Diff
Modified: trunk/JSTests/ChangeLog (241227 => 241228)
--- trunk/JSTests/ChangeLog 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/JSTests/ChangeLog 2019-02-09 03:05:40 UTC (rev 241228)
@@ -1,3 +1,14 @@
+2019-02-08 Saam barati <[email protected]>
+
+ Nodes that rely on being dominated by CheckInBounds should have a child edge to it
+ https://bugs.webkit.org/show_bug.cgi?id=194334
+ <rdar://problem/47844327>
+
+ Reviewed by Mark Lam.
+
+ * stress/check-in-bounds-should-be-a-child-use.js: Added.
+ (func):
+
2019-02-06 Yusuke Suzuki <[email protected]>
[JSC] InitializeEntrypointArguments should produce SpecCellCheck if FlushFormat is FlushedCell
Added: trunk/JSTests/stress/check-in-bounds-should-be-a-child-use.js (0 => 241228)
--- trunk/JSTests/stress/check-in-bounds-should-be-a-child-use.js (rev 0)
+++ trunk/JSTests/stress/check-in-bounds-should-be-a-child-use.js 2019-02-09 03:05:40 UTC (rev 241228)
@@ -0,0 +1,16 @@
+//@ runDefault("--useConcurrentJIT=0", "--thresholdForFTLOptimizeAfterWarmUp=100")
+
+const hello = [1337,1337,1337,1337];
+const arr = [1337,1337];
+
+function func(arg) {
+ for (let p in arg) {
+ arg.a = 42;
+ const val = arg[-698666199];
+ }
+}
+
+for (let i = 0; i < 10000; ++i) {
+ const a = func(arr);
+ const b = func(1337);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (241227 => 241228)
--- trunk/Source/_javascript_Core/ChangeLog 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-02-09 03:05:40 UTC (rev 241228)
@@ -1,3 +1,35 @@
+2019-02-08 Saam barati <[email protected]>
+
+ Nodes that rely on being dominated by CheckInBounds should have a child edge to it
+ https://bugs.webkit.org/show_bug.cgi?id=194334
+ <rdar://problem/47844327>
+
+ Reviewed by Mark Lam.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGArgumentsEliminationPhase.cpp:
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ (JSC::DFG::FixupPhase::convertToHasIndexedProperty):
+ * dfg/DFGIntegerCheckCombiningPhase.cpp:
+ (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+ * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+ * dfg/DFGNodeType.h:
+ * dfg/DFGSSALoweringPhase.cpp:
+ (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBounds):
+ (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
+
2019-02-08 Yusuke Suzuki <[email protected]>
[JSC] Shrink sizeof(CodeBlock) more
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2019-02-09 03:05:40 UTC (rev 241228)
@@ -3458,11 +3458,16 @@
case CheckInBounds: {
JSValue left = forNode(node->child1()).value();
JSValue right = forNode(node->child2()).value();
- if (left && right && left.isInt32() && right.isInt32()
- && static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32())) {
+ if (left && right && left.isInt32() && right.isInt32() && static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32()))
m_state.setFoundConstants(true);
- break;
- }
+
+ // We claim we result in Int32. It's not really important what our result is (though we
+ // don't want to claim we may result in the empty value), other nodes with data flow edges
+ // to us just do that to maintain the invariant that they can't be hoisted higher than us.
+ // So we just arbitrarily pick Int32. In some ways, StorageResult may be the more correct
+ // thing to do here. We pick NodeResultJS because it makes converting this to an identity
+ // easier.
