Title: [161218] trunk/Source/_javascript_Core
Revision
161218
Author
fpi...@apple.com
Date
2014-01-02 12:15:25 -0800 (Thu, 02 Jan 2014)

Log Message

Rationalize DFG DCE
https://bugs.webkit.org/show_bug.cgi?id=125523

Reviewed by Mark Hahnenberg.
        
Adds the ability to DCE more things. It's now the case that if a node is completely
pure, we clear NodeMustGenerate and the node becomes a DCE candidate.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDCEPhase.cpp:
(JSC::DFG::DCEPhase::cleanVariables):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::clobbersWorld):
* dfg/DFGNodeType.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileAdd):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileValueAdd):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (161217 => 161218)


--- trunk/Source/_javascript_Core/ChangeLog	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/ChangeLog	2014-01-02 20:15:25 UTC (rev 161218)
@@ -1,3 +1,37 @@
+2014-01-01  Filip Pizlo  <fpi...@apple.com>
+
+        Rationalize DFG DCE
+        https://bugs.webkit.org/show_bug.cgi?id=125523
+
+        Reviewed by Mark Hahnenberg.
+        
+        Adds the ability to DCE more things. It's now the case that if a node is completely
+        pure, we clear NodeMustGenerate and the node becomes a DCE candidate.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::cleanVariables):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileValueAdd):
+
 2014-01-02  Benjamin Poulain  <benja...@webkit.org>
 
         Attempt to fix the build of WebCore's code generator on CMake based system

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2014-01-02 20:15:25 UTC (rev 161218)
@@ -340,7 +340,19 @@
         break;
     }
         
-    case ValueAdd:
+    case ValueAdd: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        if (left && right && left.isNumber() && right.isNumber()) {
+            setConstant(node, JSValue(left.asNumber() + right.asNumber()));
+            break;
+        }
+        ASSERT(node->binaryUseKind() == UntypedUse);
+        clobberWorld(node->codeOrigin, clobberLimit);
+        forNode(node).setType(SpecString | SpecBytecodeNumber);
+        break;
+    }
+        
     case ArithAdd: {
         JSValue left = forNode(node->child1()).value();
         JSValue right = forNode(node->child2()).value();
@@ -368,9 +380,7 @@
                 forNode(node).setType(SpecDouble);
             break;
         default:
-            RELEASE_ASSERT(node->op() == ValueAdd);
-            clobberWorld(node->codeOrigin, clobberLimit);
-            forNode(node).setType(SpecString | SpecBytecodeNumber);
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
         break;

Modified: trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -1239,7 +1239,6 @@
             
         // Handle nodes that are conditionally pure: these are pure, and can
         // be CSE'd, so long as the prediction is the one we want.
-        case ValueAdd:
         case CompareLess:
         case CompareLessEq:
         case CompareGreater:

Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h	2014-01-02 20:15:25 UTC (rev 161218)
@@ -204,25 +204,11 @@
     case In:
     case GetMyArgumentsLengthSafe:
     case GetMyArgumentByValSafe:
+    case ValueAdd:
         read(World);
         write(World);
         return;
         
-    case ValueAdd:
-        switch (node->binaryUseKind()) {
-        case Int32Use:
-        case NumberUse:
-        case MachineIntUse:
-            return;
-        case UntypedUse:
-            read(World);
-            write(World);
-            return;
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-            return;
-        }
-        
     case GetCallee:
         read(AbstractHeap(Variables, JSStack::Callee));
         return;
@@ -579,30 +565,17 @@
         }
         return;
         
+    case CompareEq:
     case CompareLess:
     case CompareLessEq:
     case CompareGreater:
     case CompareGreaterEq:
-        if (graph.isPredictedNumerical(node))
+        if (!node->isBinaryUseKind(UntypedUse))
             return;
         read(World);
         write(World);
         return;
         
-    case CompareEq:
-        if (graph.isPredictedNumerical(node)
-            || node->isBinaryUseKind(StringUse)
-            || node->isBinaryUseKind(StringIdentUse))
-            return;
-        
-        if ((node->child1().useKind() == ObjectUse || node->child1().useKind() == ObjectOrOtherUse)
-            && (node->child2().useKind() == ObjectUse || node->child2().useKind() == ObjectOrOtherUse))
-            return;
-        
-        read(World);
-        write(World);
-        return;
-        
     case ToString:
         switch (node->child1().useKind()) {
         case StringObjectUse:

