Diff
Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-05-13 09:54:15 UTC (rev 200825)
@@ -1018,22 +1018,6 @@
* js/dfg-osr-exit-between-create-and-tearoff-arguments.html: Removed.
* js/script-tests/dfg-osr-exit-between-create-and-tearoff-arguments.js: Removed.
-2016-03-03 Filip Pizlo <[email protected]>
-
- DFG should be able to compile StringReplace
- https://bugs.webkit.org/show_bug.cgi?id=154979
-
- Reviewed by Benjamin Poulain.
-
- Add a microbenchmark for a case of StringReplace that we hadn't covered with a microbenchmark
- yet: using something absurd for the replace value. This is interesting for implementing the
- 32_64 version of StringReplace, which gets really weird in the absurd case because of how it
- consumes the entire register file while making the call on x86-32.
-
- * js/regress/script-tests/string-replace-generic.js: Added.
- * js/regress/string-replace-generic-expected.txt: Added.
- * js/regress/string-replace-generic.html: Added.
-
2016-03-02 Zalan Bujtas <[email protected]>
Paint table borders on empty cells even in quirks mode.
Deleted: releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/script-tests/string-replace-generic.js (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/script-tests/string-replace-generic.js 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/script-tests/string-replace-generic.js 2016-05-13 09:54:15 UTC (rev 200825)
@@ -1,8 +0,0 @@
-(function() {
- var result;
- for (var i = 0; i < 400000; ++i) {
- result = "foo".replace(/f/g, 42);
- }
- if (result != "42oo")
- throw "Error: bad result: "+ result;
-})();
Deleted: releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/string-replace-generic-expected.txt (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/string-replace-generic-expected.txt 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/string-replace-generic-expected.txt 2016-05-13 09:54:15 UTC (rev 200825)
@@ -1,10 +0,0 @@
-JSRegress/string-replace-generic
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
Deleted: releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/string-replace-generic.html (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/string-replace-generic.html 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/js/regress/string-replace-generic.html 2016-05-13 09:54:15 UTC (rev 200825)
@@ -1,12 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src=""
-</head>
-<body>
-<script src=""
-<script src=""
-<script src=""
-<script src=""
-</body>
-</html>
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog 2016-05-13 09:54:15 UTC (rev 200825)
@@ -849,29 +849,6 @@
(JSC::DFG::Node::shouldSpeculateCellOrOther):
(JSC::DFG::Node::shouldSpeculateNotCell):
-2016-03-03 Filip Pizlo <[email protected]>
-
- DFG should be able to compile StringReplace
- https://bugs.webkit.org/show_bug.cgi?id=154979
-
- Reviewed by Benjamin Poulain.
-
- Adds support for StringReplace to the DFG tier. This is a 3% speed-up on Octane/regexp.
-
- * dfg/DFGByteCodeParser.cpp:
- (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
- * dfg/DFGSpeculativeJIT.cpp:
- (JSC::DFG::SpeculativeJIT::speculateFinalObject):
- (JSC::DFG::SpeculativeJIT::speculateRegExpObject):
- (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
- * dfg/DFGSpeculativeJIT.h:
- (JSC::DFG::SpeculativeJIT::callOperation):
- * dfg/DFGSpeculativeJIT32_64.cpp:
- (JSC::DFG::SpeculativeJIT::compile):
- * dfg/DFGSpeculativeJIT64.cpp:
- (JSC::DFG::SpeculativeJIT::compile):
- * jit/JITOperations.h:
-
2016-03-02 Filip Pizlo <[email protected]>
RegExpExec/RegExpTest should not unconditionally speculate cell
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2016-05-13 09:54:15 UTC (rev 200825)
@@ -2190,6 +2190,12 @@
}
case StringPrototypeReplaceIntrinsic: {
+ if (!isFTL(m_graph.m_plan.mode)) {
+ // This is a marginally profitable intrinsic. We've only the work to make it an
+ // intrinsic on the fourth tier.
