): Deleted.
(JSC::DFG::SpeculativeJIT::speculateMachineInt): Deleted.
(JSC::DFG::SpeculativeJIT::speculateRealNumber): Deleted.
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::allocate):
(JSC::DFG::SpeculativeJIT::use):
(JSC::DFG::SpeculativeJIT::boxDouble):
(JSC::DFG::SpeculativeJIT::spill):
(JSC::DFG::SpeculativeJIT::jsValueResult):
(JSC::DFG::SpeculateInt52Operand::SpeculateInt52Operand):
(JSC::DFG::SpeculateStrictInt52Operand::SpeculateStrictInt52Operand):
(JSC::DFG::SpeculateWhicheverInt52Operand::SpeculateWhicheverInt52Operand):
(JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::convertToDouble): Deleted.
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::convertToDouble): Deleted.
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
* dfg/DFGUseKind.cpp:
(WTF::printInternal):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
(JSC::DFG::shouldNotHaveTypeCheck):
(JSC::DFG::mayHaveTypeCheck):
(JSC::DFG::isNumerical):
(JSC::DFG::isDouble):
(JSC::DFG::isCell):
(JSC::DFG::usesStructure):
(JSC::DFG::useKindForResult):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validate):
* dfg/DFGVariadicFunction.h: Removed.
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::createPhiVariables):
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileUpsilon):
(JSC::FTL::LowerDFGToLLVM::compilePhi):
(JSC::FTL::LowerDFGToLLVM::compileDoubleConstant):
(JSC::FTL::LowerDFGToLLVM::compileInt52Constant):
(JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant):
(JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
(JSC::FTL::LowerDFGToLLVM::compileValueRep):
(JSC::FTL::LowerDFGToLLVM::compileInt52Rep):
(JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
(JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
(JSC::FTL::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::LowerDFGToLLVM::compileArithDiv):
(JSC::FTL::LowerDFGToLLVM::compileArithMod):
(JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
(JSC::FTL::LowerDFGToLLVM::compileArithAbs):
(JSC::FTL::LowerDFGToLLVM::compileArithNegate):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::compare):
(JSC::FTL::LowerDFGToLLVM::boolify):
(JSC::FTL::LowerDFGToLLVM::lowInt52):
(JSC::FTL::LowerDFGToLLVM::lowStrictInt52):
(JSC::FTL::LowerDFGToLLVM::lowWhicheverInt52):
(JSC::FTL::LowerDFGToLLVM::lowDouble):
(JSC::FTL::LowerDFGToLLVM::lowJSValue):
(JSC::FTL::LowerDFGToLLVM::strictInt52ToDouble):
(JSC::FTL::LowerDFGToLLVM::jsValueToDouble):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::speculateNumber):
(JSC::FTL::LowerDFGToLLVM::speculateDoubleReal):
(JSC::FTL::LowerDFGToLLVM::compileInt52ToValue): Deleted.
(JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble): Deleted.
(JSC::FTL::LowerDFGToLLVM::setInt52WithStrictValue): Deleted.
(JSC::FTL::LowerDFGToLLVM::speculateRealNumber): Deleted.
(JSC::FTL::LowerDFGToLLVM::speculateMachineInt): Deleted.
* ftl/FTLValueFormat.cpp:
(JSC::FTL::reboxAccordingToFormat):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::sanitizeDouble):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::boxDouble):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreassemblerMacroAssemblerX86h">trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBackwardsPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockh">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockInlinesh">trunk/Source/JavaScriptCore/dfg/DFGBasicBlockInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCSEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCapabilitiesh">trunk/Source/JavaScriptCore/dfg/DFGCapabilities.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDCEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGEdgeh">trunk/Source/JavaScriptCore/dfg/DFGEdge.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFlushFormath">trunk/Source/JavaScriptCore/dfg/DFGFlushFormat.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGInPlaceAbstractStatecpp">trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGInsertionSeth">trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGIntegerCheckCombiningPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeFlagscpp">trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeFlagsh">trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitCompiler32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitCompiler64cpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGResurrectionForValidationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSSAConversionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStrengthReductionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGUseKindcpp">trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGUseKindh">trunk/Source/JavaScriptCore/dfg/DFGUseKind.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGValidatecpp">trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLValueFormatcpp">trunk/Source/JavaScriptCore/ftl/FTLValueFormat.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelperscpp">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelpersh">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGVariadicFunctionh">trunk/Source/JavaScriptCore/dfg/DFGVariadicFunction.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,3 +1,268 @@
</span><ins>+2014-04-15 Filip Pizlo <fpizlo@apple.com>
+
+ DFG IR should keep the data flow of doubles and int52's separate from the data flow of JSValue's
+ https://bugs.webkit.org/show_bug.cgi?id=131423
+
+ Reviewed by Geoffrey Garen.
+
+ This introduces more static typing into DFG IR. Previously we just had the notion of
+ JSValues and Storage. This was weird because doubles weren't always convertible to
+ JSValues, and Int52s weren't always convertible to either doubles or JSValues. We would
+ sort of insert explicit conversion nodes just for the places where we knew that an
+ implicit conversion wouldn't have been possible -- but there was no hard and fast rule so
+ we'd get bugs from forgetting to do the right conversion.
+
+ This patch introduces a hard and fast rule: doubles can never be implicitly converted to
+ anything but doubles, and likewise Int52's can never be implicitly converted. Conversion
+ nodes are used for all of the conversions. Int52Rep, DoubleRep, and ValueRep are the
+ conversions. They are like Identity but return the same value using a different
+ representation. Likewise, constants may now be represented using either JSConstant,
+ Int52Constant, or DoubleConstant. UseKinds have been adjusted accordingly, as well.
+ Int52RepUse and DoubleRepUse are node uses that mean "the node must be of Int52 (or
+ Double) type". They don't imply checks. There is also DoubleRepRealUse, which means that
+ we speculate DoubleReal and expect Double representation.
+
+ In addition to simplifying a bunch of rules in the IR and making the IR more verifiable,
+ this also makes it easier to introduce optimizations in the future. It's now possible for
+ AI to model when/how conversion take place. For example if doing a conversion results in
+ NaN sanitization, then AI can model this and can allow us to sink sanitizations. That's
+ what https://bugs.webkit.org/show_bug.cgi?id=131419 will be all about.
+
+ This was a big change, so I had to do some interesting things, like finally get rid of
+ the DFG's weird variadic template macro hacks and use real C++11 variadic templates. Also
+ the ByteCodeParser no longer emits Identity nodes since that was always pointless.
+
+ No performance change because this mostly just rationalizes preexisting behavior.
+
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * assembler/MacroAssemblerX86.h:
+ * bytecode/CodeBlock.cpp:
+ * bytecode/CodeBlock.h:
+ * dfg/DFGAbstractInterpreter.h:
+ (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
+ (JSC::DFG::AbstractInterpreter::setConstant):
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGAbstractValue.cpp:
+ (JSC::DFG::AbstractValue::set):
+ (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+ (JSC::DFG::AbstractValue::checkConsistency):
+ * dfg/DFGAbstractValue.h:
+ * dfg/DFGBackwardsPropagationPhase.cpp:
+ (JSC::DFG::BackwardsPropagationPhase::propagate):
+ * dfg/DFGBasicBlock.h:
+ * dfg/DFGBasicBlockInlines.h:
+ (JSC::DFG::BasicBlock::appendNode):
+ (JSC::DFG::BasicBlock::appendNonTerminal):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGCSEPhase.cpp:
+ (JSC::DFG::CSEPhase::constantCSE):
+ (JSC::DFG::CSEPhase::performNodeCSE):
+ (JSC::DFG::CSEPhase::int32ToDoubleCSE): Deleted.
+ * dfg/DFGCapabilities.h:
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ * dfg/DFGDCEPhase.cpp:
+ (JSC::DFG::DCEPhase::fixupBlock):
+ * dfg/DFGEdge.h:
+ (JSC::DFG::Edge::willNotHaveCheck):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::run):
+ (JSC::DFG::FixupPhase::fixupNode):
+ (JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
+ (JSC::DFG::FixupPhase::observeUseKindOnNode):
+ (JSC::DFG::FixupPhase::fixIntEdge):
+ (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+ (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+ (JSC::DFG::FixupPhase::tryToRelaxRepresentation):
+ (JSC::DFG::FixupPhase::fixEdgeRepresentation):
+ (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+ (JSC::DFG::FixupPhase::addRequiredPhantom):
+ (JSC::DFG::FixupPhase::addPhantomsIfNecessary):
+ (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
+ (JSC::DFG::FixupPhase::fixupSetLocalsInBlock): Deleted.
+ * dfg/DFGFlushFormat.h:
+ (JSC::DFG::resultFor):
+ (JSC::DFG::useKindFor):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::dump):
+ * dfg/DFGGraph.h:
+ (JSC::DFG::Graph::addNode):
+ * dfg/DFGInPlaceAbstractState.cpp:
+ (JSC::DFG::InPlaceAbstractState::initialize):
+ * dfg/DFGInsertionSet.h:
+ (JSC::DFG::InsertionSet::insertNode):
+ (JSC::DFG::InsertionSet::insertConstant):
+ (JSC::DFG::InsertionSet::insertConstantForUse):
+ * dfg/DFGIntegerCheckCombiningPhase.cpp:
+ (JSC::DFG::IntegerCheckCombiningPhase::insertAdd):
+ (JSC::DFG::IntegerCheckCombiningPhase::insertMustAdd):
+ * dfg/DFGNode.cpp:
+ (JSC::DFG::Node::convertToIdentity):
+ (WTF::printInternal):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::Node):
+ (JSC::DFG::Node::setResult):
+ (JSC::DFG::Node::result):
+ (JSC::DFG::Node::isConstant):
+ (JSC::DFG::Node::hasConstant):
+ (JSC::DFG::Node::convertToConstant):
+ (JSC::DFG::Node::valueOfJSConstant):
+ (JSC::DFG::Node::hasResult):
+ (JSC::DFG::Node::hasInt32Result):
+ (JSC::DFG::Node::hasInt52Result):
+ (JSC::DFG::Node::hasNumberResult):
+ (JSC::DFG::Node::hasDoubleResult):
+ (JSC::DFG::Node::hasJSResult):
+ (JSC::DFG::Node::hasBooleanResult):
+ (JSC::DFG::Node::hasStorageResult):
+ (JSC::DFG::Node::defaultUseKind):
+ (JSC::DFG::Node::defaultEdge):
+ (JSC::DFG::Node::convertToIdentity): Deleted.
+ * dfg/DFGNodeFlags.cpp:
+ (JSC::DFG::dumpNodeFlags):
+ * dfg/DFGNodeFlags.h:
+ (JSC::DFG::canonicalResultRepresentation):
+ * dfg/DFGNodeType.h:
+ * dfg/DFGOSRExitCompiler32_64.cpp:
+ (JSC::DFG::OSRExitCompiler::compileExit):
+ * dfg/DFGOSRExitCompiler64.cpp:
+ (JSC::DFG::OSRExitCompiler::compileExit):
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGResurrectionForValidationPhase.cpp:
+ (JSC::DFG::ResurrectionForValidationPhase::run):
+ * dfg/DFGSSAConversionPhase.cpp:
+ (JSC::DFG::SSAConversionPhase::run):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::SafeToExecuteEdge::operator()):
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+ (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
+ (JSC::DFG::SpeculativeJIT::silentFill):
+ (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
+ (JSC::DFG::JSValueRegsTemporary::~JSValueRegsTemporary):
+ (JSC::DFG::JSValueRegsTemporary::regs):
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+ (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+ (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+ (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+ (JSC::DFG::SpeculativeJIT::compileValueRep):
+ (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+ (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+ (JSC::DFG::SpeculativeJIT::compileAdd):
+ (JSC::DFG::SpeculativeJIT::compileArithSub):
+ (JSC::DFG::SpeculativeJIT::compileArithNegate):
+ (JSC::DFG::SpeculativeJIT::compileArithMul):
+ (JSC::DFG::SpeculativeJIT::compileArithDiv):
+ (JSC::DFG::SpeculativeJIT::compileArithMod):
+ (JSC::DFG::SpeculativeJIT::compare):
+ (JSC::DFG::SpeculativeJIT::compileStrictEq):
+ (JSC::DFG::SpeculativeJIT::speculateNumber):
+ (JSC::DFG::SpeculativeJIT::speculateDoubleReal):
+ (JSC::DFG::SpeculativeJIT::speculate):
+ (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): Deleted.
+ (JSC::DFG::SpeculativeJIT::speculateMachineInt): Deleted.
+ (JSC::DFG::SpeculativeJIT::speculateRealNumber): Deleted.
+ * dfg/DFGSpeculativeJIT.h:
+ (JSC::DFG::SpeculativeJIT::allocate):
+ (JSC::DFG::SpeculativeJIT::use):
+ (JSC::DFG::SpeculativeJIT::boxDouble):
+ (JSC::DFG::SpeculativeJIT::spill):
+ (JSC::DFG::SpeculativeJIT::jsValueResult):
+ (JSC::DFG::SpeculateInt52Operand::SpeculateInt52Operand):
+ (JSC::DFG::SpeculateStrictInt52Operand::SpeculateStrictInt52Operand):
+ (JSC::DFG::SpeculateWhicheverInt52Operand::SpeculateWhicheverInt52Operand):
+ (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillJSValue):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+ (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+ (JSC::DFG::SpeculativeJIT::emitBranch):
+ (JSC::DFG::SpeculativeJIT::compile):
+ (JSC::DFG::SpeculativeJIT::convertToDouble): Deleted.
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillJSValue):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+ (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+ (JSC::DFG::SpeculativeJIT::emitBranch):
+ (JSC::DFG::SpeculativeJIT::compile):
+ (JSC::DFG::SpeculativeJIT::convertToDouble): Deleted.
+ * dfg/DFGStrengthReductionPhase.cpp:
+ (JSC::DFG::StrengthReductionPhase::handleNode):
+ * dfg/DFGUseKind.cpp:
+ (WTF::printInternal):
+ * dfg/DFGUseKind.h:
+ (JSC::DFG::typeFilterFor):
+ (JSC::DFG::shouldNotHaveTypeCheck):
+ (JSC::DFG::mayHaveTypeCheck):
+ (JSC::DFG::isNumerical):
+ (JSC::DFG::isDouble):
+ (JSC::DFG::isCell):
+ (JSC::DFG::usesStructure):
+ (JSC::DFG::useKindForResult):
+ * dfg/DFGValidate.cpp:
+ (JSC::DFG::Validate::validate):
+ * dfg/DFGVariadicFunction.h: Removed.
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+ (JSC::FTL::LowerDFGToLLVM::compilePhi):
+ (JSC::FTL::LowerDFGToLLVM::compileDoubleConstant):
+ (JSC::FTL::LowerDFGToLLVM::compileInt52Constant):
+ (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant):
+ (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+ (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+ (JSC::FTL::LowerDFGToLLVM::compileInt52Rep):
+ (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+ (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+ (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+ (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+ (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+ (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+ (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+ (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+ (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+ (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+ (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+ (JSC::FTL::LowerDFGToLLVM::compare):
+ (JSC::FTL::LowerDFGToLLVM::boolify):
+ (JSC::FTL::LowerDFGToLLVM::lowInt52):
+ (JSC::FTL::LowerDFGToLLVM::lowStrictInt52):
+ (JSC::FTL::LowerDFGToLLVM::lowWhicheverInt52):
+ (JSC::FTL::LowerDFGToLLVM::lowDouble):
+ (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+ (JSC::FTL::LowerDFGToLLVM::strictInt52ToDouble):
+ (JSC::FTL::LowerDFGToLLVM::jsValueToDouble):
+ (JSC::FTL::LowerDFGToLLVM::speculate):
+ (JSC::FTL::LowerDFGToLLVM::speculateNumber):
+ (JSC::FTL::LowerDFGToLLVM::speculateDoubleReal):
+ (JSC::FTL::LowerDFGToLLVM::compileInt52ToValue): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::setInt52WithStrictValue): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::speculateRealNumber): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::speculateMachineInt): Deleted.
+ * ftl/FTLValueFormat.cpp:
+ (JSC::FTL::reboxAccordingToFormat):
+ * jit/AssemblyHelpers.cpp:
+ (JSC::AssemblyHelpers::sanitizeDouble):
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::boxDouble):
+
</ins><span class="cx"> 2014-04-15 Commit Queue <commit-queue@webkit.org>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r167199 and r167251.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -610,7 +610,6 @@
</span><span class="cx"> 0FFB921B16D02F010055A5DB /* DFGNodeAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0FFB921E16D02F470055A5DB /* DFGVariadicFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F85A31E16AB76AE0077571E /* DFGVariadicFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx"> 0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 /* NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB /* ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */; };
</span><span class="lines">@@ -894,7 +893,7 @@
</span><span class="cx"> 5540772018DA58AD00EFF7F2 /* JSArrayBufferView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66BB17B6B5AB00A7AE3F /* JSArrayBufferView.h */; };
</span><span class="cx"> 5540772118DA58AD00EFF7F2 /* JSArrayBufferViewInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66BC17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h */; };
</span><span class="cx"> 5540772218DA58AD00EFF7F2 /* JSArrayIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BDAEC517F4EA1400F6140C /* JSArrayIterator.h */; };
</span><del>- 5540772518DA58AD00EFF7F2 /* JSBoundFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */; };
</del><ins>+ 5540772518DA58AD00EFF7F2 /* (null) in Headers */ = {isa = PBXBuildFile; };
</ins><span class="cx"> 5540772B18DA58AD00EFF7F2 /* JSCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1167D80E19BCC9008066DD /* JSCell.h */; };
</span><span class="cx"> 5540772C18DA58AD00EFF7F2 /* JSCellInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F97496F1687ADE200A4FF6A /* JSCellInlines.h */; };
</span><span class="cx"> 5540772D18DA58AD00EFF7F2 /* JSCInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1DD84918A945BE0026F3FA /* JSCInlines.h */; };
</span><span class="lines">@@ -1043,51 +1042,10 @@
</span><span class="cx"> 5540788818DA58AD00EFF7F2 /* WeakRandom.h in Headers */ = {isa = PBXBuildFile; fileRef = 1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */; };
</span><span class="cx"> 5540788D18DA58AD00EFF7F2 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; };
</span><span class="cx"> 5540788F18DA58AD00EFF7F2 /* WriteBarrierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */; };
</span><del>- 5540789E18DA58AD00EFF7F2 /* Arguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC257DE50E1F51C50016B6C9 /* Arguments.cpp */; };
- 554078A018DA58AD00EFF7F2 /* ArgumentsIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A76140C9182982CB00750624 /* ArgumentsIteratorPrototype.cpp */; };
</del><span class="cx"> 554078AB18DA58AD00EFF7F2 /* ArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952060E15E8A800A898AB /* ArrayConstructor.cpp */; };
</span><del>- 554078AD18DA58AD00EFF7F2 /* ArrayIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BDAEC217F4EA1400F6140C /* ArrayIteratorPrototype.cpp */; };
</del><span class="cx"> 554078AF18DA58AD00EFF7F2 /* ArrayPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */; };
</span><del>- 554078B218DA58AD00EFF7F2 /* BooleanConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */; };
- 554078B418DA58AD00EFF7F2 /* BooleanPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */; };
- 554078D518DA58AD00EFF7F2 /* DateConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD203450E17135E002C7E82 /* DateConstructor.cpp */; };
- 554078D818DA58AD00EFF7F2 /* DatePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD203470E17135E002C7E82 /* DatePrototype.cpp */; };
- 5540794B18DA58AD00EFF7F2 /* ErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */; };
- 5540794E18DA58AD00EFF7F2 /* ErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */; };
- 5540797D18DA58AD00EFF7F2 /* FunctionConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */; };
- 5540797F18DA58AD00EFF7F2 /* FunctionPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */; };
- 554079C218DA58AD00EFF7F2 /* JSArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66B617B6B5AB00A7AE3F /* JSArrayBufferConstructor.cpp */; };
- 554079C318DA58AD00EFF7F2 /* JSArrayBufferPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66B817B6B5AB00A7AE3F /* JSArrayBufferPrototype.cpp */; };
- 554079C518DA58AD00EFF7F2 /* JSArrayIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BDAEC417F4EA1400F6140C /* JSArrayIterator.cpp */; };
- 554079C718DA58AD00EFF7F2 /* JSBoundFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */; };
- 554079D318DA58AD00EFF7F2 /* JSDataViewPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66BF17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp */; };
- 554079D518DA58AD00EFF7F2 /* JSFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85E0255597D01FF60F7 /* JSFunction.cpp */; };
- 554079DA18DA58AD00EFF7F2 /* JSGlobalObjectFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */; };
- 554079EB18DA58AD00EFF7F2 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */; };
- 554079EE18DA58AD00EFF7F2 /* JSPromiseConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C184E2017BEE240007CB63A /* JSPromiseConstructor.cpp */; };
- 554079F018DA58AD00EFF7F2 /* JSPromiseFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C008CD0186F8A9300955C24 /* JSPromiseFunctions.cpp */; };
- 554079F118DA58AD00EFF7F2 /* JSPromisePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C184E1C17BEE22E007CB63A /* JSPromisePrototype.cpp */; };
- 55407A2218DA58AD00EFF7F2 /* ConsolePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A53CE08118BC1A5600BEDF76 /* ConsolePrototype.cpp */; };
- 55407A2518DA58AD00EFF7F2 /* MapConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873717CBE85300C3E643 /* MapConstructor.cpp */; };
- 55407A2818DA58AD00EFF7F2 /* MapIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74DEF8D182D991400522C22 /* MapIteratorPrototype.cpp */; };
- 55407A2918DA58AD00EFF7F2 /* MapPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873B17CBE8D300C3E643 /* MapPrototype.cpp */; };
- 55407A2E18DA58AD00EFF7F2 /* MathObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86A0255597D01FF60F7 /* MathObject.cpp */; };
- 55407A3118DA58AD00EFF7F2 /* NameConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EBF2F91560F036008E9222 /* NameConstructor.cpp */; };
- 55407A3318DA58AD00EFF7F2 /* NamePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EBF2FD1560F036008E9222 /* NamePrototype.cpp */; };
</del><span class="cx"> 55407A3818DA58AD00EFF7F2 /* NumberConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */; };
</span><span class="cx"> 55407A3A18DA58AD00EFF7F2 /* NumberPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C40E16D4E900A06E92 /* NumberPrototype.cpp */; };
</span><del>- 55407A3C18DA58AD00EFF7F2 /* ObjectConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C60E16D4E900A06E92 /* ObjectConstructor.cpp */; };
- 55407A3D18DA58AD00EFF7F2 /* ObjectPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */; };
- 55407A6318DA58AD00EFF7F2 /* RegExpConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */; };
- 55407A6618DA58AD00EFF7F2 /* RegExpPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */; };
- 55407A7B18DA58AD00EFF7F2 /* SetIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A790DD67182F499700588807 /* SetIteratorPrototype.cpp */; };
- 55407A7C18DA58AD00EFF7F2 /* SetPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7299D9F17D12848005F5FF9 /* SetPrototype.cpp */; };
- 55407A8818DA58AD00EFF7F2 /* StringConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */; };
- 55407A8A18DA58AD00EFF7F2 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
- 55407AAC18DA58AD00EFF7F2 /* WeakMapConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA3ADD17DA41AE006538AF /* WeakMapConstructor.cpp */; };
- 55407AAE18DA58AD00EFF7F2 /* WeakMapPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA3ADF17DA41AE006538AF /* WeakMapPrototype.cpp */; };
- 55F1380B18EF5F5000982015 /* NativeErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */; };
- 55F1380C18EF5FB900982015 /* SetConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7299DA317D12858005F5FF9 /* SetConstructor.cpp */; };
</del><span class="cx"> 5D53726F0E1C54880021E549 /* Tracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D53726E0E1C54880021E549 /* Tracing.h */; };
</span><span class="cx"> 5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
</span><span class="cx"> 5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 14D857740A4696C80032146C /* testapi.js */; };
</span><span class="lines">@@ -2185,7 +2143,6 @@
</span><span class="cx"> 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBranchDirection.h; path = dfg/DFGBranchDirection.h; sourceTree = "<group>"; };
</span><del>- 0F85A31E16AB76AE0077571E /* DFGVariadicFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariadicFunction.h; path = dfg/DFGVariadicFunction.h; sourceTree = "<group>"; };
</del><span class="cx"> 0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeUseDef.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLink.cpp; path = ftl/FTLLink.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F8F2B94172E049E007DBDA5 /* FTLLink.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLLink.h; path = ftl/FTLLink.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -4849,7 +4806,6 @@
</span><span class="cx"> 0F2BDC411522801700CD8910 /* DFGVariableEvent.h */,
</span><span class="cx"> 0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */,
</span><span class="cx"> 0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */,
</span><del>- 0F85A31E16AB76AE0077571E /* DFGVariadicFunction.h */,
</del><span class="cx"> 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */,
</span><span class="cx"> 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */,
</span><span class="cx"> 0FC97F3B18202119002C9B26 /* DFGWatchpointCollectionPhase.cpp */,
</span><span class="lines">@@ -5276,7 +5232,7 @@
</span><span class="cx"> 5540771818DA58AD00EFF7F2 /* JSActivation.h in Headers */,
</span><span class="cx"> 5540771B18DA58AD00EFF7F2 /* JSArgumentsIterator.h in Headers */,
</span><span class="cx"> 5540772218DA58AD00EFF7F2 /* JSArrayIterator.h in Headers */,
</span><del>- 5540772518DA58AD00EFF7F2 /* JSBoundFunction.h in Headers */,
</del><ins>+ 5540772518DA58AD00EFF7F2 /* (null) in Headers */,
</ins><span class="cx"> 5540774818DA58AD00EFF7F2 /* JSGlobalObjectDebuggable.h in Headers */,
</span><span class="cx"> 5540774A18DA58AD00EFF7F2 /* JSGlobalObjectFunctions.h in Headers */,
</span><span class="cx"> 5540775918DA58AD00EFF7F2 /* JSMapIterator.h in Headers */,
</span><span class="lines">@@ -5750,7 +5706,6 @@
</span><span class="cx"> 0FDDBFB61666EEDA00C55FEF /* DFGVariableAccessDataDump.h in Headers */,
</span><span class="cx"> 0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */,
</span><span class="cx"> 0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */,
</span><del>- 0FFB921E16D02F470055A5DB /* DFGVariadicFunction.h in Headers */,
</del><span class="cx"> 0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */,
</span><span class="cx"> 0FC97F4218202119002C9B26 /* DFGWatchpointCollectionPhase.h in Headers */,
</span><span class="cx"> 0FDB2CE8174830A2007B3C1B /* DFGWorklist.h in Headers */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreassemblerMacroAssemblerX86h"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -157,6 +157,8 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Possibly clobbers src.