+ setNonCellTypeForNode(node, SpecInt32Only);
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -770,14 +770,15 @@
arg += inlineCallFrame->stackOffset;
data = "" FlushedJSValue);
+ Node* check = nullptr;
if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
- insertionSet.insertNode(
+ check = insertionSet.insertNode(
nodeIndex, SpecNone, CheckInBounds, node->origin,
m_graph.varArgChild(node, 1), Edge(getArrayLength(candidate), Int32Use));
}
result = insertionSet.insertNode(
- nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data));
+ nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data), Edge(check, UntypedUse));
}
}
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -6830,7 +6830,10 @@
Node* base = get(bytecode.m_base);
ArrayMode arrayMode = getArrayMode(bytecode.metadata(codeBlock).m_arrayProfile, Array::Read);
Node* property = get(bytecode.m_property);
- Node* hasIterableProperty = addToGraph(HasIndexedProperty, OpInfo(arrayMode.asWord()), OpInfo(static_cast<uint32_t>(PropertySlot::InternalMethodType::GetOwnProperty)), base, property);
+ addVarArgChild(base);
+ addVarArgChild(property);
+ addVarArgChild(nullptr);
+ Node* hasIterableProperty = addToGraph(Node::VarArg, HasIndexedProperty, OpInfo(arrayMode.asWord()), OpInfo(static_cast<uint32_t>(PropertySlot::InternalMethodType::GetOwnProperty)));
set(bytecode.m_dst, hasIterableProperty);
NEXT_OPCODE(op_has_indexed_property);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2019-02-09 03:05:40 UTC (rev 241228)
@@ -312,7 +312,7 @@
if (mode.isInBounds()) {
read(Butterfly_publicLength);
read(IndexedInt32Properties);
- def(HeapLocation(HasIndexedPropertyLoc, IndexedInt32Properties, node->child1(), node->child2()), LazyNode(node));
+ def(HeapLocation(HasIndexedPropertyLoc, IndexedInt32Properties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));
return;
}
read(Heap);
@@ -323,7 +323,7 @@
if (mode.isInBounds()) {
read(Butterfly_publicLength);
read(IndexedDoubleProperties);
- def(HeapLocation(HasIndexedPropertyLoc, IndexedDoubleProperties, node->child1(), node->child2()), LazyNode(node));
+ def(HeapLocation(HasIndexedPropertyLoc, IndexedDoubleProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));
return;
}
read(Heap);
@@ -334,7 +334,7 @@
if (mode.isInBounds()) {
read(Butterfly_publicLength);
read(IndexedContiguousProperties);
- def(HeapLocation(HasIndexedPropertyLoc, IndexedContiguousProperties, node->child1(), node->child2()), LazyNode(node));
+ def(HeapLocation(HasIndexedPropertyLoc, IndexedContiguousProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));
return;
}
read(Heap);
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -340,7 +340,9 @@
JSValue right = m_state.forNode(node->child2()).value();
if (left && right && left.isInt32() && right.isInt32()
&& static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32())) {
- node->remove(m_graph);
+
+ Node* zero = m_insertionSet.insertConstant(indexInBlock, node->origin, jsNumber(0));
+ node->convertToIdentityOn(zero);
eliminated = true;
break;
}
@@ -409,10 +411,11 @@
Node* length = emitCodeToGetArgumentsArrayLength(
m_insertionSet, arguments, indexInBlock, node->origin);
- m_insertionSet.insertNode(
+ Node* check = m_insertionSet.insertNode(
indexInBlock, SpecNone, CheckInBounds, node->origin,
node->child2(), Edge(length, Int32Use));
node->convertToGetStack(data);