+ return false;
+ }
+
if (argumentCountIncludingThis != 3)
return false;
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2016-05-13 09:54:15 UTC (rev 200825)
@@ -6678,18 +6678,13 @@
speculateCellType(edge, operand.gpr(), SpecFinalObject, FinalObjectType);
}
-void SpeculativeJIT::speculateRegExpObject(Edge edge, GPRReg cell)
-{
- speculateCellType(edge, cell, SpecRegExpObject, RegExpObjectType);
-}
-
void SpeculativeJIT::speculateRegExpObject(Edge edge)
{
if (!needsTypeCheck(edge, SpecRegExpObject))
return;
SpeculateCellOperand operand(this, edge);
- speculateRegExpObject(edge, operand.gpr());
+ speculateCellType(edge, operand.gpr(), SpecRegExpObject, RegExpObjectType);
}
void SpeculativeJIT::speculateObjectOrOther(Edge edge)
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2016-05-13 09:54:15 UTC (rev 200825)
@@ -1272,16 +1272,6 @@
m_jit.setupArgumentsWithExecState(arg1, arg2);
return appendCallSetResult(operation, result);
}
- JITCompiler::Call callOperation(J_JITOperation_EJssReo operation, GPRReg result, GPRReg arg1, GPRReg arg2)
- {
- m_jit.setupArgumentsWithExecState(arg1, arg2);
- return appendCallSetResult(operation, result);
- }
- JITCompiler::Call callOperation(J_JITOperation_EJssReoJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
- {
- m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
- return appendCallSetResult(operation, result);
- }
JITCompiler::Call callOperation(J_JITOperation_EJssZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
{
m_jit.setupArgumentsWithExecState(arg1, arg2);
@@ -1445,25 +1435,20 @@
m_jit.setupArgumentsWithExecState(arg1, arg2);
return appendCallSetResult(operation, result);
}
- JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, int32_t imm)
+ JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, MacroAssembler::TrustedImm32 imm)
{
- m_jit.setupArgumentsWithExecState(arg1, MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(imm))));
+ m_jit.setupArgumentsWithExecState(arg1, MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(imm.m_value))));
return appendCallSetResult(operation, result);
}
- JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, int32_t imm, GPRReg arg2)
+ JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, MacroAssembler::TrustedImm32 imm, GPRReg arg2)
{
- m_jit.setupArgumentsWithExecState(MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(imm))), arg2);
+ m_jit.setupArgumentsWithExecState(MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(imm.m_value))), arg2);
return appendCallSetResult(operation, result);
}
JITCompiler::Call callOperation(J_JITOperation_EJJ operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2)
{
return callOperation(operation, result.payloadGPR(), arg1.payloadGPR(), arg2.payloadGPR());
}
- JITCompiler::Call callOperation(J_JITOperation_EJJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
- {
- m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
- return appendCallSetResult(operation, result);
- }
JITCompiler::Call callOperation(J_JITOperation_ECC operation, GPRReg result, GPRReg arg1, GPRReg arg2)
{
m_jit.setupArgumentsWithExecState(arg1, arg2);
@@ -1649,16 +1634,6 @@
m_jit.setupArgumentsWithExecState(arg1, arg2);
return appendCallSetResult(operation, resultPayload, resultTag);
}
- JITCompiler::Call callOperation(J_JITOperation_EJssReo operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2)
- {
- m_jit.setupArgumentsWithExecState(arg1, arg2);
- return appendCallSetResult(operation, resultPayload, resultTag);
- }
- JITCompiler::Call callOperation(J_JITOperation_EJssReoJss operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2, GPRReg arg3)
- {
- m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
- return appendCallSetResult(operation, resultPayload, resultTag);
- }
JITCompiler::Call callOperation(J_JITOperation_EPS operation, GPRReg resultTag, GPRReg resultPayload, void* pointer, size_t size)
{