</span><ins>+ // FIXME: Don't do that.
+ // https://bugs.webkit.org/show_bug.cgi?id=131690
</ins><span class="cx"> void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2)
</span><span class="cx"> {
</span><span class="cx"> movePackedToInt32(src, dest1);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -37,7 +37,6 @@
</span><span class="cx"> #include "DFGCommon.h"
</span><span class="cx"> #include "DFGDriver.h"
</span><span class="cx"> #include "DFGJITCode.h"
</span><del>-#include "DFGNode.h"
</del><span class="cx"> #include "DFGWorklist.h"
</span><span class="cx"> #include "Debugger.h"
</span><span class="cx"> #include "Interpreter.h"
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -45,10 +45,6 @@
</span><span class="cx"> #include "DFGCommon.h"
</span><span class="cx"> #include "DFGCommonData.h"
</span><span class="cx"> #include "DFGExitProfile.h"
</span><del>-#include "DFGMinifiedGraph.h"
-#include "DFGOSREntry.h"
-#include "DFGOSRExit.h"
-#include "DFGVariableEventStream.h"
</del><span class="cx"> #include "DeferredCompilationCallback.h"
</span><span class="cx"> #include "EvalCodeCache.h"
</span><span class="cx"> #include "ExecutionCounter.h"
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -157,9 +157,16 @@
</span><span class="cx"> };
</span><span class="cx"> BooleanResult booleanResult(Node*, AbstractValue&);
</span><span class="cx">
</span><ins>+ void setBuiltInConstant(Node* node, JSValue value)
+ {
+ AbstractValue& abstractValue = forNode(node);
+ abstractValue.set(m_graph, value);
+ abstractValue.fixTypeForRepresentation(node);
+ }
+
</ins><span class="cx"> void setConstant(Node* node, JSValue value)
</span><span class="cx"> {
</span><del>- forNode(node).set(m_graph, value);
</del><ins>+ setBuiltInConstant(node, value);
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -126,9 +126,11 @@
</span><span class="cx">
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> case WeakJSConstant:
</span><span class="cx"> case PhantomArguments: {
</span><del>- forNode(node).set(m_graph, m_graph.valueOfJSConstant(node));
</del><ins>+ setBuiltInConstant(node, m_graph.valueOfJSConstant(node));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -307,39 +309,39 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int32ToDouble: {
</del><ins>+ case DoubleRep: {
</ins><span class="cx"> JSValue child = forNode(node->child1()).value();
</span><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, JSValue(JSValue::EncodeAsDouble, child.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(child.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><del>- if (isInt32Speculation(forNode(node->child1()).m_type))
- forNode(node).setType(SpecDoubleReal);
- else
- forNode(node).setType(SpecDouble);
</del><ins>+ forNode(node).setType(forNode(node->child1()).m_type);
+ forNode(node).fixTypeForRepresentation(node);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int52ToDouble: {
</del><ins>+ case Int52Rep: {
+ RELEASE_ASSERT(node->child1().useKind() == Int32Use);
+
</ins><span class="cx"> JSValue child = forNode(node->child1()).value();
</span><del>- if (child && child.isNumber()) {
</del><ins>+ if (child && child.isInt32()) {
</ins><span class="cx"> setConstant(node, child);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- forNode(node).setType(SpecDouble);
</del><ins>+
+ forNode(node).setType(SpecInt32);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int52ToValue: {
- JSValue child = forNode(node->child1()).value();
- if (child && child.isNumber()) {
- setConstant(node, child);
</del><ins>+ case ValueRep: {
+ JSValue value = forNode(node->child1()).value();
+ if (value) {
+ setConstant(node, value);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><del>- SpeculatedType type = forNode(node->child1()).m_type;
- if (type & SpecInt52)
- type = (type | SpecInt32 | SpecInt52AsDouble) & ~SpecInt52;
- forNode(node).setType(type);
</del><ins>+
+ forNode(node).setType(forNode(node->child1()).m_type);
+ forNode(node).fixTypeForRepresentation(node);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -370,7 +372,7 @@
</span><span class="cx"> if (shouldCheckOverflow(node->arithMode()))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> if (left && right && left.isMachineInt() && right.isMachineInt()) {
</span><span class="cx"> JSValue result = jsNumber(left.asMachineInt() + right.asMachineInt());
</span><span class="cx"> if (result.isMachineInt()) {
</span><span class="lines">@@ -383,9 +385,9 @@
</span><span class="cx"> || !forNode(node->child2()).isType(SpecInt32))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><del>- setConstant(node, jsNumber(left.asNumber() + right.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(left.asNumber() + right.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (isFullRealNumberSpeculation(forNode(node->child1()).m_type)
</span><span class="lines">@@ -426,7 +428,7 @@
</span><span class="cx"> if (shouldCheckOverflow(node->arithMode()))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> if (left && right && left.isMachineInt() && right.isMachineInt()) {
</span><span class="cx"> JSValue result = jsNumber(left.asMachineInt() - right.asMachineInt());
</span><span class="cx"> if (result.isMachineInt() || !shouldCheckOverflow(node->arithMode())) {
</span><span class="lines">@@ -439,9 +441,9 @@
</span><span class="cx"> || !forNode(node->child2()).isType(SpecInt32))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><del>- setConstant(node, jsNumber(left.asNumber() - right.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(left.asNumber() - right.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -477,7 +479,7 @@
</span><span class="cx"> if (shouldCheckOverflow(node->arithMode()))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> if (child && child.isMachineInt()) {
</span><span class="cx"> double doubleResult;
</span><span class="cx"> if (shouldCheckNegativeZero(node->arithMode()))
</span><span class="lines">@@ -496,9 +498,9 @@
</span><span class="cx"> if (shouldCheckNegativeZero(node->arithMode()))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, jsNumber(-child.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(-child.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -533,7 +535,7 @@
</span><span class="cx"> if (shouldCheckOverflow(node->arithMode()))
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> if (left && right && left.isMachineInt() && right.isMachineInt()) {
</span><span class="cx"> double doubleResult = left.asNumber() * right.asNumber();
</span><span class="cx"> if (!shouldCheckNegativeZero(node->arithMode()))
</span><span class="lines">@@ -547,9 +549,9 @@
</span><span class="cx"> forNode(node).setType(SpecInt52);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><del>- setConstant(node, jsNumber(left.asNumber() * right.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(left.asNumber() * right.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (isFullRealNumberSpeculation(forNode(node->child1()).m_type)
</span><span class="lines">@@ -585,9 +587,9 @@
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><del>- setConstant(node, jsNumber(left.asNumber() / right.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(left.asNumber() / right.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -619,9 +621,9 @@
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><del>- setConstant(node, jsNumber(fmod(left.asNumber(), right.asNumber())));
</del><ins>+ setConstant(node, jsDoubleNumber(fmod(left.asNumber(), right.asNumber())));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -645,11 +647,11 @@
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><span class="cx"> double a = left.asNumber();
</span><span class="cx"> double b = right.asNumber();
</span><del>- setConstant(node, jsNumber(a < b ? a : (b <= a ? b : a + b)));
</del><ins>+ setConstant(node, jsDoubleNumber(a < b ? a : (b <= a ? b : a + b)));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -673,11 +675,11 @@
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (left && right && left.isNumber() && right.isNumber()) {
</span><span class="cx"> double a = left.asNumber();
</span><span class="cx"> double b = right.asNumber();
</span><del>- setConstant(node, jsNumber(a > b ? a : (b >= a ? b : a + b)));
</del><ins>+ setConstant(node, jsDoubleNumber(a > b ? a : (b >= a ? b : a + b)));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -703,9 +705,9 @@
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> break;
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, jsNumber(child.asNumber()));
</del><ins>+ setConstant(node, jsDoubleNumber(child.asNumber()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -720,7 +722,7 @@
</span><span class="cx"> case ArithSqrt: {
</span><span class="cx"> JSValue child = forNode(node->child1()).value();
</span><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, jsNumber(sqrt(child.asNumber())));
</del><ins>+ setConstant(node, jsDoubleNumber(sqrt(child.asNumber())));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -730,7 +732,7 @@
</span><span class="cx"> case ArithFRound: {
</span><span class="cx"> JSValue child = forNode(node->child1()).value();
</span><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, jsNumber(static_cast<float>(child.asNumber())));
</del><ins>+ setConstant(node, jsDoubleNumber(static_cast<float>(child.asNumber())));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -740,7 +742,7 @@
</span><span class="cx"> case ArithSin: {
</span><span class="cx"> JSValue child = forNode(node->child1()).value();
</span><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, jsNumber(sin(child.asNumber())));
</del><ins>+ setConstant(node, jsDoubleNumber(sin(child.asNumber())));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -750,7 +752,7 @@
</span><span class="cx"> case ArithCos: {
</span><span class="cx"> JSValue child = forNode(node->child1()).value();
</span><span class="cx"> if (child && child.isNumber()) {
</span><del>- setConstant(node, jsNumber(cos(child.asNumber())));
</del><ins>+ setConstant(node, jsDoubleNumber(cos(child.asNumber())));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> forNode(node).setType(SpecDouble);
</span><span class="lines">@@ -769,7 +771,7 @@
</span><span class="cx"> switch (node->child1().useKind()) {
</span><span class="cx"> case BooleanUse:
</span><span class="cx"> case Int32Use:
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> case UntypedUse:
</span><span class="cx"> case StringUse:
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -67,8 +67,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_type = speculationFromValue(value);
</span><del>- if (m_type == SpecInt52AsDouble)
- m_type = SpecInt52;
</del><span class="cx"> m_value = value;
</span><span class="cx">
</span><span class="cx"> checkConsistency();
</span><span class="lines">@@ -85,6 +83,41 @@
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void AbstractValue::fixTypeForRepresentation(NodeFlags representation)
+{
+ if (representation == NodeResultDouble) {
+ if (m_value) {
+ ASSERT(m_value.isNumber());
+ if (m_value.isInt32())
+ m_value = jsDoubleNumber(m_value.asNumber());
+ }
+ if (m_type & SpecMachineInt) {
+ m_type &= ~SpecMachineInt;
+ m_type |= SpecInt52AsDouble;
+ }
+ RELEASE_ASSERT(!(m_type & ~SpecDouble));
+ } else if (representation == NodeResultInt52) {
+ if (m_type & SpecInt52AsDouble) {
+ m_type &= ~SpecInt52AsDouble;
+ m_type |= SpecInt52;
+ }
+ RELEASE_ASSERT(!(m_type & ~SpecMachineInt));
+ } else {
+ if (m_type & SpecInt52) {
+ m_type &= ~SpecInt52;
+ m_type |= SpecInt52AsDouble;
+ }
+ RELEASE_ASSERT(!(m_type & ~SpecBytecodeTop));
+ }
+
+ checkConsistency();
+}
+
+void AbstractValue::fixTypeForRepresentation(Node* node)
+{
+ fixTypeForRepresentation(node->result());
+}
+
</ins><span class="cx"> FiltrationResult AbstractValue::filter(Graph& graph, const StructureSet& other)
</span><span class="cx"> {
</span><span class="cx"> if (isClear())
</span><span class="lines">@@ -244,6 +277,8 @@
</span><span class="cx">
</span><span class="cx"> if (!!m_value) {
</span><span class="cx"> SpeculatedType type = m_type;
</span><ins>+ // This relaxes the assertion below a bit, since we don't know the representation of the
+ // node.
</ins><span class="cx"> if (type & SpecInt52)
</span><span class="cx"> type |= SpecInt52AsDouble;
</span><span class="cx"> ASSERT(mergeSpeculations(type, speculationFromValue(m_value)) == type);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx">
</span><span class="cx"> #include "ArrayProfile.h"
</span><span class="cx"> #include "DFGFiltrationResult.h"
</span><ins>+#include "DFGNodeFlags.h"
</ins><span class="cx"> #include "DFGStructureAbstractValue.h"
</span><span class="cx"> #include "JSCell.h"
</span><span class="cx"> #include "SpeculatedType.h"
</span><span class="lines">@@ -39,6 +40,7 @@
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><span class="cx"> class Graph;
</span><ins>+struct Node;
</ins><span class="cx">
</span><span class="cx"> struct AbstractValue {
</span><span class="cx"> AbstractValue()
</span><span class="lines">@@ -129,6 +131,9 @@
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void fixTypeForRepresentation(NodeFlags representation);
+ void fixTypeForRepresentation(Node*);
+
</ins><span class="cx"> bool operator==(const AbstractValue& other) const
</span><span class="cx"> {
</span><span class="cx"> return m_type == other.m_type
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBackwardsPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -210,7 +210,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Identity:
</del><span class="cx"> case UInt32ToNumber: {
</span><span class="cx"> node->child1()->mergeFlags(flags);
</span><span class="cx"> break;
</span><span class="lines">@@ -378,6 +377,11 @@
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+
+ case Identity:
+ // This would be trivial to handle but we just assert that we cannot see these yet.
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
</ins><span class="cx">
</span><span class="cx"> // Note: ArithSqrt, ArithSin, and ArithCos and other math intrinsics don't have special
</span><span class="cx"> // rules in here because they are always followed by Phantoms to signify that if the
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -33,7 +33,6 @@
</span><span class="cx"> #include "DFGBranchDirection.h"
</span><span class="cx"> #include "DFGFlushedAt.h"
</span><span class="cx"> #include "DFGNode.h"
</span><del>-#include "DFGVariadicFunction.h"
</del><span class="cx"> #include "Operands.h"
</span><span class="cx"> #include <wtf/HashMap.h>
</span><span class="cx"> #include <wtf/HashSet.h>
</span><span class="lines">@@ -98,15 +97,11 @@
</span><span class="cx"> void removePredecessor(BasicBlock* block);
</span><span class="cx"> void replacePredecessor(BasicBlock* from, BasicBlock* to);
</span><span class="cx">
</span><del>-#define DFG_DEFINE_APPEND_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \
- templatePre typeParams templatePost Node* appendNode(Graph&, SpeculatedType valueParamsComma valueParams);
- DFG_VARIADIC_TEMPLATE_FUNCTION(DFG_DEFINE_APPEND_NODE)
-#undef DFG_DEFINE_APPEND_NODE
</del><ins>+ template<typename... Params>
+ Node* appendNode(Graph&, SpeculatedType, Params...);
</ins><span class="cx">
</span><del>-#define DFG_DEFINE_APPEND_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \
- templatePre typeParams templatePost Node* appendNonTerminal(Graph&, SpeculatedType valueParamsComma valueParams);
- DFG_VARIADIC_TEMPLATE_FUNCTION(DFG_DEFINE_APPEND_NODE)
-#undef DFG_DEFINE_APPEND_NODE
</del><ins>+ template<typename... Params>
+ Node* appendNonTerminal(Graph&, SpeculatedType, Params...);
</ins><span class="cx">
</span><span class="cx"> void dump(PrintStream& out) const;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlockInlines.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlockInlines.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlockInlines.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -33,25 +33,21 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><del>-#define DFG_DEFINE_APPEND_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \
- templatePre typeParams templatePost inline Node* BasicBlock::appendNode(Graph& graph, SpeculatedType type valueParamsComma valueParams) \
- { \
- Node* result = graph.addNode(type valueParamsComma valueArgs); \
- append(result); \
- return result; \
- }
- DFG_VARIADIC_TEMPLATE_FUNCTION(DFG_DEFINE_APPEND_NODE)
-#undef DFG_DEFINE_APPEND_NODE
</del><ins>+template<typename... Params>
+Node* BasicBlock::appendNode(Graph& graph, SpeculatedType type, Params... params)
+{
+ Node* result = graph.addNode(type, params...);
+ append(result);
+ return result;
+}
</ins><span class="cx">
</span><del>-#define DFG_DEFINE_APPEND_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \
- templatePre typeParams templatePost inline Node* BasicBlock::appendNonTerminal(Graph& graph, SpeculatedType type valueParamsComma valueParams) \
- { \
- Node* result = graph.addNode(type valueParamsComma valueArgs); \
- insertBeforeLast(result); \
- return result; \
- }
- DFG_VARIADIC_TEMPLATE_FUNCTION(DFG_DEFINE_APPEND_NODE)
-#undef DFG_DEFINE_APPEND_NODE
</del><ins>+template<typename... Params>
+Node* BasicBlock::appendNonTerminal(Graph& graph, SpeculatedType type, Params... params)
+{
+ Node* result = graph.addNode(type, params...);
+ insertBeforeLast(result);
+ return result;
+}
</ins><span class="cx">
</span><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -3263,8 +3263,9 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case op_to_number: {
</span><del>- set(VirtualRegister(currentInstruction[1].u.operand),
- addToGraph(Identity, Edge(get(VirtualRegister(currentInstruction[2].u.operand)), NumberUse)));
</del><ins>+ Node* node = get(VirtualRegister(currentInstruction[2].u.operand));
+ addToGraph(Phantom, Edge(node, NumberUse));
+ set(VirtualRegister(currentInstruction[1].u.operand), node);
</ins><span class="cx"> NEXT_OPCODE(op_to_number);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCSEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -161,29 +161,11 @@
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- Node* int32ToDoubleCSE(Node* node)
- {
- for (unsigned i = m_indexInBlock; i--;) {
- Node* otherNode = m_currentBlock->at(i);
- if (otherNode == node->child1())
- return 0;
- switch (otherNode->op()) {
- case Int32ToDouble:
- if (otherNode->child1().sanitized() == node->child1().sanitized())
- return otherNode;
- break;
- default:
- break;
- }
- }
- return 0;
- }
-
</del><span class="cx"> Node* constantCSE(Node* node)
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = endIndexForPureCSE(); i--;) {
</span><span class="cx"> Node* otherNode = m_currentBlock->at(i);
</span><del>- if (otherNode->op() != JSConstant)
</del><ins>+ if (otherNode->op() != node->op())
</ins><span class="cx"> continue;
</span><span class="cx">
</span><span class="cx"> if (otherNode->constantNumber() != node->constantNumber())
</span><span class="lines">@@ -1148,8 +1130,9 @@
</span><span class="cx"> case CompareEqConstant:
</span><span class="cx"> case ValueToInt32:
</span><span class="cx"> case MakeRope:
</span><del>- case Int52ToDouble:
- case Int52ToValue:
</del><ins>+ case DoubleRep:
+ case ValueRep:
+ case Int52Rep:
</ins><span class="cx"> if (cseMode == StoreElimination)
</span><span class="cx"> break;
</span><span class="cx"> setReplacement(pureCSE(node));
</span><span class="lines">@@ -1177,12 +1160,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int32ToDouble:
- if (cseMode == StoreElimination)
- break;
- setReplacement(int32ToDoubleCSE(node));
- break;
-
</del><span class="cx"> case GetCallee:
</span><span class="cx"> if (cseMode == StoreElimination)
</span><span class="cx"> break;
</span><span class="lines">@@ -1261,13 +1238,15 @@
</span><span class="cx"> node->convertToPhantom();
</span><span class="cx"> Node* dataNode = replacement->child1().node();
</span><span class="cx"> ASSERT(dataNode->hasResult());
</span><del>- node->child1() = Edge(dataNode);
</del><ins>+ node->child1() = dataNode->defaultEdge();
</ins><span class="cx"> m_graph.dethread();
</span><span class="cx"> m_changed = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> if (cseMode == StoreElimination)
</span><span class="cx"> break;
</span><span class="cx"> // This is strange, but necessary. Some phases will convert nodes to constants,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCapabilitiesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCapabilities.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCapabilities.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGCapabilities.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx">
</span><span class="cx"> #include "CodeBlock.h"
</span><span class="cx"> #include "DFGCommon.h"
</span><del>-#include "DFGNode.h"
</del><span class="cx"> #include "Executable.h"
</span><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "Intrinsic.h"
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -83,6 +83,8 @@
</span><span class="cx">
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> case WeakJSConstant:
</span><span class="cx"> case Identity:
</span><span class="cx"> case Phantom:
</span><span class="lines">@@ -123,15 +125,15 @@
</span><span class="cx"> case IsNumber:
</span><span class="cx"> case IsString:
</span><span class="cx"> case LogicalNot:
</span><del>- case Int32ToDouble:
</del><span class="cx"> case ExtractOSREntryLocal:
</span><del>- case Int52ToDouble:
- case Int52ToValue:
</del><span class="cx"> case CheckInBounds:
</span><span class="cx"> case ConstantStoragePointer:
</span><span class="cx"> case UInt32ToNumber:
</span><span class="cx"> case DoubleAsInt32:
</span><span class="cx"> case Check:
</span><ins>+ case DoubleRep:
+ case ValueRep:
+ case Int52Rep:
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case MovHint:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -299,6 +299,7 @@
</span><span class="cx"> AbstractValue oldValue = m_state.forNode(node);
</span><span class="cx"> AbstractValue constantValue;
</span><span class="cx"> constantValue.set(m_graph, value);
</span><ins>+ constantValue.fixTypeForRepresentation(node);
</ins><span class="cx"> if (oldValue.merge(constantValue))
</span><span class="cx"> continue;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDCEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -194,13 +194,12 @@
</span><span class="cx">
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case MovHint: {
</span><del>- ASSERT(node->child1().useKind() == UntypedUse);
</del><ins>+ ASSERT(node->child1().useKind() == node->child1()->defaultUseKind());
</ins><span class="cx"> if (!node->child1()->shouldGenerate()) {
</span><span class="cx"> node->setOpAndDefaultFlags(ZombieHint);
</span><span class="cx"> node->child1() = Edge();
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- node->setOpAndDefaultFlags(MovHint);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGEdgeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGEdge.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGEdge.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGEdge.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -122,7 +122,7 @@
</span><span class="cx">
</span><span class="cx"> bool willNotHaveCheck() const
</span><span class="cx"> {
</span><del>- return isProved() || useKind() == UntypedUse;
</del><ins>+ return isProved() || shouldNotHaveTypeCheck(useKind());
</ins><span class="cx"> }
</span><span class="cx"> bool willHaveCheck() const
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx"> m_graph.m_argumentPositions[i].mergeArgumentUnboxingAwareness();
</span><span class="cx">
</span><span class="cx"> for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
</span><del>- fixupSetLocalsInBlock(m_graph.block(blockIndex));
</del><ins>+ fixupGetAndSetLocalsInBlock(m_graph.block(blockIndex));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
</span><span class="lines">@@ -123,8 +123,10 @@
</span><span class="cx"> node->convertToIdentity();
</span><span class="cx"> else if (nodeCanSpeculateInt32(node->arithNodeFlags()))
</span><span class="cx"> node->setArithMode(Arith::CheckOverflow);
</span><del>- else
</del><ins>+ else {
</ins><span class="cx"> node->setArithMode(Arith::DoOverflow);
</span><ins>+ node->setResult(NodeResultDouble);
+ }
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -135,10 +137,11 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (Node::shouldSpeculateNumberExpectingDefined(node->child1().node(), node->child2().node())) {
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
</ins><span class="cx"> node->setOp(ArithAdd);
</span><span class="cx"> node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
</span><ins>+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -177,8 +180,9 @@
</span><span class="cx"> case ArithSub: {
</span><span class="cx"> if (attemptToMakeIntegerAdd(node))
</span><span class="cx"> break;
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -194,14 +198,16 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (m_graph.negateShouldSpeculateMachineInt(node)) {
</span><del>- fixEdge<MachineIntUse>(node->child1());
</del><ins>+ fixEdge<Int52RepUse>(node->child1());
</ins><span class="cx"> if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
</span><span class="cx"> node->setArithMode(Arith::CheckOverflow);
</span><span class="cx"> else
</span><span class="cx"> node->setArithMode(Arith::CheckOverflowAndNegativeZero);
</span><ins>+ node->setResult(NodeResultInt52);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><del>- fixEdge<NumberUse>(node->child1());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -218,16 +224,18 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (m_graph.mulShouldSpeculateMachineInt(node)) {
</span><del>- fixEdge<MachineIntUse>(node->child1());
- fixEdge<MachineIntUse>(node->child2());
</del><ins>+ fixEdge<Int52RepUse>(node->child1());
+ fixEdge<Int52RepUse>(node->child2());
</ins><span class="cx"> if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
</span><span class="cx"> node->setArithMode(Arith::CheckOverflow);
</span><span class="cx"> else
</span><span class="cx"> node->setArithMode(Arith::CheckOverflowAndNegativeZero);
</span><ins>+ node->setResult(NodeResultInt52);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -246,24 +254,34 @@
</span><span class="cx"> node->setArithMode(Arith::CheckOverflowAndNegativeZero);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+
+ // This will cause conversion nodes to be inserted later.
+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
+
+ // But we have to make sure that everything is phantom'd until after the
+ // DoubleAsInt32 node, which occurs after the Div/Mod node that the conversions
+ // will be insered on.
+ addRequiredPhantom(node->child1().node());
+ addRequiredPhantom(node->child2().node());
</ins><span class="cx">
</span><span class="cx"> // We don't need to do ref'ing on the children because we're stealing them from
</span><span class="cx"> // the original division.
