Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (142635 => 142636)
--- trunk/Source/_javascript_Core/ChangeLog 2013-02-12 17:05:48 UTC (rev 142635)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-02-12 17:34:00 UTC (rev 142636)
@@ -1,3 +1,34 @@
+2013-02-11 Filip Pizlo <[email protected]>
+
+ DFG CompareEq optimization should be retuned
+ https://bugs.webkit.org/show_bug.cgi?id=109545
+
+ Reviewed by Mark Hahnenberg.
+
+ - Made the object-to-object equality case work again by hoisting the if statement
+ for it. Previously, object-to-object equality would be compiled as
+ object-to-object-or-other.
+
+ - Added AbstractState guards for most of the type checks that the object equality
+ code uses.
+
+ Looks like a hint of a speed-up on all of the things.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+ (JSC::DFG::SpeculativeJIT::compare):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+ (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+ (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
2013-02-12 Gabor Rapcsanyi <[email protected]>
JSC asserting with long parameter list functions in debug mode on ARM traditional
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (142635 => 142636)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2013-02-12 17:05:48 UTC (rev 142635)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2013-02-12 17:34:00 UTC (rev 142636)
@@ -848,22 +848,22 @@
node->setCanExit(false);
break;
}
- if (left->shouldSpeculateObject() && right->shouldSpeculateObjectOrOther()) {
+ if (left->shouldSpeculateObject() && right->shouldSpeculateObject()) {
node->setCanExit(true);
- forNode(left).filter(SpecCell & ~SpecString);
- forNode(right).filter((SpecCell & ~SpecString) | SpecOther);
+ forNode(left).filter(SpecObjectMask);
+ forNode(right).filter(SpecObjectMask);
break;
}
- if (left->shouldSpeculateObjectOrOther() && right->shouldSpeculateObject()) {
+ if (left->shouldSpeculateObject() && right->shouldSpeculateObjectOrOther()) {
node->setCanExit(true);
- forNode(left).filter((SpecCell & ~SpecString) | SpecOther);
- forNode(right).filter(SpecCell & ~SpecString);
+ forNode(left).filter(SpecObjectMask);
+ forNode(right).filter(SpecObjectMask | SpecOther);
break;
}
- if (left->shouldSpeculateObject() && right->shouldSpeculateObject()) {
+ if (left->shouldSpeculateObjectOrOther() && right->shouldSpeculateObject()) {
node->setCanExit(true);
- forNode(left).filter(SpecCell & ~SpecString);
- forNode(right).filter(SpecCell & ~SpecString);
+ forNode(left).filter(SpecObjectMask | SpecOther);
+ forNode(right).filter(SpecObjectMask);
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (142635 => 142636)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-02-12 17:05:48 UTC (rev 142635)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-02-12 17:34:00 UTC (rev 142636)
@@ -1501,39 +1501,51 @@
if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(node->child1()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ if (m_state.forNode(node->child2()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(node->child1()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(node->child2()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1596,12 +1608,12 @@
nonSpeculativePeepholeBranch(node, branchNode, condition, operation);
return true;
}
- if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther())
+ if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject())
+ compilePeepHoleObjectEquality(node, branchNode);
+ else if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther())
compilePeepHoleObjectToObjectOrOtherEquality(node->child1(), node->child2(), branchNode);
else if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject())
compilePeepHoleObjectToObjectOrOtherEquality(node->child2(), node->child1(), branchNode);
- else if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject())
- compilePeepHoleObjectEquality(node, branchNode);
else {
nonSpeculativePeepholeBranch(node, branchNode, condition, operation);
return true;
@@ -3379,6 +3391,11 @@
nonSpeculativeNonPeepholeCompare(node, condition, operation);
return false;
}
+
+ if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
+ compileObjectEquality(node);
+ return false;
+ }
if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {
compileObjectToObjectOrOtherEquality(node->child1(), node->child2());
@@ -3389,11 +3406,6 @@
compileObjectToObjectOrOtherEquality(node->child2(), node->child1());
return false;
}
-
- if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
- compileObjectEquality(node);
- return false;
- }
}
nonSpeculativeNonPeepholeCompare(node, condition, operation);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (142635 => 142636)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-02-12 17:05:48 UTC (rev 142635)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-02-12 17:34:00 UTC (rev 142636)
@@ -1491,39 +1491,51 @@
if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(node->child1()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ if (m_state.forNode(node->child2()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(node->child1()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(node->child2()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1556,22 +1568,28 @@
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1587,22 +1605,28 @@
// We know that within this branch, rightChild must be a cell.
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1619,7 +1643,7 @@
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
- if (!isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell)) {
+ if ((m_state.forNode(rightChild).m_type & ~SpecCell) & ~SpecOther) {
m_jit.move(op2TagGPR, resultGPR);
m_jit.or32(TrustedImm32(1), resultGPR);
@@ -1656,22 +1680,28 @@
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1686,22 +1716,28 @@
// We know that within this branch, rightChild must be a cell.
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1715,7 +1751,7 @@
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
- if (isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell))
+ if ((m_state.forNode(rightChild).m_type & ~SpecCell) & ~SpecOther)
rightNotCell.link(&m_jit);
else {
jump(notTaken, ForceJump);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (142635 => 142636)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-02-12 17:05:48 UTC (rev 142635)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-02-12 17:34:00 UTC (rev 142636)
@@ -1544,40 +1544,52 @@
GPRReg resultGPR = result.gpr();
if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
- m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op1GPR), node->child1(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op2GPR), node->child2(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ if (m_state.forNode(node->child1()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op1GPR), node->child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
+ if (m_state.forNode(node->child2()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2GPR), node->child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(node->child1()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op1GPR), node->child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op1GPR), node->child1(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op1GPR), node->child1(),
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(node->child2()).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2GPR), node->child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op2GPR), node->child2(),
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op2GPR), node->child2(),
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1606,21 +1618,27 @@
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
- speculationCheck(BadType, JSValueRegs(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1636,22 +1654,28 @@
// We know that within this branch, rightChild must be a cell.
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2GPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2GPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1668,7 +1692,7 @@
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
- if (!isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell)) {
+ if ((m_state.forNode(rightChild).m_type & ~SpecCell) & ~SpecOther) {
m_jit.move(op2GPR, resultGPR);
m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
@@ -1704,22 +1728,28 @@
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ if (m_state.forNode(leftChild).m_type & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op1GPR), leftChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op1GPR), leftChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1734,22 +1764,28 @@
// We know that within this branch, rightChild must be a cell.
if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
- speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2GPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
} else {
GPRTemporary structure(this);
GPRReg structureGPR = structure.gpr();
m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObjectMask) {
+ speculationCheck(
+ BadType, JSValueRegs(op2GPR), rightChild,
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ }
speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
- speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
@@ -1763,7 +1799,7 @@
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
- if (isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell))
+ if ((m_state.forNode(rightChild).m_type & ~SpecCell) & ~SpecOther)
rightNotCell.link(&m_jit);
else {
jump(notTaken, ForceJump);