Modified: trunk/Source/_javascript_Core/dfg/DFGDCEPhase.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGDCEPhase.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGDCEPhase.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -259,7 +259,7 @@
                 continue;
             if (node->op() == GetLocal) {
                 node = node->child1().node();
-                ASSERT(node->op() == Phi);
+                ASSERT(node->op() == Phi || node->op() == SetArgument);
                 if (node->shouldGenerate()) {
                     variables[i] = node;
                     continue;

Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -154,11 +154,16 @@
         }
             
         case ValueAdd: {
-            if (attemptToMakeIntegerAdd(node))
+            if (attemptToMakeIntegerAdd(node)) {
+                node->setOp(ArithAdd);
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
+            }
             if (Node::shouldSpeculateNumberExpectingDefined(node->child1().node(), node->child2().node())) {
                 fixEdge<NumberUse>(node->child1());
                 fixEdge<NumberUse>(node->child2());
+                node->setOp(ArithAdd);
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             
@@ -326,17 +331,20 @@
             if (Node::shouldSpeculateInt32(node->child1().node(), node->child2().node())) {
                 fixEdge<Int32Use>(node->child1());
                 fixEdge<Int32Use>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (enableInt52()
                 && Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {
                 fixEdge<MachineIntUse>(node->child1());
                 fixEdge<MachineIntUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {
                 fixEdge<NumberUse>(node->child1());
                 fixEdge<NumberUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (node->op() != CompareEq)
@@ -344,31 +352,37 @@
             if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
                 fixEdge<BooleanUse>(node->child1());
                 fixEdge<BooleanUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {
                 fixEdge<StringIdentUse>(node->child1());
                 fixEdge<StringIdentUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && GPRInfo::numberOfRegisters >= 7) {
                 fixEdge<StringUse>(node->child1());
                 fixEdge<StringUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
                 fixEdge<ObjectUse>(node->child1());
                 fixEdge<ObjectUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {
                 fixEdge<ObjectUse>(node->child1());
                 fixEdge<ObjectOrOtherUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject()) {
                 fixEdge<ObjectOrOtherUse>(node->child1());
                 fixEdge<ObjectUse>(node->child2());
+                node->clearFlags(NodeMustGenerate | NodeClobbersWorld);
                 break;
             }
             break;

Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.h (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGGraph.h	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.h	2014-01-02 20:15:25 UTC (rev 161218)
@@ -648,13 +648,6 @@
         if (!(node->flags() & NodeMightClobber))
             return false;
         switch (node->op()) {
-        case ValueAdd:
-        case CompareLess:
-        case CompareLessEq:
-        case CompareGreater:
-        case CompareGreaterEq:
-        case CompareEq:
-            return !isPredictedNumerical(node);
         case GetByVal:
         case PutByValDirect:
         case PutByVal:

