<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[192600] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/192600">192600</a></dd>
<dt>Author</dt> <dd>mark.lam@apple.com</dd>
<dt>Date</dt> <dd>2015-11-18 16:54:37 -0800 (Wed, 18 Nov 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Snippefy op_mul for the baseline JIT.
https://bugs.webkit.org/show_bug.cgi?id=151393

Reviewed by Geoffrey Garen.

Benchmarks shows that perf is neutral on x86 and x86_64 with the DFG enabled.

With the DFG disabled (relying on the baseline JIT for perf), LongSpider
3d-morph shows a 7.6% regression.  However, there are other benchmarks that shows
a progression e.g. on Kraken, audio-beat-detection and audio-fft.

Upon inspection of the generated code for 3d-morph, the only differences is the
added use of a scratch register for the result as well as a jump around the
code that handles double types.  It does not look like we're generating bad code.
I'll consider the perf acceptable in aggregate.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:

* bytecode/PolymorphicAccess.cpp:
(JSC::AccessCase::generate):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::boxInt32):
* jit/IntrinsicEmitter.cpp:
(JSC::AccessCase::emitIntrinsicGetter):
- Changed AssemblyHelpers::boxInt32() to take a TagRegistersMode.
  The pre-existing boxInt32() always assume that the tag registers are not
  available.  Since we should assume we have tag registers by default, I also
  changed all the other clients to explicitly specify a more of
  DoNotHaveTagRegisters.  That is except for the snippet generators that do have
  the tag registers.

* jit/JIT.h:
* jit/JITArithmetic.cpp:
(JSC::JIT::compileBinaryArithOpSlowCase):
(JSC::JIT::emit_op_div):
(JSC::JIT::emitSlow_op_add):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emitSlow_op_mul):
(JSC::JIT::emit_op_sub):
(JSC::JIT::compileBinaryArithOp): Deleted.
* jit/JITArithmetic32_64.cpp:
(JSC::JIT::emitBinaryDoubleOp):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul): Deleted.
(JSC::JIT::emitSlow_op_mul): Deleted.
* jit/JITMulGenerator.cpp: Added.
(JSC::JITMulGenerator::generateFastPath):
* jit/JITMulGenerator.h: Added.
(JSC::JITMulGenerator::JITMulGenerator):
(JSC::JITMulGenerator::didEmitFastPath):
(JSC::JITMulGenerator::endJumpList):
(JSC::JITMulGenerator::slowPathJumpList):

* tests/stress/op_mul.js: Added.
(o1.valueOf):
(generateScenarios):
(printScenarios):
(testCases.func):
(func):
(initializeTestCases):
(stringifyIfNeeded):
(isIdentical):
(runTest):
- Tests that JIT op_mul results are equivalent to the expected values as
  defined by the LLINT.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp">trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelpersh">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitIntrinsicEmittercpp">trunk/Source/JavaScriptCore/jit/IntrinsicEmitter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITArithmeticcpp">trunk/Source/JavaScriptCore/jit/JITArithmetic.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITArithmetic32_64cpp">trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCorejitJITMulGeneratorcpp">trunk/Source/JavaScriptCore/jit/JITMulGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITMulGeneratorh">trunk/Source/JavaScriptCore/jit/JITMulGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressop_muljs">trunk/Source/JavaScriptCore/tests/stress/op_mul.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -445,6 +445,7 @@
</span><span class="cx">     jit/JITDisassembler.cpp
</span><span class="cx">     jit/JITExceptions.cpp
</span><span class="cx">     jit/JITInlineCacheGenerator.cpp
</span><ins>+    jit/JITMulGenerator.cpp
</ins><span class="cx">     jit/JITOpcodes.cpp
</span><span class="cx">     jit/JITOpcodes32_64.cpp
</span><span class="cx">     jit/JITOperations.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/ChangeLog        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -1,5 +1,76 @@
</span><span class="cx"> 2015-11-18  Mark Lam  &lt;mark.lam@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Snippefy op_mul for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=151393
+
+        Reviewed by Geoffrey Garen.
+
+        Benchmarks shows that perf is neutral on x86 and x86_64 with the DFG enabled.
+
+        With the DFG disabled (relying on the baseline JIT for perf), LongSpider
+        3d-morph shows a 7.6% regression.  However, there are other benchmarks that shows
+        a progression e.g. on Kraken, audio-beat-detection and audio-fft.
+
+        Upon inspection of the generated code for 3d-morph, the only differences is the
+        added use of a scratch register for the result as well as a jump around the
+        code that handles double types.  It does not look like we're generating bad code.
+        I'll consider the perf acceptable in aggregate.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::boxInt32):
+        * jit/IntrinsicEmitter.cpp:
+        (JSC::AccessCase::emitIntrinsicGetter):
+        - Changed AssemblyHelpers::boxInt32() to take a TagRegistersMode.
+          The pre-existing boxInt32() always assume that the tag registers are not
+          available.  Since we should assume we have tag registers by default, I also
+          changed all the other clients to explicitly specify a more of
+          DoNotHaveTagRegisters.  That is except for the snippet generators that do have
+          the tag registers.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::compileBinaryArithOp): Deleted.
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul): Deleted.
+        (JSC::JIT::emitSlow_op_mul): Deleted.
+        * jit/JITMulGenerator.cpp: Added.
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h: Added.
+        (JSC::JITMulGenerator::JITMulGenerator):
+        (JSC::JITMulGenerator::didEmitFastPath):
+        (JSC::JITMulGenerator::endJumpList):
+        (JSC::JITMulGenerator::slowPathJumpList):
+
+        * tests/stress/op_mul.js: Added.