</span><span class="cx"> Node* newDivision = m_insertionSet.insertNode(
</span><span class="cx"> m_indexInBlock, SpecDouble, *node);
</span><ins>+ newDivision->setResult(NodeResultDouble);
</ins><span class="cx">
</span><span class="cx"> node->setOp(DoubleAsInt32);
</span><del>- node->children.initialize(Edge(newDivision, KnownNumberUse), Edge(), Edge());
</del><ins>+ node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
</ins><span class="cx"> if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
</span><span class="cx"> node->setArithMode(Arith::CheckOverflow);
</span><span class="cx"> else
</span><span class="cx"> node->setArithMode(Arith::CheckOverflowAndNegativeZero);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -275,8 +293,9 @@
</span><span class="cx"> fixEdge<Int32Use>(node->child2());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -286,7 +305,8 @@
</span><span class="cx"> fixEdge<Int32Use>(node->child1());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- fixEdge<NumberUse>(node->child1());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -294,7 +314,8 @@
</span><span class="cx"> case ArithFRound:
</span><span class="cx"> case ArithSin:
</span><span class="cx"> case ArithCos: {
</span><del>- fixEdge<NumberUse>(node->child1());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ node->setResult(NodeResultDouble);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -306,7 +327,7 @@
</span><span class="cx"> else if (node->child1()->shouldSpeculateInt32())
</span><span class="cx"> fixEdge<Int32Use>(node->child1());
</span><span class="cx"> else if (node->child1()->shouldSpeculateNumber())
</span><del>- fixEdge<NumberUse>(node->child1());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
</ins><span class="cx"> else if (node->child1()->shouldSpeculateString())
</span><span class="cx"> fixEdge<StringUse>(node->child1());
</span><span class="cx"> break;
</span><span class="lines">@@ -337,14 +358,14 @@
</span><span class="cx"> }
</span><span class="cx"> if (enableInt52()
</span><span class="cx"> && Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {
</span><del>- fixEdge<MachineIntUse>(node->child1());
- fixEdge<MachineIntUse>(node->child2());
</del><ins>+ fixEdge<Int52RepUse>(node->child1());
+ fixEdge<Int52RepUse>(node->child2());
</ins><span class="cx"> node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
</ins><span class="cx"> node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -402,13 +423,13 @@
</span><span class="cx"> }
</span><span class="cx"> if (enableInt52()
</span><span class="cx"> && Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {
</span><del>- fixEdge<MachineIntUse>(node->child1());
- fixEdge<MachineIntUse>(node->child2());
</del><ins>+ fixEdge<Int52RepUse>(node->child1());
+ fixEdge<Int52RepUse>(node->child2());
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {
</span><del>- fixEdge<NumberUse>(node->child1());
- fixEdge<NumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
+ fixEdge<DoubleRepUse>(node->child2());
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {
</span><span class="lines">@@ -501,7 +522,8 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- switch (node->arrayMode().type()) {
</del><ins>+ arrayMode = node->arrayMode();
+ switch (arrayMode.type()) {
</ins><span class="cx"> case Array::SelectUsingPredictions:
</span><span class="cx"> case Array::Unprofiled:
</span><span class="cx"> case Array::Undecided:
</span><span class="lines">@@ -520,6 +542,30 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ switch (arrayMode.type()) {
+ case Array::Double:
+ if (!arrayMode.isOutOfBounds())
+ node->setResult(NodeResultDouble);
+ break;
+
+ case Array::Float32Array:
+ case Array::Float64Array:
+ node->setResult(NodeResultDouble);
+ break;
+
+ case Array::Uint32Array:
+ if (node->shouldSpeculateInt32())
+ break;
+ if (node->shouldSpeculateMachineInt() && enableInt52())
+ node->setResult(NodeResultInt52);
+ else
+ node->setResult(NodeResultDouble);
+ break;
+
+ default:
+ break;
+ }
+
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -559,14 +605,14 @@
</span><span class="cx"> fixEdge<Int32Use>(child2);
</span><span class="cx"> fixEdge<Int32Use>(child3);
</span><span class="cx"> if (child3->prediction() & SpecInt52)
</span><del>- fixEdge<MachineIntUse>(child3);
</del><ins>+ fixEdge<Int52RepUse>(child3);
</ins><span class="cx"> else
</span><span class="cx"> fixEdge<Int32Use>(child3);
</span><span class="cx"> break;
</span><span class="cx"> case Array::Double:
</span><span class="cx"> fixEdge<KnownCellUse>(child1);
</span><span class="cx"> fixEdge<Int32Use>(child2);
</span><del>- fixEdge<RealNumberUse>(child3);
</del><ins>+ fixEdge<DoubleRepRealUse>(child3);
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Int8Array:
</span><span class="cx"> case Array::Int16Array:
</span><span class="lines">@@ -580,15 +626,15 @@
</span><span class="cx"> if (child3->shouldSpeculateInt32())
</span><span class="cx"> fixEdge<Int32Use>(child3);
</span><span class="cx"> else if (child3->shouldSpeculateMachineInt())
</span><del>- fixEdge<MachineIntUse>(child3);
</del><ins>+ fixEdge<Int52RepUse>(child3);
</ins><span class="cx"> else
</span><del>- fixEdge<NumberUse>(child3);
</del><ins>+ fixEdge<DoubleRepUse>(child3);
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Float32Array:
</span><span class="cx"> case Array::Float64Array:
</span><span class="cx"> fixEdge<KnownCellUse>(child1);
</span><span class="cx"> fixEdge<Int32Use>(child2);
</span><del>- fixEdge<NumberUse>(child3);
</del><ins>+ fixEdge<DoubleRepUse>(child3);
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Contiguous:
</span><span class="cx"> case Array::ArrayStorage:
</span><span class="lines">@@ -630,7 +676,7 @@
</span><span class="cx"> fixEdge<Int32Use>(node->child2());
</span><span class="cx"> break;
</span><span class="cx"> case Array::Double:
</span><del>- fixEdge<RealNumberUse>(node->child2());
</del><ins>+ fixEdge<DoubleRepRealUse>(node->child2());
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Contiguous:
</span><span class="cx"> case Array::ArrayStorage:
</span><span class="lines">@@ -663,7 +709,7 @@
</span><span class="cx"> else if (node->child1()->shouldSpeculateInt32())
</span><span class="cx"> fixEdge<Int32Use>(node->child1());
</span><span class="cx"> else if (node->child1()->shouldSpeculateNumber())
</span><del>- fixEdge<NumberUse>(node->child1());
</del><ins>+ fixEdge<DoubleRepUse>(node->child1());
</ins><span class="cx">
</span><span class="cx"> Node* logicalNot = node->child1().node();
</span><span class="cx"> if (logicalNot->op() == LogicalNot) {
</span><span class="lines">@@ -760,7 +806,7 @@
</span><span class="cx"> break;
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES:
</span><span class="cx"> for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)
</span><del>- fixEdge<RealNumberUse>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);
</del><ins>+ fixEdge<DoubleRepRealUse>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);
</ins><span class="cx"> break;
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><span class="lines">@@ -936,7 +982,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case Phantom:
</span><del>- case Identity:
</del><span class="cx"> case Check: {
</span><span class="cx"> switch (node->child1().useKind()) {
</span><span class="cx"> case NumberUse:
</span><span class="lines">@@ -961,16 +1006,19 @@
</span><span class="cx"> case CheckTierUpInLoop:
</span><span class="cx"> case CheckTierUpAtReturn:
</span><span class="cx"> case CheckTierUpAndOSREnter:
</span><del>- case Int52ToDouble:
- case Int52ToValue:
</del><span class="cx"> case InvalidationPoint:
</span><span class="cx"> case CheckArray:
</span><span class="cx"> case CheckInBounds:
</span><span class="cx"> case ConstantStoragePointer:
</span><span class="cx"> case DoubleAsInt32:
</span><del>- case Int32ToDouble:
</del><span class="cx"> case ValueToInt32:
</span><span class="cx"> case HardPhantom: // HardPhantom would be trivial to handle but anyway we assert that we won't see it here yet.
</span><ins>+ case DoubleRep:
+ case Int52Rep:
+ case ValueRep:
+ case DoubleConstant:
+ case Int52Constant:
+ case Identity: // This should have been cleaned up.
</ins><span class="cx"> // These are just nodes that we don't currently expect to see during fixup.
</span><span class="cx"> // If we ever wanted to insert them prior to fixup, then we just have to create
</span><span class="cx"> // fixup rules for them.
</span><span class="lines">@@ -1312,7 +1360,7 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void fixupSetLocalsInBlock(BasicBlock* block)
</del><ins>+ void fixupGetAndSetLocalsInBlock(BasicBlock* block)
</ins><span class="cx"> {
</span><span class="cx"> if (!block)
</span><span class="cx"> return;
</span><span class="lines">@@ -1320,28 +1368,49 @@
</span><span class="cx"> m_block = block;
</span><span class="cx"> for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
</span><span class="cx"> Node* node = m_currentNode = block->at(m_indexInBlock);
</span><del>- if (node->op() != SetLocal)
</del><ins>+ if (node->op() != SetLocal && node->op() != GetLocal)
</ins><span class="cx"> continue;
</span><span class="cx">
</span><span class="cx"> VariableAccessData* variable = node->variableAccessData();
</span><del>- switch (variable->flushFormat()) {
- case FlushedJSValue:
</del><ins>+ switch (node->op()) {
+ case GetLocal:
+ switch (variable->flushFormat()) {
+ case FlushedDouble:
+ node->setResult(NodeResultDouble);
+ break;
+ case FlushedInt52:
+ node->setResult(NodeResultInt52);
+ break;
+ default:
+ break;
+ }
</ins><span class="cx"> break;
</span><del>- case FlushedDouble:
- fixEdge<NumberUse>(node->child1());
</del><ins>+
+ case SetLocal:
+ switch (variable->flushFormat()) {
+ case FlushedJSValue:
+ break;
+ case FlushedDouble:
+ fixEdge<DoubleRepUse>(node->child1());
+ break;
+ case FlushedInt32:
+ fixEdge<Int32Use>(node->child1());
+ break;
+ case FlushedInt52:
+ fixEdge<Int52RepUse>(node->child1());
+ break;
+ case FlushedCell:
+ fixEdge<CellUse>(node->child1());
+ break;
+ case FlushedBoolean:
+ fixEdge<BooleanUse>(node->child1());
+ break;
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
</ins><span class="cx"> break;
</span><del>- case FlushedInt32:
- fixEdge<Int32Use>(node->child1());
- break;
- case FlushedInt52:
- fixEdge<MachineIntUse>(node->child1());
- break;
- case FlushedCell:
- fixEdge<CellUse>(node->child1());
- break;
- case FlushedBoolean:
- fixEdge<BooleanUse>(node->child1());
- break;
</del><ins>+
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> break;
</span><span class="lines">@@ -1467,7 +1536,8 @@
</span><span class="cx"> m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
</span><span class="cx"> break;
</span><span class="cx"> case NumberUse:
</span><del>- case RealNumberUse:
</del><ins>+ case DoubleRepUse:
+ case DoubleRepRealUse:
</ins><span class="cx"> if (variable->doubleFormatState() == UsingDoubleFormat)
</span><span class="cx"> m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
</span><span class="cx"> break;
</span><span class="lines">@@ -1476,7 +1546,7 @@
</span><span class="cx"> || isBooleanSpeculation(variable->prediction()))
</span><span class="cx"> m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> if (isMachineIntSpeculation(variable->prediction()))
</span><span class="cx"> m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
</span><span class="cx"> break;
</span><span class="lines">@@ -1519,9 +1589,9 @@
</span><span class="cx">
</span><span class="cx"> UseKind useKind;
</span><span class="cx"> if (node->shouldSpeculateMachineInt())
</span><del>- useKind = MachineIntUse;
</del><ins>+ useKind = Int52RepUse;
</ins><span class="cx"> else if (node->shouldSpeculateNumber())
</span><del>- useKind = NumberUse;
</del><ins>+ useKind = DoubleRepUse;
</ins><span class="cx"> else if (node->shouldSpeculateBoolean())
</span><span class="cx"> useKind = BooleanUse;
</span><span class="cx"> else
</span><span class="lines">@@ -1589,9 +1659,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (m_graph.addShouldSpeculateMachineInt(node)) {
</span><del>- fixEdge<MachineIntUse>(node->child1());
- fixEdge<MachineIntUse>(node->child2());
</del><ins>+ fixEdge<Int52RepUse>(node->child1());
+ fixEdge<Int52RepUse>(node->child2());
</ins><span class="cx"> node->setArithMode(Arith::CheckOverflow);
</span><ins>+ node->setResult(NodeResultInt52);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1724,109 +1795,150 @@
</span><span class="cx"> for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
</span><span class="cx"> m_currentNode = block->at(m_indexInBlock);
</span><span class="cx"> addPhantomsIfNecessary();
</span><del>- if (m_currentNode->containsMovHint())
- continue;
</del><ins>+ tryToRelaxRepresentation(m_currentNode);
</ins><span class="cx"> DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, injectTypeConversionsForEdge);
</span><span class="cx"> }
</span><span class="cx"> clearPhantomsAtEnd();
</span><span class="cx"> m_insertionSet.execute(block);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void tryToRelaxRepresentation(Node* node)
+ {
+ // Some operations may be able to operate more efficiently over looser representations.
+ // Identify those here. This avoids inserting a redundant representation conversion.
+ // Also, for some operations, like MovHint, this is a necessary optimization: inserting
+ // an otherwise-dead conversion just for a MovHint would break OSR's understanding of
+ // the IR.
+
+ switch (node->op()) {
+ case MovHint:
+ case Phantom:
+ case Check:
+ case HardPhantom:
+ DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, fixEdgeRepresentation);
+ break;
+
+ case ValueToInt32:
+ if (node->child1().useKind() == DoubleRepUse
+ && !node->child1()->hasDoubleResult()) {
+ node->child1().setUseKind(NumberUse);
+ break;
+ }
+ break;
+
+ default:
+ break;
+ }
+ }
+
+ void fixEdgeRepresentation(Node*, Edge& edge)
+ {
+ switch (edge.useKind()) {
+ case DoubleRepUse:
+ case DoubleRepRealUse:
+ if (edge->hasDoubleResult())
+ break;
+
+ if (edge->hasInt52Result())
+ edge.setUseKind(Int52RepUse);
+ else if (edge.useKind() == DoubleRepUse)
+ edge.setUseKind(NumberUse);
+ break;
+
+ case Int52RepUse:
+ // Nothing we can really do.
+ break;
+
+ case UntypedUse:
+ case NumberUse:
+ if (edge->hasDoubleResult())
+ edge.setUseKind(DoubleRepUse);
+ else if (edge->hasInt52Result())
+ edge.setUseKind(Int52RepUse);
+ break;
+
+ default:
+ break;
+ }
+ }
+
</ins><span class="cx"> void injectTypeConversionsForEdge(Node* node, Edge& edge)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(node == m_currentNode);
</span><span class="cx">
</span><del>- if (isDouble(edge.useKind())) {
- if (edge->shouldSpeculateInt32ForArithmetic()) {
- addRequiredPhantom(edge.node());
-
- Node* result = m_insertionSet.insertNode(
- m_indexInBlock, SpecInt52AsDouble, Int32ToDouble,
- node->origin, Edge(edge.node(), NumberUse));
-
- edge.setNode(result);
- return;
</del><ins>+ switch (edge.useKind()) {
+ case DoubleRepUse:
+ case DoubleRepRealUse: {
+ if (edge->hasDoubleResult())
+ break;
+
+ addRequiredPhantom(edge.node());
+
+ Node* result;
+ if (edge->hasInt52Result()) {
+ result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecInt52AsDouble, DoubleRep, node->origin,
+ Edge(edge.node(), Int52RepUse));
+ } else {
+ result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecDouble, DoubleRep, node->origin,
+ Edge(edge.node(), NumberUse));
</ins><span class="cx"> }
</span><ins>+
+ edge.setNode(result);
+ break;
+ }
</ins><span class="cx">
</span><del>- if (enableInt52() && edge->shouldSpeculateMachineInt()) {
- // Make all double uses of int52 values have an intermediate Int52ToDouble.
- // This is for the same reason as Int52ToValue (see below) except that
- // Int8ToDouble will convert int52's that fit in an int32 into a double
- // rather than trying to create a boxed int32 like Int52ToValue does.
-
- addRequiredPhantom(edge.node());
- Node* result = m_insertionSet.insertNode(
- m_indexInBlock, SpecInt52AsDouble, Int52ToDouble,
- node->origin, Edge(edge.node(), NumberUse));
- edge.setNode(result);
- return;
</del><ins>+ case Int52RepUse: {
+ if (edge->hasInt52Result())
+ break;
+
+ addRequiredPhantom(edge.node());
+
+ Node* result;
+ if (edge->hasDoubleResult()) {
+ // This will never happen.
+ RELEASE_ASSERT_NOT_REACHED();
+ } else if (edge->shouldSpeculateInt32ForArithmetic()) {
+ result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecInt32, Int52Rep, node->origin,
+ Edge(edge.node(), Int32Use));
+ } else {
+ // This is only here for dealing with constants.
+ RELEASE_ASSERT(edge->op() == JSConstant);
+ result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecMachineInt, Int52Constant, node->origin,
+ OpInfo(edge->constantNumber()));
</ins><span class="cx"> }
</span><ins>+
+ edge.setNode(result);
+ break;
</ins><span class="cx"> }
</span><del>-
- if (enableInt52() && edge.useKind() != MachineIntUse
- && edge->shouldSpeculateMachineInt() && !edge->shouldSpeculateInt32()) {
- // We make all non-int52 uses of int52 values have an intermediate Int52ToValue
- // node to ensure that we handle this properly:
- //
- // a: SomeInt52
- // b: ArithAdd(@a, ...)
- // c: Call(..., @a)
- // d: ArithAdd(@a, ...)
- //
- // Without an intermediate node and just labeling the uses, we will get:
- //
- // a: SomeInt52
- // b: ArithAdd(Int52:@a, ...)
- // c: Call(..., Untyped:@a)
- // d: ArithAdd(Int52:@a, ...)
- //
- // And now the c->Untyped:@a edge will box the value of @a into a double. This
- // is bad, because now the d->Int52:@a edge will either have to do double-to-int
- // conversions, or will have to OSR exit unconditionally. Alternatively we could
- // have the c->Untyped:@a edge box the value by copying rather than in-place.
- // But these boxings are also costly so this wouldn't be great.
- //
- // The solution we use is to always have non-Int52 uses of predicted Int52's use
- // an intervening Int52ToValue node:
- //
- // a: SomeInt52
- // b: ArithAdd(Int52:@a, ...)
- // x: Int52ToValue(Int52:@a)
- // c: Call(..., Untyped:@x)
- // d: ArithAdd(Int52:@a, ...)
- //
- // Note that even if we had multiple non-int52 uses of @a, the multiple
- // Int52ToValue's would get CSE'd together. So the boxing would only happen once.
- // At the same time, @a would continue to be represented as a native int52.
- //
- // An alternative would have been to insert ToNativeInt52 nodes on int52 uses of
- // int52's. This would have handled the above example but would fall over for:
- //
- // a: SomeInt52
- // b: Call(..., @a)
- // c: ArithAdd(@a, ...)
- //
- // But the solution we use handles the above gracefully.
</del><span class="cx">
</span><ins>+ default: {
+ if (!edge->hasDoubleResult() && !edge->hasInt52Result())
+ break;
+
</ins><span class="cx"> addRequiredPhantom(edge.node());
</span><del>- Node* result = m_insertionSet.insertNode(
- m_indexInBlock, SpecInt52, Int52ToValue,
- node->origin, Edge(edge.node(), UntypedUse));
</del><ins>+
+ Node* result;
+ if (edge->hasDoubleResult()) {
+ result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecDouble, ValueRep, node->origin,
+ Edge(edge.node(), DoubleRepUse));
+ } else {
+ result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecInt32 | SpecInt52AsDouble, ValueRep, node->origin,
+ Edge(edge.node(), Int52RepUse));
+ }
+
</ins><span class="cx"> edge.setNode(result);
</span><del>- return;
- }
</del><ins>+ break;
+ } }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void addRequiredPhantom(Node* node)
</span><span class="cx"> {
</span><del>- if (!m_codeOriginOfPhantoms) {
- ASSERT(m_requiredPhantoms.isEmpty());
- m_codeOriginOfPhantoms = m_currentNode->origin.forExit;
- } else {
- ASSERT(!m_requiredPhantoms.isEmpty());
- ASSERT(m_codeOriginOfPhantoms == m_currentNode->origin.forExit);
- }
-
</del><span class="cx"> m_requiredPhantoms.append(node);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1835,19 +1947,14 @@
</span><span class="cx"> if (m_requiredPhantoms.isEmpty())
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!!m_codeOriginOfPhantoms);
-
- if (m_currentNode->origin.forExit == m_codeOriginOfPhantoms)
- return;
-
</del><span class="cx"> for (unsigned i = m_requiredPhantoms.size(); i--;) {
</span><ins>+ Node* node = m_requiredPhantoms[i];
</ins><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock, SpecNone, Phantom, NodeOrigin(m_codeOriginOfPhantoms),
- Edge(m_requiredPhantoms[i], UntypedUse));
</del><ins>+ m_indexInBlock, SpecNone, Phantom, m_currentNode->origin,
+ node->defaultEdge());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_requiredPhantoms.resize(0);
</span><del>- m_codeOriginOfPhantoms = CodeOrigin();
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void clearPhantomsAtEnd()
</span><span class="lines">@@ -1863,7 +1970,6 @@
</span><span class="cx"> // https://bugs.webkit.org/show_bug.cgi?id=126778
</span><span class="cx">
</span><span class="cx"> m_requiredPhantoms.resize(0);
</span><del>- m_codeOriginOfPhantoms = CodeOrigin();
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> BasicBlock* m_block;
</span><span class="lines">@@ -1871,7 +1977,6 @@
</span><span class="cx"> Node* m_currentNode;
</span><span class="cx"> InsertionSet m_insertionSet;
</span><span class="cx"> bool m_profitabilityChanged;
</span><del>- CodeOrigin m_codeOriginOfPhantoms;
</del><span class="cx"> Vector<Node*, 3> m_requiredPhantoms;
</span><span class="cx"> };
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFlushFormath"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFlushFormat.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFlushFormat.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGFlushFormat.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx"> case FlushedInt52:
</span><span class="cx"> return NodeResultInt52;
</span><span class="cx"> case FlushedDouble:
</span><del>- return NodeResultNumber;
</del><ins>+ return NodeResultDouble;
</ins><span class="cx"> case FlushedBoolean:
</span><span class="cx"> return NodeResultBoolean;
</span><span class="cx"> }
</span><span class="lines">@@ -83,9 +83,9 @@
</span><span class="cx"> case FlushedInt32:
</span><span class="cx"> return Int32Use;
</span><span class="cx"> case FlushedInt52:
</span><del>- return MachineIntUse;
</del><ins>+ return Int52RepUse;
</ins><span class="cx"> case FlushedDouble:
</span><del>- return NumberUse;
</del><ins>+ return DoubleRepUse;
</ins><span class="cx"> case FlushedBoolean:
</span><span class="cx"> return BooleanUse;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -314,7 +314,7 @@
</span><span class="cx"> out.print(comma, inContext(JSValue(node->typedArray()), context));
</span><span class="cx"> if (node->hasStoragePointer())
</span><span class="cx"> out.print(comma, RawPointer(node->storagePointer()));
</span><del>- if (op == JSConstant) {
</del><ins>+ if (node->isConstant()) {
</ins><span class="cx"> out.print(comma, "$", node->constantNumber());
</span><span class="cx"> JSValue value = valueOfJSConstant(node);
</span><span class="cx"> out.print(" = ", inContext(value, context));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx"> #include "DFGNodeAllocator.h"
</span><span class="cx"> #include "DFGPlan.h"
</span><span class="cx"> #include "DFGScannable.h"
</span><del>-#include "DFGVariadicFunction.h"
</del><span class="cx"> #include "InlineCallFrameSet.h"
</span><span class="cx"> #include "JSStack.h"
</span><span class="cx"> #include "MethodOfGettingAValueProfile.h"
</span><span class="lines">@@ -136,15 +135,13 @@
</span><span class="cx"> ASSERT(!child->misc.replacement);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-#define DFG_DEFINE_ADD_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \
- templatePre typeParams templatePost Node* addNode(SpeculatedType type valueParamsComma valueParams) \
- { \
- Node* node = new (m_allocator) Node(valueArgs); \
- node->predict(type); \
- return node; \
</del><ins>+ template<typename... Params>
+ Node* addNode(SpeculatedType type, Params... params)
+ {
+ Node* node = new (m_allocator) Node(params...);
+ node->predict(type);
+ return node;
</ins><span class="cx"> }
</span><del>- DFG_VARIADIC_TEMPLATE_FUNCTION(DFG_DEFINE_ADD_NODE)
-#undef DFG_DEFINE_ADD_NODE
</del><span class="cx">
</span><span class="cx"> void dethread();
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGInPlaceAbstractStatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -155,14 +155,23 @@
</span><span class="cx"> block->valuesAtHead.local(i).clear();
</span><span class="cx"> block->valuesAtTail.local(i).clear();
</span><span class="cx"> }
</span><ins>+ if (m_graph.m_form == SSA)
+ continue;
</ins><span class="cx"> if (!block->isOSRTarget)
</span><span class="cx"> continue;
</span><span class="cx"> if (block->bytecodeBegin != m_graph.m_plan.osrEntryBytecodeIndex)
</span><span class="cx"> continue;
</span><span class="cx"> for (size_t i = 0; i < m_graph.m_mustHandleAbstractValues.size(); ++i) {
</span><ins>+ int operand = m_graph.m_mustHandleAbstractValues.operandForIndex(i);
+ Node* node = block->variablesAtHead.operand(operand);
+ if (!node)
+ continue;
</ins><span class="cx"> AbstractValue value = m_graph.m_mustHandleAbstractValues[i];
</span><del>- int operand = m_graph.m_mustHandleAbstractValues.operandForIndex(i);
- block->valuesAtHead.operand(operand).merge(value);
</del><ins>+ AbstractValue& abstractValue = block->valuesAtHead.operand(operand);
+ VariableAccessData* variable = node->variableAccessData();
+ FlushFormat format = variable->flushFormat();
+ abstractValue.merge(value);
+ abstractValue.fixTypeForRepresentation(resultFor(format));
</ins><span class="cx"> }
</span><span class="cx"> block->cfaShouldRevisit = true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGInsertionSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -54,28 +54,47 @@
</span><span class="cx"> {
</span><span class="cx"> return insert(Insertion(index, element));
</span><span class="cx"> }
</span><del>-
-#define DFG_DEFINE_INSERT_NODE(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs) \
- templatePre typeParams templatePost Node* insertNode(size_t index, SpeculatedType type valueParamsComma valueParams) \
- { \
- return insert(index, m_graph.addNode(type valueParamsComma valueArgs)); \
</del><ins>+
+ template<typename... Params>
+ Node* insertNode(size_t index, SpeculatedType type, Params... params)
+ {
+ return insert(index, m_graph.addNode(type, params...));
</ins><span class="cx"> }
</span><del>- DFG_VARIADIC_TEMPLATE_FUNCTION(DFG_DEFINE_INSERT_NODE)
-#undef DFG_DEFINE_INSERT_NODE
</del><span class="cx">
</span><del>- Node* insertConstant(size_t index, NodeOrigin origin, JSValue value)
</del><ins>+ Node* insertConstant(
+ size_t index, NodeOrigin origin, JSValue value,
+ NodeType op = JSConstant)
</ins><span class="cx"> {
</span><span class="cx"> unsigned constantReg =
</span><span class="cx"> m_graph.constantRegisterForConstant(value);
</span><span class="cx"> return insertNode(
</span><del>- index, speculationFromValue(value), JSConstant, origin,
- OpInfo(constantReg));
</del><ins>+ index, speculationFromValue(value), op, origin, OpInfo(constantReg));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- Node* insertConstant(size_t index, CodeOrigin origin, JSValue value)
</del><ins>+ Node* insertConstant(
+ size_t index, CodeOrigin origin, JSValue value, NodeType op = JSConstant)
</ins><span class="cx"> {
</span><del>- return insertConstant(index, NodeOrigin(origin), value);
</del><ins>+ return insertConstant(index, NodeOrigin(origin), value, op);
</ins><span class="cx"> }
</span><ins>+
+ Edge insertConstantForUse(
+ size_t index, NodeOrigin origin, JSValue value, UseKind useKind)
+ {
+ NodeType op;
+ if (isDouble(useKind))
+ op = DoubleConstant;
+ else if (useKind == Int52RepUse)
+ op = Int52Constant;
+ else
+ op = JSConstant;
+ return Edge(insertConstant(index, origin, value, op), useKind);
+ }
+
+ Edge insertConstantForUse(
+ size_t index, CodeOrigin origin, JSValue value, UseKind useKind)
+ {
+ return insertConstantForUse(index, NodeOrigin(origin), value, useKind);
+ }
</ins><span class="cx">
</span><span class="cx"> void execute(BasicBlock* block)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGIntegerCheckCombiningPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -370,10 +370,10 @@
</span><span class="cx"> if (!addend)
</span><span class="cx"> return source.node();
</span><span class="cx"> return m_insertionSet.insertNode(
</span><del>- nodeIndex, source->prediction(), ArithAdd, origin, OpInfo(arithMode),
- source, Edge(
- m_insertionSet.insertConstant(nodeIndex, origin, jsNumber(addend)),
- source.useKind()));
</del><ins>+ nodeIndex, source->prediction(), source->result(),
+ ArithAdd, origin, OpInfo(arithMode), source,
+ m_insertionSet.insertConstantForUse(
+ nodeIndex, origin, jsNumber(addend), source.useKind()));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Node* insertMustAdd(
</span><span class="lines">@@ -381,7 +381,7 @@
</span><span class="cx"> {
</span><span class="cx"> Node* result = insertAdd(nodeIndex, origin, source, addend);
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- nodeIndex, SpecNone, HardPhantom, origin, Edge(result, UntypedUse));
</del><ins>+ nodeIndex, SpecNone, HardPhantom, origin, result->defaultEdge());
</ins><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -91,6 +91,15 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void Node::convertToIdentity()
+{
+ RELEASE_ASSERT(child1());
+ RELEASE_ASSERT(!child2());
+ NodeFlags result = canonicalResultRepresentation(this->result());
+ setOpAndDefaultFlags(Identity);
+ setResult(result);
+}
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> namespace WTF {
</span><span class="lines">@@ -121,7 +130,10 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> out.print("@", node->index());
</span><del>- out.print(AbbreviatedSpeculationDump(node->prediction()));
</del><ins>+ if (node->hasDoubleResult())
+ out.print("<Double>");
+ else if (node->hasInt52Result())
+ out.print("<Int52>");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace WTF
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -38,6 +38,7 @@
</span><span class="cx"> #include "DFGNodeFlags.h"
</span><span class="cx"> #include "DFGNodeOrigin.h"
</span><span class="cx"> #include "DFGNodeType.h"
</span><ins>+#include "DFGUseKind.h"
</ins><span class="cx"> #include "DFGVariableAccessData.h"
</span><span class="cx"> #include "GetByIdVariant.h"
</span><span class="cx"> #include "JSCJSValue.h"
</span><span class="lines">@@ -239,6 +240,22 @@
</span><span class="cx"> ASSERT(!(m_flags & NodeHasVarArgs));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Construct a node with up to 3 children, no immediate value.
