<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[281889] branches/safari-612-branch/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/281889">281889</a></dd>
<dt>Author</dt> <dd>repstein@apple.com</dd>
<dt>Date</dt> <dd>2021-09-01 18:04:25 -0700 (Wed, 01 Sep 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Cherry-pick <a href="http://trac.webkit.org/projects/webkit/changeset/281355">r281355</a>. rdar://problem/82651674

    [JSC] Simplify moveIntsToDouble
    https://bugs.webkit.org/show_bug.cgi?id=229351

    Reviewed by Saam Barati.

    MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed.
    This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler.
    This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern
    IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR
    to AccessCase. But after this simplification, this is no longer necessary.

    * assembler/MacroAssemblerARMv7.h:
    (JSC::MacroAssemblerARMv7::moveIntsToDouble):
    * assembler/MacroAssemblerMIPS.h:
    (JSC::MacroAssemblerMIPS::moveIntsToDouble):
    * dfg/DFGSpeculativeJIT.cpp:
    (JSC::DFG::SpeculativeJIT::compileValueToInt32):
    (JSC::DFG::SpeculativeJIT::compileDoubleRep):
    (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
    (JSC::DFG::SpeculativeJIT::compileValueAdd):
    (JSC::DFG::SpeculativeJIT::compileValueSub):
    (JSC::DFG::SpeculativeJIT::compileMathIC):
    (JSC::DFG::SpeculativeJIT::compileValueNegate):
    (JSC::DFG::SpeculativeJIT::compileValueMul):
    (JSC::DFG::SpeculativeJIT::speculateRealNumber):
    (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
    * dfg/DFGSpeculativeJIT.h:
    (JSC::DFG::SpeculativeJIT::unboxDouble):
    * ftl/FTLLowerDFGToB3.cpp:
    (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
    (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
    * jit/AssemblyHelpers.cpp:
    (JSC::AssemblyHelpers::emitConvertValueToBoolean):
    (JSC::AssemblyHelpers::branchIfValue):
    * jit/AssemblyHelpers.h:
    (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
    (JSC::AssemblyHelpers::unboxDouble):
    * jit/JITAddGenerator.cpp:
    (JSC::JITAddGenerator::generateFastPath):
    * jit/JITAddGenerator.h:
    (JSC::JITAddGenerator::JITAddGenerator):
    * jit/JITArithmetic.cpp:
    (JSC::JIT::emitRightShiftFastPath):
    (JSC::JIT::emitMathICFast):
    * jit/JITDivGenerator.cpp:
    (JSC::JITDivGenerator::loadOperand):
    * jit/JITMulGenerator.cpp:
    (JSC::JITMulGenerator::generateInline):
    (JSC::JITMulGenerator::generateFastPath):
    * jit/JITMulGenerator.h:
    (JSC::JITMulGenerator::JITMulGenerator):
    * jit/JITPropertyAccess.cpp:
    (JSC::JIT::emitFloatTypedArrayPutByVal):
    * jit/JITPropertyAccess32_64.cpp:
    (JSC::JIT::emitGenericContiguousPutByVal):
    * jit/JITRightShiftGenerator.cpp:
    (JSC::JITRightShiftGenerator::generateFastPath):
    * jit/JITRightShiftGenerator.h:
    (JSC::JITRightShiftGenerator::JITRightShiftGenerator):
    * jit/JITSubGenerator.cpp:
    (JSC::JITSubGenerator::generateInline):
    (JSC::JITSubGenerator::generateFastPath):
    * jit/JITSubGenerator.h:
    (JSC::JITSubGenerator::JITSubGenerator):

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281355 268f45cc-cd09-0410-ab3c-d52691b4dbfc</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari612branchSourceJavaScriptCoreChangeLog">branches/safari-612-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoreassemblerMacroAssemblerARMv7h">branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoreassemblerMacroAssemblerMIPSh">branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoredfgDFGSpeculativeJITcpp">branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoredfgDFGSpeculativeJITh">branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitAssemblyHelperscpp">branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitAssemblyHelpersh">branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITAddGeneratorcpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITAddGeneratorh">branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITArithmeticcpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITArithmetic.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITDivGeneratorcpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITDivGenerator.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITMulGeneratorcpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITMulGeneratorh">branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITPropertyAccesscpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITPropertyAccess32_64cpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITRightShiftGeneratorcpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITRightShiftGeneratorh">branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITSubGeneratorcpp">branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.cpp</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorejitJITSubGeneratorh">branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari612branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/ChangeLog (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/ChangeLog       2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/ChangeLog  2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -1,3 +1,142 @@
</span><ins>+2021-09-01  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r281355. rdar://problem/82651674
+
+    [JSC] Simplify moveIntsToDouble
+    https://bugs.webkit.org/show_bug.cgi?id=229351
+    
+    Reviewed by Saam Barati.
+    
+    MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed.
+    This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler.
+    This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern
+    IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR
+    to AccessCase. But after this simplification, this is no longer necessary.
