<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[167600] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/167600">167600</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-04-21 11:43:01 -0700 (Mon, 21 Apr 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Take block execution count estimates into account when voting double
https://bugs.webkit.org/show_bug.cgi?id=131906
Reviewed by Geoffrey Garen.
This was a drama in three acts.
Act I: Slurp in BasicBlock::executionCount and use it as a weight when counting the
number of uses of a variable that want double or non-double. Easy as pie. This
gave me a huge speed-up on FloatMM and a huge slow-down on basically everything
else.
Act II: Realize that there were some programs where our previous double voting was
just on the edge of disaster and making it more precise tipped it over. In
particular, if you had an integer variable that would infrequently be used in a
computation that resulted in a variable that was frequently used as an array index,
the outer infrequentness would be the thing we'd use in the vote. So, an array
index would become double. We fix this by reviving global backwards propagation
and introducing the concept of ReallyWantsInt, which is used just for array
indices. Any variable transitively flagged as ReallyWantsInt will never be forced
double. We need that flag to be separate from UsedAsInt, since UsedAsInt needs to
be set in bitops for RageConversion but using it for double forcing is too much.
Basically, it's cheaper to have to convert a double to an int for a bitop than it
is to convert a double to an int for an array index; also a variable being used as
an array index is a much stronger hint that it ought to be an int. This recovered
performance on everything except programs that used FTL OSR entry.
Act III: Realize that OSR entrypoint creation creates blocks that have NaN execution
count, which then completely pollutes the weighting - essentially all votes go
NaN. Fix this with some surgical defenses. Basically, any client of execution
counts should allow for them to be NaN and shouldn't completely fall off a cliff
when it happens.
This is awesome. 75% speed-up on FloatMM. 11% speed-up on audio-dft. This leads to
7% speed-up on AsmBench and 2% speed-up on Kraken.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::run):
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dumpBlockHeader):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::voteNode):
(JSC::DFG::Graph::voteChildren):
* dfg/DFGNodeFlags.cpp:
(JSC::DFG::dumpNodeFlags):
* dfg/DFGNodeFlags.h:
* dfg/DFGOSREntrypointCreationPhase.cpp:
(JSC::DFG::OSREntrypointCreationPhase::run):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
(JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
* dfg/DFGVariableAccessData.cpp: Added.
(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsCaptured):
(JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
(JSC::DFG::VariableAccessData::predict):
(JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
(JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
(JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
(JSC::DFG::VariableAccessData::mergeDoubleFormatState):
(JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
(JSC::DFG::VariableAccessData::flushFormat):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::vote):
(JSC::DFG::VariableAccessData::VariableAccessData): Deleted.
(JSC::DFG::VariableAccessData::mergeIsCaptured): Deleted.
(JSC::DFG::VariableAccessData::mergeShouldNeverUnbox): Deleted.
(JSC::DFG::VariableAccessData::predict): Deleted.
(JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction): Deleted.
(JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): Deleted.
(JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat): Deleted.
(JSC::DFG::VariableAccessData::mergeDoubleFormatState): Deleted.
(JSC::DFG::VariableAccessData::makePredictionForDoubleFormat): Deleted.
(JSC::DFG::VariableAccessData::flushFormat): Deleted.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBackwardsPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeFlagscpp">trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeFlagsh">trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSREntrypointCreationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGVariableAccessDatah">trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGVariableAccessDatacpp">trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -197,6 +197,7 @@
</span><span class="cx"> dfg/DFGUseKind.cpp
</span><span class="cx"> dfg/DFGValidate.cpp
</span><span class="cx"> dfg/DFGValueSource.cpp
</span><ins>+ dfg/DFGVariableAccessData.cpp
</ins><span class="cx"> dfg/DFGVariableAccessDataDump.cpp
</span><span class="cx"> dfg/DFGVariableEvent.cpp
</span><span class="cx"> dfg/DFGVariableEventStream.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -1,3 +1,86 @@
</span><ins>+2014-04-19 Filip Pizlo <fpizlo@apple.com>
+
+ Take block execution count estimates into account when voting double
+ https://bugs.webkit.org/show_bug.cgi?id=131906
+
+ Reviewed by Geoffrey Garen.
+
+ This was a drama in three acts.
+
+ Act I: Slurp in BasicBlock::executionCount and use it as a weight when counting the
+ number of uses of a variable that want double or non-double. Easy as pie. This
+ gave me a huge speed-up on FloatMM and a huge slow-down on basically everything
+ else.
+
+ Act II: Realize that there were some programs where our previous double voting was
+ just on the edge of disaster and making it more precise tipped it over. In
+ particular, if you had an integer variable that would infrequently be used in a
+ computation that resulted in a variable that was frequently used as an array index,
+ the outer infrequentness would be the thing we'd use in the vote. So, an array
+ index would become double. We fix this by reviving global backwards propagation
+ and introducing the concept of ReallyWantsInt, which is used just for array
+ indices. Any variable transitively flagged as ReallyWantsInt will never be forced
+ double. We need that flag to be separate from UsedAsInt, since UsedAsInt needs to
+ be set in bitops for RageConversion but using it for double forcing is too much.
+ Basically, it's cheaper to have to convert a double to an int for a bitop than it
+ is to convert a double to an int for an array index; also a variable being used as
+ an array index is a much stronger hint that it ought to be an int. This recovered
+ performance on everything except programs that used FTL OSR entry.
+
+ Act III: Realize that OSR entrypoint creation creates blocks that have NaN execution
+ count, which then completely pollutes the weighting - essentially all votes go
+ NaN. Fix this with some surgical defenses. Basically, any client of execution
+ counts should allow for them to be NaN and shouldn't completely fall off a cliff
+ when it happens.
