Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (137698 => 137699)
--- trunk/Source/_javascript_Core/ChangeLog 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-12-14 03:16:43 UTC (rev 137699)
@@ -1,3 +1,33 @@
+2012-12-13 Filip Pizlo <[email protected]>
+
+ Unreviewed, roll out http://trac.webkit.org/changeset/137683.
+ It broke gmail.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGCSEPhase.cpp:
+ (JSC::DFG::CSEPhase::putStructureStoreElimination):
+ (JSC::DFG::CSEPhase::performNodeCSE):
+ * dfg/DFGCapabilities.h:
+ (JSC::DFG::canCompileOpcode):
+ * dfg/DFGNodeType.h:
+ (DFG):
+ * dfg/DFGOperations.cpp:
+ * dfg/DFGOperations.h:
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * runtime/Operations.cpp:
+ (JSC::jsTypeStringForValue):
+ (JSC):
+ * runtime/Operations.h:
+ (JSC):
+
2012-13-11 Oliver Hunt <[email protected]>
Support op_typeof in the DFG
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -31,7 +31,6 @@
#include "CodeBlock.h"
#include "DFGBasicBlock.h"
#include "GetByIdStatus.h"
-#include "Operations.h"
#include "PutByIdStatus.h"
namespace JSC { namespace DFG {
@@ -708,11 +707,6 @@
case IsString:
constantWasSet = trySetConstant(nodeIndex, jsBoolean(isJSString(child)));
break;
- case IsObject:
- if (child.isNull() || !child.isObject()) {
- constantWasSet = trySetConstant(nodeIndex, jsBoolean(child.isNull()));
- break;
- }
default:
constantWasSet = false;
break;
@@ -722,64 +716,9 @@
break;
}
}
-
forNode(nodeIndex).set(SpecBoolean);
break;
}
-
- case TypeOf: {
- JSGlobalData* globalData = m_codeBlock->globalData();
- JSValue child = forNode(node.child1()).value();
- AbstractValue& abstractChild = forNode(node.child1());
- if (child) {
- JSValue typeString = jsTypeStringForValue(*globalData, m_codeBlock->globalObjectFor(node.codeOrigin), child);
- if (trySetConstant(nodeIndex, typeString)) {
- m_foundConstants = true;
- break;
- }
- } else if (isNumberSpeculation(abstractChild.m_type)) {
- if (trySetConstant(nodeIndex, globalData->smallStrings.numberString(globalData))) {
- forNode(node.child1()).filter(SpecNumber);
- m_foundConstants = true;
- break;
- }
- } else if (isStringSpeculation(abstractChild.m_type)) {
- if (trySetConstant(nodeIndex, globalData->smallStrings.stringString(globalData))) {
- forNode(node.child1()).filter(SpecString);
- m_foundConstants = true;
- break;
- }
- } else if (isFinalObjectSpeculation(abstractChild.m_type) || isArraySpeculation(abstractChild.m_type) || isArgumentsSpeculation(abstractChild.m_type)) {
- if (trySetConstant(nodeIndex, globalData->smallStrings.objectString(globalData))) {
- forNode(node.child1()).filter(SpecFinalObject | SpecArray | SpecArguments);
- m_foundConstants = true;
- break;
- }
- } else if (isFunctionSpeculation(abstractChild.m_type)) {
- if (trySetConstant(nodeIndex, globalData->smallStrings.functionString(globalData))) {
- forNode(node.child1()).filter(SpecFunction);
- m_foundConstants = true;
- break;
- }
- } else if (isBooleanSpeculation(abstractChild.m_type)) {
- if (trySetConstant(nodeIndex, globalData->smallStrings.booleanString(globalData))) {
- forNode(node.child1()).filter(SpecBoolean);
- m_foundConstants = true;
- break;
- }
- } else {
- Node& childNode = m_graph[node.child1()];
- if (isCellSpeculation(childNode.prediction())) {
- if (isStringSpeculation(childNode.prediction()))
- forNode(node.child1()).filter(SpecString);
- else
- forNode(node.child1()).filter(SpecCell);
- node.setCanExit(true);
- }
- }
- forNode(nodeIndex).set(SpecString);
- break;
- }
case CompareLess:
case CompareLessEq:
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -3255,12 +3255,6 @@
NEXT_OPCODE(op_new_func_exp);
}
- case op_typeof: {
- set(currentInstruction[1].u.operand,
- addToGraph(TypeOf, get(currentInstruction[2].u.operand)));
- NEXT_OPCODE(op_typeof);
- }
-
default:
// Parse failed! This should not happen because the capabilities checker
// should have caught it.