+ node->child1() = Edge(check, UntypedUse);
eliminated = true;
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -1849,13 +1849,13 @@
node->setArrayMode(
node->arrayMode().refine(
m_graph, node,
- node->child1()->prediction(),
- node->child2()->prediction(),
+ m_graph.varArgChild(node, 0)->prediction(),
+ m_graph.varArgChild(node, 1)->prediction(),
SpecNone));
- blessArrayOperation(node->child1(), node->child2(), node->child3());
- fixEdge<CellUse>(node->child1());
- fixEdge<KnownInt32Use>(node->child2());
+ blessArrayOperation(m_graph.varArgChild(node, 0), m_graph.varArgChild(node, 1), m_graph.varArgChild(node, 2));
+ fixEdge<CellUse>(m_graph.varArgChild(node, 0));
+ fixEdge<KnownInt32Use>(m_graph.varArgChild(node, 1));
break;
}
case GetDirectPname: {
@@ -3484,18 +3484,29 @@
{
node->setOp(HasIndexedProperty);
node->clearFlags(NodeMustGenerate);
+
+ {
+ unsigned firstChild = m_graph.m_varArgChildren.size();
+ unsigned numChildren = 3;
+ m_graph.m_varArgChildren.append(node->child1());
+ m_graph.m_varArgChildren.append(node->child2());
+ m_graph.m_varArgChildren.append(Edge());
+ node->mergeFlags(NodeHasVarArgs);
+ node->children = AdjacencyList(AdjacencyList::Variable, firstChild, numChildren);
+ }
+
node->setArrayMode(
node->arrayMode().refine(
m_graph, node,
- node->child1()->prediction(),
- node->child2()->prediction(),
+ m_graph.varArgChild(node, 0)->prediction(),
+ m_graph.varArgChild(node, 1)->prediction(),
SpecNone));
node->setInternalMethodType(PropertySlot::InternalMethodType::HasProperty);
- blessArrayOperation(node->child1(), node->child2(), node->child3());
+ blessArrayOperation(m_graph.varArgChild(node, 0), m_graph.varArgChild(node, 1), m_graph.varArgChild(node, 2));
- fixEdge<CellUse>(node->child1());
- fixEdge<Int32Use>(node->child2());
+ fixEdge<CellUse>(m_graph.varArgChild(node, 0));
+ fixEdge<Int32Use>(m_graph.varArgChild(node, 1));
}
void fixupNormalizeMapKey(Node* node)
Modified: trunk/Source/_javascript_Core/dfg/DFGIntegerCheckCombiningPhase.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGIntegerCheckCombiningPhase.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGIntegerCheckCombiningPhase.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -150,6 +150,7 @@
CodeOrigin m_maxOrigin;
unsigned m_count { 0 }; // If this is zero then the bounds won't necessarily make sense.
bool m_hoisted { false };
+ Node* m_dependency { nullptr };
};
IntegerCheckCombiningPhase(Graph& graph)
@@ -257,14 +258,15 @@
Arith::Unchecked);
}
+ Node* minCheck = nullptr;
if (minNode) {
- m_insertionSet.insertNode(
+ minCheck = m_insertionSet.insertNode(
nodeIndex, SpecNone, CheckInBounds, node->origin,
Edge(minNode, Int32Use), Edge(data.m_key.m_key, Int32Use));
}
- m_insertionSet.insertNode(
+ m_map[data.m_key].m_dependency = m_insertionSet.insertNode(
nodeIndex, SpecNone, CheckInBounds, node->origin,
- Edge(maxNode, Int32Use), Edge(data.m_key.m_key, Int32Use));
+ Edge(maxNode, Int32Use), Edge(data.m_key.m_key, Int32Use), Edge(minCheck, UntypedUse));
break;
}
@@ -284,7 +286,7 @@
break;
case ArrayBounds:
- node->remove(m_graph);
+ node->convertToIdentityOn(m_map[data.m_key].m_dependency);
m_changed = true;
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -1010,16 +1010,8 @@
ASSERT(m_graph.m_form == SSA);
// Before we do anything, make sure that we have a zero constant at the top.
