Modified: trunk/Source/_javascript_Core/ChangeLog (284787 => 284788)
--- trunk/Source/_javascript_Core/ChangeLog 2021-10-25 16:17:06 UTC (rev 284787)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-10-25 17:02:25 UTC (rev 284788)
@@ -1,3 +1,23 @@
+2021-10-25 Mikhail R. Gadelha <[email protected]>
+
+ [JSC][32bit] Don't speculate Cell on PutByVal
+ https://bugs.webkit.org/show_bug.cgi?id=232242
+
+ Reviewed by Yusuke Suzuki.
+
+ This patch is similar to https://bugs.webkit.org/show_bug.cgi?id=232052
+ but smaller: given that we have more registers available, we don't have
+ to speculate Cells anymore.
+
+ This patch removes the Cell speculation during the DFG FixUp phase and
+ adjust the operationPutByVal* calls to use the generic version (instead
+ of the Cell versions).
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2021-10-25 Geza Lore <[email protected]>
[JSC][32bit] Use DataIC in Baseline JIT
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (284787 => 284788)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2021-10-25 16:17:06 UTC (rev 284787)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2021-10-25 17:02:25 UTC (rev 284788)
@@ -1252,12 +1252,6 @@
break;
}
}
-#if USE(JSVALUE32_64)
- // Due to register pressure on 32-bit, we speculate cell and
- // ignore the base-is-not-cell case entirely by letting the
- // baseline JIT handle it.
- fixEdge<CellUse>(child1);
-#endif
break;
case Array::Int32:
fixEdge<KnownCellUse>(child1);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (284787 => 284788)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2021-10-25 16:17:06 UTC (rev 284787)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2021-10-25 17:02:25 UTC (rev 284788)
@@ -2740,18 +2740,18 @@
}
}
- SpeculateCellOperand base(this, child1); // Save a register, speculate cell. We'll probably be right.
+ JSValueOperand base(this, child1);
JSValueOperand property(this, child2);
JSValueOperand value(this, child3);
- GPRReg baseGPR = base.gpr();
+ JSValueRegs baseRegs = base.jsValueRegs();
JSValueRegs propertyRegs = property.jsValueRegs();
JSValueRegs valueRegs = value.jsValueRegs();
flushRegisters();
if (node->op() == PutByValDirect)
- callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectCellStrict : operationPutByValDirectCellNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, valueRegs);
+ callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs);
else
- callOperation(node->ecmaMode().isStrict() ? operationPutByValCellStrict : operationPutByValCellNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, valueRegs);
+ callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs);
m_jit.exceptionCheck();
noResult(node);