+    
+    * assembler/MacroAssemblerARMv7.h:
+    (JSC::MacroAssemblerARMv7::moveIntsToDouble):
+    * assembler/MacroAssemblerMIPS.h:
+    (JSC::MacroAssemblerMIPS::moveIntsToDouble):
+    * dfg/DFGSpeculativeJIT.cpp:
+    (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+    (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+    (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
+    (JSC::DFG::SpeculativeJIT::compileValueAdd):
+    (JSC::DFG::SpeculativeJIT::compileValueSub):
+    (JSC::DFG::SpeculativeJIT::compileMathIC):
+    (JSC::DFG::SpeculativeJIT::compileValueNegate):
+    (JSC::DFG::SpeculativeJIT::compileValueMul):
+    (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+    (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
+    * dfg/DFGSpeculativeJIT.h:
+    (JSC::DFG::SpeculativeJIT::unboxDouble):
+    * ftl/FTLLowerDFGToB3.cpp:
+    (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
+    (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+    * jit/AssemblyHelpers.cpp:
+    (JSC::AssemblyHelpers::emitConvertValueToBoolean):
+    (JSC::AssemblyHelpers::branchIfValue):
+    * jit/AssemblyHelpers.h:
+    (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
+    (JSC::AssemblyHelpers::unboxDouble):
+    * jit/JITAddGenerator.cpp:
+    (JSC::JITAddGenerator::generateFastPath):
+    * jit/JITAddGenerator.h:
+    (JSC::JITAddGenerator::JITAddGenerator):
+    * jit/JITArithmetic.cpp:
+    (JSC::JIT::emitRightShiftFastPath):
+    (JSC::JIT::emitMathICFast):
+    * jit/JITDivGenerator.cpp:
+    (JSC::JITDivGenerator::loadOperand):
+    * jit/JITMulGenerator.cpp:
+    (JSC::JITMulGenerator::generateInline):
+    (JSC::JITMulGenerator::generateFastPath):
+    * jit/JITMulGenerator.h:
+    (JSC::JITMulGenerator::JITMulGenerator):
+    * jit/JITPropertyAccess.cpp:
+    (JSC::JIT::emitFloatTypedArrayPutByVal):
+    * jit/JITPropertyAccess32_64.cpp:
+    (JSC::JIT::emitGenericContiguousPutByVal):
+    * jit/JITRightShiftGenerator.cpp:
+    (JSC::JITRightShiftGenerator::generateFastPath):
+    * jit/JITRightShiftGenerator.h:
+    (JSC::JITRightShiftGenerator::JITRightShiftGenerator):
+    * jit/JITSubGenerator.cpp:
+    (JSC::JITSubGenerator::generateInline):
+    (JSC::JITSubGenerator::generateFastPath):
+    * jit/JITSubGenerator.h:
+    (JSC::JITSubGenerator::JITSubGenerator):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281355 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-08-20  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] Simplify moveIntsToDouble
+            https://bugs.webkit.org/show_bug.cgi?id=229351
+
+            Reviewed by Saam Barati.
+
+            MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed.
+            This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler.
+            This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern
+            IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR
+            to AccessCase. But after this simplification, this is no longer necessary.
+
+            * assembler/MacroAssemblerARMv7.h:
+            (JSC::MacroAssemblerARMv7::moveIntsToDouble):
+            * assembler/MacroAssemblerMIPS.h:
+            (JSC::MacroAssemblerMIPS::moveIntsToDouble):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+            (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+            (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
+            (JSC::DFG::SpeculativeJIT::compileValueAdd):
+            (JSC::DFG::SpeculativeJIT::compileValueSub):
+            (JSC::DFG::SpeculativeJIT::compileMathIC):
+            (JSC::DFG::SpeculativeJIT::compileValueNegate):
+            (JSC::DFG::SpeculativeJIT::compileValueMul):
+            (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+            (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
+            * dfg/DFGSpeculativeJIT.h:
+            (JSC::DFG::SpeculativeJIT::unboxDouble):
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+            * jit/AssemblyHelpers.cpp:
+            (JSC::AssemblyHelpers::emitConvertValueToBoolean):
+            (JSC::AssemblyHelpers::branchIfValue):
+            * jit/AssemblyHelpers.h:
+            (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
+            (JSC::AssemblyHelpers::unboxDouble):
+            * jit/JITAddGenerator.cpp:
+            (JSC::JITAddGenerator::generateFastPath):
+            * jit/JITAddGenerator.h:
+            (JSC::JITAddGenerator::JITAddGenerator):
+            * jit/JITArithmetic.cpp:
+            (JSC::JIT::emitRightShiftFastPath):
+            (JSC::JIT::emitMathICFast):
+            * jit/JITDivGenerator.cpp:
+            (JSC::JITDivGenerator::loadOperand):
+            * jit/JITMulGenerator.cpp:
+            (JSC::JITMulGenerator::generateInline):
+            (JSC::JITMulGenerator::generateFastPath):
+            * jit/JITMulGenerator.h:
+            (JSC::JITMulGenerator::JITMulGenerator):
+            * jit/JITPropertyAccess.cpp:
+            (JSC::JIT::emitFloatTypedArrayPutByVal):
+            * jit/JITPropertyAccess32_64.cpp:
+            (JSC::JIT::emitGenericContiguousPutByVal):
+            * jit/JITRightShiftGenerator.cpp:
+            (JSC::JITRightShiftGenerator::generateFastPath):
+            * jit/JITRightShiftGenerator.h:
+            (JSC::JITRightShiftGenerator::JITRightShiftGenerator):
+            * jit/JITSubGenerator.cpp:
+            (JSC::JITSubGenerator::generateInline):
+            (JSC::JITSubGenerator::generateFastPath):
+            * jit/JITSubGenerator.h:
+            (JSC::JITSubGenerator::JITSubGenerator):
+
</ins><span class="cx"> 2021-08-30  Russell Epstein  <repstein@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r281665. rdar://problem/82528295
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoreassemblerMacroAssemblerARMv7h"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -1001,9 +1001,8 @@
</span><span class="cx">         m_assembler.vmov(dest1, dest2, src);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
</del><ins>+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest)
</ins><span class="cx">     {
</span><del>-        UNUSED_PARAM(scratch);
</del><span class="cx">         m_assembler.vmov(dest, src1, src2);
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoreassemblerMacroAssemblerMIPSh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h  2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h     2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -2072,9 +2072,8 @@