+
+ This is awesome. 75% speed-up on FloatMM. 11% speed-up on audio-dft. This leads to
+ 7% speed-up on AsmBench and 2% speed-up on Kraken.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * dfg/DFGBackwardsPropagationPhase.cpp:
+ (JSC::DFG::BackwardsPropagationPhase::run):
+ (JSC::DFG::BackwardsPropagationPhase::propagate):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::dumpBlockHeader):
+ * dfg/DFGGraph.h:
+ (JSC::DFG::Graph::voteNode):
+ (JSC::DFG::Graph::voteChildren):
+ * dfg/DFGNodeFlags.cpp:
+ (JSC::DFG::dumpNodeFlags):
+ * dfg/DFGNodeFlags.h:
+ * dfg/DFGOSREntrypointCreationPhase.cpp:
+ (JSC::DFG::OSREntrypointCreationPhase::run):
+ * dfg/DFGPlan.cpp:
+ (JSC::DFG::Plan::compileInThreadImpl):
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+ (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+ * dfg/DFGVariableAccessData.cpp: Added.
+ (JSC::DFG::VariableAccessData::VariableAccessData):
+ (JSC::DFG::VariableAccessData::mergeIsCaptured):
+ (JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
+ (JSC::DFG::VariableAccessData::predict):
+ (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
+ (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+ (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+ (JSC::DFG::VariableAccessData::mergeDoubleFormatState):
+ (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
+ (JSC::DFG::VariableAccessData::flushFormat):
+ * dfg/DFGVariableAccessData.h:
+ (JSC::DFG::VariableAccessData::vote):
+ (JSC::DFG::VariableAccessData::VariableAccessData): Deleted.
+ (JSC::DFG::VariableAccessData::mergeIsCaptured): Deleted.
+ (JSC::DFG::VariableAccessData::mergeShouldNeverUnbox): Deleted.
+ (JSC::DFG::VariableAccessData::predict): Deleted.
+ (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction): Deleted.
+ (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): Deleted.
+ (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat): Deleted.
+ (JSC::DFG::VariableAccessData::mergeDoubleFormatState): Deleted.
+ (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat): Deleted.
+ (JSC::DFG::VariableAccessData::flushFormat): Deleted.
+
</ins><span class="cx"> 2014-04-21 Michael Saboff <msaboff@apple.com>
</span><span class="cx">
</span><span class="cx"> REGRESSION(r167591): ARM64 and ARM traditional builds broken
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -450,6 +450,7 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGUseKind.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGValidate.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGValueSource.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGVariableAccessData.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGVariableAccessDataDump.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGVariableEvent.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGVariableEventStream.cpp" />
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -325,6 +325,7 @@
</span><span class="cx"> 0F6B1CC61862C47800845D97 /* FTLUnwindInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B1CC21862C47800845D97 /* FTLUnwindInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F6B1CC918641DF800845D97 /* ArityCheckFailReturnThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6B1CC718641DF800845D97 /* ArityCheckFailReturnThunks.cpp */; };
</span><span class="cx"> 0F6B1CCA18641DF800845D97 /* ArityCheckFailReturnThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B1CC818641DF800845D97 /* ArityCheckFailReturnThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0F6E845A19030BEF00562741 /* DFGVariableAccessData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6E845919030BEF00562741 /* DFGVariableAccessData.cpp */; };
</ins><span class="cx"> 0F7025A91714B0FA00382C0E /* DFGOSRExitCompilerCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */; };
</span><span class="cx"> 0F7025AA1714B0FC00382C0E /* DFGOSRExitCompilerCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */; };
</span><span class="lines">@@ -2127,6 +2128,7 @@
</span><span class="cx"> 0F6B1CC21862C47800845D97 /* FTLUnwindInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLUnwindInfo.h; path = ftl/FTLUnwindInfo.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F6B1CC718641DF800845D97 /* ArityCheckFailReturnThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArityCheckFailReturnThunks.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F6B1CC818641DF800845D97 /* ArityCheckFailReturnThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArityCheckFailReturnThunks.h; sourceTree = "<group>"; };
</span><ins>+ 0F6E845919030BEF00562741 /* DFGVariableAccessData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableAccessData.cpp; path = dfg/DFGVariableAccessData.cpp; sourceTree = "<group>"; };
</ins><span class="cx"> 0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompilerCommon.cpp; path = dfg/DFGOSRExitCompilerCommon.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompilerCommon.h; path = dfg/DFGOSRExitCompilerCommon.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBackwardsPropagationPhase.cpp; path = dfg/DFGBackwardsPropagationPhase.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4810,6 +4812,7 @@
</span><span class="cx"> 0F2BDC3F1522801700CD8910 /* DFGValueRecoveryOverride.h */,
</span><span class="cx"> 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */,
</span><span class="cx"> 0F2BDC401522801700CD8910 /* DFGValueSource.h */,
</span><ins>+ 0F6E845919030BEF00562741 /* DFGVariableAccessData.cpp */,
</ins><span class="cx"> 0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */,
</span><span class="cx"> 0FDDBFB21666EED500C55FEF /* DFGVariableAccessDataDump.cpp */,
</span><span class="cx"> 0FDDBFB31666EED500C55FEF /* DFGVariableAccessDataDump.h */,
</span><span class="lines">@@ -7088,6 +7091,7 @@
</span><span class="cx"> 0FB14E1E18124ACE009B6B4D /* JITInlineCacheGenerator.cpp in Sources */,
</span><span class="cx"> BCDD51EB0FB8DF74004A8BDC /* JITOpcodes.cpp in Sources */,
</span><span class="cx"> A71236E51195F33C00BD2174 /* JITOpcodes32_64.cpp in Sources */,
</span><ins>+ 0F6E845A19030BEF00562741 /* DFGVariableAccessData.cpp in Sources */,
</ins><span class="cx"> 0F24E54C17EE274900ABB217 /* JITOperations.cpp in Sources */,
</span><span class="cx"> 86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */,
</span><span class="cx"> A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBackwardsPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -44,17 +44,21 @@
</span><span class="cx">
</span><span class="cx"> bool run()
</span><span class="cx"> {
</span><del>- for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
- BasicBlock* block = m_graph.block(blockIndex);
- if (!block)
- continue;
</del><ins>+ m_changed = true;
+ while (m_changed) {
+ m_changed = false;
+ for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+ BasicBlock* block = m_graph.block(blockIndex);
+ if (!block)
+ continue;
</ins><span class="cx">
</span><del>- // Prevent a tower of overflowing additions from creating a value that is out of the
- // safe 2^48 range.