+ Node(NodeFlags result, NodeType op, NodeOrigin nodeOrigin, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+ : origin(nodeOrigin)
+ , children(AdjacencyList::Fixed, child1, child2, child3)
+ , m_virtualRegister(VirtualRegister())
+ , m_refCount(1)
+ , m_prediction(SpecNone)
+ , m_opInfo(0)
+ , m_opInfo2(0)
+ {
+ misc.replacement = 0;
+ setOpAndDefaultFlags(op);
+ setResult(result);
+ ASSERT(!(m_flags & NodeHasVarArgs));
+ }
+
</ins><span class="cx"> // Construct a node with up to 3 children and an immediate value.
</span><span class="cx"> Node(NodeType op, NodeOrigin nodeOrigin, OpInfo imm, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
</span><span class="cx"> : origin(nodeOrigin)
</span><span class="lines">@@ -254,6 +271,22 @@
</span><span class="cx"> ASSERT(!(m_flags & NodeHasVarArgs));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Construct a node with up to 3 children and an immediate value.
+ Node(NodeFlags result, NodeType op, NodeOrigin nodeOrigin, OpInfo imm, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+ : origin(nodeOrigin)
+ , children(AdjacencyList::Fixed, child1, child2, child3)
+ , m_virtualRegister(VirtualRegister())
+ , m_refCount(1)
+ , m_prediction(SpecNone)
+ , m_opInfo(imm.m_value)
+ , m_opInfo2(0)
+ {
+ misc.replacement = 0;
+ setOpAndDefaultFlags(op);
+ setResult(result);
+ ASSERT(!(m_flags & NodeHasVarArgs));
+ }
+
</ins><span class="cx"> // Construct a node with up to 3 children and two immediate values.
</span><span class="cx"> Node(NodeType op, NodeOrigin nodeOrigin, OpInfo imm1, OpInfo imm2, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
</span><span class="cx"> : origin(nodeOrigin)
</span><span class="lines">@@ -325,6 +358,18 @@
</span><span class="cx"> return filterFlags(~flags);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void setResult(NodeFlags result)
+ {
+ ASSERT(!(result & ~NodeResultMask));
+ clearFlags(NodeResultMask);
+ mergeFlags(result);
+ }
+
+ NodeFlags result() const
+ {
+ return flags() & NodeResultMask;
+ }
+
</ins><span class="cx"> void setOpAndDefaultFlags(NodeType op)
</span><span class="cx"> {
</span><span class="cx"> m_op = op;
</span><span class="lines">@@ -341,12 +386,7 @@
</span><span class="cx"> setOpAndDefaultFlags(Phantom);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void convertToIdentity()
- {
- RELEASE_ASSERT(child1());
- RELEASE_ASSERT(!child2());
- setOpAndDefaultFlags(Identity);
- }
</del><ins>+ void convertToIdentity();
</ins><span class="cx">
</span><span class="cx"> bool mustGenerate()
</span><span class="cx"> {
</span><span class="lines">@@ -368,7 +408,14 @@
</span><span class="cx">
</span><span class="cx"> bool isConstant()
</span><span class="cx"> {
</span><del>- return op() == JSConstant;
</del><ins>+ switch (op()) {
+ case JSConstant:
+ case DoubleConstant:
+ case Int52Constant:
+ return true;
+ default:
+ return false;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool isWeakConstant()
</span><span class="lines">@@ -385,6 +432,8 @@
</span><span class="cx"> {
</span><span class="cx"> switch (op()) {
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> case WeakJSConstant:
</span><span class="cx"> case PhantomArguments:
</span><span class="cx"> return true;
</span><span class="lines">@@ -401,7 +450,12 @@
</span><span class="cx">
</span><span class="cx"> void convertToConstant(unsigned constantNumber)
</span><span class="cx"> {
</span><del>- m_op = JSConstant;
</del><ins>+ if (hasDoubleResult())
+ m_op = DoubleConstant;
+ else if (hasInt52Result())
+ m_op = Int52Constant;
+ else
+ m_op = JSConstant;
</ins><span class="cx"> m_flags &= ~(NodeMustGenerate | NodeMightClobber | NodeClobbersWorld);
</span><span class="cx"> m_opInfo = constantNumber;
</span><span class="cx"> children.reset();
</span><span class="lines">@@ -502,6 +556,8 @@
</span><span class="cx"> case WeakJSConstant:
</span><span class="cx"> return JSValue(weakConstant());
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> return codeBlock->constantRegister(FirstConstantRegisterIndex + constantNumber()).get();
</span><span class="cx"> case PhantomArguments:
</span><span class="cx"> return JSValue();
</span><span class="lines">@@ -797,33 +853,53 @@
</span><span class="cx">
</span><span class="cx"> bool hasResult()
</span><span class="cx"> {
</span><del>- return m_flags & NodeResultMask;
</del><ins>+ return !!result();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool hasInt32Result()
</span><span class="cx"> {
</span><del>- return (m_flags & NodeResultMask) == NodeResultInt32;
</del><ins>+ return result() == NodeResultInt32;
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool hasInt52Result()
+ {
+ return result() == NodeResultInt52;
+ }
+
</ins><span class="cx"> bool hasNumberResult()
</span><span class="cx"> {
</span><del>- return (m_flags & NodeResultMask) == NodeResultNumber;
</del><ins>+ return result() == NodeResultNumber;
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool hasDoubleResult()
+ {
+ return result() == NodeResultDouble;
+ }
+
</ins><span class="cx"> bool hasJSResult()
</span><span class="cx"> {
</span><del>- return (m_flags & NodeResultMask) == NodeResultJS;
</del><ins>+ return result() == NodeResultJS;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool hasBooleanResult()
</span><span class="cx"> {
</span><del>- return (m_flags & NodeResultMask) == NodeResultBoolean;
</del><ins>+ return result() == NodeResultBoolean;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool hasStorageResult()
</span><span class="cx"> {
</span><del>- return (m_flags & NodeResultMask) == NodeResultStorage;
</del><ins>+ return result() == NodeResultStorage;
</ins><span class="cx"> }
</span><ins>+
+ UseKind defaultUseKind()
+ {
+ return useKindForResult(result());
+ }
+
+ Edge defaultEdge()
+ {
+ return Edge(this, defaultUseKind());
+ }
</ins><span class="cx">
</span><span class="cx"> bool isJump()
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeFlagscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -47,6 +47,9 @@
</span><span class="cx"> case NodeResultNumber:
</span><span class="cx"> out.print(comma, "Number");
</span><span class="cx"> break;
</span><ins>+ case NodeResultDouble:
+ out.print(comma, "Double");
+ break;
</ins><span class="cx"> case NodeResultInt32:
</span><span class="cx"> out.print(comma, "Int32");
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeFlagsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,10 +38,11 @@
</span><span class="cx"> #define NodeResultMask 0x0007
</span><span class="cx"> #define NodeResultJS 0x0001
</span><span class="cx"> #define NodeResultNumber 0x0002
</span><del>-#define NodeResultInt32 0x0003
-#define NodeResultInt52 0x0004
-#define NodeResultBoolean 0x0005
-#define NodeResultStorage 0x0006
</del><ins>+#define NodeResultDouble 0x0003
+#define NodeResultInt32 0x0004
+#define NodeResultInt52 0x0005
+#define NodeResultBoolean 0x0006
+#define NodeResultStorage 0x0007
</ins><span class="cx">
</span><span class="cx"> #define NodeMustGenerate 0x0008 // set on nodes that have side effects, and may not trivially be removed by DCE.
</span><span class="cx"> #define NodeHasVarArgs 0x0010
</span><span class="lines">@@ -114,6 +115,20 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+// FIXME: Get rid of this.
+// https://bugs.webkit.org/show_bug.cgi?id=131689
+static inline NodeFlags canonicalResultRepresentation(NodeFlags flags)
+{
+ switch (flags) {
+ case NodeResultDouble:
+ case NodeResultInt52:
+ case NodeResultStorage:
+ return flags;
+ default:
+ return NodeResultJS;
+ }
+}
+
</ins><span class="cx"> void dumpNodeFlags(PrintStream&, NodeFlags);
</span><span class="cx"> MAKE_PRINT_ADAPTOR(NodeFlagsDump, NodeFlags, dumpNodeFlags);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -37,6 +37,10 @@
</span><span class="cx"> /* A constant in the CodeBlock's constant pool. */\
</span><span class="cx"> macro(JSConstant, NodeResultJS | NodeDoesNotExit) \
</span><span class="cx"> \
</span><ins>+ /* Constants with specific representations. */\
+ macro(DoubleConstant, NodeResultDouble | NodeDoesNotExit) \
+ macro(Int52Constant, NodeResultInt52 | NodeDoesNotExit) \
+ \
</ins><span class="cx"> /* A constant not in the CodeBlock's constant pool. Uses get patched to jumps that exit the */\
</span><span class="cx"> /* code block. */\
</span><span class="cx"> macro(WeakJSConstant, NodeResultJS | NodeDoesNotExit) \
</span><span class="lines">@@ -106,16 +110,14 @@
</span><span class="cx"> /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
</span><span class="cx"> macro(UInt32ToNumber, NodeResultNumber) \
</span><span class="cx"> \
</span><del>- /* Used to cast known integers to doubles, so as to separate the double form */\
- /* of the value from the integer form. */\
- macro(Int32ToDouble, NodeResultNumber) \
- /* Used to speculate that a double value is actually an integer. */\
</del><ins>+ /* Attempt to truncate a double to int32; this will exit if it can't do it. */\
</ins><span class="cx"> macro(DoubleAsInt32, NodeResultInt32) \
</span><del>- /* Used to separate representation and register allocation of Int52's represented */\
- /* as values. */\
- macro(Int52ToValue, NodeResultJS) \
- macro(Int52ToDouble, NodeResultNumber) \
</del><span class="cx"> \
</span><ins>+ /* Change the representation of a value. */\
+ macro(DoubleRep, NodeResultDouble) \
+ macro(Int52Rep, NodeResultInt52) \
+ macro(ValueRep, NodeResultJS) \
+ \
</ins><span class="cx"> /* Nodes for arithmetic operations. */\
</span><span class="cx"> macro(ArithAdd, NodeResultNumber) \
</span><span class="cx"> macro(ArithSub, NodeResultNumber) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitCompiler32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -269,9 +269,7 @@
</span><span class="cx">
</span><span class="cx"> switch (recovery.technique()) {
</span><span class="cx"> case InPair:
</span><del>- case InFPR:
</del><span class="cx"> case DisplacedInJSStack:
</span><del>- case DoubleDisplacedInJSStack:
</del><span class="cx"> m_jit.load32(
</span><span class="cx"> &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.tag,
</span><span class="cx"> GPRInfo::regT0);
</span><span class="lines">@@ -286,6 +284,14 @@
</span><span class="cx"> AssemblyHelpers::payloadFor(operand));
</span><span class="cx"> break;
</span><span class="cx">
</span><ins>+ case InFPR:
+ case DoubleDisplacedInJSStack:
+ m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
+ m_jit.loadDouble(GPRInfo::regT0, FPRInfo::fpRegT0);
+ m_jit.sanitizeDouble(FPRInfo::fpRegT0);
+ m_jit.storeDouble(FPRInfo::fpRegT0, AssemblyHelpers::addressFor(operand));
+ break;
+
</ins><span class="cx"> case UnboxedInt32InGPR:
</span><span class="cx"> case Int32DisplacedInJSStack:
</span><span class="cx"> m_jit.load32(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitCompiler64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -297,6 +297,7 @@
</span><span class="cx"> case DoubleDisplacedInJSStack:
</span><span class="cx"> m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
</span><span class="cx"> m_jit.loadDouble(GPRInfo::regT0, FPRInfo::fpRegT0);
</span><ins>+ m_jit.sanitizeDouble(FPRInfo::fpRegT0);
</ins><span class="cx"> m_jit.boxDouble(FPRInfo::fpRegT0, GPRInfo::regT0);
</span><span class="cx"> m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(operand));
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -490,7 +490,6 @@
</span><span class="cx"> case PutByValAlias:
</span><span class="cx"> case GetArrayLength:
</span><span class="cx"> case GetTypedArrayByteOffset:
</span><del>- case Int32ToDouble:
</del><span class="cx"> case DoubleAsInt32:
</span><span class="cx"> case GetLocalUnlinked:
</span><span class="cx"> case GetMyArgumentsLength:
</span><span class="lines">@@ -504,11 +503,15 @@
</span><span class="cx"> case CheckTierUpAtReturn:
</span><span class="cx"> case CheckTierUpAndOSREnter:
</span><span class="cx"> case InvalidationPoint:
</span><del>- case Int52ToValue:
- case Int52ToDouble:
</del><span class="cx"> case CheckInBounds:
</span><span class="cx"> case ValueToInt32:
</span><del>- case HardPhantom: {
</del><ins>+ case HardPhantom:
+ case DoubleRep:
+ case Int52Rep:
+ case ValueRep:
+ case DoubleConstant:
+ case Int52Constant:
+ case Identity: {
</ins><span class="cx"> // This node should never be visible at this stage of compilation. It is
</span><span class="cx"> // inserted by fixup(), which follows this phase.
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="lines">@@ -535,10 +538,6 @@
</span><span class="cx"> changed |= setPrediction(SpecBoolean);
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case Identity:
- changed |= mergePrediction(node->child1()->prediction());
- break;
-
</del><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> // These get ignored because they don't return anything.
</span><span class="cx"> case StoreBarrier:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGResurrectionForValidationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx"> if (!node->hasResult())
</span><span class="cx"> continue;
</span><span class="cx"> insertionSet.insertNode(
</span><del>- nodeIndex + 1, SpecNone, Phantom, node->origin, Edge(node));
</del><ins>+ nodeIndex + 1, SpecNone, Phantom, node->origin, node->defaultEdge());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> insertionSet.execute(block);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSSAConversionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -192,7 +192,7 @@
</span><span class="cx"> } else {
</span><span class="cx"> m_insertionSet.insertNode(
</span><span class="cx"> 0, SpecNone, MovHint, NodeOrigin(),
</span><del>- OpInfo(variable->local().offset()), Edge(node));
</del><ins>+ OpInfo(variable->local().offset()), node->defaultEdge());
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -350,7 +350,9 @@
</span><span class="cx"> VariableAccessData* variable = node->variableAccessData();
</span><span class="cx"> if (variable->isCaptured())
</span><span class="cx"> break;
</span><del>- node->child1().setNode(block->variablesAtHead.operand(variable->local()));
</del><ins>+ ASSERT(node->child1().useKind() == UntypedUse);
+ node->child1() =
+ block->variablesAtHead.operand(variable->local())->defaultEdge();
</ins><span class="cx"> node->convertToPhantom();
</span><span class="cx"> // This is only for Upsilons. An Upsilon will only refer to a
</span><span class="cx"> // PhantomLocal if there were no SetLocals or GetLocals in the block.
</span><span class="lines">@@ -363,7 +365,7 @@
</span><span class="cx"> if (variable->isCaptured())
</span><span class="cx"> break;
</span><span class="cx"> node->setOpAndDefaultFlags(GetArgument);
</span><del>- node->mergeFlags(resultFor(node->variableAccessData()->flushFormat()));
</del><ins>+ node->setResult(resultFor(node->variableAccessData()->flushFormat()));
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -46,7 +46,9 @@
</span><span class="cx"> switch (edge.useKind()) {
</span><span class="cx"> case UntypedUse:
</span><span class="cx"> case Int32Use:
</span><del>- case RealNumberUse:
</del><ins>+ case DoubleRepUse:
+ case DoubleRepRealUse:
+ case Int52RepUse:
</ins><span class="cx"> case NumberUse:
</span><span class="cx"> case BooleanUse:
</span><span class="cx"> case CellUse:
</span><span class="lines">@@ -61,7 +63,6 @@
</span><span class="cx"> case NotCellUse:
</span><span class="cx"> case OtherUse:
</span><span class="cx"> case MiscUse:
</span><del>- case MachineIntUse:
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case KnownInt32Use:
</span><span class="lines">@@ -69,11 +70,6 @@
</span><span class="cx"> m_result = false;
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- case KnownNumberUse:
- if (m_state.forNode(edge).m_type & ~SpecFullNumber)
- m_result = false;
- return;
-
</del><span class="cx"> case KnownCellUse:
</span><span class="cx"> if (m_state.forNode(edge).m_type & ~SpecCell)
</span><span class="cx"> m_result = false;
</span><span class="lines">@@ -111,6 +107,8 @@
</span><span class="cx">
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> case WeakJSConstant:
</span><span class="cx"> case Identity:
</span><span class="cx"> case ToThis:
</span><span class="lines">@@ -137,7 +135,6 @@
</span><span class="cx"> case BitURShift:
</span><span class="cx"> case ValueToInt32:
</span><span class="cx"> case UInt32ToNumber:
</span><del>- case Int32ToDouble:
</del><span class="cx"> case DoubleAsInt32:
</span><span class="cx"> case ArithAdd:
</span><span class="cx"> case ArithSub:
</span><span class="lines">@@ -242,8 +239,6 @@
</span><span class="cx"> case CheckTierUpAtReturn:
</span><span class="cx"> case CheckTierUpAndOSREnter:
</span><span class="cx"> case LoopHint:
</span><del>- case Int52ToDouble:
- case Int52ToValue:
</del><span class="cx"> case StoreBarrier:
</span><span class="cx"> case StoreBarrierWithNullCheck:
</span><span class="cx"> case InvalidationPoint:
</span><span class="lines">@@ -255,6 +250,9 @@
</span><span class="cx"> case Check:
</span><span class="cx"> case MultiGetByOffset:
</span><span class="cx"> case MultiPutByOffset:
</span><ins>+ case ValueRep:
+ case DoubleRep:
+ case Int52Rep:
</ins><span class="cx"> return true;
</span><span class="cx">
</span><span class="cx"> case GetByVal:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -332,8 +332,6 @@
</span><span class="cx"> } else if (registerFormat == DataFormatInt52) {
</span><span class="cx"> if (node->hasConstant())
</span><span class="cx"> fillAction = SetInt52Constant;
</span><del>- else if (isJSInt32(info.spillFormat()) || info.spillFormat() == DataFormatJS)
- fillAction = Load32PayloadConvertToInt52;
</del><span class="cx"> else if (info.spillFormat() == DataFormatInt52)
</span><span class="cx"> fillAction = Load64;
</span><span class="cx"> else if (info.spillFormat() == DataFormatStrictInt52)
</span><span class="lines">@@ -341,17 +339,12 @@
</span><span class="cx"> else if (info.spillFormat() == DataFormatNone)
</span><span class="cx"> fillAction = Load64;
</span><span class="cx"> else {
</span><del>- // Should never happen. Anything that qualifies as an int32 will never
- // be turned into a cell (immediate spec fail) or a double (to-double
- // conversions involve a separate node).
</del><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> fillAction = Load64; // Make GCC happy.
</span><span class="cx"> }
</span><span class="cx"> } else if (registerFormat == DataFormatStrictInt52) {
</span><span class="cx"> if (node->hasConstant())
</span><span class="cx"> fillAction = SetStrictInt52Constant;
</span><del>- else if (isJSInt32(info.spillFormat()) || info.spillFormat() == DataFormatJS)
- fillAction = Load32PayloadSignExtend;
</del><span class="cx"> else if (info.spillFormat() == DataFormatInt52)
</span><span class="cx"> fillAction = Load64ShiftInt52Right;
</span><span class="cx"> else if (info.spillFormat() == DataFormatStrictInt52)
</span><span class="lines">@@ -359,9 +352,6 @@
</span><span class="cx"> else if (info.spillFormat() == DataFormatNone)
</span><span class="cx"> fillAction = Load64;
</span><span class="cx"> else {
</span><del>- // Should never happen. Anything that qualifies as an int32 will never
- // be turned into a cell (immediate spec fail) or a double (to-double
- // conversions involve a separate node).
</del><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> fillAction = Load64; // Make GCC happy.
</span><span class="cx"> }
</span><span class="lines">@@ -376,9 +366,6 @@
</span><span class="cx"> } else if (info.spillFormat() == DataFormatInt32) {
</span><span class="cx"> ASSERT(registerFormat == DataFormatJSInt32);
</span><span class="cx"> fillAction = Load32PayloadBoxInt;
</span><del>- } else if (info.spillFormat() == DataFormatDouble) {
- ASSERT(registerFormat == DataFormatJSDouble);
- fillAction = LoadDoubleBoxDouble;
</del><span class="cx"> } else
</span><span class="cx"> fillAction = Load64;
</span><span class="cx"> #else
</span><span class="lines">@@ -434,14 +421,12 @@
</span><span class="cx"> if (node->hasConstant()) {
</span><span class="cx"> ASSERT(isNumberConstant(node));
</span><span class="cx"> fillAction = SetDoubleConstant;
</span><del>- } else if (info.spillFormat() != DataFormatNone && info.spillFormat() != DataFormatDouble) {
- // it was already spilled previously and not as a double, which means we need unboxing.
- ASSERT(info.spillFormat() & DataFormatJS);
- fillAction = LoadJSUnboxDouble;
- } else
</del><ins>+ } else {
+ ASSERT(info.spillFormat() == DataFormatNone || info.spillFormat() == DataFormatDouble);
</ins><span class="cx"> fillAction = LoadDouble;
</span><ins>+ }
</ins><span class="cx"> #elif USE(JSVALUE32_64)
</span><del>- ASSERT(info.registerFormat() == DataFormatDouble || info.registerFormat() == DataFormatJSDouble);
</del><ins>+ ASSERT(info.registerFormat() == DataFormatDouble);
</ins><span class="cx"> if (node->hasConstant()) {
</span><span class="cx"> ASSERT(isNumberConstant(node));
</span><span class="cx"> fillAction = SetDoubleConstant;
</span><span class="lines">@@ -528,14 +513,6 @@
</span><span class="cx"> m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
</span><span class="cx"> m_jit.signExtend32ToPtr(plan.gpr(), plan.gpr());
</span><span class="cx"> break;
</span><del>- case LoadDoubleBoxDouble:
- m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
- m_jit.sub64(GPRInfo::tagTypeNumberRegister, plan.gpr());
- break;
- case LoadJSUnboxDouble:
- m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), canTrample);
- unboxDouble(canTrample, plan.fpr());
- break;
</del><span class="cx"> #else
</span><span class="cx"> case SetJSConstantTag:
</span><span class="cx"> m_jit.move(Imm32(valueOfJSConstant(plan.node()).tag()), plan.gpr());
</span><span class="lines">@@ -1039,6 +1016,29 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE32_64)
</span><span class="cx">
</span><ins>+JSValueRegsTemporary::JSValueRegsTemporary() { }
+
+JSValueRegsTemporary::JSValueRegsTemporary(SpeculativeJIT* jit)
+#if USE(JSVALUE64)
+ : m_gpr(jit)
+#else
+ : m_payloadGPR(jit)
+ , m_tagGPR(jit)
+#endif
+{
+}
+
+JSValueRegsTemporary::~JSValueRegsTemporary() { }
+
+JSValueRegs JSValueRegsTemporary::regs()
+{
+#if USE(JSVALUE64)
+ return JSValueRegs(m_gpr.gpr());
+#else
+ return JSValueRegs(m_tagGPR.gpr(), m_payloadGPR.gpr());
+#endif
+}
+
</ins><span class="cx"> void GPRTemporary::adopt(GPRTemporary& other)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!m_jit);
</span><span class="lines">@@ -1258,10 +1258,10 @@
</span><span class="cx"> if (node->isBinaryUseKind(Int32Use))
</span><span class="cx"> compilePeepHoleInt32Branch(node, branchNode, condition);
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- else if (node->isBinaryUseKind(MachineIntUse))
</del><ins>+ else if (node->isBinaryUseKind(Int52RepUse))
</ins><span class="cx"> compilePeepHoleInt52Branch(node, branchNode, condition);
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><del>- else if (node->isBinaryUseKind(NumberUse))
</del><ins>+ else if (node->isBinaryUseKind(DoubleRepUse))
</ins><span class="cx"> compilePeepHoleDoubleBranch(node, branchNode, doubleCondition);
</span><span class="cx"> else if (node->op() == CompareEq) {
</span><span class="cx"> if (node->isBinaryUseKind(StringUse) || node->isBinaryUseKind(StringIdentUse)) {
</span><span class="lines">@@ -1817,16 +1817,13 @@
</span><span class="cx"> case DataFormatJSCell:
</span><span class="cx"> case DataFormatJS:
</span><span class="cx"> case DataFormatJSBoolean:
</span><ins>+ case DataFormatJSDouble:
</ins><span class="cx"> return GeneratedOperandJSValue;
</span><span class="cx">
</span><span class="cx"> case DataFormatJSInt32:
</span><span class="cx"> case DataFormatInt32:
</span><span class="cx"> return GeneratedOperandInteger;
</span><span class="cx">
</span><del>- case DataFormatJSDouble:
- case DataFormatDouble:
- return GeneratedOperandDouble;
-
</del><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return GeneratedOperandTypeUnknown;
</span><span class="lines">@@ -1845,7 +1842,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> SpeculateStrictInt52Operand op1(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, op1);
</span><span class="cx"> GPRReg op1GPR = op1.gpr();
</span><span class="lines">@@ -1855,6 +1852,19 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><ins>+
+ case DoubleRepUse: {
+ GPRTemporary result(this);
+ SpeculateDoubleOperand op1(this, node->child1());
+ FPRReg fpr = op1.fpr();
+ GPRReg gpr = result.gpr();
+ JITCompiler::Jump notTruncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateFailed);
+
+ addSlowPathGenerator(slowPathCall(notTruncatedToInteger, this, toInt32, gpr, fpr));
+
+ int32Result(gpr, node);
+ return;
+ }
</ins><span class="cx">
</span><span class="cx"> case NumberUse:
</span><span class="cx"> case NotCellUse: {
</span><span class="lines">@@ -1866,18 +1876,6 @@
</span><span class="cx"> int32Result(result.gpr(), node, op1.format());
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>- case GeneratedOperandDouble: {
- GPRTemporary result(this);
- SpeculateDoubleOperand op1(this, node->child1(), ManualOperandSpeculation);
- FPRReg fpr = op1.fpr();
- GPRReg gpr = result.gpr();
- JITCompiler::Jump notTruncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateFailed);
-
- addSlowPathGenerator(slowPathCall(notTruncatedToInteger, this, toInt32, gpr, fpr));
-
- int32Result(gpr, node);
- return;
- }
</del><span class="cx"> case GeneratedOperandJSValue: {
</span><span class="cx"> GPRTemporary result(this);
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="lines">@@ -2066,72 +2064,141 @@
</span><span class="cx"> int32Result(resultGPR, node);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void SpeculativeJIT::compileInt32ToDouble(Node* node)
</del><ins>+void SpeculativeJIT::compileDoubleRep(Node* node)
</ins><span class="cx"> {
</span><del>- ASSERT(!isInt32Constant(node->child1().node())); // This should have been constant folded.