+        (o1.valueOf):
+        (generateScenarios):
+        (printScenarios):
+        (testCases.func):
+        (func):
+        (initializeTestCases):
+        (stringifyIfNeeded):
+        (isIdentical):
+        (runTest):
+        - Tests that JIT op_mul results are equivalent to the expected values as
+          defined by the LLINT.
+
+2015-11-18  Mark Lam  &lt;mark.lam@apple.com&gt;
+
</ins><span class="cx">         Remove some unnecessary jumps in snippet code.
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=151415
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -649,6 +649,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITDisassembler.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITExceptions.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITInlineCacheGenerator.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\jit\JITMulGenerator.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITOpcodes.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITOpcodes32_64.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITOperations.cpp&quot; /&gt;
</span><span class="lines">@@ -1467,6 +1468,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITExceptions.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITInlineCacheGenerator.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITInlines.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\jit\JITMulGenerator.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITOperations.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITStubRoutine.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITSubGenerator.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -444,6 +444,9 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITExceptions.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;jit&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\jit\JITMulGenerator.cpp&quot;&gt;
+      &lt;Filter&gt;jit&lt;/Filter&gt;
+    &lt;/ClCompile&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\jit\JITOpcodes.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;jit&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><span class="lines">@@ -2519,6 +2522,9 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITInlines.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;jit&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\jit\JITMulGenerator.h&quot;&gt;
+      &lt;Filter&gt;jit&lt;/Filter&gt;
+    &lt;/ClInclude&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\jit\JITStubRoutine.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;jit&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -1962,6 +1962,8 @@
</span><span class="cx">                 FE0D4A091ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */; };
</span><span class="cx">                 FE1220271BE7F58C0039E6F2 /* JITAddGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */; };
</span><span class="cx">                 FE1220281BE7F5910039E6F2 /* JITAddGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */; };
</span><ins>+                FE187A011BFBE55E0038BBCA /* JITMulGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */; settings = {ASSET_TAGS = (); }; };
+                FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */; settings = {ASSET_TAGS = (); }; };
</ins><span class="cx">                 FE1C0FFD1B193E9800B53FCA /* Exception.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1C0FFC1B193E9800B53FCA /* Exception.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1C0FFE1B194FD100B53FCA /* Exception.cpp */; };
</span><span class="cx">                 FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
</span><span class="lines">@@ -4092,6 +4094,8 @@
</span><span class="cx">                 FE0D4A081ABA2437002F54BF /* GlobalContextWithFinalizerTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GlobalContextWithFinalizerTest.h; path = API/tests/GlobalContextWithFinalizerTest.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITAddGenerator.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITAddGenerator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITMulGenerator.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITMulGenerator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 FE1C0FFC1B193E9800B53FCA /* Exception.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Exception.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE1C0FFE1B194FD100B53FCA /* Exception.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Exception.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4774,6 +4778,8 @@
</span><span class="cx">                                 0FB14E1C18124ACE009B6B4D /* JITInlineCacheGenerator.cpp */,
</span><span class="cx">                                 0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */,
</span><span class="cx">                                 86CC85A00EE79A4700288682 /* JITInlines.h */,
</span><ins>+                                FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */,
+                                FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */,
</ins><span class="cx">                                 BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */,
</span><span class="cx">                                 A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */,
</span><span class="cx">                                 0F24E54517EE274900ABB217 /* JITOperations.cpp */,
</span><span class="lines">@@ -7417,6 +7423,7 @@
</span><span class="cx">                                 BC18C4520E16F5CD00B34460 /* LegacyProfiler.h in Headers */,
</span><span class="cx">                                 BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */,
</span><span class="cx">                                 BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
</span><ins>+                                FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */,
</ins><span class="cx">                                 86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */,
</span><span class="cx">                                 0F431738146BAC69007E3890 /* ListableHandler.h in Headers */,
</span><span class="cx">                                 A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
</span><span class="lines">@@ -8961,6 +8968,7 @@
</span><span class="cx">                                 E18E3A590DF9278C00D90B34 /* VM.cpp in Sources */,
</span><span class="cx">                                 FE5932A7183C5A2600A1ECCC /* VMEntryScope.cpp in Sources */,
</span><span class="cx">                                 7B0247561B8682E100542440 /* WASMFunctionParser.cpp in Sources */,
</span><ins>+                                FE187A011BFBE55E0038BBCA /* JITMulGenerator.cpp in Sources */,
</ins><span class="cx">                                 7B39F76D1B62DE2E00360FB4 /* WASMModuleParser.cpp in Sources */,
</span><span class="cx">                                 7B39F7721B63574D00360FB4 /* WASMReader.cpp in Sources */,
</span><span class="cx">                                 26718BA41BE99F780052017B /* AirIteratedRegisterCoalescing.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -1058,14 +1058,14 @@