- for (Node* node : *m_graph.block(0)) {
- if (node->isInt32Constant() && !node->asInt32()) {
- m_zero = node;
- break;
- }
- }
- if (!m_zero) {
- m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
- m_insertionSet.execute(m_graph.block(0));
- }
+ m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
+ m_insertionSet.execute(m_graph.block(0));
if (DFGIntegerRangeOptimizationPhaseInternal::verbose) {
dataLog("Graph before integer range optimization:\n");
@@ -1329,7 +1321,7 @@
if (nonNegative && lessThanLength) {
executeNode(block->at(nodeIndex));
- node->remove(m_graph);
+ node->convertToIdentityOn(m_zero);
changed = true;
}
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGNodeType.h (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGNodeType.h 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGNodeType.h 2019-02-09 03:05:40 UTC (rev 241228)
@@ -258,7 +258,7 @@
macro(CheckNotEmpty, NodeMustGenerate) \
macro(AssertNotEmpty, NodeMustGenerate) \
macro(CheckBadCell, NodeMustGenerate) \
- macro(CheckInBounds, NodeMustGenerate) \
+ macro(CheckInBounds, NodeMustGenerate | NodeResultJS) \
macro(CheckStringIdent, NodeMustGenerate) \
macro(CheckTypeInfoFlags, NodeMustGenerate) /* Takes an OpInfo with the flags you want to test are set */\
macro(CheckSubClass, NodeMustGenerate) \
@@ -452,7 +452,7 @@
\
/* For-in enumeration opcodes */\
macro(GetEnumerableLength, NodeMustGenerate | NodeResultJS) \
- macro(HasIndexedProperty, NodeResultBoolean) \
+ macro(HasIndexedProperty, NodeResultBoolean | NodeHasVarArgs) \
macro(HasStructureProperty, NodeResultBoolean) \
macro(HasGenericProperty, NodeResultBoolean) \
macro(GetDirectPname, NodeMustGenerate | NodeHasVarArgs | NodeResultJS) \
Modified: trunk/Source/_javascript_Core/dfg/DFGSSALoweringPhase.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGSSALoweringPhase.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGSSALoweringPhase.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -135,9 +135,14 @@
Node* length = m_insertionSet.insertNode(
m_nodeIndex, SpecInt32Only, op, m_node->origin,
OpInfo(m_node->arrayMode().asWord()), Edge(base.node(), KnownCellUse), storage);
- m_insertionSet.insertNode(
+ Node* checkInBounds = m_insertionSet.insertNode(
m_nodeIndex, SpecInt32Only, CheckInBounds, m_node->origin,
index, Edge(length, KnownInt32Use));
+
+ AdjacencyList adjacencyList = m_graph.copyVarargChildren(m_node);
+ m_graph.m_varArgChildren.append(Edge(checkInBounds, UntypedUse));
+ adjacencyList.setNumChildren(adjacencyList.numChildren() + 1);
+ m_node->children = adjacencyList;
return true;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -13036,8 +13036,8 @@
void SpeculativeJIT::compileHasIndexedProperty(Node* node)
{
- SpeculateCellOperand base(this, node->child1());
- SpeculateStrictInt32Operand index(this, node->child2());
+ SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
+ SpeculateStrictInt32Operand index(this, m_graph.varArgChild(node, 1));
GPRTemporary result(this);
GPRReg baseGPR = base.gpr();
@@ -13049,8 +13049,8 @@
switch (mode.type()) {
case Array::Int32:
case Array::Contiguous: {
- ASSERT(!!node->child3());
- StorageOperand storage(this, node->child3());
+ ASSERT(!!m_graph.varArgChild(node, 2));
+ StorageOperand storage(this, m_graph.varArgChild(node, 2));
GPRTemporary scratch(this);
GPRReg storageGPR = storage.gpr();
@@ -13073,8 +13073,8 @@
break;
}
case Array::Double: {
- ASSERT(!!node->child3());
- StorageOperand storage(this, node->child3());
+ ASSERT(!!m_graph.varArgChild(node, 2));
+ StorageOperand storage(this, m_graph.varArgChild(node, 2));
FPRTemporary scratch(this);
FPRReg scratchFPR = scratch.fpr();
GPRReg storageGPR = storage.gpr();
@@ -13091,8 +13091,8 @@
break;
}
case Array::ArrayStorage: {
- ASSERT(!!node->child3());
- StorageOperand storage(this, node->child3());
+ ASSERT(!!m_graph.varArgChild(node, 2));
+ StorageOperand storage(this, m_graph.varArgChild(node, 2));
GPRTemporary scratch(this);
GPRReg storageGPR = storage.gpr();
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (241227 => 241228)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-02-09 02:31:52 UTC (rev 241227)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-02-09 03:05:40 UTC (rev 241228)
@@ -3876,6 +3876,10 @@
speculate(
OutOfBounds, noValue(), 0,
m_out.aboveOrEqual(lowInt32(m_node->child1()), lowInt32(m_node->child2())));
+
+ // Even though we claim to have JSValue result, no user of us should
+ // depend on our value. Users of this node just need to maintain that
+ // we dominate them.