</del><ins>+ switch (node->child1().useKind()) {
+ case NumberUse: {
+ ASSERT(!isNumberConstant(node->child1().node())); // This should have been constant folded.
</ins><span class="cx">
</span><del>- if (isInt32Speculation(m_state.forNode(node->child1()).m_type)) {
- SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);
</del><ins>+ if (isInt32Speculation(m_state.forNode(node->child1()).m_type)) {
+ SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);
+ FPRTemporary result(this);
+ m_jit.convertInt32ToDouble(op1.gpr(), result.fpr());
+ doubleResult(result.fpr(), node);
+ return;
+ }
+
+ JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
</ins><span class="cx"> FPRTemporary result(this);
</span><del>- m_jit.convertInt32ToDouble(op1.gpr(), result.fpr());
- doubleResult(result.fpr(), node);
- return;
- }
</del><span class="cx">
</span><del>- JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
- FPRTemporary result(this);
-
</del><span class="cx"> #if USE(JSVALUE64)
</span><del>- GPRTemporary temp(this);
</del><ins>+ GPRTemporary temp(this);
</ins><span class="cx">
</span><del>- GPRReg op1GPR = op1.gpr();
- GPRReg tempGPR = temp.gpr();
- FPRReg resultFPR = result.fpr();
</del><ins>+ GPRReg op1GPR = op1.gpr();
+ GPRReg tempGPR = temp.gpr();
+ FPRReg resultFPR = result.fpr();
</ins><span class="cx">
</span><del>- JITCompiler::Jump isInteger = m_jit.branch64(
- MacroAssembler::AboveOrEqual, op1GPR, GPRInfo::tagTypeNumberRegister);
</del><ins>+ JITCompiler::Jump isInteger = m_jit.branch64(
+ MacroAssembler::AboveOrEqual, op1GPR, GPRInfo::tagTypeNumberRegister);
</ins><span class="cx">
</span><del>- if (needsTypeCheck(node->child1(), SpecFullNumber)) {
- typeCheck(
- JSValueRegs(op1GPR), node->child1(), SpecFullNumber,
- m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister));
- }
</del><ins>+ if (needsTypeCheck(node->child1(), SpecBytecodeNumber)) {
+ typeCheck(
+ JSValueRegs(op1GPR), node->child1(), SpecBytecodeNumber,
+ m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister));
+ }
</ins><span class="cx">
</span><del>- m_jit.move(op1GPR, tempGPR);
- unboxDouble(tempGPR, resultFPR);
- JITCompiler::Jump done = m_jit.jump();
</del><ins>+ m_jit.move(op1GPR, tempGPR);
+ unboxDouble(tempGPR, resultFPR);
+ JITCompiler::Jump done = m_jit.jump();
</ins><span class="cx">
</span><del>- isInteger.link(&m_jit);
- m_jit.convertInt32ToDouble(op1GPR, resultFPR);
- done.link(&m_jit);
-#else
- FPRTemporary temp(this);
</del><ins>+ isInteger.link(&m_jit);
+ m_jit.convertInt32ToDouble(op1GPR, resultFPR);
+ done.link(&m_jit);
+#else // USE(JSVALUE64) -> this is the 32_64 case
+ FPRTemporary temp(this);
</ins><span class="cx">
</span><del>- GPRReg op1TagGPR = op1.tagGPR();
- GPRReg op1PayloadGPR = op1.payloadGPR();
- FPRReg tempFPR = temp.fpr();
- FPRReg resultFPR = result.fpr();
</del><ins>+ GPRReg op1TagGPR = op1.tagGPR();
+ GPRReg op1PayloadGPR = op1.payloadGPR();
+ FPRReg tempFPR = temp.fpr();
+ FPRReg resultFPR = result.fpr();
</ins><span class="cx">
</span><del>- JITCompiler::Jump isInteger = m_jit.branch32(
- MacroAssembler::Equal, op1TagGPR, TrustedImm32(JSValue::Int32Tag));
</del><ins>+ JITCompiler::Jump isInteger = m_jit.branch32(
+ MacroAssembler::Equal, op1TagGPR, TrustedImm32(JSValue::Int32Tag));
</ins><span class="cx">
</span><del>- if (needsTypeCheck(node->child1(), SpecFullNumber)) {
- typeCheck(
- JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecFullNumber,
- m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));
- }
</del><ins>+ if (needsTypeCheck(node->child1(), SpecBytecodeNumber)) {
+ typeCheck(
+ JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecBytecodeNumber,
+ m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));
+ }
</ins><span class="cx">
</span><del>- unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR, tempFPR);
- JITCompiler::Jump done = m_jit.jump();
</del><ins>+ unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR, tempFPR);
+ JITCompiler::Jump done = m_jit.jump();
</ins><span class="cx">
</span><del>- isInteger.link(&m_jit);
- m_jit.convertInt32ToDouble(op1PayloadGPR, resultFPR);
- done.link(&m_jit);
-#endif
</del><ins>+ isInteger.link(&m_jit);
+ m_jit.convertInt32ToDouble(op1PayloadGPR, resultFPR);
+ done.link(&m_jit);
+#endif // USE(JSVALUE64)
</ins><span class="cx">
</span><del>- doubleResult(resultFPR, node);
</del><ins>+ doubleResult(resultFPR, node);
+ return;
+ }
+
+#if USE(JSVALUE64)
+ case Int52RepUse: {
+ SpeculateStrictInt52Operand value(this, node->child1());
+ FPRTemporary result(this);
+
+ GPRReg valueGPR = value.gpr();
+ FPRReg resultFPR = result.fpr();
+
+ m_jit.convertInt64ToDouble(valueGPR, resultFPR);
+
+ doubleResult(resultFPR, node);
+ return;
+ }
+#endif // USE(JSVALUE64)
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ return;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+void SpeculativeJIT::compileValueRep(Node* node)
+{
+ switch (node->child1().useKind()) {
+ case DoubleRepUse: {
+ SpeculateDoubleOperand value(this, node->child1());
+ JSValueRegsTemporary result(this);
+
+ FPRReg valueFPR = value.fpr();
+ JSValueRegs resultRegs = result.regs();
+
+#if CPU(X86)
+ // boxDouble() on X86 clobbers the source, so we need to copy.
+ // FIXME: Don't do that! https://bugs.webkit.org/show_bug.cgi?id=131690
+ FPRTemporary temp(this);
+ m_jit.moveDouble(valueFPR, temp.fpr());
+ valueFPR = temp.fpr();
+#endif
+
+ boxDouble(valueFPR, resultRegs);
+
+ jsValueResult(resultRegs, node);
+ return;
+ }
+
+#if USE(JSVALUE64)
+ case Int52RepUse: {
+ SpeculateStrictInt52Operand value(this, node->child1());
+ GPRTemporary result(this);
+
+ GPRReg valueGPR = value.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ boxInt52(valueGPR, resultGPR, DataFormatStrictInt52);
+
+ jsValueResult(resultGPR, node);
+ return;
+ }
+#endif // USE(JSVALUE64)
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ return;
+ }
+}
+
</ins><span class="cx"> static double clampDoubleToByte(double d)
</span><span class="cx"> {
</span><span class="cx"> d += 0.5;
</span><span class="lines">@@ -2320,7 +2387,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> SpeculateStrictInt52Operand valueOp(this, valueUse);
</span><span class="cx"> GPRTemporary scratch(this);
</span><span class="cx"> GPRReg scratchReg = scratch.gpr();
</span><span class="lines">@@ -2344,7 +2411,7 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> if (isClamped(type)) {
</span><span class="cx"> ASSERT(elementSize(type) == 1);
</span><span class="cx"> SpeculateDoubleOperand valueOp(this, valueUse);
</span><span class="lines">@@ -2440,10 +2507,7 @@
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- MacroAssembler::Jump notNaN = m_jit.branchDouble(MacroAssembler::DoubleEqual, resultReg, resultReg);
- static const double NaN = QNaN;
- m_jit.loadDouble(&NaN, resultReg);
- notNaN.link(&m_jit);
</del><ins>+ m_jit.sanitizeDouble(resultReg);
</ins><span class="cx">
</span><span class="cx"> doubleResult(resultReg, node);
</span><span class="cx"> }
</span><span class="lines">@@ -2641,7 +2705,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> ASSERT(shouldCheckOverflow(node->arithMode()));
</span><span class="cx"> ASSERT(!shouldCheckNegativeZero(node->arithMode()));
</span><span class="cx">
</span><span class="lines">@@ -2670,7 +2734,7 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx"> FPRTemporary result(this, op1, op2);
</span><span class="lines">@@ -2807,7 +2871,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> ASSERT(shouldCheckOverflow(node->arithMode()));
</span><span class="cx"> ASSERT(!shouldCheckNegativeZero(node->arithMode()));
</span><span class="cx">
</span><span class="lines">@@ -2836,7 +2900,7 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx"> FPRTemporary result(this, op1);
</span><span class="lines">@@ -2881,7 +2945,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> ASSERT(shouldCheckOverflow(node->arithMode()));
</span><span class="cx">
</span><span class="cx"> if (!m_state.forNode(node->child1()).couldBeType(SpecInt52)) {
</span><span class="lines">@@ -2918,7 +2982,7 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> FPRTemporary result(this);
</span><span class="cx">
</span><span class="lines">@@ -2969,7 +3033,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> ASSERT(shouldCheckOverflow(node->arithMode()));
</span><span class="cx">
</span><span class="cx"> // This is super clever. We want to do an int52 multiplication and check the
</span><span class="lines">@@ -3026,7 +3090,7 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx"> FPRTemporary result(this, op1, op2);
</span><span class="lines">@@ -3190,7 +3254,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx"> FPRTemporary result(this, op1);
</span><span class="lines">@@ -3495,7 +3559,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx">
</span><span class="lines">@@ -3530,13 +3594,13 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- if (node->isBinaryUseKind(MachineIntUse)) {
</del><ins>+ if (node->isBinaryUseKind(Int52RepUse)) {
</ins><span class="cx"> compileInt52Compare(node, condition);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- if (node->isBinaryUseKind(NumberUse)) {
</del><ins>+ if (node->isBinaryUseKind(DoubleRepUse)) {
</ins><span class="cx"> compileDoubleCompare(node, doubleCondition);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="lines">@@ -3610,7 +3674,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>- if (node->isBinaryUseKind(MachineIntUse)) {
</del><ins>+ if (node->isBinaryUseKind(Int52RepUse)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -3626,7 +3690,7 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx">
</span><del>- if (node->isBinaryUseKind(NumberUse)) {
</del><ins>+ if (node->isBinaryUseKind(DoubleRepUse)) {
</ins><span class="cx"> unsigned branchIndexInBlock = detectPeepHoleBranch();
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="lines">@@ -4487,36 +4551,37 @@
</span><span class="cx"> (SpeculateInt32Operand(this, edge)).gpr();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void SpeculativeJIT::speculateMachineInt(Edge edge)
-{
-#if USE(JSVALUE64)
- if (!needsTypeCheck(edge, SpecMachineInt))
- return;
-
- (SpeculateWhicheverInt52Operand(this, edge)).gpr();
-#else // USE(JSVALUE64)
- UNUSED_PARAM(edge);
- UNREACHABLE_FOR_PLATFORM();
-#endif // USE(JSVALUE64)
-}
-
</del><span class="cx"> void SpeculativeJIT::speculateNumber(Edge edge)
</span><span class="cx"> {
</span><del>- if (!needsTypeCheck(edge, SpecFullNumber))
</del><ins>+ if (!needsTypeCheck(edge, SpecBytecodeNumber))
</ins><span class="cx"> return;
</span><span class="cx">
</span><del>- (SpeculateDoubleOperand(this, edge)).fpr();
</del><ins>+ JSValueOperand value(this, edge, ManualOperandSpeculation);
+#if USE(JSVALUE64)
+ GPRReg gpr = value.gpr();
+ typeCheck(
+ JSValueRegs(gpr), edge, SpecBytecodeNumber,
+ m_jit.branchTest64(MacroAssembler::Zero, gpr, GPRInfo::tagTypeNumberRegister));
+#else
+ GPRReg tagGPR = value.tagGPR();
+ DFG_TYPE_CHECK(
+ value.jsValueRegs(), edge, ~SpecInt32,
+ m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag)));
+ DFG_TYPE_CHECK(
+ value.jsValueRegs(), edge, SpecBytecodeNumber,
+ m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)));
+#endif
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-void SpeculativeJIT::speculateRealNumber(Edge edge)
</del><ins>+void SpeculativeJIT::speculateDoubleReal(Edge edge)
</ins><span class="cx"> {
</span><del>- if (!needsTypeCheck(edge, SpecFullRealNumber))
</del><ins>+ if (!needsTypeCheck(edge, SpecDoubleReal))
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> SpeculateDoubleOperand operand(this, edge);
</span><span class="cx"> FPRReg fpr = operand.fpr();
</span><del>- DFG_TYPE_CHECK(
- JSValueRegs(), edge, SpecFullRealNumber,
</del><ins>+ typeCheck(
+ JSValueRegs(), edge, SpecDoubleReal,
</ins><span class="cx"> m_jit.branchDouble(
</span><span class="cx"> MacroAssembler::DoubleNotEqualOrUnordered, fpr, fpr));
</span><span class="cx"> }
</span><span class="lines">@@ -4768,9 +4833,12 @@
</span><span class="cx"> case KnownInt32Use:
</span><span class="cx"> ASSERT(!needsTypeCheck(edge, SpecInt32));
</span><span class="cx"> break;
</span><del>- case KnownNumberUse:
- ASSERT(!needsTypeCheck(edge, SpecFullNumber));
</del><ins>+ case DoubleRepUse:
+ ASSERT(!needsTypeCheck(edge, SpecDouble));
</ins><span class="cx"> break;
</span><ins>+ case Int52RepUse:
+ ASSERT(!needsTypeCheck(edge, SpecMachineInt));
+ break;
</ins><span class="cx"> case KnownCellUse:
</span><span class="cx"> ASSERT(!needsTypeCheck(edge, SpecCell));
</span><span class="cx"> break;
</span><span class="lines">@@ -4780,15 +4848,12 @@
</span><span class="cx"> case Int32Use:
</span><span class="cx"> speculateInt32(edge);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
- speculateMachineInt(edge);
- break;
- case RealNumberUse:
- speculateRealNumber(edge);
- break;
</del><span class="cx"> case NumberUse:
</span><span class="cx"> speculateNumber(edge);
</span><span class="cx"> break;
</span><ins>+ case DoubleRepRealUse:
+ speculateDoubleReal(edge);
+ break;
</ins><span class="cx"> case BooleanUse:
</span><span class="cx"> speculateBoolean(edge);
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx"> class SpeculateCellOperand;
</span><span class="cx"> class SpeculateBooleanOperand;
</span><span class="cx">
</span><del>-enum GeneratedOperandType { GeneratedOperandTypeUnknown, GeneratedOperandInteger, GeneratedOperandDouble, GeneratedOperandJSValue};
</del><ins>+enum GeneratedOperandType { GeneratedOperandTypeUnknown, GeneratedOperandInteger, GeneratedOperandJSValue};
</ins><span class="cx">
</span><span class="cx"> inline GPRReg extractResult(GPRReg result) { return result; }
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="lines">@@ -190,7 +190,6 @@
</span><span class="cx"> if (spillMe.isValid()) {
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(spillMe);
</span><del>- RELEASE_ASSERT(info.registerFormat() != DataFormatJSDouble);
</del><span class="cx"> if ((info.registerFormat() & DataFormatJS))
</span><span class="cx"> m_gprs.release(info.tagGPR() == gpr ? info.payloadGPR() : info.tagGPR());
</span><span class="cx"> #endif
</span><span class="lines">@@ -265,7 +264,7 @@
</span><span class="cx"> else if (registerFormat != DataFormatNone)
</span><span class="cx"> m_gprs.release(info.gpr());
</span><span class="cx"> #elif USE(JSVALUE32_64)
</span><del>- if (registerFormat == DataFormatDouble || registerFormat == DataFormatJSDouble)
</del><ins>+ if (registerFormat == DataFormatDouble)
</ins><span class="cx"> m_fprs.release(info.fpr());
</span><span class="cx"> else if (registerFormat & DataFormatJS) {
</span><span class="cx"> m_gprs.release(info.tagGPR());
</span><span class="lines">@@ -459,6 +458,10 @@
</span><span class="cx"> m_jit.unboxDouble(tagGPR, payloadGPR, fpr, scratchFPR);
</span><span class="cx"> }
</span><span class="cx"> #endif
</span><ins>+ void boxDouble(FPRReg fpr, JSValueRegs regs)
+ {
+ m_jit.boxDouble(fpr, regs);
+ }
</ins><span class="cx">
</span><span class="cx"> // Spill a VirtualRegister to the JSStack.
</span><span class="cx"> void spill(VirtualRegister spillMe)
</span><span class="lines">@@ -528,11 +531,10 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatDouble:
- case DataFormatJSDouble: {
</del><ins>+ case DataFormatDouble: {
</ins><span class="cx"> // On JSVALUE32_64 boxing a double is a no-op.
</span><span class="cx"> m_jit.storeDouble(info.fpr(), JITCompiler::addressFor(spillMe));
</span><del>- info.spill(*m_stream, spillMe, DataFormatJSDouble);
</del><ins>+ info.spill(*m_stream, spillMe, DataFormatDouble);
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -925,6 +927,14 @@
</span><span class="cx"> jsValueResult(tag, payload, node, DataFormatJS, mode);
</span><span class="cx"> }
</span><span class="cx"> #endif
</span><ins>+ void jsValueResult(JSValueRegs regs, Node* node, DataFormat format = DataFormatJS, UseChildrenMode mode = CallUseChildren)
+ {
+#if USE(JSVALUE64)
+ jsValueResult(regs.gpr(), node, format, mode);
+#else
+ jsValueResult(regs.tagGPR(), regs.payloadGPR(), node, format, mode);
+#endif
+ }
</ins><span class="cx"> void storageResult(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
</span><span class="cx"> {
</span><span class="cx"> if (mode == CallUseChildren)
</span><span class="lines">@@ -2080,10 +2090,12 @@
</span><span class="cx">
</span><span class="cx"> void compileGetArrayLength(Node*);
</span><span class="cx">
</span><ins>+ void compileValueRep(Node*);
+ void compileDoubleRep(Node*);
+
</ins><span class="cx"> void compileValueToInt32(Node*);
</span><span class="cx"> void compileUInt32ToNumber(Node*);
</span><span class="cx"> void compileDoubleAsInt32(Node*);
</span><del>- void compileInt32ToDouble(Node*);
</del><span class="cx"> void compileAdd(Node*);
</span><span class="cx"> void compileMakeRope(Node*);
</span><span class="cx"> void compileArithSub(Node*);
</span><span class="lines">@@ -2185,12 +2197,6 @@
</span><span class="cx">
</span><span class="cx"> void emitAllocateJSArray(GPRReg resultGPR, Structure*, GPRReg storageGPR, unsigned numElements);
</span><span class="cx">
</span><del>-#if USE(JSVALUE64)
- JITCompiler::Jump convertToDouble(GPRReg value, FPRReg result, GPRReg tmp);
-#elif USE(JSVALUE32_64)
- JITCompiler::Jump convertToDouble(JSValueOperand&, FPRReg result);
-#endif
-
</del><span class="cx"> // Add a speculation check.
</span><span class="cx"> void speculationCheck(ExitKind, JSValueSource, Node*, MacroAssembler::Jump jumpToFail);
</span><span class="cx"> void speculationCheck(ExitKind, JSValueSource, Node*, const MacroAssembler::JumpList& jumpsToFail);
</span><span class="lines">@@ -2217,7 +2223,7 @@
</span><span class="cx"> void speculateInt32(Edge);
</span><span class="cx"> void speculateMachineInt(Edge);
</span><span class="cx"> void speculateNumber(Edge);
</span><del>- void speculateRealNumber(Edge);
</del><ins>+ void speculateDoubleReal(Edge);
</ins><span class="cx"> void speculateBoolean(Edge);
</span><span class="cx"> void speculateCell(Edge);
</span><span class="cx"> void speculateObject(Edge);
</span><span class="lines">@@ -2565,6 +2571,23 @@
</span><span class="cx"> GPRReg m_gpr;
</span><span class="cx"> };
</span><span class="cx">
</span><ins>+class JSValueRegsTemporary {
+public:
+ JSValueRegsTemporary();
+ JSValueRegsTemporary(SpeculativeJIT*);
+ ~JSValueRegsTemporary();
+
+ JSValueRegs regs();
+
+private:
+#if USE(JSVALUE64)
+ GPRTemporary m_gpr;
+#else
+ GPRTemporary m_payloadGPR;
+ GPRTemporary m_tagGPR;
+#endif
+};
+
</ins><span class="cx"> class FPRTemporary {
</span><span class="cx"> public:
</span><span class="cx"> FPRTemporary(SpeculativeJIT*);
</span><span class="lines">@@ -2754,12 +2777,12 @@
</span><span class="cx"> // Gives you a canonical Int52 (i.e. it's left-shifted by 16, low bits zero).
</span><span class="cx"> class SpeculateInt52Operand {
</span><span class="cx"> public:
</span><del>- explicit SpeculateInt52Operand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ explicit SpeculateInt52Operand(SpeculativeJIT* jit, Edge edge)
</ins><span class="cx"> : m_jit(jit)
</span><span class="cx"> , m_edge(edge)
</span><span class="cx"> , m_gprOrInvalid(InvalidGPRReg)
</span><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
</del><ins>+ RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</ins><span class="cx"> if (jit->isFilled(node()))
</span><span class="cx"> gpr();
</span><span class="cx"> }
</span><span class="lines">@@ -2801,12 +2824,12 @@
</span><span class="cx"> // Gives you a strict Int52 (i.e. the payload is in the low 48 bits, high 16 bits are sign-extended).