</span><span class="cx">         jit.load32(CCallHelpers::Address(scratchGPR, ArrayStorage::lengthOffset()), scratchGPR);
</span><span class="cx">         state.failAndIgnore.append(
</span><span class="cx">             jit.branch32(CCallHelpers::LessThan, scratchGPR, CCallHelpers::TrustedImm32(0)));
</span><del>-        jit.boxInt32(scratchGPR, valueRegs);
</del><ins>+        jit.boxInt32(scratchGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
</ins><span class="cx">         state.succeed();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     case StringLength: {
</span><span class="cx">         jit.load32(CCallHelpers::Address(baseGPR, JSString::offsetOfLength()), valueRegs.payloadGPR());
</span><del>-        jit.boxInt32(valueRegs.payloadGPR(), valueRegs);
</del><ins>+        jit.boxInt32(valueRegs.payloadGPR(), valueRegs, CCallHelpers::DoNotHaveTagRegisters);
</ins><span class="cx">         state.succeed();
</span><span class="cx">         return;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -1112,12 +1112,16 @@
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void boxInt32(GPRReg intGPR, JSValueRegs boxedRegs)
</del><ins>+    void boxInt32(GPRReg intGPR, JSValueRegs boxedRegs, TagRegistersMode mode = HaveTagRegisters)
</ins><span class="cx">     {
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>-        move(intGPR, boxedRegs.gpr());
-        or64(TrustedImm64(TagTypeNumber), boxedRegs.gpr());
</del><ins>+        if (mode == DoNotHaveTagRegisters) {
+            move(intGPR, boxedRegs.gpr());
+            or64(TrustedImm64(TagTypeNumber), boxedRegs.gpr());
+        } else
+            or64(GPRInfo::tagTypeNumberRegister, intGPR, boxedRegs.gpr());
</ins><span class="cx"> #else
</span><ins>+        UNUSED_PARAM(mode);
</ins><span class="cx">         move(intGPR, boxedRegs.payloadGPR());
</span><span class="cx">         move(TrustedImm32(JSValue::Int32Tag), boxedRegs.tagGPR());
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitIntrinsicEmittercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/IntrinsicEmitter.cpp (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/IntrinsicEmitter.cpp        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/jit/IntrinsicEmitter.cpp        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx">     switch (intrinsic()) {
</span><span class="cx">     case TypedArrayLengthIntrinsic: {
</span><span class="cx">         jit.load32(MacroAssembler::Address(state.baseGPR, JSArrayBufferView::offsetOfLength()), valueGPR);
</span><del>-        jit.boxInt32(valueGPR, valueRegs);
</del><ins>+        jit.boxInt32(valueGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
</ins><span class="cx">         state.succeed();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">             jit.lshift32(valueGPR, Imm32(logElementSize(type)), valueGPR);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        jit.boxInt32(valueGPR, valueRegs);
</del><ins>+        jit.boxInt32(valueGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
</ins><span class="cx">         state.succeed();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -118,7 +118,7 @@
</span><span class="cx">         
</span><span class="cx">         done.link(&amp;jit);
</span><span class="cx">         
</span><del>-        jit.boxInt32(valueGPR, valueRegs);
</del><ins>+        jit.boxInt32(valueGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
</ins><span class="cx">         state.succeed();
</span><span class="cx">         return;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/jit/JIT.h        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -462,7 +462,6 @@
</span><span class="cx">         void emitJumpSlowCaseIfNotInt(RegisterID, RegisterID, RegisterID scratch);
</span><span class="cx"> 
</span><span class="cx">         void emitTagBool(RegisterID);
</span><del>-        void compileBinaryArithOp(OpcodeID, int dst, int src1, int src2, OperandTypes opi);
</del><span class="cx">         void compileBinaryArithOpSlowCase(Instruction*, OpcodeID, Vector&lt;SlowCaseEntry&gt;::iterator&amp;, int dst, int src1, int src2, OperandTypes, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase);
</span><span class="cx"> 
</span><span class="cx">         void compileGetByIdHotPath(int baseVReg, const Identifier*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITArithmeticcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITArithmetic.cpp (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITArithmetic.cpp        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/jit/JITArithmetic.cpp        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;JITAddGenerator.h&quot;
</span><span class="cx"> #include &quot;JITInlines.h&quot;
</span><ins>+#include &quot;JITMulGenerator.h&quot;
</ins><span class="cx"> #include &quot;JITOperations.h&quot;
</span><span class="cx"> #include &quot;JITSubGenerator.h&quot;
</span><span class="cx"> #include &quot;JSArray.h&quot;
</span><span class="lines">@@ -662,38 +663,6 @@
</span><span class="cx"> 
</span><span class="cx"> /* ------------------------------ BEGIN: USE(JSVALUE64) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
</span><span class="cx"> 
</span><del>-void JIT::compileBinaryArithOp(OpcodeID opcodeID, int, int op1, int op2, OperandTypes)
-{
-    emitGetVirtualRegisters(op1, regT0, op2, regT1);
-    emitJumpSlowCaseIfNotInt(regT0);
-    emitJumpSlowCaseIfNotInt(regT1);
-    ASSERT_UNUSED(opcodeID, opcodeID == op_mul);
-    if (shouldEmitProfiling()) {
-        // We want to be able to measure if this is taking the slow case just
-        // because of negative zero. If this produces positive zero, then we
-        // don't want the slow case to be taken because that will throw off
-        // speculative compilation.
-        move(regT0, regT2);
-        addSlowCase(branchMul32(Overflow, regT1, regT2));
-        JumpList done;
-        done.append(branchTest32(NonZero, regT2));
-        Jump negativeZero = branch32(LessThan, regT0, TrustedImm32(0));
-        done.append(branch32(GreaterThanOrEqual, regT1, TrustedImm32(0)));
-        negativeZero.link(this);
-        // We only get here if we have a genuine negative zero. Record this,
-        // so that the speculative JIT knows that we failed speculation
-        // because of a negative zero.
-        add32(TrustedImm32(1), AbsoluteAddress(&amp;m_codeBlock-&gt;addSpecialFastCaseProfile(m_bytecodeOffset)-&gt;m_counter));
-        addSlowCase(jump());
-        done.link(this);
-        move(regT2, regT0);
-    } else {
-        addSlowCase(branchMul32(Overflow, regT1, regT0));
-        addSlowCase(branchTest32(Zero, regT0));
-    }
-    emitTagInt(regT0, regT0);
-}
-
</del><span class="cx"> void JIT::compileBinaryArithOpSlowCase(Instruction* currentInstruction, OpcodeID opcodeID, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter, int result, int op1, int op2, OperandTypes types, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase)
</span><span class="cx"> {
</span><span class="cx">     // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
</span><span class="lines">@@ -711,8 +680,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     linkSlowCase(iter); // Integer overflow case - we could handle this in JIT code, but this is likely rare.