</span><span class="cx">         m_assembler.vmov(dest1, dest2, src);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
</del><ins>+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest)
</ins><span class="cx">     {
</span><del>-        UNUSED_PARAM(scratch);
</del><span class="cx">         m_assembler.vmov(dest, src1, src2);
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp       2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -2856,7 +2856,6 @@
</span><span class="cx">                 GPRReg tagGPR = op1.tagGPR();
</span><span class="cx">                 FPRTemporary tempFpr(this);
</span><span class="cx">                 FPRReg fpr = tempFpr.fpr();
</span><del>-                FPRTemporary scratch(this);
</del><span class="cx"> 
</span><span class="cx">                 JITCompiler::Jump isInteger = m_jit.branchIfInt32(tagGPR);
</span><span class="cx"> 
</span><span class="lines">@@ -2885,7 +2884,7 @@
</span><span class="cx">                     isNumber.link(&m_jit);
</span><span class="cx">                 }
</span><span class="cx"> 
</span><del>-                unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());
</del><ins>+                unboxDouble(tagGPR, payloadGPR, fpr);
</ins><span class="cx"> 
</span><span class="cx">                 silentSpillAllRegisters(resultGpr);
</span><span class="cx">                 callOperation(operationToInt32, resultGpr, fpr);
</span><span class="lines">@@ -2989,9 +2988,7 @@
</span><span class="cx">         GPRReg tempGPR = temp.gpr();
</span><span class="cx">         m_jit.unboxDoubleWithoutAssertions(op1Regs.gpr(), tempGPR, resultFPR);
</span><span class="cx"> #else
</span><del>-        FPRTemporary temp(this);
-        FPRReg tempFPR = temp.fpr();
-        unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR, tempFPR);
</del><ins>+        unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR);
</ins><span class="cx"> #endif
</span><span class="cx">         
</span><span class="cx">         JITCompiler::Jump done = m_jit.branchIfNotNaN(resultFPR);
</span><span class="lines">@@ -3068,11 +3065,8 @@
</span><span class="cx">         m_jit.convertInt32ToDouble(op1GPR, resultFPR);
</span><span class="cx">         done.link(&m_jit);
</span><span class="cx"> #else // USE(JSVALUE64) -> this is the 32_64 case
</span><del>-        FPRTemporary temp(this);
-    
</del><span class="cx">         GPRReg op1TagGPR = op1.tagGPR();
</span><span class="cx">         GPRReg op1PayloadGPR = op1.payloadGPR();
</span><del>-        FPRReg tempFPR = temp.fpr();
</del><span class="cx">         FPRReg resultFPR = result.fpr();
</span><span class="cx">         JITCompiler::JumpList done;
</span><span class="cx">     
</span><span class="lines">@@ -3109,7 +3103,7 @@
</span><span class="cx">                 m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR, tempFPR);
</del><ins>+        unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR);
</ins><span class="cx">         done.append(m_jit.jump());
</span><span class="cx">     
</span><span class="cx">         isInteger.link(&m_jit);
</span><span class="lines">@@ -4622,14 +4616,11 @@
</span><span class="cx">     JSValueRegs resultRegs = JSValueRegs(result.gpr());
</span><span class="cx">     GPRTemporary scratch(this);
</span><span class="cx">     GPRReg scratchGPR = scratch.gpr();
</span><del>-    FPRReg scratchFPR = InvalidFPRReg;
</del><span class="cx"> #else
</span><span class="cx">     GPRTemporary resultTag(this);
</span><span class="cx">     GPRTemporary resultPayload(this);
</span><span class="cx">     JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
</span><span class="cx">     GPRReg scratchGPR = resultTag.gpr();
</span><del>-    FPRTemporary fprScratch(this);
-    FPRReg scratchFPR = fprScratch.fpr();
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     SnippetOperand leftOperand;
</span><span class="lines">@@ -4653,8 +4644,7 @@
</span><span class="cx">         rightRegs = right->jsValueRegs();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
-        leftFPR, scratchGPR, scratchFPR, shiftType);
</del><ins>+    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, scratchGPR, shiftType);
</ins><span class="cx">     gen.generateFastPath(m_jit);
</span><span class="cx"> 
</span><span class="cx">     ASSERT(gen.didEmitFastPath());
</span><span class="lines">@@ -4859,14 +4849,6 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-#if USE(JSVALUE64)
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = false;
-#else
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = true;
-#endif
-
</del><span class="cx">     CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
</span><span class="cx">     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
</span><span class="cx">     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
</span><span class="lines">@@ -4874,7 +4856,7 @@
</span><span class="cx">     auto repatchingFunction = operationValueAddOptimize;
</span><span class="cx">     auto nonRepatchingFunction = operationValueAdd;
</span><span class="cx">     
</span><del>-    compileMathIC(node, addIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
</del><ins>+    compileMathIC(node, addIC, repatchingFunction, nonRepatchingFunction);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void SpeculativeJIT::compileValueSub(Node* node)
</span><span class="lines">@@ -4951,14 +4933,6 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-#if USE(JSVALUE64)
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = false;
-#else
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = true;
-#endif
-
</del><span class="cx">     CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
</span><span class="cx">     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
</span><span class="cx">     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
</span><span class="lines">@@ -4966,11 +4940,11 @@
</span><span class="cx">     auto repatchingFunction = operationValueSubOptimize;
</span><span class="cx">     auto nonRepatchingFunction = operationValueSub;
</span><span class="cx"> 
</span><del>-    compileMathIC(node, subIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
</del><ins>+    compileMathIC(node, subIC, repatchingFunction, nonRepatchingFunction);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