- m_allowNestedOverflowingAdditions = block->size() < (1 << 16);
</del><ins>+ // Prevent a tower of overflowing additions from creating a value that is out of the
+ // safe 2^48 range.
+ m_allowNestedOverflowingAdditions = block->size() < (1 << 16);
</ins><span class="cx">
</span><del>- for (unsigned indexInBlock = block->size(); indexInBlock--;)
- propagate(block->at(indexInBlock));
</del><ins>+ for (unsigned indexInBlock = block->size(); indexInBlock--;)
+ propagate(block->at(indexInBlock));
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return true;
</span><span class="lines">@@ -174,7 +178,8 @@
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case GetLocal: {
</span><span class="cx"> VariableAccessData* variableAccessData = node->variableAccessData();
</span><del>- variableAccessData->mergeFlags(flags);
</del><ins>+ flags &= ~NodeBytecodeUsesAsInt; // We don't care about cross-block uses-as-int.
+ m_changed |= variableAccessData->mergeFlags(flags);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -182,10 +187,19 @@
</span><span class="cx"> VariableAccessData* variableAccessData = node->variableAccessData();
</span><span class="cx"> if (!variableAccessData->isLoadedFrom())
</span><span class="cx"> break;
</span><del>- node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
</del><ins>+ flags = variableAccessData->flags();
+ RELEASE_ASSERT(!(flags & ~NodeBytecodeBackPropMask));
+ flags |= NodeBytecodeUsesAsNumber; // Account for the fact that control flow may cause overflows that our modeling can't handle.
+ node->child1()->mergeFlags(flags);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case Flush: {
+ VariableAccessData* variableAccessData = node->variableAccessData();
+ m_changed |= variableAccessData->mergeFlags(NodeBytecodeUsesAsValue);
+ break;
+ }
+
</ins><span class="cx"> case MovHint:
</span><span class="cx"> case Check:
</span><span class="cx"> break;
</span><span class="lines">@@ -199,6 +213,7 @@
</span><span class="cx"> case ArithIMul: {
</span><span class="cx"> flags |= NodeBytecodeUsesAsInt;
</span><span class="cx"> flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther);
</span><ins>+ flags &= ~NodeBytecodeUsesAsArrayIndex;
</ins><span class="cx"> node->child1()->mergeFlags(flags);
</span><span class="cx"> node->child2()->mergeFlags(flags);
</span><span class="cx"> break;
</span><span class="lines">@@ -206,7 +221,7 @@
</span><span class="cx">
</span><span class="cx"> case StringCharCodeAt: {
</span><span class="cx"> node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
</span><del>- node->child2()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt);
</del><ins>+ node->child2()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -305,17 +320,17 @@
</span><span class="cx">
</span><span class="cx"> case GetByVal: {
</span><span class="cx"> node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
</span><del>- node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt);
</del><ins>+ node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case GetMyArgumentByValSafe: {
</span><del>- node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt);
</del><ins>+ node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case NewArrayWithSize: {
</span><del>- node->child1()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt);
</del><ins>+ node->child1()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -323,13 +338,13 @@
</span><span class="cx"> // Negative zero is not observable. NaN versus undefined are only observable
</span><span class="cx"> // in that you would get a different exception message. So, like, whatever: we
</span><span class="cx"> // claim here that NaN v. undefined is observable.
