<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[203572] branches/safari-602-branch/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/203572">203572</a></dd>
<dt>Author</dt> <dd>bshafiei@apple.com</dd>
<dt>Date</dt> <dd>2016-07-22 02:25:50 -0700 (Fri, 22 Jul 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/203488">r203488</a>. rdar://problem/27439330</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari602branchSourceJavaScriptCoreChangeLog">branches/safari-602-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3B3LowerToAircpp">branches/safari-602-branch/Source/JavaScriptCore/b3/B3LowerToAir.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3B3PatchpointSpecialcpp">branches/safari-602-branch/Source/JavaScriptCore/b3/B3PatchpointSpecial.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3B3StackmapSpecialcpp">branches/safari-602-branch/Source/JavaScriptCore/b3/B3StackmapSpecial.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3B3Validatecpp">branches/safari-602-branch/Source/JavaScriptCore/b3/B3Validate.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3B3ValueRepcpp">branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3B3ValueReph">branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.h</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreb3testb3cpp">branches/safari-602-branch/Source/JavaScriptCore/b3/testb3.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">branches/safari-602-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari602branchSourceJavaScriptCoretestsstressftlbitxorrightresultinterferencejs">branches/safari-602-branch/Source/JavaScriptCore/tests/stress/ftl-bit-xor-right-result-interference.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari602branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/ChangeLog (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/ChangeLog 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/ChangeLog 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -1,3 +1,54 @@
</span><ins>+2016-07-22 Babak Shafiei <bshafiei@apple.com>
+
+ Merge r203488. rdar://problem/27439330
+
+ 2016-07-20 Filip Pizlo <fpizlo@apple.com>
+
+ FTL snippet generators should be able to request a different register for output and input
+ https://bugs.webkit.org/show_bug.cgi?id=160010
+ rdar://problem/27439330
+
+ Reviewed by Saam Barati.
+
+ The BitOr and BitXor snippet generators have problems if the register for the right input is
+ the same as the register for the result. We could fix those generators, but I'm not convinced
+ that the other snippet generators don't have this bug. So, the approach that this patch takes
+ is to teach the FTL to request that B3 to use a different register for the result than for
+ any input to the snippet patchpoint.
+
+ Air already has the ability to let any instruction do an EarlyDef, which means exactly this.
+ But B3 did not expose this via ValueRep. This patch exposes this in ValueRep as
+ SomeEarlyRegister. That's most of the change.
+
+ This adds a testb3 test for SomeEarlyRegister and a regression test for this particular
+ problem. The regression test failed on trunk JSC before this.
+
+ * b3/B3LowerToAir.cpp:
+ (JSC::B3::Air::LowerToAir::lower):
+ * b3/B3PatchpointSpecial.cpp:
+ (JSC::B3::PatchpointSpecial::forEachArg):
+ (JSC::B3::PatchpointSpecial::admitsStack):
+ * b3/B3StackmapSpecial.cpp:
+ (JSC::B3::StackmapSpecial::forEachArgImpl):
+ (JSC::B3::StackmapSpecial::isArgValidForRep):
+ * b3/B3Validate.cpp:
+ * b3/B3ValueRep.cpp:
+ (JSC::B3::ValueRep::addUsedRegistersTo):
+ (JSC::B3::ValueRep::dump):
+ (WTF::printInternal):
+ * b3/B3ValueRep.h:
+ (JSC::B3::ValueRep::ValueRep):
+ (JSC::B3::ValueRep::reg):
+ (JSC::B3::ValueRep::isAny):
+ (JSC::B3::ValueRep::isReg):
+ (JSC::B3::ValueRep::isSomeRegister): Deleted.
+ * b3/testb3.cpp:
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
+ (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
+ (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):
+ * tests/stress/ftl-bit-xor-right-result-interference.js: Added.
+
</ins><span class="cx"> 2016-07-19 Babak Shafiei <bshafiei@apple.com>
</span><span class="cx">
</span><span class="cx"> Merge r203419.