Modified: trunk/Source/_javascript_Core/dfg/DFGNodeType.h (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGNodeType.h	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGNodeType.h	2014-01-02 20:15:25 UTC (rev 161218)
@@ -96,12 +96,12 @@
     macro(InvalidationPoint, NodeMustGenerate) \
     \
     /* Nodes for bitwise operations. */\
-    macro(BitAnd, NodeResultInt32 | NodeMustGenerate) \
-    macro(BitOr, NodeResultInt32 | NodeMustGenerate) \
-    macro(BitXor, NodeResultInt32 | NodeMustGenerate) \
-    macro(BitLShift, NodeResultInt32 | NodeMustGenerate) \
-    macro(BitRShift, NodeResultInt32 | NodeMustGenerate) \
-    macro(BitURShift, NodeResultInt32 | NodeMustGenerate) \
+    macro(BitAnd, NodeResultInt32) \
+    macro(BitOr, NodeResultInt32) \
+    macro(BitXor, NodeResultInt32) \
+    macro(BitLShift, NodeResultInt32) \
+    macro(BitRShift, NodeResultInt32) \
+    macro(BitURShift, NodeResultInt32) \
     /* Bitwise operators call ToInt32 on their operands. */\
     macro(ValueToInt32, NodeResultInt32) \
     /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
@@ -118,22 +118,22 @@
     macro(Int52ToDouble, NodeResultNumber) \
     \
     /* Nodes for arithmetic operations. */\
-    macro(ArithAdd, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithSub, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithNegate, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithMul, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithIMul, NodeResultInt32 | NodeMustGenerate) \
-    macro(ArithDiv, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithMod, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithAbs, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithMin, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithMax, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithSqrt, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithSin, NodeResultNumber | NodeMustGenerate) \
-    macro(ArithCos, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithAdd, NodeResultNumber) \
+    macro(ArithSub, NodeResultNumber) \
+    macro(ArithNegate, NodeResultNumber) \
+    macro(ArithMul, NodeResultNumber) \
+    macro(ArithIMul, NodeResultInt32) \
+    macro(ArithDiv, NodeResultNumber) \
+    macro(ArithMod, NodeResultNumber) \
+    macro(ArithAbs, NodeResultNumber) \
+    macro(ArithMin, NodeResultNumber) \
+    macro(ArithMax, NodeResultNumber) \
+    macro(ArithSqrt, NodeResultNumber) \
+    macro(ArithSin, NodeResultNumber) \
+    macro(ArithCos, NodeResultNumber) \
     \
     /* Add of values may either be arithmetic, or result in string concatenation. */\
-    macro(ValueAdd, NodeResultJS | NodeMustGenerate | NodeMightClobber) \
+    macro(ValueAdd, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     \
     /* Property access. */\
     /* PutByValAlias indicates a 'put' aliases a prior write to the same property. */\
@@ -208,12 +208,12 @@
     macro(StringFromCharCode, NodeResultJS) \
     \
     /* Nodes for comparison operations. */\
-    macro(CompareLess, NodeResultBoolean | NodeMustGenerate | NodeMightClobber) \
-    macro(CompareLessEq, NodeResultBoolean | NodeMustGenerate | NodeMightClobber) \
-    macro(CompareGreater, NodeResultBoolean | NodeMustGenerate | NodeMightClobber) \
-    macro(CompareGreaterEq, NodeResultBoolean | NodeMustGenerate | NodeMightClobber) \
-    macro(CompareEq, NodeResultBoolean | NodeMustGenerate | NodeMightClobber) \
-    macro(CompareEqConstant, NodeResultBoolean | NodeMustGenerate) \
+    macro(CompareLess, NodeResultBoolean | NodeMustGenerate | NodeClobbersWorld) \
+    macro(CompareLessEq, NodeResultBoolean | NodeMustGenerate | NodeClobbersWorld) \
+    macro(CompareGreater, NodeResultBoolean | NodeMustGenerate | NodeClobbersWorld) \
+    macro(CompareGreaterEq, NodeResultBoolean | NodeMustGenerate | NodeClobbersWorld) \
+    macro(CompareEq, NodeResultBoolean | NodeMustGenerate | NodeClobbersWorld) \
+    macro(CompareEqConstant, NodeResultBoolean) \
     macro(CompareStrictEq, NodeResultBoolean) \
     macro(CompareStrictEqConstant, NodeResultBoolean) \
     \

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -2685,12 +2685,6 @@
         return;
     }
         
-    case UntypedUse: {
-        RELEASE_ASSERT(node->op() == ValueAdd);
-        compileValueAdd(node);
-        return;
-    }
-        
     default:
         RELEASE_ASSERT_NOT_REACHED();
         break;

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2014-01-02 20:15:25 UTC (rev 161218)
@@ -1966,7 +1966,6 @@
     void compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, Node* branchNode);
     void compileObjectEquality(Node*);
     void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
-    void compileValueAdd(Node*);
     void compileObjectOrOtherLogicalNot(Edge value);
     void compileLogicalNot(Node*);
     void compileStringEquality(Node*);

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -1418,28 +1418,6 @@
     booleanResult(resultPayload.gpr(), node);
 }
 