</span><del>-    if (opcodeID == op_mul &amp;&amp; !op1HasImmediateIntFastCase &amp;&amp; !op2HasImmediateIntFastCase) // op_mul has an extra slow case to handle 0 * negative number.
-        linkSlowCase(iter);
</del><span class="cx"> 
</span><span class="cx">     Label stubFunctionCall(this);
</span><span class="cx"> 
</span><span class="lines">@@ -760,12 +727,9 @@
</span><span class="cx">         op2wasInteger.link(this);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (opcodeID == op_mul)
-        mulDouble(fpRegT2, fpRegT1);
-    else {
-        ASSERT(opcodeID == op_div);
-        divDouble(fpRegT2, fpRegT1);
-    }
</del><ins>+    ASSERT_UNUSED(opcodeID, opcodeID == op_div);
+    divDouble(fpRegT2, fpRegT1);
+
</ins><span class="cx">     moveDoubleTo64(fpRegT1, regT0);
</span><span class="cx">     sub64(tagTypeNumberRegister, regT0);
</span><span class="cx">     emitPutVirtualRegister(result, regT0);
</span><span class="lines">@@ -773,43 +737,6 @@
</span><span class="cx">     end.link(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_mul(Instruction* currentInstruction)
-{
-    int result = currentInstruction[1].u.operand;
-    int op1 = currentInstruction[2].u.operand;
-    int op2 = currentInstruction[3].u.operand;
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
-    // For now, only plant a fast int case if the constant operand is greater than zero.
-    int32_t value;
-    if (isOperandConstantInt(op1) &amp;&amp; ((value = getOperandConstantInt(op1)) &gt; 0)) {
-        emitGetVirtualRegister(op2, regT0);
-        emitJumpSlowCaseIfNotInt(regT0);
-        addSlowCase(branchMul32(Overflow, regT0, Imm32(value), regT1));
-        emitTagInt(regT1, regT0);
-    } else if (isOperandConstantInt(op2) &amp;&amp; ((value = getOperandConstantInt(op2)) &gt; 0)) {
-        emitGetVirtualRegister(op1, regT0);
-        emitJumpSlowCaseIfNotInt(regT0);
-        addSlowCase(branchMul32(Overflow, regT0, Imm32(value), regT1));
-        emitTagInt(regT1, regT0);
-    } else
-        compileBinaryArithOp(op_mul, result, op1, op2, types);
-
-    emitPutVirtualRegister(result);
-}
-
-void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    int result = currentInstruction[1].u.operand;
-    int op1 = currentInstruction[2].u.operand;
-    int op2 = currentInstruction[3].u.operand;
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
-    bool op1HasImmediateIntFastCase = isOperandConstantInt(op1) &amp;&amp; getOperandConstantInt(op1) &gt; 0;
-    bool op2HasImmediateIntFastCase = !op1HasImmediateIntFastCase &amp;&amp; isOperandConstantInt(op2) &amp;&amp; getOperandConstantInt(op2) &gt; 0;
-    compileBinaryArithOpSlowCase(currentInstruction, op_mul, iter, result, op1, op2, types, op1HasImmediateIntFastCase, op2HasImmediateIntFastCase);
-}
-
</del><span class="cx"> void JIT::emit_op_div(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="cx">     int dst = currentInstruction[1].u.operand;
</span><span class="lines">@@ -979,6 +906,84 @@
</span><span class="cx">     slowPathCall.call();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+#if USE(JSVALUE64)
+    JSValueRegs leftRegs = JSValueRegs(regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT1);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT2;
+    FPRReg scratchFPR = InvalidFPRReg;
+#else
+    JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT4;
+    FPRReg scratchFPR = fpRegT2;
+#endif
+
+    bool leftIsConstInt32 = isOperandConstantInt(op1);
+    bool rightIsConstInt32 = isOperandConstantInt(op2);
+    ResultType leftType = types.first();
+    ResultType rightType = types.second();
+    int32_t leftConstInt32 = 0;
+    int32_t rightConstInt32 = 0;
+
+    uint32_t* profilingCounter = nullptr;
+    if (shouldEmitProfiling())
+        profilingCounter = &amp;m_codeBlock-&gt;addSpecialFastCaseProfile(m_bytecodeOffset)-&gt;m_counter;
+
+    ASSERT(!leftIsConstInt32 || !rightIsConstInt32);
+
+    if (leftIsConstInt32)
+        leftConstInt32 = getOperandConstantInt(op1);
+    if (rightIsConstInt32)
+        rightConstInt32 = getOperandConstantInt(op2);
+
+    bool leftIsPositiveConstInt32 = leftIsConstInt32 &amp;&amp; (leftConstInt32 &gt; 0);
+    bool rightIsPositiveConstInt32 = rightIsConstInt32 &amp;&amp; (rightConstInt32 &gt; 0);
+
+    if (leftIsPositiveConstInt32)
+        emitGetVirtualRegister(op2, rightRegs);
+    else if (rightIsPositiveConstInt32)
+        emitGetVirtualRegister(op1, leftRegs);
+    else {
+        emitGetVirtualRegister(op1, leftRegs);
+        emitGetVirtualRegister(op2, rightRegs);
+    }
+
+    JITMulGenerator gen(resultRegs, leftRegs, rightRegs, leftType, rightType,
+        leftIsPositiveConstInt32, rightIsPositiveConstInt32, leftConstInt32, rightConstInt32,
+        fpRegT0, fpRegT1, scratchGPR, scratchFPR, profilingCounter);
+
+    gen.generateFastPath(*this);
+
+    if (gen.didEmitFastPath()) {
+        gen.endJumpList().link(this);
+        emitPutVirtualRegister(result, resultRegs);
+
+        addSlowCase(gen.slowPathJumpList());
+    } else {
+        ASSERT(gen.endJumpList().empty());
+        ASSERT(gen.slowPathJumpList().empty());
+        JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mul);
+        slowPathCall.call();
+    }
+}
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+    
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mul);
+    slowPathCall.call();
+}
+
</ins><span class="cx"> void JIT::emit_op_sub(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="cx">     int result = currentInstruction[1].u.operand;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITArithmetic32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp (192599 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp        2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -512,11 +512,6 @@
</span><span class="cx">         // Do the math.