</span><del>- node->child1()->mergeFlags(NodeBytecodeUsesAsInt | NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther);
</del><ins>+ node->child1()->mergeFlags(NodeBytecodeUsesAsInt | NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case StringCharAt: {
</span><span class="cx"> node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
</span><del>- node->child2()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt);
</del><ins>+ node->child2()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -346,7 +361,7 @@
</span><span class="cx"> case PutByValDirect:
</span><span class="cx"> case PutByVal: {
</span><span class="cx"> m_graph.varArgChild(node, 0)->mergeFlags(NodeBytecodeUsesAsValue);
</span><del>- m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt);
</del><ins>+ m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
</ins><span class="cx"> m_graph.varArgChild(node, 2)->mergeFlags(NodeBytecodeUsesAsValue);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -396,6 +411,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool m_allowNestedOverflowingAdditions;
</span><ins>+ bool m_changed;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> bool performBackwardsPropagation(Graph& graph)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -357,6 +357,8 @@
</span><span class="cx"> void Graph::dumpBlockHeader(PrintStream& out, const char* prefix, BasicBlock* block, PhiNodeDumpMode phiNodeDumpMode, DumpContext* context)
</span><span class="cx"> {
</span><span class="cx"> out.print(prefix, "Block ", *block, " (", inContext(block->at(0)->origin.semantic, context), "): ", block->isReachable ? "" : "(skipped)", block->isOSRTarget ? " (OSR target)" : "", "\n");
</span><ins>+ if (block->executionCount == block->executionCount)
+ out.print(prefix, " Execution count: ", block->executionCount, "\n");
</ins><span class="cx"> out.print(prefix, " Predecessors:");
</span><span class="cx"> for (size_t i = 0; i < block->predecessors.size(); ++i)
</span><span class="cx"> out.print(" ", *block->predecessors[i]);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -701,7 +701,7 @@
</span><span class="cx"> return node->children.child(index);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void voteNode(Node* node, unsigned ballot)
</del><ins>+ void voteNode(Node* node, unsigned ballot, float weight = 1)
</ins><span class="cx"> {
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case ValueToInt32:
</span><span class="lines">@@ -713,35 +713,35 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (node->op() == GetLocal)
</span><del>- node->variableAccessData()->vote(ballot);
</del><ins>+ node->variableAccessData()->vote(ballot, weight);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void voteNode(Edge edge, unsigned ballot)
</del><ins>+ void voteNode(Edge edge, unsigned ballot, float weight = 1)
</ins><span class="cx"> {
</span><del>- voteNode(edge.node(), ballot);
</del><ins>+ voteNode(edge.node(), ballot, weight);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void voteChildren(Node* node, unsigned ballot)
</del><ins>+ void voteChildren(Node* node, unsigned ballot, float weight = 1)
</ins><span class="cx"> {
</span><span class="cx"> if (node->flags() & NodeHasVarArgs) {
</span><span class="cx"> for (unsigned childIdx = node->firstChild();
</span><span class="cx"> childIdx < node->firstChild() + node->numChildren();
</span><span class="cx"> childIdx++) {
</span><span class="cx"> if (!!m_varArgChildren[childIdx])
</span><del>- voteNode(m_varArgChildren[childIdx], ballot);
</del><ins>+ voteNode(m_varArgChildren[childIdx], ballot, weight);
</ins><span class="cx"> }
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (!node->child1())
</span><span class="cx"> return;
</span><del>- voteNode(node->child1(), ballot);
</del><ins>+ voteNode(node->child1(), ballot, weight);
</ins><span class="cx"> if (!node->child2())
</span><span class="cx"> return;
</span><del>- voteNode(node->child2(), ballot);
</del><ins>+ voteNode(node->child2(), ballot, weight);
</ins><span class="cx"> if (!node->child3())
</span><span class="cx"> return;
</span><del>- voteNode(node->child3(), ballot);
</del><ins>+ voteNode(node->child3(), ballot, weight);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename T> // T = Node* or Edge
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeFlagscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -99,6 +99,9 @@
</span><span class="cx">
</span><span class="cx"> if (flags & NodeBytecodeUsesAsInt)
</span><span class="cx"> out.print(comma, "UseAsInt");
</span><ins>+
+ if (flags & NodeBytecodeUsesAsArrayIndex)
+ out.print(comma, "ReallyWantsInt");
</ins><span class="cx">
</span><span class="cx"> if (!(flags & NodeDoesNotExit))
</span><span class="cx"> out.print(comma, "CanExit");
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeFlagsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -53,21 +53,22 @@
</span><span class="cx"> #define NodeMayOverflow 0x0080
</span><span class="cx"> #define NodeMayNegZero 0x0100
</span><span class="cx">
</span><del>-#define NodeBytecodeBackPropMask 0x1E00
</del><ins>+#define NodeBytecodeBackPropMask 0x3E00
</ins><span class="cx"> #define NodeBytecodeUseBottom 0x0000
</span><span class="cx"> #define NodeBytecodeUsesAsNumber 0x0200 // The result of this computation may be used in a context that observes fractional, or bigger-than-int32, results.
</span><span class="cx"> #define NodeBytecodeNeedsNegZero 0x0400 // The result of this computation may be used in a context that observes -0.
</span><span class="cx"> #define NodeBytecodeUsesAsOther 0x0800 // The result of this computation may be used in a context that distinguishes between NaN and other things (like undefined).
</span><span class="cx"> #define NodeBytecodeUsesAsValue (NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther)
</span><span class="cx"> #define NodeBytecodeUsesAsInt 0x1000 // The result of this computation is known to be used in a context that prefers, but does not require, integer values.
</span><ins>+#define NodeBytecodeUsesAsArrayIndex 0x2000 // The result of this computation is known to be used in a context that strongly prefers integer values, to the point that we should avoid using doubles if at all possible.
</ins><span class="cx">
</span><span class="cx"> #define NodeArithFlagsMask (NodeBehaviorMask | NodeBytecodeBackPropMask)
</span><span class="cx">
</span><del>-#define NodeDoesNotExit 0x2000 // This flag is negated to make it natural for the default to be that a node does exit.
</del><ins>+#define NodeDoesNotExit 0x4000 // This flag is negated to make it natural for the default to be that a node does exit.
</ins><span class="cx">
</span><del>-#define NodeRelevantToOSR 0x4000
</del><ins>+#define NodeRelevantToOSR 0x8000
</ins><span class="cx">
</span><del>-#define NodeIsFlushed 0x8000 // Used by Graph::computeIsFlushed(), will tell you which local nodes are backwards-reachable from a Flush.
</del><ins>+#define NodeIsFlushed 0x10000 // Used by Graph::computeIsFlushed(), will tell you which local nodes are backwards-reachable from a Flush.