}
void compileGetByVal()
@@ -10422,12 +10426,13 @@
void compileHasIndexedProperty()
{
+ LValue base = lowCell(m_graph.varArgChild(m_node, 0));
+ LValue index = lowInt32(m_graph.varArgChild(m_node, 1));
+
switch (m_node->arrayMode().type()) {
case Array::Int32:
case Array::Contiguous: {
- LValue base = lowCell(m_node->child1());
- LValue index = lowInt32(m_node->child2());
- LValue storage = lowStorage(m_node->child3());
+ LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
@@ -10448,7 +10453,7 @@
lastNext = m_out.insertNewBlocksBefore(slowCase);
LValue checkHoleResultValue =
- m_out.notZero64(m_out.load64(baseIndex(heap, storage, index, m_node->child2())));
+ m_out.notZero64(m_out.load64(baseIndex(heap, storage, index, m_graph.varArgChild(m_node, 1))));
ValueFromBlock checkHoleResult = m_out.anchor(checkHoleResultValue);
m_out.branch(checkHoleResultValue, usually(continuation), rarely(slowCase));
@@ -10462,9 +10467,7 @@
return;
}
case Array::Double: {
- LValue base = lowCell(m_node->child1());
- LValue index = lowInt32(m_node->child2());
- LValue storage = lowStorage(m_node->child3());
+ LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
@@ -10483,7 +10486,7 @@
} else
lastNext = m_out.insertNewBlocksBefore(slowCase);
- LValue doubleValue = m_out.loadDouble(baseIndex(heap, storage, index, m_node->child2()));
+ LValue doubleValue = m_out.loadDouble(baseIndex(heap, storage, index, m_graph.varArgChild(m_node, 1)));
LValue checkHoleResultValue = m_out.doubleEqual(doubleValue, doubleValue);
ValueFromBlock checkHoleResult = m_out.anchor(checkHoleResultValue);
m_out.branch(checkHoleResultValue, usually(continuation), rarely(slowCase));
@@ -10499,9 +10502,7 @@
}
case Array::ArrayStorage: {
- LValue base = lowCell(m_node->child1());
- LValue index = lowInt32(m_node->child2());
- LValue storage = lowStorage(m_node->child3());
+ LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
LBasicBlock slowCase = m_out.newBlock();
@@ -10519,7 +10520,7 @@
lastNext = m_out.insertNewBlocksBefore(slowCase);
LValue checkHoleResultValue =
- m_out.notZero64(m_out.load64(baseIndex(m_heaps.ArrayStorage_vector, storage, index, m_node->child2())));
+ m_out.notZero64(m_out.load64(baseIndex(m_heaps.ArrayStorage_vector, storage, index, m_graph.varArgChild(m_node, 1))));
ValueFromBlock checkHoleResult = m_out.anchor(checkHoleResultValue);
m_out.branch(checkHoleResultValue, usually(continuation), rarely(slowCase));
@@ -10534,8 +10535,6 @@
}
default: {
- LValue base = lowCell(m_node->child1());
- LValue index = lowInt32(m_node->child2());
LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
setBoolean(m_out.notZero64(vmCall(Int64, m_out.operation(operationHasIndexedPropertyByInt), m_callFrame, base, index, internalMethodType)));
break;