</span><span class="cx">         doTheMath.link(this);
</span><span class="cx">         switch (opcodeID) {
</span><del>-            case op_mul:
-                emitLoadDouble(op1, fpRegT2);
-                mulDouble(fpRegT2, fpRegT0);
-                emitStoreDouble(dst, fpRegT0);
-                break;
</del><span class="cx">             case op_div: {
</span><span class="cx">                 emitLoadDouble(op1, fpRegT1);
</span><span class="cx">                 divDouble(fpRegT0, fpRegT1);
</span><span class="lines">@@ -603,11 +598,6 @@
</span><span class="cx"> 
</span><span class="cx">         // Do the math.
</span><span class="cx">         switch (opcodeID) {
</span><del>-            case op_mul:
-                emitLoadDouble(op2, fpRegT2);
-                mulDouble(fpRegT2, fpRegT0);
-                emitStoreDouble(dst, fpRegT0);
-                break;
</del><span class="cx">             case op_div: {
</span><span class="cx">                 emitLoadDouble(op2, fpRegT2);
</span><span class="cx">                 divDouble(fpRegT2, fpRegT0);
</span><span class="lines">@@ -676,83 +666,6 @@
</span><span class="cx">     end.link(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// Multiplication (*)
-
-void JIT::emit_op_mul(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int op1 = currentInstruction[2].u.operand;
-    int op2 = currentInstruction[3].u.operand;
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
-    m_codeBlock-&gt;addSpecialFastCaseProfile(m_bytecodeOffset);
-
-    JumpList notInt32Op1;
-    JumpList notInt32Op2;
-
-    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
-
-    // Int32 case.
-    move(regT0, regT3);
-    addSlowCase(branchMul32(Overflow, regT2, regT0));
-    addSlowCase(branchTest32(Zero, regT0));
-    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
-
-    if (!supportsFloatingPoint()) {
-        addSlowCase(notInt32Op1);
-        addSlowCase(notInt32Op2);
-        return;
-    }
-    Jump end = jump();
-
-    // Double case.
-    emitBinaryDoubleOp(op_mul, dst, op1, op2, types, notInt32Op1, notInt32Op2);
-    end.link(this);
-}
-
-void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    int dst = currentInstruction[1].u.operand;
-    int op1 = currentInstruction[2].u.operand;
-    int op2 = currentInstruction[3].u.operand;
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
-    Jump overflow = getSlowCase(iter); // overflow check
-    linkSlowCase(iter); // zero result check
-
-    Jump negZero = branchOr32(Signed, regT2, regT3);
-    emitStoreInt32(dst, TrustedImm32(0), (op1 == dst || op2 == dst));
-
-    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_mul));
-
-    negZero.link(this);
-    // We only get here if we have a genuine negative zero. Record this,
-    // so that the speculative JIT knows that we failed speculation
-    // because of a negative zero.
-    add32(TrustedImm32(1), AbsoluteAddress(&amp;m_codeBlock-&gt;specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)-&gt;m_counter));
-    overflow.link(this);
-
-    if (!supportsFloatingPoint()) {
-        linkSlowCase(iter); // int32 check
-        linkSlowCase(iter); // int32 check
-    }
-
-    if (supportsFloatingPoint()) {
-        if (!types.first().definitelyIsNumber())
-            linkSlowCase(iter); // double check
-
-        if (!types.second().definitelyIsNumber()) {
-            linkSlowCase(iter); // int32 check
-            linkSlowCase(iter); // double check
-        }
-    }
-
-    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mul);
-    slowPathCall.call();
-}
-
</del><span class="cx"> // Division (/)
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_div(Instruction* currentInstruction)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITMulGeneratorcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/jit/JITMulGenerator.cpp (0 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITMulGenerator.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/jit/JITMulGenerator.cpp        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -0,0 +1,165 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+
+#if ENABLE(JIT)
+#include &quot;JITMulGenerator.h&quot;
+
+namespace JSC {
+
+void JITMulGenerator::generateFastPath(CCallHelpers&amp; jit)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+    ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+    ASSERT(!m_leftIsPositiveConstInt32 || !m_rightIsPositiveConstInt32);
+    
+    if (!m_leftType.mightBeNumber() || !m_rightType.mightBeNumber()) {
+        ASSERT(!m_didEmitFastPath);
+        return;
+    }
+
+    m_didEmitFastPath = true;
+
+    if (m_leftIsPositiveConstInt32 || m_rightIsPositiveConstInt32) {
+        JSValueRegs var;
+        ResultType varType = ResultType::unknownType();
+        int32_t constInt32;
+
+        if (m_leftIsPositiveConstInt32) {
+            var = m_right;
+            varType = m_rightType;
+            constInt32 = m_leftConstInt32;
+        } else {
+            var = m_left;
+            varType = m_leftType;
+            constInt32 = m_rightConstInt32;
+        }
+
+        // Try to do intVar * intConstant.
+        CCallHelpers::Jump notInt32 = jit.branchIfNotInt32(var);
+
+        m_slowPathJumpList.append(jit.branchMul32(CCallHelpers::Overflow, var.payloadGPR(), CCallHelpers::Imm32(constInt32), m_scratchGPR));
+
+        jit.boxInt32(m_scratchGPR, m_result);
+        m_endJumpList.append(jit.jump());
+
+        if (!jit.supportsFloatingPoint()) {
+            m_slowPathJumpList.append(notInt32);
+            return;
+        }
+
+        // Try to do doubleVar * double(intConstant).