m_jit.setupArgumentsWithExecState(TrustedImmPtr(pointer), TrustedImmPtr(size));
@@ -1816,11 +1791,6 @@
{
return callOperation(operation, result.tagGPR(), result.payloadGPR(), arg1.tagGPR(), arg1.payloadGPR(), arg2.tagGPR(), arg2.payloadGPR());
}
- JITCompiler::Call callOperation(J_JITOperation_EJJJ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload, GPRReg arg3Tag, GPRReg arg3Payload)
- {
- m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, arg2Payload, arg2Tag, arg3Payload, arg3Tag);
- return appendCallSetResult(operation, resultPayload, resultTag);
- }
JITCompiler::Call callOperation(J_JITOperation_ECJ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2Tag, GPRReg arg2Payload)
{
@@ -2502,7 +2472,6 @@
void speculateObject(Edge);
void speculateFunction(Edge);
void speculateFinalObject(Edge);
- void speculateRegExpObject(Edge, GPRReg cell);
void speculateRegExpObject(Edge);
void speculateObjectOrOther(Edge);
void speculateString(Edge edge, GPRReg cell);
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2016-05-13 09:54:15 UTC (rev 200825)
@@ -2910,75 +2910,7 @@
booleanResult(result.gpr(), node);
break;
}
-
- case StringReplace: {
- if (node->child1().useKind() == StringUse
- && node->child2().useKind() == RegExpObjectUse
- && node->child3().useKind() == StringUse) {
- if (JSString* replace = node->child3()->dynamicCastConstant<JSString*>()) {
- if (!replace->length()) {
- SpeculateCellOperand string(this, node->child1());
- SpeculateCellOperand regExp(this, node->child2());
- GPRReg stringGPR = string.gpr();
- GPRReg regExpGPR = regExp.gpr();
- speculateString(node->child1(), stringGPR);
- speculateRegExpObject(node->child2(), regExpGPR);
-
- flushRegisters();
- GPRFlushedCallResult2 resultTag(this);
- GPRFlushedCallResult resultPayload(this);
- callOperation(
- operationStringProtoFuncReplaceRegExpEmptyStr, resultTag.gpr(),
- resultPayload.gpr(), stringGPR, regExpGPR);
- m_jit.exceptionCheck();
- cellResult(resultPayload.gpr(), node);
- break;
- }
- }
-
- SpeculateCellOperand string(this, node->child1());
- SpeculateCellOperand regExp(this, node->child2());
- SpeculateCellOperand replace(this, node->child3());
- GPRReg stringGPR = string.gpr();
- GPRReg regExpGPR = regExp.gpr();
- GPRReg replaceGPR = replace.gpr();
- speculateString(node->child1(), stringGPR);
- speculateRegExpObject(node->child2(), regExpGPR);
- speculateString(node->child3(), replaceGPR);
-
- flushRegisters();
- GPRFlushedCallResult2 resultTag(this);
- GPRFlushedCallResult resultPayload(this);
- callOperation(
- operationStringProtoFuncReplaceRegExpString, resultTag.gpr(), resultPayload.gpr(),
- stringGPR, regExpGPR, replaceGPR);
- m_jit.exceptionCheck();
- cellResult(resultPayload.gpr(), node);
- break;
- }
- JSValueOperand string(this, node->child1());
- JSValueOperand regExp(this, node->child2());
- JSValueOperand replace(this, node->child3());
- GPRReg stringTagGPR = string.tagGPR();
- GPRReg stringPayloadGPR = string.payloadGPR();
- GPRReg regExpTagGPR = regExp.tagGPR();
- GPRReg regExpPayloadGPR = regExp.payloadGPR();
- GPRReg replaceTagGPR = replace.tagGPR();
- GPRReg replacePayloadGPR = replace.payloadGPR();
-
- flushRegisters();
- GPRFlushedCallResult2 resultTag(this);
- GPRFlushedCallResult resultPayload(this);
- callOperation(
- operationStringProtoFuncReplaceGeneric, resultTag.gpr(), resultPayload.gpr(),
- stringTagGPR, stringPayloadGPR, regExpTagGPR, regExpPayloadGPR, replaceTagGPR,
- replacePayloadGPR);
- m_jit.exceptionCheck();
- cellResult(resultPayload.gpr(), node);
- break;
- }
-
case ArrayPush: {
ASSERT(node->arrayMode().isJSArray());
@@ -4938,6 +4870,7 @@
case KillStack:
case GetStack:
case GetMyArgumentByVal:
+ case StringReplace:
DFG_CRASH(m_jit.graph(), node, "unexpected node in DFG backend");
break;
}
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2016-05-13 09:54:15 UTC (rev 200825)
@@ -44,7 +44,6 @@
#include "ObjectPrototype.h"
#include "SetupVarargsFrame.h"
#include "SpillRegistersMode.h"