-void SpeculativeJIT::compileValueAdd(Node* node)
-{
-    JSValueOperand op1(this, node->child1());
-    JSValueOperand op2(this, node->child2());
-
-    GPRReg op1TagGPR = op1.tagGPR();
-    GPRReg op1PayloadGPR = op1.payloadGPR();
-    GPRReg op2TagGPR = op2.tagGPR();
-    GPRReg op2PayloadGPR = op2.payloadGPR();
-
-    flushRegisters();
-    
-    GPRResult2 resultTag(this);
-    GPRResult resultPayload(this);
-    if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
-        callOperation(operationValueAddNotNumber, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
-    else
-        callOperation(operationValueAdd, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
-    
-    jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
-}
-
 void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)
 {
     JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
@@ -2072,7 +2050,28 @@
         break;
     }
         
-    case ValueAdd:
+    case ValueAdd: {
+        JSValueOperand op1(this, node->child1());
+        JSValueOperand op2(this, node->child2());
+        
+        GPRReg op1TagGPR = op1.tagGPR();
+        GPRReg op1PayloadGPR = op1.payloadGPR();
+        GPRReg op2TagGPR = op2.tagGPR();
+        GPRReg op2PayloadGPR = op2.payloadGPR();
+        
+        flushRegisters();
+        
+        GPRResult2 resultTag(this);
+        GPRResult resultPayload(this);
+        if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
+            callOperation(operationValueAddNotNumber, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
+        else
+            callOperation(operationValueAdd, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
+        
+        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+        break;
+    }
+
     case ArithAdd:
         compileAdd(node);
         break;

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -1806,25 +1806,6 @@
     jsValueResult(result.gpr(), node, DataFormatJSBoolean);
 }
 
-void SpeculativeJIT::compileValueAdd(Node* node)
-{
-    JSValueOperand op1(this, node->child1());
-    JSValueOperand op2(this, node->child2());
-    
-    GPRReg op1GPR = op1.gpr();
-    GPRReg op2GPR = op2.gpr();
-    
-    flushRegisters();
-    
-    GPRResult result(this);
-    if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
-        callOperation(operationValueAddNotNumber, result.gpr(), op1GPR, op2GPR);
-    else
-        callOperation(operationValueAdd, result.gpr(), op1GPR, op2GPR);
-    
-    jsValueResult(result.gpr(), node);
-}
-
 void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)
 {
     JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
@@ -2403,7 +2384,25 @@
         break;
     }
         
-    case ValueAdd:
+    case ValueAdd: {
+        JSValueOperand op1(this, node->child1());
+        JSValueOperand op2(this, node->child2());
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg op2GPR = op2.gpr();
+        
+        flushRegisters();
+        
+        GPRResult result(this);
+        if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
+            callOperation(operationValueAddNotNumber, result.gpr(), op1GPR, op2GPR);
+        else
+            callOperation(operationValueAdd, result.gpr(), op1GPR, op2GPR);
+        
+        jsValueResult(result.gpr(), node);
+        break;
+    }
+        
     case ArithAdd:
         compileAdd(node);
         break;

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (161217 => 161218)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp	2014-01-02 20:11:55 UTC (rev 161217)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp	2014-01-02 20:15:25 UTC (rev 161218)
@@ -261,8 +261,10 @@
         case Phantom:
             compilePhantom();
             break;
+        case ValueAdd:
+            compileValueAdd();
+            break;
         case ArithAdd:
-        case ValueAdd:
             compileAddSub();
             break;
         case ArithSub:
@@ -763,6 +765,19 @@
         DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, speculate);
     }
     
+    void compileValueAdd()
+    {
+        J_JITOperation_EJJ operation;
+        if (!(m_state.forNode(m_node->child1()).m_type & SpecFullNumber)
+            && !(m_state.forNode(m_node->child2()).m_type & SpecFullNumber))
+            operation = operationValueAddNotNumber;
+        else
+            operation = operationValueAdd;
+        setJSValue(vmCall(
+            m_out.operation(operation), m_callFrame,
+            lowJSValue(m_node->child1()), lowJSValue(m_node->child2())));
+    }
+    
     void compileAddSub()
     {
         bool isSub =  m_node->op() == ArithSub;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to