Modified: branches/safari-600.7-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (185704 => 185705)
--- branches/safari-600.7-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2015-06-18 17:15:50 UTC (rev 185704)
+++ branches/safari-600.7-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2015-06-18 17:39:52 UTC (rev 185705)
@@ -731,16 +731,16 @@
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
+ m_interpreter.filter(value, SpecInt32);
+ VirtualRegister virtualRegister = edge->virtualRegister();
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
- if (m_interpreter.filter(value, SpecInt32) == Contradiction) {
+ if (edge->hasConstant() && !isInt32Constant(edge.node())) {
terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
returnFormat = DataFormatInt32;
return allocate();
}
-
- VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
-
+
switch (info.registerFormat()) {
case DataFormatNone: {
if (edge->hasConstant()) {
@@ -754,7 +754,6 @@
}
DataFormat spillFormat = info.spillFormat();
-
ASSERT_UNUSED(spillFormat, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
// If we know this was spilled as an integer we can fill without checking.
@@ -800,6 +799,10 @@
case DataFormatJSDouble:
case DataFormatJSCell:
case DataFormatJSBoolean:
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ returnFormat = DataFormatInt32;
+ return allocate();
+
case DataFormatDouble:
case DataFormatStorage:
default:
@@ -858,17 +861,17 @@
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
-
- if (m_interpreter.filter(value, SpecCell) == Contradiction) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
+ m_interpreter.filter(value, SpecCell);
VirtualRegister virtualRegister = edge->virtualRegister();
GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
+ if (info.spillFormat() == DataFormatInt32) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
if (edge->hasConstant()) {
JSValue jsValue = valueOfJSConstant(edge.node());
GPRReg gpr = allocate();
@@ -930,6 +933,9 @@
case DataFormatJSDouble:
case DataFormatJSBoolean:
case DataFormatBoolean:
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+
case DataFormatDouble:
case DataFormatStorage:
RELEASE_ASSERT_NOT_REACHED();
@@ -944,23 +950,27 @@
{
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
-
- if (m_interpreter.filter(value, SpecBoolean) == Contradiction) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
+ m_interpreter.filter(value, SpecBoolean);
VirtualRegister virtualRegister = edge->virtualRegister();
GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
+ if (info.spillFormat() == DataFormatInt32) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
if (edge->hasConstant()) {
JSValue jsValue = valueOfJSConstant(edge.node());
GPRReg gpr = allocate();
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
- info.fillBoolean(*m_stream, gpr);
+ if (jsValue.isBoolean()) {
+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
+ info.fillBoolean(*m_stream, gpr);
+ return gpr;
+ }
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
return gpr;
}
@@ -1004,6 +1014,9 @@
case DataFormatJSDouble:
case DataFormatJSCell:
case DataFormatCell:
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+
case DataFormatDouble:
case DataFormatStorage:
RELEASE_ASSERT_NOT_REACHED();
Modified: branches/safari-600.7-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (185704 => 185705)
--- branches/safari-600.7-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2015-06-18 17:15:50 UTC (rev 185704)
+++ branches/safari-600.7-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2015-06-18 17:39:52 UTC (rev 185705)
@@ -721,16 +721,20 @@
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
+ m_interpreter.filter(value, SpecInt32);
+ VirtualRegister virtualRegister = edge->virtualRegister();
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
- if (m_interpreter.filter(value, SpecInt32) == Contradiction) {
+ if (edge->hasConstant() && !isInt32Constant(edge.node())) {
+ // Protect the silent spill/fill logic by failing early. If we "speculate" on
+ // the constant then the silent filler may think that we have an int32 and a
+ // constant, so it will try to fill this as an int32 constant. Bad things will
+ // happen.
terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
returnFormat = DataFormatInt32;
return allocate();
}
-
- VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
-
+
switch (info.registerFormat()) {
case DataFormatNone: {
GPRReg gpr = allocate();
@@ -829,7 +833,12 @@
case DataFormatCell:
case DataFormatBoolean:
case DataFormatJSCell:
- case DataFormatJSBoolean:
+ case DataFormatJSBoolean: {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ returnFormat = DataFormatInt32;
+ return allocate();
+ }
+
case DataFormatDouble:
case DataFormatStorage:
case DataFormatInt52:
@@ -862,17 +871,17 @@
{
ASSERT(desiredFormat == DataFormatInt52 || desiredFormat == DataFormatStrictInt52);
AbstractValue& value = m_state.forNode(edge);
-
- if (m_interpreter.filter(value, SpecMachineInt) == Contradiction) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
+ m_interpreter.filter(value, SpecMachineInt);
VirtualRegister virtualRegister = edge->virtualRegister();
GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
+ if ((edge->hasConstant() && !valueOfJSConstant(edge.node()).isMachineInt())) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
GPRReg gpr = allocate();
if (edge->hasConstant()) {
@@ -991,12 +1000,7 @@
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
-
- if (m_interpreter.filter(value, SpecCell) == Contradiction) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
+ m_interpreter.filter(value, SpecCell);
VirtualRegister virtualRegister = edge->virtualRegister();
GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
@@ -1015,7 +1019,12 @@
terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
return gpr;
}
-
+
+ if (!(info.spillFormat() & DataFormatJS)) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return gpr;
+ }
+
m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
@@ -1051,7 +1060,11 @@
case DataFormatInt32:
case DataFormatJSDouble:
case DataFormatJSBoolean:
- case DataFormatBoolean:
+ case DataFormatBoolean: {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
case DataFormatDouble:
case DataFormatStorage:
case DataFormatInt52:
@@ -1068,24 +1081,28 @@
{
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
-
- if (m_interpreter.filter(value, SpecBoolean) == Contradiction) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
+ m_interpreter.filter(value, SpecBoolean);
VirtualRegister virtualRegister = edge->virtualRegister();
GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
+ if (info.spillFormat() == DataFormatInt32) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
GPRReg gpr = allocate();
if (edge->hasConstant()) {
JSValue jsValue = valueOfJSConstant(edge.node());
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
- info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
+ if (jsValue.isBoolean()) {
+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+ info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
+ return gpr;
+ }
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
return gpr;
}
RELEASE_ASSERT(info.spillFormat() & DataFormatJS);
@@ -1126,6 +1143,9 @@
case DataFormatJSDouble:
case DataFormatJSCell:
case DataFormatCell:
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+
case DataFormatDouble:
case DataFormatStorage:
case DataFormatInt52:
