Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (127478 => 127479)
--- trunk/Source/_javascript_Core/ChangeLog 2012-09-04 18:45:35 UTC (rev 127478)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-09-04 18:46:21 UTC (rev 127479)
@@ -1,3 +1,23 @@
+2012-09-04 Mark Hahnenberg <[email protected]>
+
+ Remove uses of ClassInfo from SpeculativeJIT::compileObjectOrOtherLogicalNot
+ https://bugs.webkit.org/show_bug.cgi?id=95510
+
+ Reviewed by Oliver Hunt.
+
+ More refactoring to get rid of ClassInfo checks in the DFG.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ * dfg/DFGSpeculativeJIT.h:
+ (SpeculativeJIT):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+ (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+ (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+
2012-09-03 Patrick Gansterer <[email protected]>
Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r127393.
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (127478 => 127479)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-09-04 18:45:35 UTC (rev 127478)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-09-04 18:46:21 UTC (rev 127479)
@@ -608,14 +608,9 @@
Node& child = m_graph[node.child1()];
if (isBooleanSpeculation(child.prediction()))
speculateBooleanUnary(node);
- else if (child.shouldSpeculateFinalObjectOrOther()) {
- node.setCanExit(
- !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type));
- forNode(node.child1()).filter(SpecFinalObject | SpecOther);
- } else if (child.shouldSpeculateArrayOrOther()) {
- node.setCanExit(
- !isArrayOrOtherSpeculation(forNode(node.child1()).m_type));
- forNode(node.child1()).filter(SpecArray | SpecOther);
+ else if (child.shouldSpeculateNonStringCellOrOther()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
} else if (child.shouldSpeculateInteger())
speculateInt32Unary(node);
else if (child.shouldSpeculateNumber())
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (127478 => 127479)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2012-09-04 18:45:35 UTC (rev 127478)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2012-09-04 18:46:21 UTC (rev 127479)
@@ -2059,7 +2059,7 @@
void compileObjectEquality(Node&);
void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
void compileValueAdd(Node&);
- void compileObjectOrOtherLogicalNot(Edge value, const ClassInfo*, bool needSpeculationCheck);
+ void compileNonStringCellOrOtherLogicalNot(Edge value, bool needSpeculationCheck);
void compileLogicalNot(Node&);
void emitNonStringCellOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck);
void emitBranch(Node&);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (127478 => 127479)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-09-04 18:45:35 UTC (rev 127478)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-09-04 18:46:21 UTC (rev 127479)
@@ -1791,7 +1791,7 @@
jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
}
-void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::compileNonStringCellOrOtherLogicalNot(Edge nodeUse, bool needSpeculationCheck)
{
JSValueOperand value(this, nodeUse);
GPRTemporary resultPayload(this);
@@ -1800,8 +1800,44 @@
GPRReg resultPayloadGPR = resultPayload.gpr();
MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
- if (needSpeculationCheck)
- speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valuePayloadGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+ if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), structureGPR);
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+
+ MacroAssembler::Jump isNotMasqueradesAsUndefined =
+ m_jit.branchTest8(
+ MacroAssembler::Zero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+ isNotMasqueradesAsUndefined.link(&m_jit);
+ }
m_jit.move(TrustedImm32(0), resultPayloadGPR);
MacroAssembler::Jump done = m_jit.jump();
@@ -1811,7 +1847,11 @@
if (needSpeculationCheck) {
m_jit.move(valueTagGPR, resultPayloadGPR);
m_jit.or32(TrustedImm32(1), resultPayloadGPR);
- speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branch32(MacroAssembler::NotEqual, resultPayloadGPR, TrustedImm32(JSValue::NullTag)));
+ speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+ m_jit.branch32(
+ MacroAssembler::NotEqual,
+ resultPayloadGPR,
+ TrustedImm32(JSValue::NullTag)));
}
m_jit.move(TrustedImm32(1), resultPayloadGPR);
@@ -1829,14 +1869,11 @@
booleanResult(result.gpr(), m_compileIndex);
return;
}
- if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
- compileObjectOrOtherLogicalNot(node.child1(), &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+ if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+ compileNonStringCellOrOtherLogicalNot(node.child1(),
+ !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
return;
}
- if (at(node.child1()).shouldSpeculateArrayOrOther()) {
- compileObjectOrOtherLogicalNot(node.child1(), &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
- return;
- }
if (at(node.child1()).shouldSpeculateInteger()) {
SpeculateIntegerOperand value(this, node.child1());
GPRTemporary resultPayload(this, value);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (127478 => 127479)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-09-04 18:45:35 UTC (rev 127478)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-09-04 18:46:21 UTC (rev 127479)
@@ -1835,7 +1835,7 @@
jsValueResult(result.gpr(), m_compileIndex);
}
-void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::compileNonStringCellOrOtherLogicalNot(Edge nodeUse, bool needSpeculationCheck)
{
JSValueOperand value(this, nodeUse);
GPRTemporary result(this);
@@ -1843,19 +1843,59 @@
GPRReg resultGPR = result.gpr();
MacroAssembler::Jump notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, valueGPR, GPRInfo::tagMaskRegister);
- if (needSpeculationCheck)
- speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valueGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
- m_jit.move(TrustedImm32(static_cast<int32_t>(ValueFalse)), resultGPR);
+ if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(valueGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(valueGPR, JSCell::structureOffset()), structureGPR);
+
+ if (needSpeculationCheck) {
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+
+ MacroAssembler::Jump isNotMasqueradesAsUndefined =
+ m_jit.branchTest8(
+ MacroAssembler::Zero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+ isNotMasqueradesAsUndefined.link(&m_jit);
+ }
+ m_jit.move(TrustedImm32(ValueFalse), resultGPR);
MacroAssembler::Jump done = m_jit.jump();
notCell.link(&m_jit);
-
+
if (needSpeculationCheck) {
m_jit.move(valueGPR, resultGPR);
m_jit.andPtr(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
- speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, resultGPR, MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))));
+ speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+ m_jit.branchPtr(
+ MacroAssembler::NotEqual,
+ resultGPR,
+ MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))));
}
- m_jit.move(TrustedImm32(static_cast<int32_t>(ValueTrue)), resultGPR);
+ m_jit.move(TrustedImm32(ValueTrue), resultGPR);
done.link(&m_jit);
@@ -1864,14 +1904,11 @@
void SpeculativeJIT::compileLogicalNot(Node& node)
{
- if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
- compileObjectOrOtherLogicalNot(node.child1(), &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+ if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+ compileNonStringCellOrOtherLogicalNot(node.child1(),
+ !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
return;
}
- if (at(node.child1()).shouldSpeculateArrayOrOther()) {
- compileObjectOrOtherLogicalNot(node.child1(), &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
- return;
- }
if (at(node.child1()).shouldSpeculateInteger()) {
SpeculateIntegerOperand value(this, node.child1());
GPRTemporary result(this, value);