Modified: trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -562,7 +562,6 @@
case CreateThis:
case AllocatePropertyStorage:
case ReallocatePropertyStorage:
- case TypeOf:
return NoNode;
case GetIndexedPropertyStorage:
@@ -1128,7 +1127,6 @@
case SkipTopScope:
case SkipScope:
case GetScopeRegisters:
- case TypeOf:
setReplacement(pureCSE(node));
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGCapabilities.h (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGCapabilities.h 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGCapabilities.h 2012-12-14 03:16:43 UTC (rev 137699)
@@ -196,7 +196,6 @@
case op_jneq_ptr:
case op_put_to_base_variable:
case op_put_to_base:
- case op_typeof:
return CanCompile;
case op_call_varargs:
Modified: trunk/Source/_javascript_Core/dfg/DFGNodeType.h (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGNodeType.h 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGNodeType.h 2012-12-14 03:16:43 UTC (rev 137699)
@@ -210,7 +210,6 @@
macro(IsString, NodeResultBoolean) \
macro(IsObject, NodeResultBoolean) \
macro(IsFunction, NodeResultBoolean) \
- macro(TypeOf, NodeResultJS) \
macro(LogicalNot, NodeResultBoolean) \
macro(ToPrimitive, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
macro(StrCat, NodeResultJS | NodeMustGenerate | NodeHasVarArgs | NodeClobbersWorld) \
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -1370,11 +1370,6 @@
return jsIsFunctionType(JSValue::decode(value));
}
-JSCell* DFG_OPERATION operationTypeOf(ExecState* exec, JSCell* value)
-{
- return jsTypeStringForValue(exec, JSValue(value)).asCell();
-}
-
void DFG_OPERATION operationReallocateStorageAndFinishPut(ExecState* exec, JSObject* base, Structure* structure, PropertyOffset offset, EncodedJSValue value)
{
JSGlobalData& globalData = exec->globalData();
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.h (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.h 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.h 2012-12-14 03:16:43 UTC (rev 137699)
@@ -198,7 +198,6 @@
double DFG_OPERATION operationFModOnInts(int32_t, int32_t) WTF_INTERNAL;
size_t DFG_OPERATION operationIsObject(ExecState*, EncodedJSValue) WTF_INTERNAL;
size_t DFG_OPERATION operationIsFunction(EncodedJSValue) WTF_INTERNAL;
-JSCell* DFG_OPERATION operationTypeOf(ExecState*, JSCell*) WTF_INTERNAL;
void DFG_OPERATION operationReallocateStorageAndFinishPut(ExecState*, JSObject*, Structure*, PropertyOffset, EncodedJSValue) WTF_INTERNAL;
char* DFG_OPERATION operationAllocatePropertyStorageWithInitialCapacity(ExecState*) WTF_INTERNAL;
char* DFG_OPERATION operationAllocatePropertyStorage(ExecState*, size_t newSize) WTF_INTERNAL;
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -497,13 +497,7 @@
changed |= mergeDefaultFlags(node);
break;
}
-
- case TypeOf: {
- changed |= setPrediction(SpecString);
- changed |= mergeDefaultFlags(node);
- break;
- }
-
+
case GetById: {
changed |= mergePrediction(node.getHeapPrediction());
changed |= mergeDefaultFlags(node);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -4558,67 +4558,7 @@
booleanResult(result.gpr(), m_compileIndex);
break;
}
- case TypeOf: {
- JSValueOperand value(this, node.child1());
- GPRReg tagGPR = value.tagGPR();
- GPRReg payloadGPR = value.payloadGPR();
- GPRTemporary temp(this);
- GPRReg tempGPR = temp.gpr();
- GPRResult result(this);
- GPRReg resultGPR = result.gpr();
- JITCompiler::JumpList doneJumps;
- flushRegisters();
-
