Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (127342 => 127343)
--- trunk/Source/_javascript_Core/ChangeLog 2012-09-01 00:33:12 UTC (rev 127342)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-09-01 00:38:37 UTC (rev 127343)
@@ -1,3 +1,21 @@
+2012-08-31 Mark Hahnenberg <[email protected]>
+
+ Remove use of ClassInfo in SpeculativeJIT::emitBranch
+ https://bugs.webkit.org/show_bug.cgi?id=95623
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ * dfg/DFGSpeculativeJIT.h:
+ (SpeculativeJIT):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+ (JSC::DFG::SpeculativeJIT::emitBranch):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+ (JSC::DFG::SpeculativeJIT::emitBranch):
+
2012-08-31 Geoffrey Garen <[email protected]>
Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (127342 => 127343)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-09-01 00:33:12 UTC (rev 127342)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-09-01 00:38:37 UTC (rev 127343)
@@ -1038,14 +1038,9 @@
Node& child = m_graph[node.child1()];
if (child.shouldSpeculateBoolean())
speculateBooleanUnary(node);
- else if (child.shouldSpeculateFinalObjectOrOther()) {
- node.setCanExit(
- !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type));
- forNode(node.child1()).filter(SpecFinalObject | SpecOther);
- } else if (child.shouldSpeculateArrayOrOther()) {
- node.setCanExit(
- !isArrayOrOtherSpeculation(forNode(node.child1()).m_type));
- forNode(node.child1()).filter(SpecArray | SpecOther);
+ else if (child.shouldSpeculateNonStringCellOrOther()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
} else if (child.shouldSpeculateInteger())
speculateInt32Unary(node);
else if (child.shouldSpeculateNumber())
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (127342 => 127343)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2012-09-01 00:33:12 UTC (rev 127342)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2012-09-01 00:38:37 UTC (rev 127343)
@@ -2061,7 +2061,7 @@
void compileValueAdd(Node&);
void compileObjectOrOtherLogicalNot(Edge value, const ClassInfo*, bool needSpeculationCheck);
void compileLogicalNot(Node&);
- void emitObjectOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken, const ClassInfo*, bool needSpeculationCheck);
+ void emitNonStringCellOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck);
void emitBranch(Node&);
void compileIntegerCompare(Node&, MacroAssembler::RelationalCondition);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (127342 => 127343)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-09-01 00:33:12 UTC (rev 127342)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-09-01 00:38:37 UTC (rev 127343)
@@ -1877,7 +1877,7 @@
booleanResult(resultPayloadGPR, m_compileIndex, UseChildrenCalledExplicitly);
}
-void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::emitNonStringCellOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck)
{
JSValueOperand value(this, nodeUse);
GPRTemporary scratch(this);
@@ -1886,8 +1886,37 @@
GPRReg scratchGPR = scratch.gpr();
MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
- if (needSpeculationCheck)
- speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valuePayloadGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+ if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ } else {
+ m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), scratchGPR);
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ scratchGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+
+ JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(scratchGPR, Structure::globalObjectOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+ isNotMasqueradesAsUndefined.link(&m_jit);
+ }
jump(taken, ForceJump);
notCell.link(&m_jit);
@@ -1924,10 +1953,9 @@
jump(notTaken);
noResult(m_compileIndex);
- } else if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
- emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
- } else if (at(node.child1()).shouldSpeculateArrayOrOther()) {
- emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+ } else if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+ emitNonStringCellOrOtherBranch(node.child1(), taken, notTaken,
+ !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
} else if (at(node.child1()).shouldSpeculateNumber()) {
if (at(node.child1()).shouldSpeculateInteger()) {
bool invert = false;
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (127342 => 127343)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-09-01 00:33:12 UTC (rev 127342)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-09-01 00:38:37 UTC (rev 127343)
@@ -1937,7 +1937,7 @@
jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean, UseChildrenCalledExplicitly);
}
-void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::emitNonStringCellOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck)
{
JSValueOperand value(this, nodeUse);
GPRTemporary scratch(this);
@@ -1945,8 +1945,37 @@
GPRReg scratchGPR = scratch.gpr();
MacroAssembler::Jump notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, valueGPR, GPRInfo::tagMaskRegister);
- if (needSpeculationCheck)
- speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valueGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+ if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(valueGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ } else {
+ m_jit.loadPtr(MacroAssembler::Address(valueGPR, JSCell::structureOffset()), scratchGPR);
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ scratchGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+
+ JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(scratchGPR, Structure::globalObjectOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+ isNotMasqueradesAsUndefined.link(&m_jit);
+ }
jump(taken, ForceJump);
notCell.link(&m_jit);
@@ -1966,10 +1995,9 @@
BlockIndex taken = node.takenBlockIndex();
BlockIndex notTaken = node.notTakenBlockIndex();
- if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
- emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
- } else if (at(node.child1()).shouldSpeculateArrayOrOther()) {
- emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+ if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+ emitNonStringCellOrOtherBranch(node.child1(), taken, notTaken,
+ !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
} else if (at(node.child1()).shouldSpeculateNumber()) {
if (at(node.child1()).shouldSpeculateInteger()) {
bool invert = false;