</ins><span class="cx">
</span><span class="cx"> typedef uint32_t NodeFlags;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSREntrypointCreationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -83,7 +83,12 @@
</span><span class="cx">
</span><span class="cx"> BlockInsertionSet insertionSet(m_graph);
</span><span class="cx">
</span><del>- BasicBlock* newRoot = insertionSet.insert(0, PNaN);
</del><ins>+ // We say that the execution count of the entry block is 1, because we know for sure
+ // that this must be the case. Under our definition of executionCount, "1" means "once
+ // per invocation". We could have said NaN here, since that would ask any clients of
+ // executionCount to use best judgement - but that seems unnecessary since we know for
+ // sure what the executionCount should be in this case.
+ BasicBlock* newRoot = insertionSet.insert(0, 1);
</ins><span class="cx"> NodeOrigin origin = target->at(0)->origin;
</span><span class="cx">
</span><span class="cx"> Vector<Node*> locals(baseline->m_numCalleeRegisters);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -209,8 +209,7 @@
</span><span class="cx"> performUnification(dfg);
</span><span class="cx"> performPredictionInjection(dfg);
</span><span class="cx">
</span><del>- if (isFTL(mode))
- performStaticExecutionCountEstimation(dfg);
</del><ins>+ performStaticExecutionCountEstimation(dfg);
</ins><span class="cx">
</span><span class="cx"> if (mode == FTLForOSREntryMode) {
</span><span class="cx"> bool result = performOSREntrypointCreation(dfg);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -641,8 +641,14 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void doDoubleVoting(Node* node)
</del><ins>+ void doDoubleVoting(Node* node, float weight)
</ins><span class="cx"> {
</span><ins>+ // Loop pre-headers created by OSR entrypoint creation may have NaN weight to indicate
+ // that we actually don't know they weight. Assume that they execute once. This turns
+ // out to be an OK assumption since the pre-header doesn't have any meaningful code.
+ if (weight != weight)
+ weight = 1;
+
</ins><span class="cx"> switch (node->op()) {
</span><span class="cx"> case ValueAdd:
</span><span class="cx"> case ArithAdd:
</span><span class="lines">@@ -659,8 +665,8 @@
</span><span class="cx"> else
</span><span class="cx"> ballot = VoteValue;
</span><span class="cx">
</span><del>- m_graph.voteNode(node->child1(), ballot);
- m_graph.voteNode(node->child2(), ballot);
</del><ins>+ m_graph.voteNode(node->child1(), ballot, weight);
+ m_graph.voteNode(node->child2(), ballot, weight);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -677,8 +683,8 @@
</span><span class="cx"> else
</span><span class="cx"> ballot = VoteValue;
</span><span class="cx">
</span><del>- m_graph.voteNode(node->child1(), ballot);
- m_graph.voteNode(node->child2(), ballot);
</del><ins>+ m_graph.voteNode(node->child1(), ballot, weight);
+ m_graph.voteNode(node->child2(), ballot, weight);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -697,8 +703,8 @@
</span><span class="cx"> else
</span><span class="cx"> ballot = VoteValue;
</span><span class="cx">
</span><del>- m_graph.voteNode(node->child1(), ballot);
- m_graph.voteNode(node->child2(), ballot);
</del><ins>+ m_graph.voteNode(node->child1(), ballot, weight);
+ m_graph.voteNode(node->child2(), ballot, weight);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -709,23 +715,23 @@
</span><span class="cx"> else
</span><span class="cx"> ballot = VoteValue;
</span><span class="cx">
</span><del>- m_graph.voteNode(node->child1(), ballot);
</del><ins>+ m_graph.voteNode(node->child1(), ballot, weight);
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case ArithSqrt:
</span><span class="cx"> case ArithCos:
</span><span class="cx"> case ArithSin:
</span><del>- m_graph.voteNode(node->child1(), VoteDouble);
</del><ins>+ m_graph.voteNode(node->child1(), VoteDouble, weight);
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case SetLocal: {
</span><span class="cx"> SpeculatedType prediction = node->child1()->prediction();
</span><span class="cx"> if (isDoubleSpeculation(prediction))
</span><del>- node->variableAccessData()->vote(VoteDouble);
</del><ins>+ node->variableAccessData()->vote(VoteDouble, weight);
</ins><span class="cx"> else if (
</span><span class="cx"> !isFullNumberSpeculation(prediction)
</span><span class="cx"> || isInt32Speculation(prediction) || isMachineIntSpeculation(prediction))
</span><del>- node->variableAccessData()->vote(VoteValue);
</del><ins>+ node->variableAccessData()->vote(VoteValue, weight);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -735,14 +741,14 @@
</span><span class="cx"> Edge child1 = m_graph.varArgChild(node, 0);
</span><span class="cx"> Edge child2 = m_graph.varArgChild(node, 1);
</span><span class="cx"> Edge child3 = m_graph.varArgChild(node, 2);
</span><del>- m_graph.voteNode(child1, VoteValue);
- m_graph.voteNode(child2, VoteValue);
</del><ins>+ m_graph.voteNode(child1, VoteValue, weight);