+        notInt32.link(&amp;jit);
+        if (!varType.definitelyIsNumber())
+            m_slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
+
+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
+
+        jit.move(CCallHelpers::Imm32(constInt32), m_scratchGPR);
+        jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
+
+        // Fall thru to doubleVar * doubleVar.
+
+    } else {
+        ASSERT(!m_leftIsPositiveConstInt32 &amp;&amp; !m_rightIsPositiveConstInt32);
+
+        CCallHelpers::Jump leftNotInt;
+        CCallHelpers::Jump rightNotInt;
+
+        // Try to do intVar * intVar.
+        leftNotInt = jit.branchIfNotInt32(m_left);
+        rightNotInt = jit.branchIfNotInt32(m_right);
+
+        m_slowPathJumpList.append(jit.branchMul32(CCallHelpers::Overflow, m_right.payloadGPR(), m_left.payloadGPR(), m_scratchGPR));
+        if (!m_profilingCounter) {
+            m_slowPathJumpList.append(jit.branchTest32(CCallHelpers::Zero, m_scratchGPR)); // Go slow if potential negative zero.
+
+        } else {
+            CCallHelpers::JumpList notNegativeZero;
+            notNegativeZero.append(jit.branchTest32(CCallHelpers::NonZero, m_scratchGPR));
+
+            CCallHelpers::Jump negativeZero = jit.branch32(CCallHelpers::LessThan, m_left.payloadGPR(), CCallHelpers::TrustedImm32(0));
+            notNegativeZero.append(jit.branch32(CCallHelpers::GreaterThanOrEqual, m_right.payloadGPR(), CCallHelpers::TrustedImm32(0)));
+
+            negativeZero.link(&amp;jit);
+            // Record this, so that the speculative JIT knows that we failed speculation
+            // because of a negative zero.
+            jit.add32(CCallHelpers::TrustedImm32(1), CCallHelpers::AbsoluteAddress(m_profilingCounter));
+            m_slowPathJumpList.append(jit.jump());
+
+            notNegativeZero.link(&amp;jit);
+        }
+
+        jit.boxInt32(m_scratchGPR, m_result);
+        m_endJumpList.append(jit.jump());
+
+        if (!jit.supportsFloatingPoint()) {
+            m_slowPathJumpList.append(leftNotInt);
+            m_slowPathJumpList.append(rightNotInt);
+            return;
+        }
+
+        leftNotInt.link(&amp;jit);
+        if (!m_leftType.definitelyIsNumber())
+            m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+        if (!m_rightType.definitelyIsNumber())
+            m_slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
+
+        jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
+        CCallHelpers::Jump rightWasInteger = jit.jump();
+
+        rightNotInt.link(&amp;jit);
+        if (!m_rightType.definitelyIsNumber())
+            m_slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+        jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
+
+        rightIsDouble.link(&amp;jit);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+
+        rightWasInteger.link(&amp;jit);
+
+        // Fall thru to doubleVar * doubleVar.
+    }
+
+    // Do doubleVar * doubleVar.
+    jit.mulDouble(m_rightFPR, m_leftFPR);
+    jit.boxDouble(m_leftFPR, m_result);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITMulGeneratorh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/jit/JITMulGenerator.h (0 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITMulGenerator.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/jit/JITMulGenerator.h        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -0,0 +1,91 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JITMulGenerator_h
+#define JITMulGenerator_h
+
+#if ENABLE(JIT)
+
+#include &quot;CCallHelpers.h&quot;
+#include &quot;ResultType.h&quot;
+
+namespace JSC {
+
+class JITMulGenerator {
+public:
+    JITMulGenerator(JSValueRegs result, JSValueRegs left, JSValueRegs right,
+        ResultType leftType, ResultType rightType, bool leftIsPositiveConstInt32, bool rightIsPositiveConstInt32,
+        int32_t leftConstInt32, int32_t rightConstInt32, FPRReg leftFPR, FPRReg rightFPR,
+        GPRReg scratchGPR, FPRReg scratchFPR, uint32_t* profilingCounter)
+        : m_result(result)
+        , m_left(left)
+        , m_right(right)
+        , m_leftType(leftType)
+        , m_rightType(rightType)
+        , m_leftIsPositiveConstInt32(leftIsPositiveConstInt32)
+        , m_rightIsPositiveConstInt32(rightIsPositiveConstInt32)
+        , m_leftConstInt32(leftConstInt32)
+        , m_rightConstInt32(rightConstInt32)
+        , m_leftFPR(leftFPR)
+        , m_rightFPR(rightFPR)
+        , m_scratchGPR(scratchGPR)
+        , m_scratchFPR(scratchFPR)
+        , m_profilingCounter(profilingCounter)
+    {
+        ASSERT(!leftIsPositiveConstInt32 || !rightIsPositiveConstInt32);
+    }
+
+    void generateFastPath(CCallHelpers&amp;);
+
+    bool didEmitFastPath() const { return m_didEmitFastPath; }
+    CCallHelpers::JumpList endJumpList() { return m_endJumpList; }
+    CCallHelpers::JumpList slowPathJumpList() { return m_slowPathJumpList; }
+
+private:
+    JSValueRegs m_result;
+    JSValueRegs m_left;
+    JSValueRegs m_right;
+    ResultType m_leftType;
+    ResultType m_rightType;
+    bool m_leftIsPositiveConstInt32;
+    bool m_rightIsPositiveConstInt32;
+    int32_t m_leftConstInt32;
+    int32_t m_rightConstInt32;
+    FPRReg m_leftFPR;
+    FPRReg m_rightFPR;
+    GPRReg m_scratchGPR;
+    FPRReg m_scratchFPR;
+    uint32_t* m_profilingCounter;
+    bool m_didEmitFastPath { false };
+
+    CCallHelpers::JumpList m_endJumpList;
+    CCallHelpers::JumpList m_slowPathJumpList;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // JITMulGenerator_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressop_muljs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/op_mul.js (0 => 192600)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/op_mul.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/op_mul.js        2015-11-19 00:54:37 UTC (rev 192600)
</span><span class="lines">@@ -0,0 +1,386 @@
</span><ins>+//@ runFTLNoCJIT
+
+// This test module aims to test the multiplication operator by comparing its runtime
+// behavior (using the different tiers) with expected values computed at initialization
+// time using the LLINT / bytecode generator.