- JITCompiler::Jump isNotCell = m_jit.branch32(JITCompiler::NotEqual, tagGPR, JITCompiler::TrustedImm32(JSValue::CellTag));
- Node& child = m_jit.graph()[node.child1()];
- if (child.shouldSpeculateCell())
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node.child1(), isNotCell);
-
- if (!child.shouldSpeculateNonStringCell()) {
- m_jit.loadPtr(JITCompiler::Address(payloadGPR, JSCell::structureOffset()), tempGPR);
- JITCompiler::Jump notString = m_jit.branch8(JITCompiler::NotEqual, JITCompiler::Address(tempGPR, Structure::typeInfoTypeOffset()), TrustedImm32(StringType));
- if (child.shouldSpeculateString())
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node.child1(), notString);
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.stringString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- if (!child.shouldSpeculateString()) {
- notString.link(&m_jit);
- callOperation(operationTypeOf, resultGPR, payloadGPR);
- doneJumps.append(m_jit.jump());
- }
- } else {
- callOperation(operationTypeOf, resultGPR, payloadGPR);
- doneJumps.append(m_jit.jump());
- }
-
- if (!child.shouldSpeculateCell()) {
- isNotCell.link(&m_jit);
-
- m_jit.add32(TrustedImm32(1), tagGPR, tempGPR);
- JITCompiler::Jump notNumber = m_jit.branch32(JITCompiler::AboveOrEqual, tempGPR, JITCompiler::TrustedImm32(JSValue::LowestTag + 1));
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.numberString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- notNumber.link(&m_jit);
-
- JITCompiler::Jump notUndefined = m_jit.branch32(JITCompiler::NotEqual, tagGPR, TrustedImm32(JSValue::UndefinedTag));
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.undefinedString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- notUndefined.link(&m_jit);
-
- JITCompiler::Jump notNull = m_jit.branch32(JITCompiler::NotEqual, tagGPR, TrustedImm32(JSValue::NullTag));
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.objectString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- notNull.link(&m_jit);
-
- // Only boolean left
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.booleanString(m_jit.globalData())), resultGPR);
- }
- doneJumps.link(&m_jit);
- cellResult(resultGPR, m_compileIndex);
- break;
- }
-
case Phi:
case Flush:
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -4069,7 +4069,7 @@
cachedGetById(node.codeOrigin, baseGPR, resultGPR, node.identifierNumber(), notCell, DontSpill);
jsValueResult(resultGPR, m_compileIndex, UseChildrenCalledExplicitly);
-
+
break;
}
@@ -4484,64 +4484,6 @@
break;
}
- case TypeOf: {
- JSValueOperand value(this, node.child1());
- GPRReg valueGPR = value.gpr();
- GPRTemporary temp(this);
- GPRReg tempGPR = temp.gpr();
- GPRResult result(this);
- GPRReg resultGPR = result.gpr();
- JITCompiler::JumpList doneJumps;
-
- flushRegisters();
-
- JITCompiler::Jump isNotCell = m_jit.branchTest64(JITCompiler::NonZero, valueGPR, GPRInfo::tagMaskRegister);
- Node& child = m_jit.graph()[node.child1()];
- if (child.shouldSpeculateCell())
- speculationCheck(BadType, JSValueSource(valueGPR), node.child1(), isNotCell);
-
- if (!child.shouldSpeculateNonStringCell()) {
- m_jit.loadPtr(JITCompiler::Address(valueGPR, JSCell::structureOffset()), tempGPR);
- JITCompiler::Jump notString = m_jit.branch8(JITCompiler::NotEqual, JITCompiler::Address(tempGPR, Structure::typeInfoTypeOffset()), TrustedImm32(StringType));
- if (child.shouldSpeculateString())