</span><span class="cx"> class SpeculateStrictInt52Operand {
</span><span class="cx"> public:
</span><del>- explicit SpeculateStrictInt52Operand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ explicit SpeculateStrictInt52Operand(SpeculativeJIT* jit, Edge edge)
</ins><span class="cx"> : m_jit(jit)
</span><span class="cx"> , m_edge(edge)
</span><span class="cx"> , m_gprOrInvalid(InvalidGPRReg)
</span><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
</del><ins>+ RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</ins><span class="cx"> if (jit->isFilled(node()))
</span><span class="cx"> gpr();
</span><span class="cx"> }
</span><span class="lines">@@ -2849,35 +2872,35 @@
</span><span class="cx">
</span><span class="cx"> class SpeculateWhicheverInt52Operand {
</span><span class="cx"> public:
</span><del>- explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge)
</ins><span class="cx"> : m_jit(jit)
</span><span class="cx"> , m_edge(edge)
</span><span class="cx"> , m_gprOrInvalid(InvalidGPRReg)
</span><span class="cx"> , m_strict(jit->betterUseStrictInt52(edge))
</span><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
</del><ins>+ RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</ins><span class="cx"> if (jit->isFilled(node()))
</span><span class="cx"> gpr();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, const SpeculateWhicheverInt52Operand& other, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, const SpeculateWhicheverInt52Operand& other)
</ins><span class="cx"> : m_jit(jit)
</span><span class="cx"> , m_edge(edge)
</span><span class="cx"> , m_gprOrInvalid(InvalidGPRReg)
</span><span class="cx"> , m_strict(other.m_strict)
</span><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
</del><ins>+ RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</ins><span class="cx"> if (jit->isFilled(node()))
</span><span class="cx"> gpr();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, OppositeShiftTag, const SpeculateWhicheverInt52Operand& other, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, OppositeShiftTag, const SpeculateWhicheverInt52Operand& other)
</ins><span class="cx"> : m_jit(jit)
</span><span class="cx"> , m_edge(edge)
</span><span class="cx"> , m_gprOrInvalid(InvalidGPRReg)
</span><span class="cx"> , m_strict(!other.m_strict)
</span><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
</del><ins>+ RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</ins><span class="cx"> if (jit->isFilled(node()))
</span><span class="cx"> gpr();
</span><span class="cx"> }
</span><span class="lines">@@ -2926,13 +2949,13 @@
</span><span class="cx">
</span><span class="cx"> class SpeculateDoubleOperand {
</span><span class="cx"> public:
</span><del>- explicit SpeculateDoubleOperand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ explicit SpeculateDoubleOperand(SpeculativeJIT* jit, Edge edge)
</ins><span class="cx"> : m_jit(jit)
</span><span class="cx"> , m_edge(edge)
</span><span class="cx"> , m_fprOrInvalid(InvalidFPRReg)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_jit);
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || isDouble(edge.useKind()));
</del><ins>+ RELEASE_ASSERT(isDouble(edge.useKind()));
</ins><span class="cx"> if (jit->isFilled(node()))
</span><span class="cx"> fpr();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -134,20 +134,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case DataFormatJSDouble:
</span><del>- case DataFormatDouble: {
- FPRReg oldFPR = info.fpr();
- m_fprs.lock(oldFPR);
- tagGPR = allocate();
- payloadGPR = allocate();
- boxDouble(oldFPR, tagGPR, payloadGPR);
- m_fprs.unlock(oldFPR);
- m_fprs.release(oldFPR);
- m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);
- m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);
- info.fillJSValue(*m_stream, tagGPR, payloadGPR, DataFormatJS);
- return true;
- }
-
</del><span class="cx"> case DataFormatJS:
</span><span class="cx"> case DataFormatJSInt32:
</span><span class="cx"> case DataFormatJSCell:
</span><span class="lines">@@ -160,6 +146,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case DataFormatStorage:
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> // this type currently never occurs
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="lines">@@ -756,12 +743,6 @@
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if (info.spillFormat() == DataFormatDouble) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- returnFormat = DataFormatInt32;
- return allocate();
- }
-
</del><span class="cx"> if (edge->hasConstant()) {
</span><span class="cx"> ASSERT(isInt32Constant(edge.node()));
</span><span class="cx"> GPRReg gpr = allocate();
</span><span class="lines">@@ -813,7 +794,6 @@
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatDouble:
</del><span class="cx"> case DataFormatCell:
</span><span class="cx"> case DataFormatBoolean:
</span><span class="cx"> case DataFormatJSDouble:
</span><span class="lines">@@ -823,6 +803,7 @@
</span><span class="cx"> returnFormat = DataFormatInt32;
</span><span class="cx"> return allocate();
</span><span class="cx">
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> case DataFormatStorage:
</span><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="lines">@@ -845,136 +826,34 @@
</span><span class="cx">
</span><span class="cx"> FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge)
</span><span class="cx"> {
</span><del>- AbstractValue& value = m_state.forNode(edge);
- SpeculatedType type = value.m_type;
- ASSERT(edge.useKind() != KnownNumberUse || !(value.m_type & ~SpecFullNumber));
- m_interpreter.filter(value, SpecFullNumber);
</del><ins>+ ASSERT(isDouble(edge.useKind()));
+ ASSERT(edge->hasDoubleResult());
</ins><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><span class="cx">
</span><span class="cx"> if (info.registerFormat() == DataFormatNone) {
</span><span class="cx">
</span><span class="cx"> if (edge->hasConstant()) {
</span><del>- if (isInt32Constant(edge.node())) {
- GPRReg gpr = allocate();
- m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- info.fillInt32(*m_stream, gpr);
- unlock(gpr);
- } else if (isNumberConstant(edge.node())) {
- FPRReg fpr = fprAllocate();
- m_jit.loadDouble(addressOfDoubleConstant(edge.node()), fpr);
- m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
- info.fillDouble(*m_stream, fpr);
- return fpr;
- } else {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return fprAllocate();
- }
- } else {
- DataFormat spillFormat = info.spillFormat();
- ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
- if (spillFormat == DataFormatJSDouble || spillFormat == DataFormatDouble) {
- FPRReg fpr = fprAllocate();
- m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
- m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
- info.fillDouble(*m_stream, fpr);
- return fpr;
- }
-
</del><ins>+ RELEASE_ASSERT(isNumberConstant(edge.node()));
</ins><span class="cx"> FPRReg fpr = fprAllocate();
</span><del>- JITCompiler::Jump hasUnboxedDouble;
-
- if (spillFormat != DataFormatJSInt32 && spillFormat != DataFormatInt32) {
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag));
- if (type & ~SpecFullNumber)
- speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::AboveOrEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::LowestTag)));
- m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
- hasUnboxedDouble = m_jit.jump();
-
- isInteger.link(&m_jit);
- }
-
- m_jit.convertInt32ToDouble(JITCompiler::payloadFor(virtualRegister), fpr);
-
- if (hasUnboxedDouble.isSet())
- hasUnboxedDouble.link(&m_jit);
-
- m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
</del><ins>+ m_jit.loadDouble(addressOfDoubleConstant(edge.node()), fpr);
+ m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
</ins><span class="cx"> info.fillDouble(*m_stream, fpr);
</span><del>- info.killSpilled();
</del><span class="cx"> return fpr;
</span><span class="cx"> }
</span><del>- }
-
- switch (info.registerFormat()) {
- case DataFormatJS:
- case DataFormatJSInt32: {
- GPRReg tagGPR = info.tagGPR();
- GPRReg payloadGPR = info.payloadGPR();
</del><ins>+
+ RELEASE_ASSERT(info.spillFormat() == DataFormatDouble);
</ins><span class="cx"> FPRReg fpr = fprAllocate();
</span><del>-
- m_gprs.lock(tagGPR);
- m_gprs.lock(payloadGPR);
-
- JITCompiler::Jump hasUnboxedDouble;
-
- if (info.registerFormat() != DataFormatJSInt32) {
- FPRTemporary scratch(this);
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));
- if (type & ~SpecFullNumber)
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)));
- unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());
- hasUnboxedDouble = m_jit.jump();
- isInteger.link(&m_jit);
- }
-
- m_jit.convertInt32ToDouble(payloadGPR, fpr);
-
- if (hasUnboxedDouble.isSet())
- hasUnboxedDouble.link(&m_jit);
-
- m_gprs.release(tagGPR);
- m_gprs.release(payloadGPR);
- m_gprs.unlock(tagGPR);
- m_gprs.unlock(payloadGPR);
- m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
</del><ins>+ m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
+ m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
</ins><span class="cx"> info.fillDouble(*m_stream, fpr);
</span><del>- info.killSpilled();
</del><span class="cx"> return fpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatInt32: {
- FPRReg fpr = fprAllocate();
- GPRReg gpr = info.gpr();
- m_gprs.lock(gpr);
- m_jit.convertInt32ToDouble(gpr, fpr);
- m_gprs.unlock(gpr);
- return fpr;
- }
-
- case DataFormatJSDouble:
- case DataFormatDouble: {
- FPRReg fpr = info.fpr();
- m_fprs.lock(fpr);
- return fpr;
- }
-
- case DataFormatNone:
- case DataFormatStorage:
- RELEASE_ASSERT_NOT_REACHED();
-
- case DataFormatCell:
- case DataFormatJSCell:
- case DataFormatBoolean:
- case DataFormatJSBoolean:
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return fprAllocate();
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return InvalidFPRReg;
- }
</del><ins>+ RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
+ FPRReg fpr = info.fpr();
+ m_fprs.lock(fpr);
+ return fpr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
</span><span class="lines">@@ -988,7 +867,7 @@
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if (info.spillFormat() == DataFormatInt32 || info.spillFormat() == DataFormatDouble) {
</del><ins>+ if (info.spillFormat() == DataFormatInt32) {
</ins><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx"> }
</span><span class="lines">@@ -1052,12 +931,12 @@
</span><span class="cx"> case DataFormatJSInt32:
</span><span class="cx"> case DataFormatInt32:
</span><span class="cx"> case DataFormatJSDouble:
</span><del>- case DataFormatDouble:
</del><span class="cx"> case DataFormatJSBoolean:
</span><span class="cx"> case DataFormatBoolean:
</span><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx">
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> case DataFormatStorage:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="lines">@@ -1077,7 +956,7 @@
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if (info.spillFormat() == DataFormatInt32 || info.spillFormat() == DataFormatDouble) {
</del><ins>+ if (info.spillFormat() == DataFormatInt32) {
</ins><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx"> }
</span><span class="lines">@@ -1133,12 +1012,12 @@
</span><span class="cx"> case DataFormatJSInt32:
</span><span class="cx"> case DataFormatInt32:
</span><span class="cx"> case DataFormatJSDouble:
</span><del>- case DataFormatDouble:
</del><span class="cx"> case DataFormatJSCell:
</span><span class="cx"> case DataFormatCell:
</span><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx">
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> case DataFormatStorage:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="lines">@@ -1148,28 +1027,6 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JITCompiler::Jump SpeculativeJIT::convertToDouble(JSValueOperand& op, FPRReg result)
-{
- FPRTemporary scratch(this);
-
- GPRReg opPayloadGPR = op.payloadGPR();
- GPRReg opTagGPR = op.tagGPR();
- FPRReg scratchFPR = scratch.fpr();
-
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, opTagGPR, TrustedImm32(JSValue::Int32Tag));
- JITCompiler::Jump notNumber = m_jit.branch32(MacroAssembler::AboveOrEqual, opPayloadGPR, TrustedImm32(JSValue::LowestTag));
-
- unboxDouble(opTagGPR, opPayloadGPR, result, scratchFPR);
- JITCompiler::Jump done = m_jit.jump();
-
- isInteger.link(&m_jit);
- m_jit.convertInt32ToDouble(opPayloadGPR, result);
-
- done.link(&m_jit);
-
- return notNumber;
-}
-
</del><span class="cx"> void SpeculativeJIT::compileBaseValueStoreBarrier(Edge& baseEdge, Edge& valueEdge)
</span><span class="cx"> {
</span><span class="cx"> #if ENABLE(GGC)
</span><span class="lines">@@ -1547,7 +1404,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand value(this, node->child1());
</span><span class="cx"> FPRTemporary scratch(this);
</span><span class="cx"> GPRTemporary resultPayload(this);
</span><span class="lines">@@ -1676,7 +1533,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> case Int32Use: {
</span><span class="cx"> if (node->child1().useKind() == Int32Use) {
</span><span class="cx"> bool invert = false;
</span><span class="lines">@@ -1817,6 +1674,7 @@
</span><span class="cx">
</span><span class="cx"> switch (op) {
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
</ins><span class="cx"> initConstantInfo(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -1978,14 +1836,6 @@
</span><span class="cx">
</span><span class="cx"> case FlushedJSValue:
</span><span class="cx"> case FlushedArguments: {
</span><del>- if (generationInfoFromVirtualRegister(node->child1()->virtualRegister()).registerFormat() == DataFormatDouble) {
- SpeculateDoubleOperand value(this, node->child1(), ManualOperandSpeculation);
- m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->machineLocal()));
- noResult(node);
- recordSetLocal(DataFormatDouble);
- break;
- }
-
</del><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node->machineLocal()));
</span><span class="cx"> m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node->machineLocal()));
</span><span class="lines">@@ -2077,11 +1927,16 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int32ToDouble: {
- compileInt32ToDouble(node);
</del><ins>+ case DoubleRep: {
+ compileDoubleRep(node);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case ValueRep: {
+ compileValueRep(node);
+ break;
+ }
+
</ins><span class="cx"> case ValueAdd: {
</span><span class="cx"> JSValueOperand op1(this, node->child1());
</span><span class="cx"> JSValueOperand op2(this, node->child2());
</span><span class="lines">@@ -2151,7 +2006,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> FPRTemporary result(this);
</span><span class="cx">
</span><span class="lines">@@ -2193,7 +2048,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx"> FPRTemporary result(this, op1);
</span><span class="lines">@@ -4745,8 +4600,8 @@
</span><span class="cx"> case CheckTierUpInLoop:
</span><span class="cx"> case CheckTierUpAtReturn:
</span><span class="cx"> case CheckTierUpAndOSREnter:
</span><del>- case Int52ToDouble:
- case Int52ToValue:
</del><ins>+ case Int52Rep:
+ case Int52Constant:
</ins><span class="cx"> case CheckInBounds:
</span><span class="cx"> case ArithIMul:
</span><span class="cx"> case MultiGetByOffset:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -106,21 +106,9 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatInt52:
- case DataFormatStrictInt52: {
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
- boxInt52(gpr, gpr, spillFormat);
- return gpr;
- }
-
</del><span class="cx"> default:
</span><span class="cx"> m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><del>- if (spillFormat == DataFormatDouble) {
- // Need to box the double, since we want a JSValue.
- m_jit.sub64(GPRInfo::tagTypeNumberRegister, gpr);
- spillFormat = DataFormatJSDouble;
- } else
- RELEASE_ASSERT(spillFormat & DataFormatJS);
</del><ins>+ RELEASE_ASSERT(spillFormat & DataFormatJS);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> info.fillJSValue(*m_stream, gpr, spillFormat);
</span><span class="lines">@@ -143,28 +131,6 @@
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatDouble: {
- FPRReg fpr = info.fpr();
- GPRReg gpr = boxDouble(fpr);
-
- // Update all info
- info.fillJSValue(*m_stream, gpr, DataFormatJSDouble);
- m_fprs.release(fpr);
- m_gprs.retain(gpr, virtualRegister, SpillOrderJS);
-
- return gpr;
- }
-
- case DataFormatInt52:
- case DataFormatStrictInt52: {
- GPRReg gpr = info.gpr();
- lock(gpr);
- GPRReg resultGPR = allocate();
- boxInt52(gpr, resultGPR, info.registerFormat());
- unlock(gpr);
- return resultGPR;
- }
-
</del><span class="cx"> case DataFormatCell:
</span><span class="cx"> // No retag required on JSVALUE64!
</span><span class="cx"> case DataFormatJS:
</span><span class="lines">@@ -179,6 +145,8 @@
</span><span class="cx">
</span><span class="cx"> case DataFormatBoolean:
</span><span class="cx"> case DataFormatStorage:
</span><ins>+ case DataFormatDouble:
+ case DataFormatInt52:
</ins><span class="cx"> // this type currently never occurs
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="lines">@@ -769,12 +737,6 @@
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if (info.spillFormat() == DataFormatDouble) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- returnFormat = DataFormatInt32;
- return allocate();
- }
-
</del><span class="cx"> GPRReg gpr = allocate();
</span><span class="cx">
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="lines">@@ -788,7 +750,7 @@
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><span class="cx">
</span><del>- RELEASE_ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInt32 || spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</del><ins>+ RELEASE_ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
</ins><span class="cx">
</span><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">
</span><span class="lines">@@ -809,36 +771,6 @@
</span><span class="cx"> returnFormat = DataFormatJSInt32;
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><del>- if (spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52) {
- // Generally, this can only happen if we've already proved that the
- // value is an int32. That's because if a value originated as a JSValue
- // then we would speculate that it's an int32 before representing it as
- // an int52. Otherwise, if we knowingly produced an int52, then we would
- // be boxing it into a value using Int52ToValue. This assertion is valid
- // only because Int52 is something that we introduce at prediction time.
- // However: we may have an int32-producing node replaced by an
- // int52-producing node due to CSE. So we must do a check.
- RELEASE_ASSERT(!(type & ~SpecMachineInt));
- if (type & SpecInt52) {
- GPRReg temp = allocate();
- m_jit.signExtend32ToPtr(gpr, temp);
- // Currently, we can't supply value profiling information here. :-/
- speculationCheck(
- BadType, JSValueRegs(), 0,
- m_jit.branch64(MacroAssembler::NotEqual, gpr, temp));
- unlock(temp);
- }
- if (spillFormat == DataFormatStrictInt52)
- m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
- else {
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
- m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
- m_jit.zeroExtend32ToPtr(gpr, gpr);
- }
- info.fillInt32(*m_stream, gpr);
- returnFormat = DataFormatInt32;
- return gpr;
- }
</del><span class="cx"> m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><span class="cx">
</span><span class="cx"> // Fill as JSValue, and fall through.
</span><span class="lines">@@ -897,47 +829,7 @@
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatStrictInt52:
- case DataFormatInt52: {
- GPRReg gpr = info.gpr();
- GPRReg result;
- DataFormat oldFormat = info.registerFormat();
- if (m_gprs.isLocked(gpr)) {
- result = allocate();
- m_jit.move(gpr, result);
- } else {
- lock(gpr);
- info.fillInt32(*m_stream, gpr);
- result = gpr;
- }
- RELEASE_ASSERT(!(type & ~SpecMachineInt));
- if (oldFormat == DataFormatInt52)
- m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), result);
- if (type & SpecInt52) {
- GPRReg temp = allocate();
- m_jit.signExtend32ToPtr(result, temp);
- // Currently, we can't supply value profiling information here. :-/
- speculationCheck(
- BadType, JSValueRegs(), 0,
- m_jit.branch64(MacroAssembler::NotEqual, result, temp));
- unlock(temp);
- }
- m_jit.zeroExtend32ToPtr(result, result);
- returnFormat = DataFormatInt32;
- return gpr;
- }
-
- case DataFormatDouble:
- case DataFormatJSDouble: {
- if (edge->hasConstant() && isInt32Constant(edge.node())) {
- GPRReg gpr = allocate();
- ASSERT(isInt32Constant(edge.node()));
- m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);
- returnFormat = DataFormatInt32;
- return gpr;
- }
- FALLTHROUGH;
- }
</del><ins>+ case DataFormatJSDouble:
</ins><span class="cx"> case DataFormatCell:
</span><span class="cx"> case DataFormatBoolean:
</span><span class="cx"> case DataFormatJSCell:
</span><span class="lines">@@ -947,7 +839,10 @@
</span><span class="cx"> return allocate();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> case DataFormatStorage:
</span><ins>+ case DataFormatInt52:
+ case DataFormatStrictInt52:
</ins><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -976,14 +871,13 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(desiredFormat == DataFormatInt52 || desiredFormat == DataFormatStrictInt52);
</span><span class="cx"> AbstractValue& value = m_state.forNode(edge);
</span><del>- SpeculatedType type = value.m_type;
</del><span class="cx"> m_interpreter.filter(value, SpecMachineInt);
</span><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if ((edge->hasConstant() && !valueOfJSConstant(edge.node()).isMachineInt()) || info.spillFormat() == DataFormatDouble) {
</del><ins>+ if ((edge->hasConstant() && !valueOfJSConstant(edge.node()).isMachineInt())) {
</ins><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx"> }
</span><span class="lines">@@ -1004,84 +898,23 @@
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><span class="cx">
</span><del>- RELEASE_ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInt32 || spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</del><ins>+ RELEASE_ASSERT(spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</ins><span class="cx">
</span><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">
</span><del>- if (spillFormat == DataFormatJSInt32 || spillFormat == DataFormatInt32) {
- // If we know this was spilled as an integer we can fill without checking.
- m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
- m_jit.signExtend32ToPtr(gpr, gpr);
- if (desiredFormat == DataFormatStrictInt52) {
- info.fillStrictInt52(*m_stream, gpr);
- return gpr;
- }
- m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
- info.fillInt52(*m_stream, gpr);
</del><ins>+ m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+ if (desiredFormat == DataFormatStrictInt52) {
+ if (spillFormat == DataFormatInt52)
+ m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
+ info.fillStrictInt52(*m_stream, gpr);
</ins><span class="cx"> return gpr;
</span><span class="cx"> }
</span><del>- if (spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52) {
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
- if (desiredFormat == DataFormatStrictInt52) {
- if (spillFormat == DataFormatInt52)
- m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
- info.fillStrictInt52(*m_stream, gpr);
- return gpr;
- }
- if (spillFormat == DataFormatStrictInt52)
- m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
- info.fillInt52(*m_stream, gpr);
- return gpr;
- }
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
-
- // Fill as JSValue, and fall through.
- info.fillJSValue(*m_stream, gpr, DataFormatJSInt32);
- m_gprs.unlock(gpr);
- FALLTHROUGH;
</del><ins>+ if (spillFormat == DataFormatStrictInt52)
+ m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
+ info.fillInt52(*m_stream, gpr);
+ return gpr;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatJS: {
- // Check the value is an integer. Note that we would *like* to unbox an Int52
- // at this point but this is too costly. We only *prove* that this is an Int52
- // even though we check if it's an int32.
- GPRReg gpr = info.gpr();
- GPRReg result;
- if (m_gprs.isLocked(gpr)) {
- result = allocate();
- m_jit.move(gpr, result);
- } else {
- m_gprs.lock(gpr);
- result = gpr;
- }
- if (type & ~SpecInt32)
- speculationCheck(BadType, JSValueRegs(result), edge, m_jit.branch64(MacroAssembler::Below, result, GPRInfo::tagTypeNumberRegister));
- if (result == gpr) // The not-already-locked, so fill in-place, case.
- info.fillInt52(*m_stream, gpr, desiredFormat);
- m_jit.signExtend32ToPtr(result, result);
- if (desiredFormat == DataFormatInt52)
- m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), result);
- return result;
- }
-
- case DataFormatInt32:
- case DataFormatJSInt32: {
- GPRReg gpr = info.gpr();
- GPRReg result;
- if (m_gprs.isLocked(gpr)) {
- result = allocate();
- m_jit.move(gpr, result);
- } else {
- m_gprs.lock(gpr);
- info.fillInt52(*m_stream, gpr, desiredFormat);
- result = gpr;
- }
- m_jit.signExtend32ToPtr(result, result);
- if (desiredFormat == DataFormatInt52)
- m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), result);
- return result;
- }
-
</del><span class="cx"> case DataFormatStrictInt52: {
</span><span class="cx"> GPRReg gpr = info.gpr();
</span><span class="cx"> bool wasLocked = m_gprs.isLocked(gpr);
</span><span class="lines">@@ -1116,31 +949,6 @@
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatDouble:
- case DataFormatJSDouble:
- if (edge->hasConstant()) {
- JSValue jsValue = valueOfJSConstant(edge.node());
- if (jsValue.isMachineInt()) {
- int64_t value = jsValue.asMachineInt();
- if (desiredFormat == DataFormatInt52)
- value = value << JSValue::int52ShiftAmount;
- GPRReg gpr = allocate();
- m_jit.move(MacroAssembler::Imm64(value), gpr);
- return gpr;
- }
- }
- FALLTHROUGH;
- case DataFormatCell:
- case DataFormatBoolean:
- case DataFormatJSCell:
- case DataFormatJSBoolean: {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
- case DataFormatStorage:
- RELEASE_ASSERT_NOT_REACHED();
-
</del><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return InvalidGPRReg;
</span><span class="lines">@@ -1149,10 +957,8 @@
</span><span class="cx">
</span><span class="cx"> FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge)
</span><span class="cx"> {
</span><del>- AbstractValue& value = m_state.forNode(edge);
- SpeculatedType type = value.m_type;
- ASSERT(edge.useKind() != KnownNumberUse || !(value.m_type & ~SpecFullNumber));
- m_interpreter.filter(value, SpecFullNumber);
</del><ins>+ ASSERT(edge.useKind() == DoubleRepUse || edge.useKind() == DoubleRepRealUse);
+ ASSERT(edge->hasDoubleResult());
</ins><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><span class="cx">
</span><span class="lines">@@ -1160,17 +966,6 @@
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="cx"> GPRReg gpr = allocate();
</span><span class="cx">
</span><del>- if (isInt32Constant(edge.node())) {
- FPRReg fpr = fprAllocate();
- m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(static_cast<double>(valueOfInt32Constant(edge.node())))), gpr);
- m_jit.move64ToDouble(gpr, fpr);
- unlock(gpr);
-
- // Don't fill double here since that will lead to confusion: the
- // register allocator will now think that this is a double while
- // everyone else thinks it's an integer.
- return fpr;
- }
</del><span class="cx"> if (isNumberConstant(edge.node())) {
</span><span class="cx"> FPRReg fpr = fprAllocate();
</span><span class="cx"> m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(valueOfNumberConstant(edge.node()))), gpr);
</span><span class="lines">@@ -1186,159 +981,18 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><del>- switch (spillFormat) {
- case DataFormatDouble: {
- FPRReg fpr = fprAllocate();
- m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
- m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
- info.fillDouble(*m_stream, fpr);
- return fpr;
- }
-
- case DataFormatInt32: {
- GPRReg gpr = allocate();
-
- m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
- m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
- info.fillInt32(*m_stream, gpr);
- unlock(gpr);
- break;
- }
-
- case DataFormatInt52: {
- GPRReg gpr = allocate();
- m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
- info.fillInt52(*m_stream, gpr);
- unlock(gpr);
- break;
- }
-
- case DataFormatStrictInt52: {
- GPRReg gpr = allocate();
- m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
- info.fillStrictInt52(*m_stream, gpr);
- unlock(gpr);
- break;
- }
-
- default:
- GPRReg gpr = allocate();
-
- RELEASE_ASSERT(spillFormat & DataFormatJS);
- m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
- m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
- info.fillJSValue(*m_stream, gpr, spillFormat);
- unlock(gpr);
- break;
- }
- }
-
- switch (info.registerFormat()) {
- case DataFormatNone: // Should have filled, above.
- case DataFormatBoolean: // This type never occurs.
- case DataFormatStorage:
- RELEASE_ASSERT_NOT_REACHED();
-
- case DataFormatCell:
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return fprAllocate();
-
- case DataFormatJSCell:
- case DataFormatJS:
- case DataFormatJSBoolean: {
- GPRReg jsValueGpr = info.gpr();
- m_gprs.lock(jsValueGpr);
</del><ins>+ RELEASE_ASSERT(spillFormat == DataFormatDouble);
</ins><span class="cx"> FPRReg fpr = fprAllocate();
</span><del>- GPRReg tempGpr = allocate();
-
- JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, jsValueGpr, GPRInfo::tagTypeNumberRegister);
-
- if (type & ~SpecFullNumber)
- speculationCheck(BadType, JSValueRegs(jsValueGpr), edge, m_jit.branchTest64(MacroAssembler::Zero, jsValueGpr, GPRInfo::tagTypeNumberRegister));
-
- // First, if we get here we have a double encoded as a JSValue
- m_jit.move(jsValueGpr, tempGpr);
- unboxDouble(tempGpr, fpr);
- JITCompiler::Jump hasUnboxedDouble = m_jit.jump();
-
- // Finally, handle integers.