+//
+// It works by generating test scenarios from permutations of value pairs to exercise
+// the multiplication operator. It computes the expected results by evaluating an
+// expression to multiply the values in an initialization pass. The scenarios are later
+// applied to a set of test functions of the forms:
+//
+//     variable * variable
+//     constant * variable
+//     variable * constant
+//
+// See generateScenarios() and initializeTestCases() for details on how the test
+// cases are generated.
+//
+// If all goes well, this test module will terminate silently. If not, it will print
+// errors.
+
+var verbose = false;
+var abortOnFirstFail = false;
+
+var o1 = {
+    valueOf: function() { return 10; }
+};
+
+var posInfinity = 1 / 0;
+var negInfinity = -1 / 0;
+
+var set1 = [
+    'o1',
+    'null',
+    'undefined',
+    'NaN',
+    'posInfinity',
+    'negInfinity',
+    '&quot;abc&quot;',
+];
+
+var set2 = [
+    '0',
+    '-0',
+    '1',
+    '-1',
+    '0x3fff',
+    '-0x3fff',
+    '0x7fff',
+    '-0x7fff',
+    '0x10000',
+    '-0x10000',
+    '2147483647',
+    '-2147483647',
+    '4294967296',
+    '-4294967296',
+    '100.2',
+    '-100.2',
+    'true',
+    'false',
+];
+
+// Assemble the values that we'll be testing with:
+var values = [];
+for (var i = 0; i &lt; set1.length; i++)
+    values.push(set1[i]);
+for (var i = 0; i &lt; set2.length; i++)
+    values.push(set2[i]);
+for (var i = 0; i &lt; set2.length; i++)
+    values.push('&quot;' + set2[i] + '&quot;');
+
+function generateScenarios(xvalues, yvalues) {
+    var scenarios = [];
+    for (var i = 0; i &lt; xvalues.length; i++) {
+        for (var j = 0; j &lt; yvalues.length; j++) {
+            var xStr = xvalues[i];
+            var yStr = yvalues[j];
+            var x = eval(xStr);
+            var y = eval(yStr);
+            var name = &quot;(&quot; + xStr + &quot; * &quot; + yStr + &quot;)&quot;;
+            var expected = eval(&quot;&quot; + xStr + &quot; * &quot; + yStr);
+            var scenario = { name: name, x: x, y: y, expected: expected };
+
+            scenarios.push(scenario);
+        }
+    }
+    return scenarios;
+}
+
+function printScenarios(scenarios) {
+    for (var i = 0; i &lt; scenarios.length; i++) {
+        var scenario = scenarios[i];
+        print(&quot;scenario[&quot; + i + &quot;]: { name: &quot; + scenario.name + &quot;, x: &quot; + scenario.x, &quot;, y: &quot; + scenario.y + &quot;, expected: &quot; + scenario.expected + &quot; }&quot;);
+    }
+}
+
+var testCases = [
+    {
+        name: &quot;mul&quot;,
+        func: function(x, y) { return x * y; },
+        xvalues: values,
+        yvalues: values
+    },
+    {
+        name: &quot;mulI32V&quot;,
+        func: function(x, y) { return 1 * y; },
+        xvalues: [ '1' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVI32&quot;,
+        func: function(x, y) { return x * 1; },
+        xvalues: values,
+        yvalues: [ '1' ]
+    },
+    {
+        name: &quot;mulI32oV&quot;,
+        func: function(x, y) { return 2147483647 * y; },
+        xvalues: [ '2147483647' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVI32o&quot;,
+        func: function(x, y) { return x * 2147483647; },
+        xvalues: values,
+        yvalues: [ '2147483647' ]
+    },
+    {
+        name: &quot;mulI32onV&quot;,
+        func: function(x, y) { return -2147483647 * y; },
+        xvalues: [ '-2147483647' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVI32on&quot;,
+        func: function(x, y) { return x * (-2147483647); },
+        xvalues: values,
+        yvalues: [ '-2147483647' ]
+    },
+    {
+        name: &quot;mulI52V&quot;,
+        func: function(x, y) { return 4294967296 * y; },
+        xvalues: [ '4294967296' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVI52&quot;,
+        func: function(x, y) { return x * 4294967296; },
+        xvalues: values,
+        yvalues: [ '4294967296' ]
+    },
+    {
+        name: &quot;mulI52nV&quot;,
+        func: function(x, y) { return -4294967296 * y; },
+        xvalues: [ '-4294967296' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVI52n&quot;,
+        func: function(x, y) { return x * (-4294967296); },
+        xvalues: values,
+        yvalues: [ '-4294967296' ]
+    },
+    {
+        name: &quot;mulDV&quot;,
+        func: function(x, y) { return 100.2 * y; },
+        xvalues: [ '100.2' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVD&quot;,
+        func: function(x, y) { return x * 100.2; },
+        xvalues: values,
+        yvalues: [ '100.2' ]
+    },
+    {
+        name: &quot;mulBV&quot;,
+        func: function(x, y) { return true * y; },
+        xvalues: [ 'true' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVB&quot;,
+        func: function(x, y) { return x * true; },
+        xvalues: values,
+        yvalues: [ 'true' ]
+    },
+    {
+        name: &quot;mulSi32V&quot;,
+        func: function(x, y) { return &quot;10&quot; * y; },
+        xvalues: [ '&quot;10&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSi32&quot;,
+        func: function(x, y) { return x * &quot;10&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;10&quot;' ]
+    },
+
+    {
+        name: &quot;mulSi32oV&quot;,
+        func: function(x, y) { return &quot;2147483647&quot; * y; },
+        xvalues: [ '&quot;2147483647&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSi32o&quot;,