</span><del>-void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathIC, bool needsScratchGPRReg, bool needsScratchFPRReg, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
</del><ins>+void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathIC, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
</ins><span class="cx"> {
</span><span class="cx">     Edge& leftChild = node->child1();
</span><span class="cx">     Edge& rightChild = node->child2();
</span><span class="lines">@@ -4987,20 +4961,10 @@
</span><span class="cx">     FPRReg rightFPR = rightNumber.fpr();
</span><span class="cx"> 
</span><span class="cx">     GPRReg scratchGPR = InvalidGPRReg;
</span><del>-    FPRReg scratchFPR = InvalidFPRReg;
</del><span class="cx"> 
</span><del>-    std::optional<FPRTemporary> fprScratch;
-    if (needsScratchFPRReg) {
-        fprScratch.emplace(this);
-        scratchFPR = fprScratch->fpr();
-    }
-
</del><span class="cx"> #if USE(JSVALUE64)
</span><del>-    std::optional<GPRTemporary> gprScratch;
-    if (needsScratchGPRReg) {
-        gprScratch.emplace(this);
-        scratchGPR = gprScratch->gpr();
-    }
</del><ins>+    GPRTemporary gprScratch(this);
+    scratchGPR = gprScratch.gpr();
</ins><span class="cx">     GPRTemporary result(this);
</span><span class="cx">     JSValueRegs resultRegs = JSValueRegs(result.gpr());
</span><span class="cx"> #else
</span><span class="lines">@@ -5007,8 +4971,7 @@
</span><span class="cx">     GPRTemporary resultTag(this);
</span><span class="cx">     GPRTemporary resultPayload(this);
</span><span class="cx">     JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
</span><del>-    if (needsScratchGPRReg)
-        scratchGPR = resultRegs.tagGPR();
</del><ins>+    scratchGPR = resultRegs.tagGPR();
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     SnippetOperand leftOperand(m_state.forNode(leftChild).resultType());
</span><span class="lines">@@ -5038,7 +5001,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     Box<MathICGenerationState> addICGenerationState = Box<MathICGenerationState>::create();
</span><del>-    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, rightFPR, scratchGPR, scratchFPR);
</del><ins>+    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, rightFPR, scratchGPR);
</ins><span class="cx"> 
</span><span class="cx">     bool shouldEmitProfiling = false;
</span><span class="cx">     bool generatedInline = mathIC->generateInline(m_jit, *addICGenerationState, shouldEmitProfiling);
</span><span class="lines">@@ -5558,8 +5521,7 @@
</span><span class="cx">     JITNegIC* negIC = m_jit.codeBlock()->addJITNegIC(arithProfile);
</span><span class="cx">     auto repatchingFunction = operationArithNegateOptimize;
</span><span class="cx">     auto nonRepatchingFunction = operationArithNegate;
</span><del>-    bool needsScratchGPRReg = true;
-    compileMathIC(node, negIC, needsScratchGPRReg, repatchingFunction, nonRepatchingFunction);
</del><ins>+    compileMathIC(node, negIC, repatchingFunction, nonRepatchingFunction);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void SpeculativeJIT::compileArithNegate(Node* node)
</span><span class="lines">@@ -5642,14 +5604,10 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
</span><del>-void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC, bool needsScratchGPRReg, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
</del><ins>+void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
</ins><span class="cx"> {
</span><del>-    GPRReg scratchGPR = InvalidGPRReg;
-    std::optional<GPRTemporary> gprScratch;
-    if (needsScratchGPRReg) {
-        gprScratch.emplace(this);
-        scratchGPR = gprScratch->gpr();
-    }
</del><ins>+    GPRTemporary gprScratch(this);
+    GPRReg scratchGPR = gprScratch.gpr();
</ins><span class="cx">     JSValueOperand childOperand(this, node->child1());
</span><span class="cx">     JSValueRegs childRegs = childOperand.jsValueRegs();
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="lines">@@ -5801,13 +5759,6 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    bool needsScratchGPRReg = true;
-#if USE(JSVALUE64)
-    bool needsScratchFPRReg = false;
-#else
-    bool needsScratchFPRReg = true;
-#endif
-
</del><span class="cx">     CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
</span><span class="cx">     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
</span><span class="cx">     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
</span><span class="lines">@@ -5815,7 +5766,7 @@
</span><span class="cx">     auto repatchingFunction = operationValueMulOptimize;
</span><span class="cx">     auto nonRepatchingFunction = operationValueMul;
</span><span class="cx"> 
</span><del>-    compileMathIC(node, mulIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
</del><ins>+    compileMathIC(node, mulIC, repatchingFunction, nonRepatchingFunction);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void SpeculativeJIT::compileArithMul(Node* node)
</span><span class="lines">@@ -11263,9 +11214,7 @@
</span><span class="cx">     GPRReg tempGPR = temp.gpr();
</span><span class="cx">     m_jit.unboxDoubleWithoutAssertions(op1Regs.gpr(), tempGPR, resultFPR);
</span><span class="cx"> #else
</span><del>-    FPRTemporary temp(this);
-    FPRReg tempFPR = temp.fpr();
-    unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR, tempFPR);
</del><ins>+    unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR);
</ins><span class="cx"> #endif
</span><span class="cx">     
</span><span class="cx">     JITCompiler::Jump done = m_jit.branchIfNotNaN(resultFPR);
</span><span class="lines">@@ -13298,7 +13247,7 @@
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx">     m_jit.unboxDoubleWithoutAssertions(keyRegs.gpr(), scratchGPR, doubleValueFPR);
</span><span class="cx"> #else
</span><del>-    unboxDouble(keyRegs.tagGPR(), keyRegs.payloadGPR(), doubleValueFPR, tempFPR);
</del><ins>+    unboxDouble(keyRegs.tagGPR(), keyRegs.payloadGPR(), doubleValueFPR);
</ins><span class="cx"> #endif
</span><span class="cx">     auto notNaN = m_jit.branchIfNotNaN(doubleValueFPR);
</span><span class="cx">     m_jit.moveTrustedValue(jsNaN(), resultRegs);
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -480,9 +480,9 @@
</span><span class="cx">     {
</span><span class="cx">         m_jit.boxDouble(fpr, tagGPR, payloadGPR);