- isInteger.link(&m_jit);
- m_jit.convertInt32ToDouble(jsValueGpr, fpr);
- hasUnboxedDouble.link(&m_jit);
-
- m_gprs.release(jsValueGpr);
- m_gprs.unlock(jsValueGpr);
- m_gprs.unlock(tempGpr);
</del><ins>+ m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
</ins><span class="cx"> m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
</span><span class="cx"> info.fillDouble(*m_stream, fpr);
</span><del>- info.killSpilled();
</del><span class="cx"> return fpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case DataFormatJSInt32:
- case DataFormatInt32: {
- FPRReg fpr = fprAllocate();
- GPRReg gpr = info.gpr();
- m_gprs.lock(gpr);
- m_jit.convertInt32ToDouble(gpr, fpr);
- m_gprs.unlock(gpr);
- return fpr;
- }
-
- case DataFormatInt52: {
- FPRReg fpr = fprAllocate();
- GPRReg gpr = info.gpr();
- m_gprs.lock(gpr);
- GPRReg temp = allocate();
- m_jit.move(gpr, temp);
- m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), temp);
- m_jit.convertInt64ToDouble(temp, fpr);
- unlock(temp);
- m_gprs.unlock(gpr);
- return fpr;
- }
-
- case DataFormatStrictInt52: {
- FPRReg fpr = fprAllocate();
- GPRReg gpr = info.gpr();
- m_gprs.lock(gpr);
- m_jit.convertInt64ToDouble(gpr, fpr);
- m_gprs.unlock(gpr);
- return fpr;
- }
-
- // Unbox the double
- case DataFormatJSDouble: {
- GPRReg gpr = info.gpr();
- FPRReg fpr = fprAllocate();
- if (m_gprs.isLocked(gpr)) {
- // Make sure we don't trample gpr if it is in use.
- GPRReg temp = allocate();
- m_jit.move(gpr, temp);
- unboxDouble(temp, fpr);
- unlock(temp);
- } else
- unboxDouble(gpr, fpr);
-
- m_gprs.release(gpr);
- m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-
- info.fillDouble(*m_stream, fpr);
- return fpr;
- }
-
- case DataFormatDouble: {
- FPRReg fpr = info.fpr();
- m_fprs.lock(fpr);
- return fpr;
- }
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return InvalidFPRReg;
- }
</del><ins>+ RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
+ FPRReg fpr = info.fpr();
+ m_fprs.lock(fpr);
+ return fpr;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
</span><span class="lines">@@ -1352,11 +1006,6 @@
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if (info.spillFormat() == DataFormatInt32 || info.spillFormat() == DataFormatDouble) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
</del><span class="cx"> GPRReg gpr = allocate();
</span><span class="cx">
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="lines">@@ -1405,16 +1054,16 @@
</span><span class="cx"> case DataFormatJSInt32:
</span><span class="cx"> case DataFormatInt32:
</span><span class="cx"> case DataFormatJSDouble:
</span><del>- case DataFormatDouble:
</del><span class="cx"> case DataFormatJSBoolean:
</span><del>- case DataFormatBoolean:
- case DataFormatInt52:
- case DataFormatStrictInt52: {
</del><ins>+ case DataFormatBoolean: {
</ins><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> case DataFormatStorage:
</span><ins>+ case DataFormatInt52:
+ case DataFormatStrictInt52:
</ins><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -1433,7 +1082,7 @@
</span><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><del>- if (info.spillFormat() == DataFormatInt32 || info.spillFormat() == DataFormatDouble) {
</del><ins>+ if (info.spillFormat() == DataFormatInt32) {
</ins><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><span class="cx"> }
</span><span class="lines">@@ -1487,16 +1136,15 @@
</span><span class="cx"> case DataFormatJSInt32:
</span><span class="cx"> case DataFormatInt32:
</span><span class="cx"> case DataFormatJSDouble:
</span><del>- case DataFormatDouble:
</del><span class="cx"> case DataFormatJSCell:
</span><span class="cx"> case DataFormatCell:
</span><del>- case DataFormatInt52:
- case DataFormatStrictInt52: {
</del><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return allocate();
</span><del>- }
</del><span class="cx">
</span><ins>+ case DataFormatDouble:
</ins><span class="cx"> case DataFormatStorage:
</span><ins>+ case DataFormatInt52:
+ case DataFormatStrictInt52:
</ins><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -1505,26 +1153,6 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JITCompiler::Jump SpeculativeJIT::convertToDouble(GPRReg value, FPRReg result, GPRReg tmp)
-{
- JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, value, GPRInfo::tagTypeNumberRegister);
-
- JITCompiler::Jump notNumber = m_jit.branchTest64(MacroAssembler::Zero, value, GPRInfo::tagTypeNumberRegister);
-
- m_jit.move(value, tmp);
- unboxDouble(tmp, result);
-
- JITCompiler::Jump done = m_jit.jump();
-
- isInteger.link(&m_jit);
-
- m_jit.convertInt32ToDouble(value, result);
-
- done.link(&m_jit);
-
- return notNumber;
-}
-
</del><span class="cx"> void SpeculativeJIT::compileBaseValueStoreBarrier(Edge& baseEdge, Edge& valueEdge)
</span><span class="cx"> {
</span><span class="cx"> #if ENABLE(GGC)
</span><span class="lines">@@ -1921,7 +1549,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand value(this, node->child1());
</span><span class="cx"> FPRTemporary scratch(this);
</span><span class="cx"> GPRTemporary result(this);
</span><span class="lines">@@ -2060,7 +1688,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case Int32Use:
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> if (node->child1().useKind() == Int32Use) {
</span><span class="cx"> bool invert = false;
</span><span class="cx">
</span><span class="lines">@@ -2153,6 +1781,8 @@
</span><span class="cx">
</span><span class="cx"> switch (op) {
</span><span class="cx"> case JSConstant:
</span><ins>+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> initConstantInfo(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -2400,24 +2030,23 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int32ToDouble: {
- compileInt32ToDouble(node);
</del><ins>+ case DoubleRep: {
+ compileDoubleRep(node);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int52ToValue: {
- JSValueOperand operand(this, node->child1());
- GPRTemporary result(this, Reuse, operand);
- m_jit.move(operand.gpr(), result.gpr());
- jsValueResult(result.gpr(), node);
</del><ins>+ case ValueRep: {
+ compileValueRep(node);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Int52ToDouble: {
- SpeculateDoubleOperand operand(this, node->child1());
- FPRTemporary result(this, operand);
- m_jit.moveDouble(operand.fpr(), result.fpr());
- doubleResult(result.fpr(), node);
</del><ins>+ case Int52Rep: {
+ SpeculateInt32Operand operand(this, node->child1());
+ GPRTemporary result(this, Reuse, operand);
+
+ m_jit.signExtend32ToPtr(operand.gpr(), result.gpr());
+
+ strictInt52Result(result.gpr(), node);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2486,7 +2115,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> FPRTemporary result(this);
</span><span class="cx">
</span><span class="lines">@@ -2524,7 +2153,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> SpeculateDoubleOperand op1(this, node->child1());
</span><span class="cx"> SpeculateDoubleOperand op2(this, node->child2());
</span><span class="cx"> FPRTemporary result(this, op1);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStrengthReductionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -170,6 +170,62 @@
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx">
</span><ins>+ case ValueRep:
+ case Int52Rep:
+ case DoubleRep: {
+ // This short-circuits circuitous conversions, like ValueRep(DoubleRep(value)) or
+ // even more complicated things. Like, it can handle a beast like
+ // ValueRep(DoubleRep(Int52Rep(value))).
+
+ // The only speculation that we would do beyond validating that we have a type that
+ // can be represented a certain way is an Int32 check that would appear on Int52Rep
+ // nodes. For now, if we see this and the final type we want is an Int52, we use it
+ // as an excuse not to fold. The only thing we would need is a Int52RepInt32Use kind.
+ bool hadInt32Check = false;
+ if (m_node->op() == Int52Rep) {
+ ASSERT(m_node->child1().useKind() == Int32Use);
+ hadInt32Check = true;
+ }
+ for (Node* node = m_node->child1().node(); ; node = node->child1().node()) {
+ if (canonicalResultRepresentation(node->result()) ==
+ canonicalResultRepresentation(m_node->result())) {
+ m_insertionSet.insertNode(
+ m_nodeIndex, SpecNone, Phantom, m_node->origin, m_node->child1());
+ if (hadInt32Check) {
+ // FIXME: Consider adding Int52RepInt32Use or even DoubleRepInt32Use,
+ // which would be super weird. The latter would only arise in some
+ // seriously circuitous conversions.
+ if (canonicalResultRepresentation(node->result()) != NodeResultJS)
+ break;
+
+ m_insertionSet.insertNode(
+ m_nodeIndex, SpecNone, Phantom, m_node->origin,
+ Edge(node, Int32Use));
+ }
+ m_node->child1() = node->defaultEdge();
+ m_node->convertToIdentity();
+ m_changed = true;
+ break;
+ }
+
+ switch (node->op()) {
+ case Int52Rep:
+ ASSERT(node->child1().useKind() == Int32Use);
+ hadInt32Check = true;
+ continue;
+
+ case DoubleRep:
+ case ValueRep:
+ continue;
+
+ default:
+ break;
+ }
+ break;
+ }
+ break;
+ }
+
</ins><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGUseKindcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -46,18 +46,18 @@
</span><span class="cx"> case KnownInt32Use:
</span><span class="cx"> out.print("KnownInt32");
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
- out.print("MachineInt");
</del><ins>+ case Int52RepUse:
+ out.print("Int52Rep");
</ins><span class="cx"> break;
</span><del>- case RealNumberUse:
- out.print("RealNumber");
- break;
</del><span class="cx"> case NumberUse:
</span><span class="cx"> out.print("Number");
</span><span class="cx"> break;
</span><del>- case KnownNumberUse:
- out.print("KnownNumber");
</del><ins>+ case DoubleRepUse:
+ out.print("DoubleRep");
</ins><span class="cx"> break;
</span><ins>+ case DoubleRepRealUse:
+ out.print("DoubleRepReal");
+ break;
</ins><span class="cx"> case BooleanUse:
</span><span class="cx"> out.print("Boolean");
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGUseKindh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGUseKind.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGUseKind.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGUseKind.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx">
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">
</span><ins>+#include "DFGNodeFlags.h"
</ins><span class="cx"> #include "SpeculatedType.h"
</span><span class="cx"> #include <wtf/PrintStream.h>
</span><span class="cx">
</span><span class="lines">@@ -37,10 +38,10 @@
</span><span class="cx"> UntypedUse,
</span><span class="cx"> Int32Use,
</span><span class="cx"> KnownInt32Use,
</span><del>- MachineIntUse,
- RealNumberUse,
</del><ins>+ Int52RepUse,
</ins><span class="cx"> NumberUse,
</span><del>- KnownNumberUse,
</del><ins>+ DoubleRepUse,
+ DoubleRepRealUse,
</ins><span class="cx"> BooleanUse,
</span><span class="cx"> CellUse,
</span><span class="cx"> KnownCellUse,
</span><span class="lines">@@ -59,7 +60,7 @@
</span><span class="cx"> LastUseKind // Must always be the last entry in the enum, as it is used to denote the number of enum elements.
</span><span class="cx"> };
</span><span class="cx">
</span><del>-ALWAYS_INLINE SpeculatedType typeFilterFor(UseKind useKind)
</del><ins>+inline SpeculatedType typeFilterFor(UseKind useKind)
</ins><span class="cx"> {
</span><span class="cx"> switch (useKind) {
</span><span class="cx"> case UntypedUse:
</span><span class="lines">@@ -67,13 +68,14 @@
</span><span class="cx"> case Int32Use:
</span><span class="cx"> case KnownInt32Use:
</span><span class="cx"> return SpecInt32;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> return SpecMachineInt;
</span><del>- case RealNumberUse:
- return SpecFullRealNumber;
</del><span class="cx"> case NumberUse:
</span><del>- case KnownNumberUse:
- return SpecFullNumber;
</del><ins>+ return SpecBytecodeNumber;
+ case DoubleRepUse:
+ return SpecDouble;
+ case DoubleRepRealUse:
+ return SpecDoubleReal;
</ins><span class="cx"> case BooleanUse:
</span><span class="cx"> return SpecBoolean;
</span><span class="cx"> case CellUse:
</span><span class="lines">@@ -108,53 +110,53 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE bool shouldNotHaveTypeCheck(UseKind kind)
</del><ins>+inline bool shouldNotHaveTypeCheck(UseKind kind)
</ins><span class="cx"> {
</span><span class="cx"> switch (kind) {
</span><span class="cx"> case UntypedUse:
</span><span class="cx"> case KnownInt32Use:
</span><del>- case KnownNumberUse:
</del><span class="cx"> case KnownCellUse:
</span><span class="cx"> case KnownStringUse:
</span><ins>+ case Int52RepUse:
+ case DoubleRepUse:
</ins><span class="cx"> return true;
</span><span class="cx"> default:
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE bool mayHaveTypeCheck(UseKind kind)
</del><ins>+inline bool mayHaveTypeCheck(UseKind kind)
</ins><span class="cx"> {
</span><span class="cx"> return !shouldNotHaveTypeCheck(kind);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE bool isNumerical(UseKind kind)
</del><ins>+inline bool isNumerical(UseKind kind)
</ins><span class="cx"> {
</span><span class="cx"> switch (kind) {
</span><span class="cx"> case Int32Use:
</span><span class="cx"> case KnownInt32Use:
</span><del>- case MachineIntUse:
- case RealNumberUse:
</del><span class="cx"> case NumberUse:
</span><del>- case KnownNumberUse:
</del><ins>+ case Int52RepUse:
+ case DoubleRepUse:
+ case DoubleRepRealUse:
</ins><span class="cx"> return true;
</span><span class="cx"> default:
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE bool isDouble(UseKind kind)
</del><ins>+inline bool isDouble(UseKind kind)
</ins><span class="cx"> {
</span><span class="cx"> switch (kind) {
</span><del>- case RealNumberUse:
- case NumberUse:
- case KnownNumberUse:
</del><ins>+ case DoubleRepUse:
+ case DoubleRepRealUse:
</ins><span class="cx"> return true;
</span><span class="cx"> default:
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE bool isCell(UseKind kind)
</del><ins>+inline bool isCell(UseKind kind)
</ins><span class="cx"> {
</span><span class="cx"> switch (kind) {
</span><span class="cx"> case CellUse:
</span><span class="lines">@@ -174,7 +176,7 @@
</span><span class="cx">
</span><span class="cx"> // Returns true if it uses structure in a way that could be clobbered by
</span><span class="cx"> // things that change the structure.
</span><del>-ALWAYS_INLINE bool usesStructure(UseKind kind)
</del><ins>+inline bool usesStructure(UseKind kind)
</ins><span class="cx"> {
</span><span class="cx"> switch (kind) {
</span><span class="cx"> case StringObjectUse:
</span><span class="lines">@@ -185,6 +187,19 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+inline UseKind useKindForResult(NodeFlags result)
+{
+ ASSERT(!(result & ~NodeResultMask));
+ switch (result) {
+ case NodeResultInt52:
+ return Int52RepUse;
+ case NodeResultDouble:
+ return DoubleRepUse;
+ default:
+ return UntypedUse;
+ }
+}
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> namespace WTF {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012-2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -115,6 +115,9 @@
</span><span class="cx">
</span><span class="cx"> m_myRefCounts.find(edge.node())->value++;
</span><span class="cx">
</span><ins>+ VALIDATE((node, edge), edge->hasDoubleResult() == (edge.useKind() == DoubleRepUse || edge.useKind() == DoubleRepRealUse));
+ VALIDATE((node, edge), edge->hasInt52Result() == (edge.useKind() == Int52RepUse));
+
</ins><span class="cx"> if (m_graph.m_form == SSA) {
</span><span class="cx"> // In SSA, all edges must hasResult().
</span><span class="cx"> VALIDATE((node, edge), edge->hasResult());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGVariadicFunctionh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGVariadicFunction.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGVariadicFunction.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/dfg/DFGVariadicFunction.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,57 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DFGVariadicFunction_h
-#define DFGVariadicFunction_h
-
-#define DFG_COMMA ,
-
-// The signature of v is (templatePre, templatePost, typeParams, valueParams, valueArgs)
-//
-// You would use it like:
-// #define DEFINE_FUNCTION(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs)
-// templatePre typeParams templatePost void f(valueParams) { g(valueArgs); }
-// DFG_VARIADIC_TEMPLATE_FUNCTION(DEFINE_FUNCTION)
-// #undef DEFINE_FUNCTION
-//
-// Or if you wanted the defined function to take an additional template arg, you would do:
-// #define DEFINE_FUNCTION(templatePre, templatePost, typeParams, valueParamsComma, valueParams, valueArgs)
-// template<typename T valueParamsComma typeParams> void f(T value valueParamsComma valueParams) { g(value, valueArgs); }
-// DFG_VARIADIC_TEMPLATE_FUNCTION(DEFINE_FUNCTION)
-// #undef DEFINE_FUNCTION
-
-#define DFG_VARIADIC_TEMPLATE_FUNCTION(v) \
- v(, , , , , ) \
- v(template<, >, typename _DFG_T1, DFG_COMMA, const _DFG_T1& _DFG_value1, _DFG_value1) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2, _DFG_value1 DFG_COMMA _DFG_value2) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2 DFG_COMMA typename _DFG_T3, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2 DFG_COMMA const _DFG_T3& _DFG_value3, _DFG_value1 DFG_COMMA _DFG_value2 DFG_COMMA _DFG_value3) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2 DFG_COMMA typename _DFG_T3 DFG_COMMA typename _DFG_T4, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2 DFG_COMMA const _DFG_T3& _DFG_value3 DFG_COMMA const _DFG_T4& _DFG_value4, _DFG_value1 DFG_COMMA _DFG_value2 DFG_COMMA _DFG_value3 DFG_COMMA _DFG_value4) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2 DFG_COMMA typename _DFG_T3 DFG_COMMA typename _DFG_T4 DFG_COMMA typename _DFG_T5, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2 DFG_COMMA const _DFG_T3& _DFG_value3 DFG_COMMA const _DFG_T4& _DFG_value4 DFG_COMMA const _DFG_T5& _DFG_value5, _DFG_value1 DFG_COMMA _DFG_value2 DFG_COMMA _DFG_value3 DFG_COMMA _DFG_value4 DFG_COMMA _DFG_value5) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2 DFG_COMMA typename _DFG_T3 DFG_COMMA typename _DFG_T4 DFG_COMMA typename _DFG_T5 DFG_COMMA typename _DFG_T6, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2 DFG_COMMA const _DFG_T3& _DFG_value3 DFG_COMMA const _DFG_T4& _DFG_value4 DFG_COMMA const _DFG_T5& _DFG_value5 DFG_COMMA const _DFG_T6& _DFG_value6, _DFG_value1 DFG_COMMA _DFG_value2 DFG_COMMA _DFG_value3 DFG_COMMA _DFG_value4 DFG_COMMA _DFG_value5 DFG_COMMA _DFG_value6) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2 DFG_COMMA typename _DFG_T3 DFG_COMMA typename _DFG_T4 DFG_COMMA typename _DFG_T5 DFG_COMMA typename _DFG_T6 DFG_COMMA typename _DFG_T7, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2 DFG_COMMA const _DFG_T3& _DFG_value3 DFG_COMMA const _DFG_T4& _DFG_value4 DFG_COMMA const _DFG_T5& _DFG_value5 DFG_COMMA const _DFG_T6& _DFG_value6 DFG_COMMA const _DFG_T7& _DFG_value7, _DFG_value1 DFG_COMMA _DFG_value2 DFG_COMMA _DFG_value3 DFG_COMMA _DFG_value4 DFG_COMMA _DFG_value5 DFG_COMMA _DFG_value6 DFG_COMMA _DFG_value7) \
- v(template<, >, typename _DFG_T1 DFG_COMMA typename _DFG_T2 DFG_COMMA typename _DFG_T3 DFG_COMMA typename _DFG_T4 DFG_COMMA typename _DFG_T5 DFG_COMMA typename _DFG_T6 DFG_COMMA typename _DFG_T7 DFG_COMMA typename _DFG_T8, DFG_COMMA, const _DFG_T1& _DFG_value1 DFG_COMMA const _DFG_T2& _DFG_value2 DFG_COMMA const _DFG_T3& _DFG_value3 DFG_COMMA const _DFG_T4& _DFG_value4 DFG_COMMA const _DFG_T5& _DFG_value5 DFG_COMMA const _DFG_T6& _DFG_value6 DFG_COMMA const _DFG_T7& _DFG_value7 DFG_COMMA _DFG_T8& _DFG_value8, _DFG_value1 DFG_COMMA _DFG_value2 DFG_COMMA _DFG_value3 DFG_COMMA _DFG_value4 DFG_COMMA _DFG_value5 DFG_COMMA _DFG_value6 DFG_COMMA _DFG_value7 DFG_COMMA _DFG_value8)
-
-#endif // DFGVariadicFunction_h
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -90,7 +90,6 @@
</span><span class="cx"> case ArithFRound:
</span><span class="cx"> case ArithNegate:
</span><span class="cx"> case UInt32ToNumber:
</span><del>- case Int32ToDouble:
</del><span class="cx"> case CompareEqConstant:
</span><span class="cx"> case Jump:
</span><span class="cx"> case ForceOSRExit:
</span><span class="lines">@@ -103,7 +102,6 @@
</span><span class="cx"> case GetClosureRegisters:
</span><span class="cx"> case GetClosureVar:
</span><span class="cx"> case PutClosureVar:
</span><del>- case Int52ToValue:
</del><span class="cx"> case InvalidationPoint:
</span><span class="cx"> case StringCharAt:
</span><span class="cx"> case CheckFunction:
</span><span class="lines">@@ -152,8 +150,19 @@
</span><span class="cx"> case IsFunction:
</span><span class="cx"> case CheckHasInstance:
</span><span class="cx"> case InstanceOf:
</span><ins>+ case DoubleRep:
+ case ValueRep:
+ case Int52Rep:
+ case DoubleConstant:
+ case Int52Constant:
</ins><span class="cx"> // These are OK.
</span><span class="cx"> break;
</span><ins>+ case Identity:
+ // No backend handles this because it will be optimized out. But we may check
+ // for capabilities before optimization. It would be a deep error to remove this
+ // case because it would prevent us from catching bugs where the FTL backend
+ // pipeline failed to optimize out an Identity.
+ break;
</ins><span class="cx"> case PutByIdDirect:
</span><span class="cx"> case PutById:
</span><span class="cx"> if (node->child1().useKind() == CellUse)
</span><span class="lines">@@ -235,9 +244,9 @@
</span><span class="cx"> case CompareEq:
</span><span class="cx"> if (node->isBinaryUseKind(Int32Use))
</span><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(MachineIntUse))
</del><ins>+ if (node->isBinaryUseKind(Int52RepUse))
</ins><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(NumberUse))
</del><ins>+ if (node->isBinaryUseKind(DoubleRepUse))
</ins><span class="cx"> break;
</span><span class="cx"> if (node->isBinaryUseKind(StringIdentUse))
</span><span class="cx"> break;
</span><span class="lines">@@ -255,9 +264,9 @@
</span><span class="cx"> case CompareStrictEq:
</span><span class="cx"> if (node->isBinaryUseKind(Int32Use))
</span><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(MachineIntUse))
</del><ins>+ if (node->isBinaryUseKind(Int52RepUse))
</ins><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(NumberUse))
</del><ins>+ if (node->isBinaryUseKind(DoubleRepUse))
</ins><span class="cx"> break;
</span><span class="cx"> if (node->isBinaryUseKind(StringIdentUse))
</span><span class="cx"> break;
</span><span class="lines">@@ -280,9 +289,9 @@
</span><span class="cx"> case CompareGreaterEq:
</span><span class="cx"> if (node->isBinaryUseKind(Int32Use))
</span><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(MachineIntUse))
</del><ins>+ if (node->isBinaryUseKind(Int52RepUse))
</ins><span class="cx"> break;
</span><del>- if (node->isBinaryUseKind(NumberUse))
</del><ins>+ if (node->isBinaryUseKind(DoubleRepUse))
</ins><span class="cx"> break;
</span><span class="cx"> if (node->isBinaryUseKind(UntypedUse))
</span><span class="cx"> break;
</span><span class="lines">@@ -350,10 +359,10 @@
</span><span class="cx"> case UntypedUse:
</span><span class="cx"> case Int32Use:
</span><span class="cx"> case KnownInt32Use:
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> case NumberUse:
</span><del>- case KnownNumberUse:
- case RealNumberUse:
</del><ins>+ case DoubleRepUse:
+ case DoubleRepRealUse:
</ins><span class="cx"> case BooleanUse:
</span><span class="cx"> case CellUse:
</span><span class="cx"> case KnownCellUse:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -186,7 +186,7 @@
</span><span class="cx"> continue;
</span><span class="cx"> LType type;
</span><span class="cx"> switch (node->flags() & NodeResultMask) {
</span><del>- case NodeResultNumber:
</del><ins>+ case NodeResultDouble:
</ins><span class="cx"> type = m_out.doubleType;
</span><span class="cx"> break;
</span><span class="cx"> case NodeResultInt32:
</span><span class="lines">@@ -282,12 +282,30 @@
</span><span class="cx"> break;
</span><span class="cx"> case JSConstant:
</span><span class="cx"> break;
</span><ins>+ case DoubleConstant:
+ compileDoubleConstant();
+ break;
+ case Int52Constant:
+ compileInt52Constant();
+ break;
</ins><span class="cx"> case WeakJSConstant:
</span><span class="cx"> compileWeakJSConstant();
</span><span class="cx"> break;
</span><span class="cx"> case PhantomArguments:
</span><span class="cx"> compilePhantomArguments();
</span><span class="cx"> break;
</span><ins>+ case DoubleRep:
+ compileDoubleRep();
+ break;
+ case ValueRep:
+ compileValueRep();
+ break;
+ case Int52Rep:
+ compileInt52Rep();
+ break;
+ case ValueToInt32:
+ compileValueToInt32();
+ break;
</ins><span class="cx"> case GetArgument:
</span><span class="cx"> compileGetArgument();
</span><span class="cx"> break;
</span><span class="lines">@@ -378,9 +396,6 @@
</span><span class="cx"> case UInt32ToNumber:
</span><span class="cx"> compileUInt32ToNumber();
</span><span class="cx"> break;
</span><del>- case Int32ToDouble:
- compileInt32ToDouble();
- break;
</del><span class="cx"> case CheckStructure:
</span><span class="cx"> compileCheckStructure();
</span><span class="cx"> break;
</span><span class="lines">@@ -569,12 +584,6 @@
</span><span class="cx"> case InvalidationPoint:
</span><span class="cx"> compileInvalidationPoint();
</span><span class="cx"> break;
</span><del>- case ValueToInt32:
- compileValueToInt32();
- break;
- case Int52ToValue:
- compileInt52ToValue();
- break;
</del><span class="cx"> case CheckArgumentsNotCreated:
</span><span class="cx"> compileCheckArgumentsNotCreated();
</span><span class="cx"> break;
</span><span class="lines">@@ -633,73 +642,18 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compileValueToInt32()
- {
- switch (m_node->child1().useKind()) {
- case Int32Use:
- setInt32(lowInt32(m_node->child1()));
- break;
-
- case MachineIntUse:
- setInt32(m_out.castToInt32(lowStrictInt52(m_node->child1())));
- break;
-
- case NumberUse:
- case NotCellUse: {
- LoweredNodeValue value = m_int32Values.get(m_node->child1().node());
- if (isValid(value)) {
- setInt32(value.value());
- break;
- }
-
- value = m_jsValueValues.get(m_node->child1().node());
- if (isValid(value)) {
- setInt32(numberOrNotCellToInt32(m_node->child1(), value.value()));
- break;
- }
-
- value = m_doubleValues.get(m_node->child1().node());
- if (isValid(value)) {
- setInt32(doubleToInt32(value.value()));
- break;
- }
-
- // We'll basically just get here for constants. But it's good to have this
- // catch-all since we often add new representations into the mix.