+ m_graph.voteNode(child2, VoteValue, weight);
</ins><span class="cx"> switch (node->arrayMode().type()) {
</span><span class="cx"> case Array::Double:
</span><del>- m_graph.voteNode(child3, VoteDouble);
</del><ins>+ m_graph.voteNode(child3, VoteDouble, weight);
</ins><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- m_graph.voteNode(child3, VoteValue);
</del><ins>+ m_graph.voteNode(child3, VoteValue, weight);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -753,7 +759,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- m_graph.voteChildren(node, VoteValue);
</del><ins>+ m_graph.voteChildren(node, VoteValue, weight);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -769,7 +775,7 @@
</span><span class="cx"> ASSERT(block->isReachable);
</span><span class="cx"> for (unsigned i = 0; i < block->size(); ++i) {
</span><span class="cx"> m_currentNode = block->at(i);
</span><del>- doDoubleVoting(m_currentNode);
</del><ins>+ doDoubleVoting(m_currentNode, block->executionCount);
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGVariableAccessDatacpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp (0 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -0,0 +1,206 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGVariableAccessData.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+VariableAccessData::VariableAccessData()
+ : m_local(static_cast<VirtualRegister>(std::numeric_limits<int>::min()))
+ , m_prediction(SpecNone)
+ , m_argumentAwarePrediction(SpecNone)
+ , m_flags(0)
+ , m_isCaptured(false)
+ , m_shouldNeverUnbox(false)
+ , m_isArgumentsAlias(false)
+ , m_structureCheckHoistingFailed(false)
+ , m_checkArrayHoistingFailed(false)
+ , m_isProfitableToUnbox(false)
+ , m_isLoadedFrom(false)
+ , m_doubleFormatState(EmptyDoubleFormatState)
+{
+ clearVotes();
+}
+
+VariableAccessData::VariableAccessData(VirtualRegister local, bool isCaptured)
+ : m_local(local)
+ , m_prediction(SpecNone)
+ , m_argumentAwarePrediction(SpecNone)
+ , m_flags(0)
+ , m_isCaptured(isCaptured)
+ , m_shouldNeverUnbox(isCaptured)
+ , m_isArgumentsAlias(false)
+ , m_structureCheckHoistingFailed(false)
+ , m_checkArrayHoistingFailed(false)
+ , m_isProfitableToUnbox(false)
+ , m_isLoadedFrom(false)
+ , m_doubleFormatState(EmptyDoubleFormatState)
+{
+ clearVotes();
+}
+
+bool VariableAccessData::mergeIsCaptured(bool isCaptured)
+{
+ return checkAndSet(m_shouldNeverUnbox, m_shouldNeverUnbox | isCaptured)
+ | checkAndSet(m_isCaptured, m_isCaptured | isCaptured);
+}
+
+bool VariableAccessData::mergeShouldNeverUnbox(bool shouldNeverUnbox)
+{
+ bool newShouldNeverUnbox = m_shouldNeverUnbox | shouldNeverUnbox;
+ if (newShouldNeverUnbox == m_shouldNeverUnbox)
+ return false;
+ m_shouldNeverUnbox = newShouldNeverUnbox;
+ return true;
+}
+
+bool VariableAccessData::predict(SpeculatedType prediction)
+{
+ VariableAccessData* self = find();
+ bool result = mergeSpeculation(self->m_prediction, prediction);
+ if (result)
+ mergeSpeculation(m_argumentAwarePrediction, m_prediction);
+ return result;
+}
+
+bool VariableAccessData::mergeArgumentAwarePrediction(SpeculatedType prediction)
+{
+ return mergeSpeculation(find()->m_argumentAwarePrediction, prediction);
+}
+
+bool VariableAccessData::shouldUseDoubleFormatAccordingToVote()
+{
+ // We don't support this facility for arguments, yet.
+ // FIXME: make this work for arguments.
+ if (local().isArgument())
+ return false;
+
+ // If the variable is not a number prediction, then this doesn't
+ // make any sense.
+ if (!isFullNumberSpeculation(prediction())) {
+ // FIXME: we may end up forcing a local in inlined argument position to be a double even
+ // if it is sometimes not even numeric, since this never signals the fact that it doesn't
+ // want doubles. https://bugs.webkit.org/show_bug.cgi?id=109511
+ return false;
+ }
+
+ // If the variable is predicted to hold only doubles, then it's a
+ // no-brainer: it should be formatted as a double.
+ if (isDoubleSpeculation(prediction()))
+ return true;
+
+ // If the variable is known to be used as an integer, then be safe -
+ // don't force it to be a double.
+ if (flags() & NodeBytecodeUsesAsInt)
+ return false;
+
+ // If the variable has been voted to become a double, then make it a
+ // double.
+ if (voteRatio() >= Options::doubleVoteRatioForDoubleFormat())
+ return true;
+
+ return false;
+}
+
+bool VariableAccessData::tallyVotesForShouldUseDoubleFormat()
+{
+ ASSERT(isRoot());
+
+ if (local().isArgument() || shouldNeverUnbox()
+ || (flags() & NodeBytecodeUsesAsArrayIndex))
+ return DFG::mergeDoubleFormatState(m_doubleFormatState, NotUsingDoubleFormat);
+
+ if (m_doubleFormatState == CantUseDoubleFormat)
+ return false;
+
+ bool newValueOfShouldUseDoubleFormat = shouldUseDoubleFormatAccordingToVote();
+ if (!newValueOfShouldUseDoubleFormat) {
+ // We monotonically convert to double. Hence, if the fixpoint leads us to conclude that we should
+ // switch back to int, we instead ignore this and stick with double.