- speculationCheck(BadType, JSValueSource(valueGPR), node.child1(), notString);
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.stringString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- if (!child.shouldSpeculateString()) {
- notString.link(&m_jit);
- callOperation(operationTypeOf, resultGPR, valueGPR);
- doneJumps.append(m_jit.jump());
- }
- } else {
- callOperation(operationTypeOf, resultGPR, valueGPR);
- doneJumps.append(m_jit.jump());
- }
-
- if (!child.shouldSpeculateCell()) {
- isNotCell.link(&m_jit);
- JITCompiler::Jump notNumber = m_jit.branchTest64(JITCompiler::Zero, valueGPR, GPRInfo::tagTypeNumberRegister);
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.numberString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- notNumber.link(&m_jit);
-
- JITCompiler::Jump notUndefined = m_jit.branch64(JITCompiler::NotEqual, valueGPR, JITCompiler::TrustedImm64(ValueUndefined));
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.undefinedString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- notUndefined.link(&m_jit);
-
- JITCompiler::Jump notNull = m_jit.branch64(JITCompiler::NotEqual, valueGPR, JITCompiler::TrustedImm64(ValueNull));
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.objectString(m_jit.globalData())), resultGPR);
- doneJumps.append(m_jit.jump());
- notNull.link(&m_jit);
-
- // Only boolean left
- m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.booleanString(m_jit.globalData())), resultGPR);
- }
- doneJumps.link(&m_jit);
- cellResult(resultGPR, m_compileIndex);
- break;
- }
-
case Flush:
case Phi:
break;
Modified: trunk/Source/_javascript_Core/runtime/Operations.cpp (137698 => 137699)
--- trunk/Source/_javascript_Core/runtime/Operations.cpp 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/runtime/Operations.cpp 2012-12-14 03:16:43 UTC (rev 137699)
@@ -56,8 +56,9 @@
return jsNumber(p1.toNumber(callFrame) + p2.toNumber(callFrame));
}
-JSValue jsTypeStringForValue(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue v)
+JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
{
+ JSGlobalData& globalData = callFrame->globalData();
if (v.isUndefined())
return globalData.smallStrings.undefinedString(&globalData);
if (v.isBoolean())
@@ -69,7 +70,7 @@
if (v.isObject()) {
// Return "undefined" for objects that should be treated
// as null when doing comparisons.
- if (asObject(v)->structure()->masqueradesAsUndefined(globalObject))
+ if (asObject(v)->structure()->masqueradesAsUndefined(callFrame->lexicalGlobalObject()))
return globalData.smallStrings.undefinedString(&globalData);
CallData callData;
JSObject* object = asObject(v);
@@ -79,11 +80,6 @@
return globalData.smallStrings.objectString(&globalData);
}
-JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
-{
- return jsTypeStringForValue(callFrame->globalData(), callFrame->lexicalGlobalObject(), v);
-}
-
bool jsIsObjectType(CallFrame* callFrame, JSValue v)
{
if (!v.isCell())
Modified: trunk/Source/_javascript_Core/runtime/Operations.h (137698 => 137699)
--- trunk/Source/_javascript_Core/runtime/Operations.h 2012-12-14 03:13:27 UTC (rev 137698)
+++ trunk/Source/_javascript_Core/runtime/Operations.h 2012-12-14 03:16:43 UTC (rev 137699)
@@ -32,7 +32,6 @@
NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
JSValue jsTypeStringForValue(CallFrame*, JSValue);
- JSValue jsTypeStringForValue(JSGlobalData&, JSGlobalObject*, JSValue);
bool jsIsObjectType(CallFrame*, JSValue);
bool jsIsFunctionType(JSValue);
