Title: [205380] trunk/Source/_javascript_Core
- Revision
- 205380
- Author
- [email protected]
- Date
- 2016-09-02 16:13:50 -0700 (Fri, 02 Sep 2016)
Log Message
[JSC] Remove some more useless cases from FTL Capabilities
https://bugs.webkit.org/show_bug.cgi?id=161466
Patch by Benjamin Poulain <[email protected]> on 2016-09-02
Reviewed by Geoffrey Garen.
Some cases do not make sense:
-In: Fixup only generate CellUse.
-PutByIdXXX: same.
-GetIndexedPropertyStorage: those cases are the only ones supported
by DFG. We would have crashed in SpeculativeJIT if other modes
were generated.
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compilePutById):
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileIn):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (205379 => 205380)
--- trunk/Source/_javascript_Core/ChangeLog 2016-09-02 22:52:13 UTC (rev 205379)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-09-02 23:13:50 UTC (rev 205380)
@@ -1,3 +1,24 @@
+2016-09-02 Benjamin Poulain <[email protected]>
+
+ [JSC] Remove some more useless cases from FTL Capabilities
+ https://bugs.webkit.org/show_bug.cgi?id=161466
+
+ Reviewed by Geoffrey Garen.
+
+ Some cases do not make sense:
+ -In: Fixup only generate CellUse.
+ -PutByIdXXX: same.
+ -GetIndexedPropertyStorage: those cases are the only ones supported
+ by DFG. We would have crashed in SpeculativeJIT if other modes
+ were generated.
+
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compilePutById):
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
+ (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+
2016-09-02 Chris Dumez <[email protected]>
Unreviewed, roll out r205354 because it caused JSC test failures
Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (205379 => 205380)
--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2016-09-02 22:52:13 UTC (rev 205379)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp 2016-09-02 23:13:50 UTC (rev 205380)
@@ -179,6 +179,7 @@
case Throw:
case ThrowReferenceError:
case Unreachable:
+ case In:
case IsJSArray:
case IsEmpty:
case IsUndefined:
@@ -204,6 +205,7 @@
case HasStructureProperty:
case GetDirectPname:
case GetEnumerableLength:
+ case GetIndexedPropertyStorage:
case GetPropertyEnumerator:
case GetEnumeratorStructurePname:
case GetEnumeratorGenericPname:
@@ -224,6 +226,10 @@
case ForwardVarargs:
case Switch:
case TypeOf:
+ case PutById:
+ case PutByIdDirect:
+ case PutByIdFlush:
+ case PutByIdWithThis:
case PutGetterById:
case PutSetterById:
case PutGetterSetterById:
@@ -261,24 +267,6 @@
// case because it would prevent us from catching bugs where the FTL backend
// pipeline failed to optimize out an Identity.
break;
- case In:
- if (node->child2().useKind() == CellUse)
- break;
- return CannotCompile;
- case PutByIdDirect:
- case PutById:
- case PutByIdFlush:
- if (node->child1().useKind() == CellUse)
- break;
- return CannotCompile;
- case PutByIdWithThis:
- break;
- case GetIndexedPropertyStorage:
- if (node->arrayMode().type() == Array::String)
- break;
- if (isTypedView(node->arrayMode().typedArrayType()))
- break;
- return CannotCompile;
case CheckArray:
switch (node->arrayMode().type()) {
case Array::Int32:
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (205379 => 205380)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2016-09-02 22:52:13 UTC (rev 205379)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2016-09-02 23:13:50 UTC (rev 205380)
@@ -2707,11 +2707,9 @@
void compilePutById()
{
+ DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == CellUse);
+
Node* node = m_node;
-
- // See above; CellUse is easier so we do only that for now.
- ASSERT(node->child1().useKind() == CellUse);
-
LValue base = lowCell(node->child1());
LValue value = lowJSValue(node->child2());
auto uid = m_graph.identifiers()[node->identifierNumber()];
@@ -2813,7 +2811,8 @@
setStorage(m_out.loadPtr(m_out.phi(pointerType(), fastResult, slowResult), m_heaps.StringImpl_data));
return;
}
-
+
+ DFG_ASSERT(m_graph, m_node, isTypedView(m_node->arrayMode().typedArrayType()));
setStorage(m_out.loadPtr(cell, m_heaps.JSArrayBufferView_vector));
}
@@ -6511,6 +6510,8 @@
void compileIn()
{
+ DFG_ASSERT(m_graph, m_node, m_node->child2().useKind() == CellUse);
+
Node* node = m_node;
Edge base = node->child2();
LValue cell = lowCell(base);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