</span><span class="cx">     }
</span><del>-    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr, FPRReg scratchFPR)
</del><ins>+    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr)
</ins><span class="cx">     {
</span><del>-        m_jit.unboxDouble(tagGPR, payloadGPR, fpr, scratchFPR);
</del><ins>+        m_jit.unboxDouble(tagGPR, payloadGPR, fpr);
</ins><span class="cx">     }
</span><span class="cx"> #endif
</span><span class="cx">     void boxDouble(FPRReg fpr, JSValueRegs regs)
</span><span class="lines">@@ -1395,9 +1395,9 @@
</span><span class="cx">     void compileShiftOp(Node*);
</span><span class="cx"> 
</span><span class="cx">     template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
</span><del>-    void compileMathIC(Node*, JITBinaryMathIC<Generator>*, bool needsScratchGPRReg, bool needsScratchFPRReg, RepatchingFunction, NonRepatchingFunction);
</del><ins>+    void compileMathIC(Node*, JITBinaryMathIC<Generator>*, RepatchingFunction, NonRepatchingFunction);
</ins><span class="cx">     template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
</span><del>-    void compileMathIC(Node*, JITUnaryMathIC<Generator>*, bool needsScratchGPRReg, RepatchingFunction, NonRepatchingFunction);
</del><ins>+    void compileMathIC(Node*, JITUnaryMathIC<Generator>*, RepatchingFunction, NonRepatchingFunction);
</ins><span class="cx"> 
</span><span class="cx">     void compileArithDoubleUnaryOp(Node*, double (*doubleFunction)(double), double (*operation)(JSGlobalObject*, EncodedJSValue));
</span><span class="cx">     void compileValueAdd(Node*);
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -2503,7 +2503,7 @@
</span><span class="cx">                 JITBinaryMathIC<Generator>* mathIC = jit.codeBlock()->addMathIC<Generator>(arithProfile);
</span><span class="cx">                 mathIC->m_generator = Generator(leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
</span><span class="cx">                     JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()), params.fpScratch(0),
</span><del>-                    params.fpScratch(1), params.gpScratch(0), InvalidFPRReg);
</del><ins>+                    params.fpScratch(1), params.gpScratch(0));
</ins><span class="cx"> 
</span><span class="cx">                 bool shouldEmitProfiling = false;
</span><span class="cx">                 bool generatedInline = mathIC->generateInline(jit, *mathICGenerationState, shouldEmitProfiling);
</span><span class="lines">@@ -16012,7 +16012,7 @@
</span><span class="cx">                 auto generator = Box<JITRightShiftGenerator>::create(
</span><span class="cx">                     leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
</span><span class="cx">                     JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()),
</span><del>-                    params.fpScratch(0), params.gpScratch(0), InvalidFPRReg, shiftType);
</del><ins>+                    params.fpScratch(0), params.gpScratch(0), shiftType);
</ins><span class="cx"> 
</span><span class="cx">                 generator->generateFastPath(jit);
</span><span class="cx">                 generator->endJumpList().link(&jit);
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitAssemblyHelperscpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.cpp 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.cpp    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -819,7 +819,7 @@
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx">     unboxDouble(value.gpr(), result, valueAsFPR);
</span><span class="cx"> #else
</span><del>-    unboxDouble(value, valueAsFPR, tempFPR);
</del><ins>+    unboxDouble(value, valueAsFPR);
</ins><span class="cx"> #endif
</span><span class="cx">     move(invert ? TrustedImm32(1) : TrustedImm32(0), result);
</span><span class="cx">     done.append(branchDoubleZeroOrNaN(valueAsFPR, tempFPR));
</span><span class="lines">@@ -920,7 +920,7 @@
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx">     unboxDouble(value.gpr(), scratch, valueAsFPR);
</span><span class="cx"> #else
</span><del>-    unboxDouble(value, valueAsFPR, tempFPR);
</del><ins>+    unboxDouble(value, valueAsFPR);
</ins><span class="cx"> #endif
</span><span class="cx">     if (invert) {
</span><span class="cx">         truthy.append(branchDoubleZeroOrNaN(valueAsFPR, tempFPR));
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.h   2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/AssemblyHelpers.h      2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -1304,7 +1304,7 @@
</span><span class="cx">         boxDouble(fpr, regs.gpr(), mode);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg resultGPR, FPRReg)
</del><ins>+    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg resultGPR)
</ins><span class="cx">     {
</span><span class="cx">         unboxDouble(regs.payloadGPR(), resultGPR, destFPR);
</span><span class="cx">     }
</span><span class="lines">@@ -1355,9 +1355,9 @@
</span><span class="cx">     {
</span><span class="cx">         moveDoubleToInts(fpr, payloadGPR, tagGPR);
</span><span class="cx">     }
</span><del>-    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr, FPRReg scratchFPR)
</del><ins>+    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr)
</ins><span class="cx">     {
</span><del>-        moveIntsToDouble(payloadGPR, tagGPR, fpr, scratchFPR);
</del><ins>+        moveIntsToDouble(payloadGPR, tagGPR, fpr);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     void boxDouble(FPRReg fpr, JSValueRegs regs)
</span><span class="lines">@@ -1364,14 +1364,14 @@
</span><span class="cx">     {
</span><span class="cx">         boxDouble(fpr, regs.tagGPR(), regs.payloadGPR());
</span><span class="cx">     }
</span><del>-    void unboxDouble(JSValueRegs regs, FPRReg fpr, FPRReg scratchFPR)
</del><ins>+    void unboxDouble(JSValueRegs regs, FPRReg fpr)
</ins><span class="cx">     {
</span><del>-        unboxDouble(regs.tagGPR(), regs.payloadGPR(), fpr, scratchFPR);
</del><ins>+        unboxDouble(regs.tagGPR(), regs.payloadGPR(), fpr);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void unboxDoubleNonDestructive(const JSValueRegs regs, FPRReg destFPR, GPRReg, FPRReg scratchFPR)
</del><ins>+    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg)
</ins><span class="cx">     {
</span><del>-        unboxDouble(regs, destFPR, scratchFPR);