- setInt32(
- numberOrNotCellToInt32(
- m_node->child1(),
- lowJSValue(m_node->child1(), ManualOperandSpeculation)));
- break;
- }
-
- case BooleanUse:
- setInt32(m_out.zeroExt(lowBoolean(m_node->child1()), m_out.int32));
- break;
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
- }
-
- void compileInt52ToValue()
- {
- setJSValue(lowJSValue(m_node->child1()));
- }
-
</del><span class="cx"> void compileUpsilon()
</span><span class="cx"> {
</span><span class="cx"> LValue destination = m_phis.get(m_node->phi());
</span><span class="cx">
</span><span class="cx"> switch (m_node->child1().useKind()) {
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> m_out.set(lowDouble(m_node->child1()), destination);
</span><span class="cx"> break;
</span><span class="cx"> case Int32Use:
</span><span class="cx"> m_out.set(lowInt32(m_node->child1()), destination);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> m_out.set(lowInt52(m_node->child1()), destination);
</span><span class="cx"> break;
</span><span class="cx"> case BooleanUse:
</span><span class="lines">@@ -722,7 +676,7 @@
</span><span class="cx"> LValue source = m_phis.get(m_node);
</span><span class="cx">
</span><span class="cx"> switch (m_node->flags() & NodeResultMask) {
</span><del>- case NodeResultNumber:
</del><ins>+ case NodeResultDouble:
</ins><span class="cx"> setDouble(m_out.get(source));
</span><span class="cx"> break;
</span><span class="cx"> case NodeResultInt32:
</span><span class="lines">@@ -742,17 +696,120 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><ins>+
+ void compileDoubleConstant()
+ {
+ setDouble(m_out.constDouble(m_graph.valueOfNumberConstant(m_node)));
+ }
+
+ void compileInt52Constant()
+ {
+ int64_t value = m_graph.valueOfJSConstant(m_node).asMachineInt();
+
+ setInt52(m_out.constInt64(value << JSValue::int52ShiftAmount));
+ setStrictInt52(m_out.constInt64(value));
+ }
</ins><span class="cx">
</span><ins>+ void compileWeakJSConstant()
+ {
+ setJSValue(weakPointer(m_node->weakConstant()));
+ }
+
</ins><span class="cx"> void compilePhantomArguments()
</span><span class="cx"> {
</span><span class="cx"> setJSValue(m_out.constInt64(JSValue::encode(JSValue())));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compileWeakJSConstant()
</del><ins>+ void compileDoubleRep()
</ins><span class="cx"> {
</span><del>- setJSValue(weakPointer(m_node->weakConstant()));
</del><ins>+ switch (m_node->child1().useKind()) {
+ case NumberUse: {
+ LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+ setDouble(jsValueToDouble(m_node->child1(), value));
+ return;
+ }
+
+ case Int52RepUse: {
+ setDouble(strictInt52ToDouble(lowStrictInt52(m_node->child1())));
+ return;
+ }
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ void compileValueRep()
+ {
+ switch (m_node->child1().useKind()) {
+ case DoubleRepUse: {
+ setJSValue(boxDouble(lowDouble(m_node->child1())));
+ return;
+ }
+
+ case Int52RepUse: {
+ setJSValue(strictInt52ToJSValue(lowStrictInt52(m_node->child1())));
+ return;
+ }
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
+ }
+
+ void compileInt52Rep()
+ {
+ setStrictInt52(m_out.signExt(lowInt32(m_node->child1()), m_out.int64));
+ }
+
+ void compileValueToInt32()
+ {
+ switch (m_node->child1().useKind()) {
+ case Int32Use:
+ setInt32(lowInt32(m_node->child1()));
+ break;
+
+ case Int52RepUse:
+ setInt32(m_out.castToInt32(lowStrictInt52(m_node->child1())));
+ break;
+
+ case DoubleRepUse:
+ setInt32(doubleToInt32(lowDouble(m_node->child1())));
+ break;
+
+ case NumberUse:
+ case NotCellUse: {
+ LoweredNodeValue value = m_int32Values.get(m_node->child1().node());
+ if (isValid(value)) {
+ setInt32(value.value());
+ break;
+ }
+
+ value = m_jsValueValues.get(m_node->child1().node());
+ if (isValid(value)) {
+ setInt32(numberOrNotCellToInt32(m_node->child1(), value.value()));
+ break;
+ }
+
+ // We'll basically just get here for constants. But it's good to have this
+ // catch-all since we often add new representations into the mix.
+ setInt32(
+ numberOrNotCellToInt32(
+ m_node->child1(),
+ lowJSValue(m_node->child1(), ManualOperandSpeculation)));
+ break;
+ }
+
+ case BooleanUse:
+ setInt32(m_out.zeroExt(lowBoolean(m_node->child1()), m_out.int32));
+ break;
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+ }
+
</ins><span class="cx"> void compileGetArgument()
</span><span class="cx"> {
</span><span class="cx"> VariableAccessData* variable = m_node->variableAccessData();
</span><span class="lines">@@ -966,7 +1023,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> if (!m_state.forNode(m_node->child1()).couldBeType(SpecInt52)
</span><span class="cx"> && !m_state.forNode(m_node->child2()).couldBeType(SpecInt52)) {
</span><span class="cx"> Int52Kind kind;
</span><span class="lines">@@ -1016,7 +1073,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> LValue C1 = lowDouble(m_node->child1());
</span><span class="cx"> LValue C2 = lowDouble(m_node->child2());
</span><span class="cx">
</span><span class="lines">@@ -1065,7 +1122,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> Int52Kind kind;
</span><span class="cx"> LValue left = lowWhicheverInt52(m_node->child1(), kind);
</span><span class="cx"> LValue right = lowInt52(m_node->child2(), opposite(kind));
</span><span class="lines">@@ -1092,7 +1149,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> setDouble(
</span><span class="cx"> m_out.doubleMul(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
</span><span class="cx"> break;
</span><span class="lines">@@ -1195,7 +1252,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> setDouble(m_out.doubleDiv(
</span><span class="cx"> lowDouble(m_node->child1()), lowDouble(m_node->child2())));
</span><span class="cx"> break;
</span><span class="lines">@@ -1293,7 +1350,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> setDouble(
</span><span class="cx"> m_out.doubleRem(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
</span><span class="cx"> break;
</span><span class="lines">@@ -1321,7 +1378,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> LValue left = lowDouble(m_node->child1());
</span><span class="cx"> LValue right = lowDouble(m_node->child2());
</span><span class="cx">
</span><span class="lines">@@ -1371,7 +1428,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> setDouble(m_out.doubleAbs(lowDouble(m_node->child1())));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -1418,7 +1475,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case MachineIntUse: {
</del><ins>+ case Int52RepUse: {
</ins><span class="cx"> if (!m_state.forNode(m_node->child1()).couldBeType(SpecInt52)) {
</span><span class="cx"> Int52Kind kind;
</span><span class="cx"> LValue value = lowWhicheverInt52(m_node->child1(), kind);
</span><span class="lines">@@ -1438,7 +1495,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> setDouble(m_out.doubleNeg(lowDouble(m_node->child1())));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -1498,11 +1555,6 @@
</span><span class="cx"> setInt32(value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compileInt32ToDouble()
- {
- setDouble(lowDouble(m_node->child1()));
- }
-
</del><span class="cx"> void compileCheckStructure()
</span><span class="cx"> {
</span><span class="cx"> LValue cell = lowCell(m_node->child1());
</span><span class="lines">@@ -2213,7 +2265,7 @@
</span><span class="cx"> if (isInt(type)) {
</span><span class="cx"> LValue intValue;
</span><span class="cx"> switch (child3.useKind()) {
</span><del>- case MachineIntUse:
</del><ins>+ case Int52RepUse:
</ins><span class="cx"> case Int32Use: {
</span><span class="cx"> if (child3.useKind() == Int32Use)
</span><span class="cx"> intValue = lowInt32(child3);
</span><span class="lines">@@ -2246,7 +2298,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case NumberUse: {
</del><ins>+ case DoubleRepUse: {
</ins><span class="cx"> LValue doubleValue = lowDouble(child3);
</span><span class="cx">
</span><span class="cx"> if (isClamped(type)) {
</span><span class="lines">@@ -3328,8 +3380,8 @@
</span><span class="cx"> void compileCompareEq()
</span><span class="cx"> {
</span><span class="cx"> if (m_node->isBinaryUseKind(Int32Use)
</span><del>- || m_node->isBinaryUseKind(MachineIntUse)
- || m_node->isBinaryUseKind(NumberUse)
</del><ins>+ || m_node->isBinaryUseKind(Int52RepUse)
+ || m_node->isBinaryUseKind(DoubleRepUse)
</ins><span class="cx"> || m_node->isBinaryUseKind(ObjectUse)
</span><span class="cx"> || m_node->isBinaryUseKind(BooleanUse)
</span><span class="cx"> || m_node->isBinaryUseKind(StringIdentUse)) {
</span><span class="lines">@@ -3371,7 +3423,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->isBinaryUseKind(MachineIntUse)) {
</del><ins>+ if (m_node->isBinaryUseKind(Int52RepUse)) {
</ins><span class="cx"> Int52Kind kind;
</span><span class="cx"> LValue left = lowWhicheverInt52(m_node->child1(), kind);
</span><span class="cx"> LValue right = lowInt52(m_node->child2(), kind);
</span><span class="lines">@@ -3379,7 +3431,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->isBinaryUseKind(NumberUse)) {
</del><ins>+ if (m_node->isBinaryUseKind(DoubleRepUse)) {
</ins><span class="cx"> setBoolean(
</span><span class="cx"> m_out.doubleEqual(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
</span><span class="cx"> return;
</span><span class="lines">@@ -4123,7 +4175,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->isBinaryUseKind(MachineIntUse)) {
</del><ins>+ if (m_node->isBinaryUseKind(Int52RepUse)) {
</ins><span class="cx"> Int52Kind kind;
</span><span class="cx"> LValue left = lowWhicheverInt52(m_node->child1(), kind);
</span><span class="cx"> LValue right = lowInt52(m_node->child2(), kind);
</span><span class="lines">@@ -4131,7 +4183,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_node->isBinaryUseKind(NumberUse)) {
</del><ins>+ if (m_node->isBinaryUseKind(DoubleRepUse)) {
</ins><span class="cx"> LValue left = lowDouble(m_node->child1());
</span><span class="cx"> LValue right = lowDouble(m_node->child2());
</span><span class="cx"> setBoolean(m_out.fcmp(realCondition, left, right));
</span><span class="lines">@@ -4388,7 +4440,7 @@
</span><span class="cx"> return lowBoolean(m_node->child1());
</span><span class="cx"> case Int32Use:
</span><span class="cx"> return m_out.notZero32(lowInt32(m_node->child1()));
</span><del>- case NumberUse:
</del><ins>+ case DoubleRepUse:
</ins><span class="cx"> return m_out.doubleNotEqual(lowDouble(edge), m_out.doubleZero);
</span><span class="cx"> case ObjectOrOtherUse:
</span><span class="cx"> return m_out.bitNot(
</span><span class="lines">@@ -4734,22 +4786,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> enum Int52Kind { StrictInt52, Int52 };
</span><del>- LValue lowInt52(Edge edge, Int52Kind kind, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ LValue lowInt52(Edge edge, Int52Kind kind)
</ins><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
</del><ins>+ RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</ins><span class="cx">
</span><del>- if (edge->hasConstant()) {
- JSValue value = m_graph.valueOfJSConstant(edge.node());
- if (!value.isMachineInt()) {
- terminate(Uncountable);
- return m_out.int64Zero;
- }
- int64_t result = value.asMachineInt();
- if (kind == Int52)
- result <<= JSValue::int52ShiftAmount;
- return m_out.constInt64(result);
- }
-
</del><span class="cx"> LoweredNodeValue value;
</span><span class="cx">
</span><span class="cx"> switch (kind) {
</span><span class="lines">@@ -4773,37 +4813,20 @@
</span><span class="cx"> return int52ToStrictInt52(value.value());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
- value = m_int32Values.get(edge.node());
- if (isValid(value)) {
- return setInt52WithStrictValue(
- edge.node(), m_out.signExt(value.value(), m_out.int64), kind);
- }
-
- RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecInt52));
-
- value = m_jsValueValues.get(edge.node());
- if (isValid(value)) {
- LValue boxedResult = value.value();
- FTL_TYPE_CHECK(
- jsValueValue(boxedResult), edge, SpecMachineInt, isNotInt32(boxedResult));
- return setInt52WithStrictValue(
- edge.node(), m_out.signExt(unboxInt32(boxedResult), m_out.int64), kind);
- }
-
- RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecMachineInt));
</del><ins>+
+ RELEASE_ASSERT(!m_state.forNode(edge).m_type);
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.int64Zero;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue lowInt52(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ LValue lowInt52(Edge edge)
</ins><span class="cx"> {
</span><del>- return lowInt52(edge, Int52, mode);
</del><ins>+ return lowInt52(edge, Int52);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- LValue lowStrictInt52(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ LValue lowStrictInt52(Edge edge)
</ins><span class="cx"> {
</span><del>- return lowInt52(edge, StrictInt52, mode);
</del><ins>+ return lowInt52(edge, StrictInt52);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool betterUseStrictInt52(Node* node)
</span><span class="lines">@@ -4830,10 +4853,10 @@
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue lowWhicheverInt52(Edge edge, Int52Kind& kind, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ LValue lowWhicheverInt52(Edge edge, Int52Kind& kind)
</ins><span class="cx"> {
</span><span class="cx"> kind = bestInt52Kind(edge);
</span><del>- return lowInt52(edge, kind, mode);
</del><ins>+ return lowInt52(edge, kind);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> LValue lowCell(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</span><span class="lines">@@ -4931,71 +4954,15 @@
</span><span class="cx"> return m_out.booleanFalse;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue lowDouble(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</del><ins>+ LValue lowDouble(Edge edge)
</ins><span class="cx"> {
</span><del>- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || isDouble(edge.useKind()));
</del><ins>+ RELEASE_ASSERT(isDouble(edge.useKind()));
</ins><span class="cx">
</span><del>- if (edge->hasConstant()) {
- JSValue value = m_graph.valueOfJSConstant(edge.node());
- if (!value.isNumber()) {
- terminate(Uncountable);
- return m_out.doubleZero;
- }
- return m_out.constDouble(value.asNumber());
- }
-
</del><span class="cx"> LoweredNodeValue value = m_doubleValues.get(edge.node());
</span><span class="cx"> if (isValid(value))
</span><span class="cx"> return value.value();
</span><span class="cx">
</span><del>- value = m_int32Values.get(edge.node());
- if (isValid(value)) {
- LValue result = m_out.intToDouble(value.value());
- setDouble(edge.node(), result);
- return result;
- }
-
- value = m_strictInt52Values.get(edge.node());
- if (isValid(value))
- return strictInt52ToDouble(edge, value.value());
-
- value = m_int52Values.get(edge.node());
- if (isValid(value))
- return strictInt52ToDouble(edge, int52ToStrictInt52(value.value()));
-
- value = m_jsValueValues.get(edge.node());
- if (isValid(value)) {
- LValue boxedResult = value.value();
-
- LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("Double unboxing int case"));
- LBasicBlock doubleCase = FTL_NEW_BLOCK(m_out, ("Double unboxing double case"));
- LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Double unboxing continuation"));
-
- m_out.branch(isNotInt32(boxedResult), unsure(doubleCase), unsure(intCase));
-
- LBasicBlock lastNext = m_out.appendTo(intCase, doubleCase);
-
- ValueFromBlock intToDouble = m_out.anchor(
- m_out.intToDouble(unboxInt32(boxedResult)));
- m_out.jump(continuation);
-
- m_out.appendTo(doubleCase, continuation);
-
- FTL_TYPE_CHECK(
- jsValueValue(boxedResult), edge, SpecFullNumber, isCellOrMisc(boxedResult));
-
- ValueFromBlock unboxedDouble = m_out.anchor(unboxDouble(boxedResult));
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
-
- LValue result = m_out.phi(m_out.doubleType, intToDouble, unboxedDouble);
-
- setDouble(edge.node(), result);
- return result;
- }
-
- RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecFullNumber));
</del><ins>+ RELEASE_ASSERT(!m_state.forNode(edge).m_type);
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.doubleZero;
</span><span class="cx"> }
</span><span class="lines">@@ -5003,6 +4970,8 @@
</span><span class="cx"> LValue lowJSValue(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</span><span class="cx"> {
</span><span class="cx"> ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);
</span><ins>+ RELEASE_ASSERT(!isDouble(edge.useKind()));
+ RELEASE_ASSERT(edge.useKind() != Int52RepUse);
</ins><span class="cx">
</span><span class="cx"> if (edge->hasConstant())
</span><span class="cx"> return m_out.constInt64(JSValue::encode(m_graph.valueOfJSConstant(edge.node())));
</span><span class="lines">@@ -5018,14 +4987,6 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- value = m_strictInt52Values.get(edge.node());
- if (isValid(value))
- return strictInt52ToJSValue(value.value());
-
- value = m_int52Values.get(edge.node());
- if (isValid(value))
- return strictInt52ToJSValue(int52ToStrictInt52(value.value()));
-
</del><span class="cx"> value = m_booleanValues.get(edge.node());
</span><span class="cx"> if (isValid(value)) {
</span><span class="cx"> LValue result = boxBoolean(value.value());
</span><span class="lines">@@ -5033,13 +4994,6 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- value = m_doubleValues.get(edge.node());
- if (isValid(value)) {
- LValue result = boxDouble(value.value());
- setJSValue(edge.node(), result);
- return result;
- }
-
</del><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="lines">@@ -5065,11 +5019,9 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue strictInt52ToDouble(Edge edge, LValue value)
</del><ins>+ LValue strictInt52ToDouble(LValue value)
</ins><span class="cx"> {
</span><del>- LValue result = m_out.intToDouble(value);
- setDouble(edge.node(), result);
- return result;
</del><ins>+ return m_out.intToDouble(value);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> LValue strictInt52ToJSValue(LValue value)
</span><span class="lines">@@ -5099,23 +5051,6 @@
</span><span class="cx"> return m_out.phi(m_out.int64, results);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue setInt52WithStrictValue(Node* node, LValue value, Int52Kind kind)
- {
- switch (kind) {
- case StrictInt52:
- setStrictInt52(node, value);
- return value;
-
- case Int52:
- value = strictInt52ToInt52(value);
- setInt52(node, value);
- return value;
- }
-
- RELEASE_ASSERT_NOT_REACHED();
- return 0;
- }
-
</del><span class="cx"> LValue strictInt52ToInt52(LValue value)
</span><span class="cx"> {
</span><span class="cx"> return m_out.shl(value, m_out.constInt64(JSValue::int52ShiftAmount));
</span><span class="lines">@@ -5147,6 +5082,7 @@
</span><span class="cx"> {
</span><span class="cx"> return m_out.testNonZero64(jsValue, m_tagTypeNumber);
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> LValue unboxDouble(LValue jsValue)
</span><span class="cx"> {
</span><span class="cx"> return m_out.bitCast(m_out.add(jsValue, m_tagTypeNumber), m_out.doubleType);
</span><span class="lines">@@ -5155,6 +5091,39 @@
</span><span class="cx"> {
</span><span class="cx"> return m_out.sub(m_out.bitCast(doubleValue, m_out.int64), m_tagTypeNumber);
</span><span class="cx"> }
</span><ins>+ LValue jsValueToDouble(Edge edge, LValue boxedValue)
+ {
+ LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("DoubleRep unboxing int case"));
+ LBasicBlock doubleCase = FTL_NEW_BLOCK(m_out, ("DoubleRep unboxing double case"));
+ LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("DoubleRep unboxing continuation"));
+
+ LValue isNotInt32;
+ if (!m_interpreter.needsTypeCheck(edge, SpecInt32))
+ isNotInt32 = m_out.booleanFalse;
+ else if (!m_interpreter.needsTypeCheck(edge, ~SpecInt32))
+ isNotInt32 = m_out.booleanTrue;
+ else
+ isNotInt32 = this->isNotInt32(boxedValue);
+ m_out.branch(isNotInt32, unsure(doubleCase), unsure(intCase));
+
+ LBasicBlock lastNext = m_out.appendTo(intCase, doubleCase);
+
+ ValueFromBlock intToDouble = m_out.anchor(
+ m_out.intToDouble(unboxInt32(boxedValue)));
+ m_out.jump(continuation);
+
+ m_out.appendTo(doubleCase, continuation);
+
+ FTL_TYPE_CHECK(
+ jsValueValue(boxedValue), edge, SpecBytecodeNumber, isCellOrMisc(boxedValue));
+
+ ValueFromBlock unboxedDouble = m_out.anchor(unboxDouble(boxedValue));
+ m_out.jump(continuation);
+
+ m_out.appendTo(continuation, lastNext);
+
+ return m_out.phi(m_out.doubleType, intToDouble, unboxedDouble);
+ }
</ins><span class="cx">
</span><span class="cx"> LValue isNumber(LValue jsValue)
</span><span class="cx"> {
</span><span class="lines">@@ -5226,8 +5195,9 @@
</span><span class="cx"> case UntypedUse:
</span><span class="cx"> break;
</span><span class="cx"> case KnownInt32Use:
</span><del>- case KnownNumberUse:
</del><span class="cx"> case KnownStringUse:
</span><ins>+ case DoubleRepUse:
+ case Int52RepUse:
</ins><span class="cx"> ASSERT(!m_interpreter.needsTypeCheck(edge));
</span><span class="cx"> break;
</span><span class="cx"> case Int32Use:
</span><span class="lines">@@ -5260,14 +5230,11 @@
</span><span class="cx"> case StringOrStringObjectUse:
</span><span class="cx"> speculateStringOrStringObject(edge);
</span><span class="cx"> break;
</span><del>- case RealNumberUse:
- speculateRealNumber(edge);
- break;
</del><span class="cx"> case NumberUse:
</span><span class="cx"> speculateNumber(edge);
</span><span class="cx"> break;
</span><del>- case MachineIntUse:
- speculateMachineInt(edge);
</del><ins>+ case DoubleRepRealUse:
+ speculateDoubleReal(edge);
</ins><span class="cx"> break;
</span><span class="cx"> case BooleanUse:
</span><span class="cx"> speculateBoolean(edge);
</span><span class="lines">@@ -5529,14 +5496,11 @@
</span><span class="cx">
</span><span class="cx"> void speculateNumber(Edge edge)
</span><span class="cx"> {
</span><del>- // Do an early return here because lowDouble() can create a lot of control flow.
- if (!m_interpreter.needsTypeCheck(edge))
- return;
-
- lowDouble(edge);
</del><ins>+ LValue value = lowJSValue(edge, ManualOperandSpeculation);
+ FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isNotNumber(value));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void speculateRealNumber(Edge edge)
</del><ins>+ void speculateDoubleReal(Edge edge)
</ins><span class="cx"> {
</span><span class="cx"> // Do an early return here because lowDouble() can create a lot of control flow.
</span><span class="cx"> if (!m_interpreter.needsTypeCheck(edge))
</span><span class="lines">@@ -5544,19 +5508,10 @@
</span><span class="cx">
</span><span class="cx"> LValue value = lowDouble(edge);
</span><span class="cx"> FTL_TYPE_CHECK(
</span><del>- doubleValue(value), edge, SpecFullRealNumber,
</del><ins>+ doubleValue(value), edge, SpecDoubleReal,
</ins><span class="cx"> m_out.doubleNotEqualOrUnordered(value, value));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void speculateMachineInt(Edge edge)
- {
- if (!m_interpreter.needsTypeCheck(edge))
- return;
-
- Int52Kind kind;
- lowWhicheverInt52(edge, kind);
- }
-
</del><span class="cx"> void speculateBoolean(Edge edge)
</span><span class="cx"> {
</span><span class="cx"> lowBoolean(edge);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLValueFormatcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLValueFormat.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLValueFormat.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/ftl/FTLValueFormat.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -71,6 +71,7 @@
</span><span class="cx"> case ValueFormatDouble: {
</span><span class="cx"> jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch1);
</span><span class="cx"> jit.move64ToDouble(value, FPRInfo::fpRegT0);
</span><ins>+ jit.sanitizeDouble(FPRInfo::fpRegT0);
</ins><span class="cx"> jit.boxDouble(FPRInfo::fpRegT0, value);
</span><span class="cx"> jit.move64ToDouble(scratch1, FPRInfo::fpRegT0);
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelperscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -54,6 +54,14 @@
</span><span class="cx"> return result.iterator->value;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void AssemblyHelpers::sanitizeDouble(FPRReg fpr)
+{
+ MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);
+ static const double NaN = QNaN;
+ loadDouble(&NaN, fpr);
+ notNaN.link(this);
+}
+
</ins><span class="cx"> #if ENABLE(SAMPLING_FLAGS)
</span><span class="cx"> void AssemblyHelpers::setSamplingFlag(int32_t flag)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h (167324 => 167325)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h 2014-04-15 20:23:39 UTC (rev 167324)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h 2014-04-15 20:26:16 UTC (rev 167325)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -417,6 +417,8 @@
</span><span class="cx"> void jitAssertTagsInPlace() { }
</span><span class="cx"> void jitAssertArgumentCountSane() { }
</span><span class="cx"> #endif
</span><ins>+
+ void sanitizeDouble(FPRReg);
</ins><span class="cx">
</span><span class="cx"> // These methods convert between doubles, and doubles boxed and JSValues.
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="lines">@@ -435,6 +437,11 @@
</span><span class="cx"> return fpr;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void boxDouble(FPRReg fpr, JSValueRegs regs)
+ {
+ boxDouble(fpr, regs.gpr());
+ }
+
</ins><span class="cx"> // Here are possible arrangements of source, target, scratch:
</span><span class="cx"> // - source, target, scratch can all be separate registers.
</span><span class="cx"> // - source and target can be the same but scratch is separate.
</span><span class="lines">@@ -467,6 +474,11 @@
</span><span class="cx"> {
</span><span class="cx"> moveIntsToDouble(payloadGPR, tagGPR, fpr, scratchFPR);
</span><span class="cx"> }
</span><ins>+
+ void boxDouble(FPRReg fpr, JSValueRegs regs)
+ {
+ boxDouble(fpr, regs.tagGPR(), regs.payloadGPR());
+ }
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> enum ExceptionCheckKind { NormalExceptionCheck, InvertedExceptionCheck };
</span></span></pre>
</div>
</div>
</body>
</html>