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3B3LowerToAircpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/B3LowerToAir.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/B3LowerToAir.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/B3LowerToAir.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -2194,6 +2194,7 @@
</span><span class="cx"> case ValueRep::ColdAny:
</span><span class="cx"> case ValueRep::LateColdAny:
</span><span class="cx"> case ValueRep::SomeRegister:
</span><ins>+ case ValueRep::SomeEarlyRegister:
</ins><span class="cx"> inst.args.append(tmp(patchpointValue));
</span><span class="cx"> break;
</span><span class="cx"> case ValueRep::Register: {
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3B3PatchpointSpecialcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/B3PatchpointSpecial.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/B3PatchpointSpecial.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/B3PatchpointSpecial.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -46,17 +46,25 @@
</span><span class="cx">
</span><span class="cx"> void PatchpointSpecial::forEachArg(Inst& inst, const ScopedLambda<Inst::EachArgCallback>& callback)
</span><span class="cx"> {
</span><ins>+ PatchpointValue* patchpoint = inst.origin->as<PatchpointValue>();
</ins><span class="cx"> unsigned argIndex = 1;
</span><span class="cx">
</span><del>- if (inst.origin->type() != Void)
- callback(inst.args[argIndex++], Arg::Def, inst.origin->airType(), inst.origin->airWidth());
</del><ins>+ if (patchpoint->type() != Void) {
+ Arg::Role role;
+ if (patchpoint->resultConstraint.kind() == ValueRep::SomeEarlyRegister)
+ role = Arg::EarlyDef;
+ else
+ role = Arg::Def;
+
+ callback(inst.args[argIndex++], role, inst.origin->airType(), inst.origin->airWidth());
+ }
</ins><span class="cx">
</span><span class="cx"> forEachArgImpl(0, argIndex, inst, SameAsRep, Nullopt, callback);
</span><span class="cx"> argIndex += inst.origin->numChildren();
</span><span class="cx">
</span><del>- for (unsigned i = inst.origin->as<PatchpointValue>()->numGPScratchRegisters; i--;)
</del><ins>+ for (unsigned i = patchpoint->numGPScratchRegisters; i--;)
</ins><span class="cx"> callback(inst.args[argIndex++], Arg::Scratch, Arg::GP, Arg::conservativeWidth(Arg::GP));
</span><del>- for (unsigned i = inst.origin->as<PatchpointValue>()->numFPScratchRegisters; i--;)
</del><ins>+ for (unsigned i = patchpoint->numFPScratchRegisters; i--;)
</ins><span class="cx"> callback(inst.args[argIndex++], Arg::Scratch, Arg::FP, Arg::conservativeWidth(Arg::FP));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -109,6 +117,7 @@
</span><span class="cx"> case ValueRep::StackArgument:
</span><span class="cx"> return true;
</span><span class="cx"> case ValueRep::SomeRegister:
</span><ins>+ case ValueRep::SomeEarlyRegister:
</ins><span class="cx"> case ValueRep::Register:
</span><span class="cx"> case ValueRep::LateRegister:
</span><span class="cx"> return false;
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3B3StackmapSpecialcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/B3StackmapSpecial.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/B3StackmapSpecial.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/B3StackmapSpecial.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -116,6 +116,9 @@
</span><span class="cx"> case ValueRep::LateColdAny:
</span><span class="cx"> role = Arg::LateColdUse;
</span><span class="cx"> break;
</span><ins>+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case ForceLateUse:
</span><span class="lines">@@ -230,6 +233,7 @@
</span><span class="cx"> // We already verified by isArgValidForValue().