+        func: function(x, y) { return x * &quot;2147483647&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;2147483647&quot;' ]
+    },
+    {
+        name: &quot;mulSi32onV&quot;,
+        func: function(x, y) { return &quot;-2147483647&quot; * y; },
+        xvalues: [ '&quot;-2147483647&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSi32on&quot;,
+        func: function(x, y) { return x * &quot;-2147483647&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;-2147483647&quot;' ]
+    },
+    {
+        name: &quot;mulSi52V&quot;,
+        func: function(x, y) { return &quot;4294967296&quot; * y; },
+        xvalues: [ '&quot;4294967296&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSi52&quot;,
+        func: function(x, y) { return x * &quot;4294967296&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;4294967296&quot;' ]
+    },
+    {
+        name: &quot;mulSi52nV&quot;,
+        func: function(x, y) { return &quot;-4294967296&quot; * y; },
+        xvalues: [ '&quot;-4294967296&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSi52n&quot;,
+        func: function(x, y) { return x * &quot;-4294967296&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;-4294967296&quot;' ]
+    },
+    {
+        name: &quot;mulSdV&quot;,
+        func: function(x, y) { return &quot;100.2&quot; * y; },
+        xvalues: [ '&quot;100.2&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSd&quot;,
+        func: function(x, y) { return x * &quot;100.2&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;100.2&quot;' ]
+    },
+    {
+        name: &quot;mulSbV&quot;,
+        func: function(x, y) { return &quot;true&quot; * y; },
+        xvalues: [ '&quot;true&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVSb&quot;,
+        func: function(x, y) { return x * &quot;true&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;true&quot;' ]
+    },
+
+    {
+        name: &quot;mulSV&quot;,
+        func: function(x, y) { return &quot;abc&quot; * y; },
+        xvalues: [ '&quot;abc&quot;' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVS&quot;,
+        func: function(x, y) { return x * &quot;abc&quot;; },
+        xvalues: values,
+        yvalues: [ '&quot;abc&quot;' ]
+    },
+    {
+        name: &quot;mulNV&quot;,
+        func: function(x, y) { return null * y; },
+        xvalues: [ 'null' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVN&quot;,
+        func: function(x, y) { return x * null; },
+        xvalues: values,
+        yvalues: [ 'null' ]
+    },
+    {
+        name: &quot;mulOV&quot;,
+        func: function(x, y) { return o1 * y; },
+        xvalues: [ 'o1' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVO&quot;,
+        func: function(x, y) { return x * o1; },
+        xvalues: values,
+        yvalues: [ 'o1' ]
+    },
+    {
+        name: &quot;mulNaNV&quot;,
+        func: function(x, y) { return NaN * y; },
+        xvalues: [ 'NaN' ],
+        yvalues: values
+    },
+    {
+        name: &quot;mulVNaN&quot;,
+        func: function(x, y) { return x * NaN; },
+        xvalues: values,
+        yvalues: [ 'NaN' ]
+    },
+];
+
+function initializeTestCases() {
+    for (var test of testCases) {
+        noInline(test.func);
+        test.scenarios = generateScenarios(test.xvalues, test.yvalues);
+    }
+}
+initializeTestCases();
+
+var errorReport = &quot;&quot;;
+
+function stringifyIfNeeded(x) {
+    if (typeof x == &quot;string&quot;)
+        return '&quot;' + x + '&quot;';
+    return x;
+}
+
+function isIdentical(x, y) {
+    if (x == y) {
+        if (x)
+            return true;
+        // Distinguish between 0 and negative 0.
+        if (1 / x == 1 / y)
+            return true;
+    } else if (Number.isNaN(x) &amp;&amp; Number.isNaN(y))
+        return true;
+    return false;
+}
+
+function runTest(test) {
+    var failedScenario = [];
+    var scenarios = test.scenarios;
+    var testFunc = test.func;
+    try {
+        for (var i = 0; i &lt; 10000; i++) {
+            for (var scenarioID = 0; scenarioID &lt; scenarios.length; scenarioID++) {
+                var scenario = scenarios[scenarioID];
+                if (verbose)
+                    print(&quot;Testing &quot; + test.name + &quot;:&quot; + scenario.name + &quot; on iteration &quot; + i + &quot;: expecting &quot; + stringifyIfNeeded(scenario.expected)); 
+
+                var result = testFunc(scenario.x, scenario.y);
+                if (isIdentical(result, scenario.expected))
+                    continue;
+                if (!failedScenario[scenarioID]) {
+                    errorReport += &quot;FAIL: &quot; + test.name + &quot;:&quot; + scenario.name + &quot; started failing on iteration &quot; + i
+                        + &quot;: expected &quot; + stringifyIfNeeded(scenario.expected) + &quot;, actual &quot; + stringifyIfNeeded(result) + &quot;\n&quot;;
+                    if (abortOnFirstFail)
+                        throw errorReport;
+                    failedScenario[scenarioID] = scenario;
+                }
+            }
+        }
+    } catch(e) {
+        if (abortOnFirstFail)
+            throw e; // Negate the catch by re-throwing.
+        errorReport += &quot;Unexpected exception: &quot; + e + &quot;\n&quot;;
+    }
+}
+
+for (var test of testCases)
+    runTest(test);
+
+if (errorReport !== &quot;&quot;)
+    throw &quot;Error: bad result:\n&quot; + errorReport;
</ins></span></pre>
</div>
</div>

</body>
</html>