</del><ins>+        unboxDouble(regs, destFPR);
</ins><span class="cx">     }
</span><span class="cx"> #endif
</span><span class="cx">     
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITAddGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.cpp 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.cpp    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -80,7 +80,6 @@
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">     ASSERT(m_scratchGPR != m_left.tagGPR());
</span><span class="cx">     ASSERT(m_scratchGPR != m_right.tagGPR());
</span><del>-    ASSERT(m_scratchFPR != InvalidFPRReg);
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
</span><span class="lines">@@ -114,7 +113,7 @@
</span><span class="cx">         if (!varOpr.definitelyIsNumber())
</span><span class="cx">             slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
</span><span class="cx"> 
</span><del>-        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR);
</ins><span class="cx"> 
</span><span class="cx">         jit.move(CCallHelpers::Imm32(constOpr.asConstInt32()), m_scratchGPR);
</span><span class="cx">         jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
</span><span class="lines">@@ -151,7 +150,7 @@
</span><span class="cx">         if (!m_rightOperand.definitelyIsNumber())
</span><span class="cx">             slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
</span><span class="cx"> 
</span><del>-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
</ins><span class="cx">         CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
</span><span class="cx"> 
</span><span class="cx">         jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
</span><span class="lines">@@ -164,7 +163,7 @@
</span><span class="cx">         jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
</span><span class="cx"> 
</span><span class="cx">         rightIsDouble.link(&jit);
</span><del>-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
</ins><span class="cx"> 
</span><span class="cx">         rightWasInteger.link(&jit);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITAddGeneratorh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.h   2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITAddGenerator.h      2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITAddGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
</span><span class="cx">         JSValueRegs result, JSValueRegs left, JSValueRegs right,
</span><del>-        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
</del><ins>+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR)
</ins><span class="cx">         : m_leftOperand(leftOperand)
</span><span class="cx">         , m_rightOperand(rightOperand)
</span><span class="cx">         , m_result(result)
</span><span class="lines">@@ -50,7 +50,6 @@
</span><span class="cx">         , m_leftFPR(leftFPR)
</span><span class="cx">         , m_rightFPR(rightFPR)
</span><span class="cx">         , m_scratchGPR(scratchGPR)
</span><del>-        , m_scratchFPR(scratchFPR)
</del><span class="cx">     {
</span><span class="cx">         ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
</span><span class="cx">     }
</span><span class="lines">@@ -70,7 +69,6 @@
</span><span class="cx">     FPRReg m_leftFPR;
</span><span class="cx">     FPRReg m_rightFPR;
</span><span class="cx">     GPRReg m_scratchGPR;
</span><del>-    FPRReg m_scratchFPR;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITArithmeticcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITArithmetic.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITArithmetic.cpp   2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITArithmetic.cpp      2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -854,13 +854,11 @@
</span><span class="cx">     JSValueRegs rightRegs = JSValueRegs(regT1);
</span><span class="cx">     JSValueRegs resultRegs = leftRegs;
</span><span class="cx">     GPRReg scratchGPR = regT2;
</span><del>-    FPRReg scratchFPR = InvalidFPRReg;
</del><span class="cx"> #else
</span><span class="cx">     JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
</span><span class="cx">     JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
</span><span class="cx">     JSValueRegs resultRegs = leftRegs;
</span><span class="cx">     GPRReg scratchGPR = regT4;
</span><del>-    FPRReg scratchFPR = fpRegT2;
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     SnippetOperand leftOperand;
</span><span class="lines">@@ -878,8 +876,7 @@
</span><span class="cx">     if (!rightOperand.isConst())
</span><span class="cx">         emitGetVirtualRegister(op2, rightRegs);
</span><span class="cx"> 
</span><del>-    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
-        fpRegT0, scratchGPR, scratchFPR, snippetShiftType);
</del><ins>+    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, scratchGPR, snippetShiftType);
</ins><span class="cx"> 
</span><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx"> 
</span><span class="lines">@@ -979,13 +976,11 @@
</span><span class="cx">     JSValueRegs rightRegs = JSValueRegs(regT2);
</span><span class="cx">     JSValueRegs resultRegs = JSValueRegs(regT0);
</span><span class="cx">     GPRReg scratchGPR = regT3;
</span><del>-    FPRReg scratchFPR = fpRegT2;
</del><span class="cx"> #else
</span><span class="cx">     JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
</span><span class="cx">     JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
</span><span class="cx">     JSValueRegs resultRegs = leftRegs;
</span><span class="cx">     GPRReg scratchGPR = regT4;
</span><del>-    FPRReg scratchFPR = fpRegT2;
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     SnippetOperand leftOperand(bytecode.m_operandTypes.first());
</span><span class="lines">@@ -998,7 +993,7 @@
</span><span class="cx"> 
</span><span class="cx">     RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
</span><span class="cx"> 
</span><del>-    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, fpRegT1, scratchGPR, scratchFPR);
</del><ins>+    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, fpRegT1, scratchGPR);
</ins><span class="cx">     
</span><span class="cx">     ASSERT(!(Generator::isLeftOperandValidConstant(leftOperand) && Generator::isRightOperandValidConstant(rightOperand)));
</span><span class="cx">     