-#include "StringPrototype.h"
#include "TypeProfilerLog.h"
#include "Watchdog.h"
@@ -3057,68 +3056,7 @@
jsValueResult(result.gpr(), node, DataFormatJSBoolean);
break;
}
-
- case StringReplace: {
- if (node->child1().useKind() == StringUse
- && node->child2().useKind() == RegExpObjectUse
- && node->child3().useKind() == StringUse) {
- if (JSString* replace = node->child3()->dynamicCastConstant<JSString*>()) {
- if (!replace->length()) {
- SpeculateCellOperand string(this, node->child1());
- SpeculateCellOperand regExp(this, node->child2());
- GPRReg stringGPR = string.gpr();
- GPRReg regExpGPR = regExp.gpr();
- speculateString(node->child1(), stringGPR);
- speculateRegExpObject(node->child2(), regExpGPR);
-
- flushRegisters();
- GPRFlushedCallResult result(this);
- callOperation(
- operationStringProtoFuncReplaceRegExpEmptyStr, result.gpr(), stringGPR,
- regExpGPR);
- m_jit.exceptionCheck();
- cellResult(result.gpr(), node);
- break;
- }
- }
-
- SpeculateCellOperand string(this, node->child1());
- SpeculateCellOperand regExp(this, node->child2());
- SpeculateCellOperand replace(this, node->child3());
- GPRReg stringGPR = string.gpr();
- GPRReg regExpGPR = regExp.gpr();
- GPRReg replaceGPR = replace.gpr();
- speculateString(node->child1(), stringGPR);
- speculateRegExpObject(node->child2(), regExpGPR);
- speculateString(node->child3(), replaceGPR);
-
- flushRegisters();
- GPRFlushedCallResult result(this);
- callOperation(
- operationStringProtoFuncReplaceRegExpString, result.gpr(), stringGPR, regExpGPR,
- replaceGPR);
- m_jit.exceptionCheck();
- cellResult(result.gpr(), node);
- break;
- }
- JSValueOperand string(this, node->child1());
- JSValueOperand regExp(this, node->child2());
- JSValueOperand replace(this, node->child3());
- GPRReg stringGPR = string.gpr();
- GPRReg regExpGPR = regExp.gpr();
- GPRReg replaceGPR = replace.gpr();
-
- flushRegisters();
- GPRFlushedCallResult result(this);
- callOperation(
- operationStringProtoFuncReplaceGeneric, result.gpr(), stringGPR, regExpGPR,
- replaceGPR);
- m_jit.exceptionCheck();
- cellResult(result.gpr(), node);
- break;
- }
-
case ArrayPush: {
ASSERT(node->arrayMode().isJSArray());
@@ -5007,6 +4945,7 @@
case PutStack:
case KillStack:
case GetStack:
+ case StringReplace:
DFG_CRASH(m_jit.graph(), node, "Unexpected node");
break;
}
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/jit/JITOperations.h (200824 => 200825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/jit/JITOperations.h 2016-05-13 08:22:21 UTC (rev 200824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/jit/JITOperations.h 2016-05-13 09:54:15 UTC (rev 200825)
@@ -45,7 +45,6 @@
class JSFunction;
class JSLexicalEnvironment;
class JSScope;
-class RegExpObject;
class Register;
class StructureStubInfo;
class SymbolTable;
@@ -95,7 +94,6 @@
Pc: Instruction* i.e. bytecode PC
Q: int64_t
R: Register
- Reo: RegExpObject*
S: size_t
Sprt: SlowPathReturnType
Ssi: StructureStubInfo*
@@ -130,13 +128,9 @@
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJI)(ExecState*, EncodedJSValue, UniquedStringImpl*);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJIdc)(ExecState*, EncodedJSValue, const Identifier*);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
-typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, ArrayProfile*);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, ByValInfo*);
-typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJssZ)(ExecState*, JSString*, int32_t);
-typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJssReo)(ExecState*, JSString*, RegExpObject*);
-typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJssReoJss)(ExecState*, JSString*, RegExpObject*, JSString*);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJP)(ExecState*, EncodedJSValue, void*);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EP)(ExecState*, void*);
typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EPP)(ExecState*, void*, void*);