+ return false;
+ }
+
+ if (m_doubleFormatState == UsingDoubleFormat)
+ return false;
+
+ return DFG::mergeDoubleFormatState(m_doubleFormatState, UsingDoubleFormat);
+}
+
+bool VariableAccessData::mergeDoubleFormatState(DoubleFormatState doubleFormatState)
+{
+ return DFG::mergeDoubleFormatState(find()->m_doubleFormatState, doubleFormatState);
+}
+
+bool VariableAccessData::makePredictionForDoubleFormat()
+{
+ ASSERT(isRoot());
+
+ if (m_doubleFormatState != UsingDoubleFormat)
+ return false;
+
+ SpeculatedType type = m_prediction;
+ if (type & ~SpecBytecodeNumber)
+ type |= SpecDoublePureNaN;
+ if (type & SpecMachineInt)
+ type |= SpecInt52AsDouble;
+ return checkAndSet(m_prediction, type);
+}
+
+FlushFormat VariableAccessData::flushFormat()
+{
+ ASSERT(find() == this);
+
+ if (isArgumentsAlias())
+ return FlushedArguments;
+
+ if (!shouldUnboxIfPossible())
+ return FlushedJSValue;
+
+ if (shouldUseDoubleFormat())
+ return FlushedDouble;
+
+ SpeculatedType prediction = argumentAwarePrediction();
+ if (isInt32Speculation(prediction))
+ return FlushedInt32;
+
+ if (enableInt52() && !m_local.isArgument() && isMachineIntSpeculation(prediction))
+ return FlushedInt52;
+
+ if (isCellSpeculation(prediction))
+ return FlushedCell;
+
+ if (isBooleanSpeculation(prediction))
+ return FlushedBoolean;
+
+ return FlushedJSValue;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGVariableAccessDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h (167599 => 167600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h 2014-04-21 18:10:41 UTC (rev 167599)
+++ trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h 2014-04-21 18:43:01 UTC (rev 167600)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011-2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -26,6 +26,8 @@
</span><span class="cx"> #ifndef DFGVariableAccessData_h
</span><span class="cx"> #define DFGVariableAccessData_h
</span><span class="cx">
</span><ins>+#if ENABLE(DFG_JIT)
+
</ins><span class="cx"> #include "DFGCommon.h"
</span><span class="cx"> #include "DFGDoubleFormatState.h"
</span><span class="cx"> #include "DFGFlushFormat.h"
</span><span class="lines">@@ -45,40 +47,9 @@
</span><span class="cx">
</span><span class="cx"> class VariableAccessData : public UnionFind<VariableAccessData> {
</span><span class="cx"> public:
</span><del>- VariableAccessData()
- : m_local(static_cast<VirtualRegister>(std::numeric_limits<int>::min()))
- , m_prediction(SpecNone)
- , m_argumentAwarePrediction(SpecNone)
- , m_flags(0)
- , m_isCaptured(false)
- , m_shouldNeverUnbox(false)
- , m_isArgumentsAlias(false)
- , m_structureCheckHoistingFailed(false)
- , m_checkArrayHoistingFailed(false)
- , m_isProfitableToUnbox(false)
- , m_isLoadedFrom(false)
- , m_doubleFormatState(EmptyDoubleFormatState)
- {
- clearVotes();
- }
</del><ins>+ VariableAccessData();
+ VariableAccessData(VirtualRegister local, bool isCaptured);
</ins><span class="cx">
</span><del>- VariableAccessData(VirtualRegister local, bool isCaptured)
- : m_local(local)
- , m_prediction(SpecNone)
- , m_argumentAwarePrediction(SpecNone)
- , m_flags(0)
- , m_isCaptured(isCaptured)
- , m_shouldNeverUnbox(isCaptured)
- , m_isArgumentsAlias(false)
- , m_structureCheckHoistingFailed(false)
- , m_checkArrayHoistingFailed(false)
- , m_isProfitableToUnbox(false)
- , m_isLoadedFrom(false)
- , m_doubleFormatState(EmptyDoubleFormatState)
- {
- clearVotes();
- }
-
</del><span class="cx"> VirtualRegister local()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_local == find()->m_local);
</span><span class="lines">@@ -91,11 +62,7 @@
</span><span class="cx"> return m_machineLocal;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool mergeIsCaptured(bool isCaptured)
- {
- return checkAndSet(m_shouldNeverUnbox, m_shouldNeverUnbox | isCaptured)
- | checkAndSet(m_isCaptured, m_isCaptured | isCaptured);
- }
</del><ins>+ bool mergeIsCaptured(bool isCaptured);
</ins><span class="cx">
</span><span class="cx"> bool isCaptured()
</span><span class="cx"> {
</span><span class="lines">@@ -112,14 +79,7 @@
</span><span class="cx"> return m_isProfitableToUnbox;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool mergeShouldNeverUnbox(bool shouldNeverUnbox)
- {
- bool newShouldNeverUnbox = m_shouldNeverUnbox | shouldNeverUnbox;
- if (newShouldNeverUnbox == m_shouldNeverUnbox)
- return false;
- m_shouldNeverUnbox = newShouldNeverUnbox;
- return true;
- }
</del><ins>+ bool mergeShouldNeverUnbox(bool shouldNeverUnbox);
</ins><span class="cx">
</span><span class="cx"> // Returns true if it would be unsound to store the value in an unboxed fashion.