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITDivGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITDivGenerator.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITDivGenerator.cpp 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITDivGenerator.cpp    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx">         jit.convertInt32ToDouble(oprRegs.payloadGPR(), destFPR);
</span><span class="cx">         CCallHelpers::Jump oprIsLoaded = jit.jump();
</span><span class="cx">         notInt32.link(&jit);
</span><del>-        jit.unboxDoubleNonDestructive(oprRegs, destFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(oprRegs, destFPR, m_scratchGPR);
</ins><span class="cx">         oprIsLoaded.link(&jit);
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITMulGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.cpp 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.cpp    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -58,8 +58,8 @@
</span><span class="cx">             state.slowPathJumps.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
</span><span class="cx">         state.slowPathJumps.append(jit.branchIfInt32(m_left));
</span><span class="cx">         state.slowPathJumps.append(jit.branchIfInt32(m_right));
</span><del>-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
</ins><span class="cx">         jit.mulDouble(m_rightFPR, m_leftFPR);
</span><span class="cx">         jit.boxDouble(m_leftFPR, m_result);
</span><span class="cx"> 
</span><span class="lines">@@ -99,7 +99,6 @@
</span><span class="cx"> #else
</span><span class="cx">     ASSERT(m_scratchGPR != m_left.tagGPR());
</span><span class="cx">     ASSERT(m_scratchGPR != m_right.tagGPR());
</span><del>-    ASSERT(m_scratchFPR != InvalidFPRReg);
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
</span><span class="lines">@@ -134,7 +133,7 @@
</span><span class="cx">         if (!varOpr.definitelyIsNumber())
</span><span class="cx">             slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
</span><span class="cx"> 
</span><del>-        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR);
</ins><span class="cx"> 
</span><span class="cx">         jit.move(CCallHelpers::Imm32(constOpr.asConstInt32()), m_scratchGPR);
</span><span class="cx">         jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
</span><span class="lines">@@ -169,7 +168,7 @@
</span><span class="cx">         if (!m_rightOperand.definitelyIsNumber())
</span><span class="cx">             slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
</span><span class="cx"> 
</span><del>-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
</ins><span class="cx">         CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
</span><span class="cx"> 
</span><span class="cx">         jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
</span><span class="lines">@@ -182,7 +181,7 @@
</span><span class="cx">         jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
</span><span class="cx"> 
</span><span class="cx">         rightIsDouble.link(&jit);
</span><del>-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
</ins><span class="cx"> 
</span><span class="cx">         rightWasInteger.link(&jit);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITMulGeneratorh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.h   2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITMulGenerator.h      2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITMulGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
</span><span class="cx">         JSValueRegs result, JSValueRegs left, JSValueRegs right,
</span><del>-        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
</del><ins>+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR)
</ins><span class="cx">         : m_leftOperand(leftOperand)
</span><span class="cx">         , m_rightOperand(rightOperand)
</span><span class="cx">         , m_result(result)
</span><span class="lines">@@ -51,7 +51,6 @@
</span><span class="cx">         , m_leftFPR(leftFPR)
</span><span class="cx">         , m_rightFPR(rightFPR)
</span><span class="cx">         , m_scratchGPR(scratchGPR)
</span><del>-        , m_scratchFPR(scratchFPR)
</del><span class="cx">     {
</span><span class="cx">         ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
</span><span class="cx">     }
</span><span class="lines">@@ -71,7 +70,6 @@
</span><span class="cx">     FPRReg m_leftFPR;
</span><span class="cx">     FPRReg m_rightFPR;
</span><span class="cx">     GPRReg m_scratchGPR;
</span><del>-    FPRReg m_scratchFPR;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess.cpp       2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess.cpp  2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -3600,7 +3600,7 @@
</span><span class="cx">     Jump ready = jump();
</span><span class="cx">     doubleCase.link(this);
</span><span class="cx">     slowCases.append(branch32(Above, lateScratch, TrustedImm32(JSValue::LowestTag)));
</span><del>-    moveIntsToDouble(earlyScratch, lateScratch, fpRegT0, fpRegT1);
</del><ins>+    moveIntsToDouble(earlyScratch, lateScratch, fpRegT0);
</ins><span class="cx">     ready.link(this);
</span><span class="cx"> #endif
</span><span class="cx">     
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITPropertyAccess32_64cpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp  2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp     2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -545,7 +545,7 @@
</span><span class="cx">         convertInt32ToDouble(regT0, fpRegT0);
</span><span class="cx">         Jump ready = jump();
</span><span class="cx">         notInt.link(this);
</span><del>-        moveIntsToDouble(regT0, regT1, fpRegT0, fpRegT1);
</del><ins>+        moveIntsToDouble(regT0, regT1, fpRegT0);
</ins><span class="cx">         slowCases.append(branchIfNaN(fpRegT0));
</span><span class="cx">         ready.link(this);
</span><span class="cx">         storeDouble(fpRegT0, BaseIndex(regT3, regT2, TimesEight));
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITRightShiftGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.cpp  2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.cpp     2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -38,7 +38,6 @@
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">     ASSERT(m_scratchGPR != m_left.tagGPR());
</span><span class="cx">     ASSERT(m_scratchGPR != m_right.tagGPR());