</span><span class="cx"> return true;
</span><span class="cx"> case ValueRep::SomeRegister:
</span><ins>+ case ValueRep::SomeEarlyRegister:
</ins><span class="cx"> return arg.isTmp();
</span><span class="cx"> case ValueRep::LateRegister:
</span><span class="cx"> case ValueRep::Register:
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3B3Validatecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/B3Validate.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/B3Validate.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/B3Validate.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -338,6 +338,7 @@
</span><span class="cx"> switch (value->as<PatchpointValue>()->resultConstraint.kind()) {
</span><span class="cx"> case ValueRep::WarmAny:
</span><span class="cx"> case ValueRep::SomeRegister:
</span><ins>+ case ValueRep::SomeEarlyRegister:
</ins><span class="cx"> case ValueRep::Register:
</span><span class="cx"> case ValueRep::StackArgument:
</span><span class="cx"> break;
</span><span class="lines">@@ -346,7 +347,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- validateStackmapConstraint(value, ConstrainedValue(value, value->as<PatchpointValue>()->resultConstraint));
</del><ins>+ validateStackmapConstraint(value, ConstrainedValue(value, value->as<PatchpointValue>()->resultConstraint), ConstraintRole::Def);
</ins><span class="cx"> }
</span><span class="cx"> validateStackmap(value);
</span><span class="cx"> break;
</span><span class="lines">@@ -406,7 +407,11 @@
</span><span class="cx"> validateStackmapConstraint(stackmap, child);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void validateStackmapConstraint(Value* context, const ConstrainedValue& value)
</del><ins>+ enum class ConstraintRole {
+ Use,
+ Def
+ };
+ void validateStackmapConstraint(Value* context, const ConstrainedValue& value, ConstraintRole role = ConstraintRole::Use)
</ins><span class="cx"> {
</span><span class="cx"> switch (value.rep().kind()) {
</span><span class="cx"> case ValueRep::WarmAny:
</span><span class="lines">@@ -415,6 +420,9 @@
</span><span class="cx"> case ValueRep::SomeRegister:
</span><span class="cx"> case ValueRep::StackArgument:
</span><span class="cx"> break;
</span><ins>+ case ValueRep::SomeEarlyRegister:
+ VALIDATE(role == ConstraintRole::Def, ("At ", *context, ": ", value));
+ break;
</ins><span class="cx"> case ValueRep::Register:
</span><span class="cx"> case ValueRep::LateRegister:
</span><span class="cx"> if (value.rep().reg().isGPR())
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3B3ValueRepcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -40,6 +40,7 @@
</span><span class="cx"> case ColdAny:
</span><span class="cx"> case LateColdAny:
</span><span class="cx"> case SomeRegister:
</span><ins>+ case SomeEarlyRegister:
</ins><span class="cx"> case Constant:
</span><span class="cx"> return;
</span><span class="cx"> case LateRegister:
</span><span class="lines">@@ -70,6 +71,7 @@
</span><span class="cx"> case ColdAny:
</span><span class="cx"> case LateColdAny:
</span><span class="cx"> case SomeRegister:
</span><ins>+ case SomeEarlyRegister:
</ins><span class="cx"> return;
</span><span class="cx"> case LateRegister:
</span><span class="cx"> case Register:
</span><span class="lines">@@ -173,6 +175,9 @@
</span><span class="cx"> case ValueRep::SomeRegister:
</span><span class="cx"> out.print("SomeRegister");
</span><span class="cx"> return;
</span><ins>+ case ValueRep::SomeEarlyRegister:
+ out.print("SomeEarlyRegister");
+ return;
</ins><span class="cx"> case ValueRep::Register:
</span><span class="cx"> out.print("Register");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3B3ValueReph"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.h (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.h 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/B3ValueRep.h 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -67,6 +67,11 @@
</span><span class="cx"> // register that this claims to clobber!
</span><span class="cx"> SomeRegister,
</span><span class="cx">
</span><ins>+ // As an input representation, this tells us that B3 should pick some register, but implies
+ // that the def happens before any of the effects of the stackmap. This is only valid for
+ // the result constraint of a Patchpoint.
+ SomeEarlyRegister,
+
</ins><span class="cx"> // As an input representation, this forces a particular register. As an output
</span><span class="cx"> // representation, this tells us what register B3 picked.