</span><span class="cx"> // If this returns false, it simply means that it is sound to unbox; it doesn't
</span><span class="lines">@@ -183,14 +143,7 @@
</span><span class="cx"> return m_isLoadedFrom;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool predict(SpeculatedType prediction)
- {
- VariableAccessData* self = find();
- bool result = mergeSpeculation(self->m_prediction, prediction);
- if (result)
- mergeSpeculation(m_argumentAwarePrediction, m_prediction);
- return result;
- }
</del><ins>+ bool predict(SpeculatedType prediction);
</ins><span class="cx">
</span><span class="cx"> SpeculatedType nonUnifiedPrediction()
</span><span class="cx"> {
</span><span class="lines">@@ -207,10 +160,7 @@
</span><span class="cx"> return find()->m_argumentAwarePrediction;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool mergeArgumentAwarePrediction(SpeculatedType prediction)
- {
- return mergeSpeculation(find()->m_argumentAwarePrediction, prediction);
- }
</del><ins>+ bool mergeArgumentAwarePrediction(SpeculatedType prediction);
</ins><span class="cx">
</span><span class="cx"> void clearVotes()
</span><span class="cx"> {
</span><span class="lines">@@ -219,10 +169,10 @@
</span><span class="cx"> m_votes[1] = 0;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void vote(unsigned ballot)
</del><ins>+ void vote(unsigned ballot, float weight = 1)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(ballot < 2);
</span><del>- m_votes[ballot]++;
</del><ins>+ m_votes[ballot] += weight;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> double voteRatio()
</span><span class="lines">@@ -231,39 +181,7 @@
</span><span class="cx"> return static_cast<double>(m_votes[1]) / m_votes[0];
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool shouldUseDoubleFormatAccordingToVote()
- {
- // We don't support this facility for arguments, yet.
- // FIXME: make this work for arguments.
- if (local().isArgument())
- return false;
-
- // If the variable is not a number prediction, then this doesn't
- // make any sense.
- if (!isFullNumberSpeculation(prediction())) {
- // FIXME: we may end up forcing a local in inlined argument position to be a double even
- // if it is sometimes not even numeric, since this never signals the fact that it doesn't
- // want doubles. https://bugs.webkit.org/show_bug.cgi?id=109511
- return false;
- }
-
- // If the variable is predicted to hold only doubles, then it's a
- // no-brainer: it should be formatted as a double.
- if (isDoubleSpeculation(prediction()))
- return true;
-
- // If the variable is known to be used as an integer, then be safe -
- // don't force it to be a double.
- if (flags() & NodeBytecodeUsesAsInt)
- return false;
-
- // If the variable has been voted to become a double, then make it a
- // double.
- if (voteRatio() >= Options::doubleVoteRatioForDoubleFormat())
- return true;
-
- return false;
- }
</del><ins>+ bool shouldUseDoubleFormatAccordingToVote();
</ins><span class="cx">
</span><span class="cx"> DoubleFormatState doubleFormatState()
</span><span class="cx"> {
</span><span class="lines">@@ -279,48 +197,11 @@
</span><span class="cx"> return doubleState && isProfitableToUnbox();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool tallyVotesForShouldUseDoubleFormat()
- {
- ASSERT(isRoot());
-
- if (local().isArgument() || shouldNeverUnbox())
- return DFG::mergeDoubleFormatState(m_doubleFormatState, NotUsingDoubleFormat);
-
- if (m_doubleFormatState == CantUseDoubleFormat)
- return false;
-
- bool newValueOfShouldUseDoubleFormat = shouldUseDoubleFormatAccordingToVote();
- if (!newValueOfShouldUseDoubleFormat) {
- // We monotonically convert to double. Hence, if the fixpoint leads us to conclude that we should
- // switch back to int, we instead ignore this and stick with double.
- return false;
- }
-
- if (m_doubleFormatState == UsingDoubleFormat)
- return false;
-
- return DFG::mergeDoubleFormatState(m_doubleFormatState, UsingDoubleFormat);
- }
</del><ins>+ bool tallyVotesForShouldUseDoubleFormat();
</ins><span class="cx">
</span><del>- bool mergeDoubleFormatState(DoubleFormatState doubleFormatState)
- {
- return DFG::mergeDoubleFormatState(find()->m_doubleFormatState, doubleFormatState);
- }
</del><ins>+ bool mergeDoubleFormatState(DoubleFormatState);
</ins><span class="cx">
</span><del>- bool makePredictionForDoubleFormat()
- {
- ASSERT(isRoot());
-
- if (m_doubleFormatState != UsingDoubleFormat)
- return false;
-
- SpeculatedType type = m_prediction;
- if (type & ~SpecBytecodeNumber)
- type |= SpecDoublePureNaN;
- if (type & SpecMachineInt)
- type |= SpecInt52AsDouble;
- return checkAndSet(m_prediction, type);
- }
</del><ins>+ bool makePredictionForDoubleFormat();
</ins><span class="cx">
</span><span class="cx"> NodeFlags flags() const { return m_flags; }
</span><span class="cx">
</span><span class="lines">@@ -329,34 +210,7 @@
</span><span class="cx"> return checkAndSet(m_flags, m_flags | newFlags);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- FlushFormat flushFormat()
- {
- ASSERT(find() == this);
-
- if (isArgumentsAlias())
- return FlushedArguments;
-
- if (!shouldUnboxIfPossible())
- return FlushedJSValue;
-
- if (shouldUseDoubleFormat())
- return FlushedDouble;
-
- SpeculatedType prediction = argumentAwarePrediction();
- if (isInt32Speculation(prediction))
- return FlushedInt32;
-
- if (enableInt52() && !m_local.isArgument() && isMachineIntSpeculation(prediction))
- return FlushedInt52;
-
- if (isCellSpeculation(prediction))
- return FlushedCell;
-
- if (isBooleanSpeculation(prediction))
- return FlushedBoolean;
-
- return FlushedJSValue;
- }
</del><ins>+ FlushFormat flushFormat();
</ins><span class="cx">
</span><span class="cx"> FlushedAt flushedAt()
</span><span class="cx"> {
</span><span class="lines">@@ -389,4 +243,6 @@
</span><span class="cx">
</span><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><ins>+#endif // ENABLE(DFG_JIT)
+
</ins><span class="cx"> #endif // DFGVariableAccessData_h
</span></span></pre>
</div>
</div>
</body>
</html>