</span><del>-    ASSERT(m_scratchFPR != InvalidFPRReg);
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
</span><span class="lines">@@ -69,7 +68,7 @@
</span><span class="cx"> 
</span><span class="cx">             m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
</span><span class="cx"> 
</span><del>-            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
</ins><span class="cx"> #if CPU(ARM64)
</span><span class="cx">             if (MacroAssemblerARM64::supportsDoubleToInt32ConversionUsingJavaScriptSemantics())
</span><span class="cx">                 jit.convertDoubleToInt32UsingJavaScriptSemantics(m_leftFPR, m_scratchGPR);
</span><span class="lines">@@ -128,7 +127,7 @@
</span><span class="cx">             leftNotInt.link(&jit);
</span><span class="cx"> 
</span><span class="cx">             m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
</span><del>-            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
</ins><span class="cx"> #if CPU(ARM64)
</span><span class="cx">             if (MacroAssemblerARM64::supportsDoubleToInt32ConversionUsingJavaScriptSemantics())
</span><span class="cx">                 jit.convertDoubleToInt32UsingJavaScriptSemantics(m_leftFPR, m_scratchGPR);
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITRightShiftGeneratorh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.h    2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITRightShiftGenerator.h       2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -40,11 +40,10 @@
</span><span class="cx"> 
</span><span class="cx">     JITRightShiftGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
</span><span class="cx">         JSValueRegs result, JSValueRegs left, JSValueRegs right,
</span><del>-        FPRReg leftFPR, GPRReg scratchGPR, FPRReg scratchFPR, ShiftType type = SignedShift)
</del><ins>+        FPRReg leftFPR, GPRReg scratchGPR, ShiftType type = SignedShift)
</ins><span class="cx">         : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, scratchGPR)
</span><span class="cx">         , m_shiftType(type)
</span><span class="cx">         , m_leftFPR(leftFPR)
</span><del>-        , m_scratchFPR(scratchFPR)
</del><span class="cx">     { }
</span><span class="cx"> 
</span><span class="cx">     void generateFastPath(CCallHelpers&);
</span><span class="lines">@@ -52,7 +51,6 @@
</span><span class="cx"> private:
</span><span class="cx">     ShiftType m_shiftType;
</span><span class="cx">     FPRReg m_leftFPR;
</span><del>-    FPRReg m_scratchFPR;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITSubGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.cpp (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.cpp 2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.cpp    2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -56,8 +56,8 @@
</span><span class="cx">             state.slowPathJumps.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
</span><span class="cx">         state.slowPathJumps.append(jit.branchIfInt32(m_left));
</span><span class="cx">         state.slowPathJumps.append(jit.branchIfInt32(m_right));
</span><del>-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
</ins><span class="cx">         jit.subDouble(m_rightFPR, m_leftFPR);
</span><span class="cx">         jit.boxDouble(m_leftFPR, m_result);
</span><span class="cx"> 
</span><span class="lines">@@ -86,7 +86,6 @@
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">     ASSERT(m_scratchGPR != m_left.tagGPR());
</span><span class="cx">     ASSERT(m_scratchGPR != m_right.tagGPR());
</span><del>-    ASSERT(m_scratchFPR != InvalidFPRReg);
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     CCallHelpers::Jump leftNotInt = jit.branchIfNotInt32(m_left);
</span><span class="lines">@@ -111,7 +110,7 @@
</span><span class="cx">     if (!m_rightOperand.definitelyIsNumber())
</span><span class="cx">         slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
</span><span class="cx"> 
</span><del>-    jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+    jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
</ins><span class="cx">     CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
</span><span class="cx"> 
</span><span class="cx">     jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
</span><span class="lines">@@ -124,7 +123,7 @@
</span><span class="cx">     jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
</span><span class="cx"> 
</span><span class="cx">     rightIsDouble.link(&jit);
</span><del>-    jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
</del><ins>+    jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
</ins><span class="cx"> 
</span><span class="cx">     rightWasInteger.link(&jit);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorejitJITSubGeneratorh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.h (281888 => 281889)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.h   2021-09-02 00:15:35 UTC (rev 281888)
+++ branches/safari-612-branch/Source/JavaScriptCore/jit/JITSubGenerator.h      2021-09-02 01:04:25 UTC (rev 281889)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITSubGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
</span><span class="cx">         JSValueRegs result, JSValueRegs left, JSValueRegs right,
</span><del>-        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
</del><ins>+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR)
</ins><span class="cx">         : m_leftOperand(leftOperand)
</span><span class="cx">         , m_rightOperand(rightOperand)
</span><span class="cx">         , m_result(result)
</span><span class="lines">@@ -50,7 +50,6 @@
</span><span class="cx">         , m_leftFPR(leftFPR)
</span><span class="cx">         , m_rightFPR(rightFPR)
</span><span class="cx">         , m_scratchGPR(scratchGPR)
</span><del>-        , m_scratchFPR(scratchFPR)
</del><span class="cx">     { }
</span><span class="cx"> 
</span><span class="cx">     JITMathICInlineResult generateInline(CCallHelpers&, MathICGenerationState&, const BinaryArithProfile*);
</span><span class="lines">@@ -68,7 +67,6 @@
</span><span class="cx">     FPRReg m_leftFPR;
</span><span class="cx">     FPRReg m_rightFPR;
</span><span class="cx">     GPRReg m_scratchGPR;
</span><del>-    FPRReg m_scratchFPR;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre>
</div>
</div>

</body>
</html>