</span><span class="cx"> Register,
</span><span class="lines">@@ -103,7 +108,7 @@
</span><span class="cx"> ValueRep(Kind kind)
</span><span class="cx"> : m_kind(kind)
</span><span class="cx"> {
</span><del>- ASSERT(kind == WarmAny || kind == ColdAny || kind == LateColdAny || kind == SomeRegister);
</del><ins>+ ASSERT(kind == WarmAny || kind == ColdAny || kind == LateColdAny || kind == SomeRegister || kind == SomeEarlyRegister);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static ValueRep reg(Reg reg)
</span><span class="lines">@@ -177,8 +182,6 @@
</span><span class="cx">
</span><span class="cx"> bool isAny() const { return kind() == WarmAny || kind() == ColdAny || kind() == LateColdAny; }
</span><span class="cx">
</span><del>- bool isSomeRegister() const { return kind() == SomeRegister; }
-
</del><span class="cx"> bool isReg() const { return kind() == Register || kind() == LateRegister; }
</span><span class="cx">
</span><span class="cx"> Reg reg() const
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreb3testb3cpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/b3/testb3.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/b3/testb3.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/b3/testb3.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -12144,6 +12144,49 @@
</span><span class="cx"> validate(proc);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void testSomeEarlyRegister()
+{
+ auto run = [&] (bool succeed) {
+ Procedure proc;
+
+ BasicBlock* root = proc.addBlock();
+
+ PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+ patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+ bool ranFirstPatchpoint = false;
+ patchpoint->setGenerator(
+ [&] (CCallHelpers&, const StackmapGenerationParams& params) {
+ CHECK(params[0].gpr() == GPRInfo::returnValueGPR);
+ ranFirstPatchpoint = true;
+ });
+
+ Value* arg = patchpoint;
+
+ patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+ patchpoint->appendSomeRegister(arg);
+ if (succeed)
+ patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+ bool ranSecondPatchpoint = false;
+ patchpoint->setGenerator(
+ [&] (CCallHelpers&, const StackmapGenerationParams& params) {
+ if (succeed)
+ CHECK(params[0].gpr() != params[1].gpr());
+ else
+ CHECK(params[0].gpr() == params[1].gpr());
+ ranSecondPatchpoint = true;
+ });
+
+ root->appendNew<Value>(proc, Return, Origin(), patchpoint);
+
+ compile(proc);
+ CHECK(ranFirstPatchpoint);
+ CHECK(ranSecondPatchpoint);
+ };
+
+ run(true);
+ run(false);
+}
+
</ins><span class="cx"> // Make sure the compiler does not try to optimize anything out.
</span><span class="cx"> NEVER_INLINE double zero()
</span><span class="cx"> {
</span><span class="lines">@@ -13549,6 +13592,7 @@
</span><span class="cx"> RUN(testLateRegister());
</span><span class="cx"> RUN(testReduceStrengthCheckBottomUseInAnotherBlock());
</span><span class="cx"> RUN(testResetReachabilityDanglingReference());
</span><ins>+ RUN(testSomeEarlyRegister());
</ins><span class="cx">
</span><span class="cx"> if (tasks.isEmpty())
</span><span class="cx"> usage();
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (203571 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-07-22 09:25:46 UTC (rev 203571)
+++ branches/safari-602-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -8016,6 +8016,7 @@
</span><span class="cx"> if (scratchFPRUsage == NeedScratchFPR)
</span><span class="cx"> patchpoint->numFPScratchRegisters++;
</span><span class="cx"> patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><ins>+ patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
</ins><span class="cx"> State* state = &m_ftlState;
</span><span class="cx"> patchpoint->setGenerator(
</span><span class="cx"> [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="lines">@@ -8078,6 +8079,7 @@
</span><span class="cx"> preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> patchpoint->numGPScratchRegisters = 1;
</span><span class="cx"> patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><ins>+ patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
</ins><span class="cx"> State* state = &m_ftlState;
</span><span class="cx"> patchpoint->setGenerator(
</span><span class="cx"> [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="lines">@@ -8133,6 +8135,7 @@
</span><span class="cx"> patchpoint->numGPScratchRegisters = 1;
</span><span class="cx"> patchpoint->numFPScratchRegisters = 1;
</span><span class="cx"> patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><ins>+ patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
</ins><span class="cx"> State* state = &m_ftlState;
</span><span class="cx"> patchpoint->setGenerator(
</span><span class="cx"> [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoretestsstressftlbitxorrightresultinterferencejs"></a>
<div class="addfile"><h4>Added: branches/safari-602-branch/Source/JavaScriptCore/tests/stress/ftl-bit-xor-right-result-interference.js (0 => 203572)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/tests/stress/ftl-bit-xor-right-result-interference.js (rev 0)
+++ branches/safari-602-branch/Source/JavaScriptCore/tests/stress/ftl-bit-xor-right-result-interference.js 2016-07-22 09:25:50 UTC (rev 203572)
</span><span class="lines">@@ -0,0 +1,31 @@
</span><ins>+var toggle = 0;
+
+function bar()
+{
+ if (toggle ^= 1)
+ return 42;
+ else
+ return {valueOf: function() { return 42; }};
+}
+
+noInline(bar);
+
+function baz()
+{
+ return 7;
+}
+
+noInline(baz);
+
+function foo()
+{
+ return bar() ^ baz();
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100000; ++i) {
+ var result = foo();
+ if (result != 45)
+ throw "Error: bad result: " + result;
+}
</ins></span></pre>
</div>
</div>
</body>
</html>