Diff
Modified: trunk/Source/_javascript_Core/CMakeLists.txt (192599 => 192600)
--- trunk/Source/_javascript_Core/CMakeLists.txt 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/CMakeLists.txt 2015-11-19 00:54:37 UTC (rev 192600)
@@ -445,6 +445,7 @@
jit/JITDisassembler.cpp
jit/JITExceptions.cpp
jit/JITInlineCacheGenerator.cpp
+ jit/JITMulGenerator.cpp
jit/JITOpcodes.cpp
jit/JITOpcodes32_64.cpp
jit/JITOperations.cpp
Modified: trunk/Source/_javascript_Core/ChangeLog (192599 => 192600)
--- trunk/Source/_javascript_Core/ChangeLog 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-11-19 00:54:37 UTC (rev 192600)
@@ -1,5 +1,76 @@
2015-11-18 Mark Lam <mark....@apple.com>
+ Snippefy op_mul for the baseline JIT.
+ https://bugs.webkit.org/show_bug.cgi?id=151393
+
+ Reviewed by Geoffrey Garen.
+
+ Benchmarks shows that perf is neutral on x86 and x86_64 with the DFG enabled.
+
+ With the DFG disabled (relying on the baseline JIT for perf), LongSpider
+ 3d-morph shows a 7.6% regression. However, there are other benchmarks that shows
+ a progression e.g. on Kraken, audio-beat-detection and audio-fft.
+
+ Upon inspection of the generated code for 3d-morph, the only differences is the
+ added use of a scratch register for the result as well as a jump around the
+ code that handles double types. It does not look like we're generating bad code.
+ I'll consider the perf acceptable in aggregate.
+
+ * CMakeLists.txt:
+ * _javascript_Core.vcxproj/_javascript_Core.vcxproj:
+ * _javascript_Core.vcxproj/_javascript_Core.vcxproj.filters:
+ * _javascript_Core.xcodeproj/project.pbxproj:
+
+ * bytecode/PolymorphicAccess.cpp:
+ (JSC::AccessCase::generate):
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::boxInt32):
+ * jit/IntrinsicEmitter.cpp:
+ (JSC::AccessCase::emitIntrinsicGetter):
+ - Changed AssemblyHelpers::boxInt32() to take a TagRegistersMode.
+ The pre-existing boxInt32() always assume that the tag registers are not
+ available. Since we should assume we have tag registers by default, I also
+ changed all the other clients to explicitly specify a more of
+ DoNotHaveTagRegisters. That is except for the snippet generators that do have
+ the tag registers.
+
+ * jit/JIT.h:
+ * jit/JITArithmetic.cpp:
+ (JSC::JIT::compileBinaryArithOpSlowCase):
+ (JSC::JIT::emit_op_div):
+ (JSC::JIT::emitSlow_op_add):
+ (JSC::JIT::emit_op_mul):
+ (JSC::JIT::emitSlow_op_mul):
+ (JSC::JIT::emit_op_sub):
+ (JSC::JIT::compileBinaryArithOp): Deleted.
+ * jit/JITArithmetic32_64.cpp:
+ (JSC::JIT::emitBinaryDoubleOp):
+ (JSC::JIT::emit_op_div):
+ (JSC::JIT::emit_op_mul): Deleted.
+ (JSC::JIT::emitSlow_op_mul): Deleted.
+ * jit/JITMulGenerator.cpp: Added.
+ (JSC::JITMulGenerator::generateFastPath):
+ * jit/JITMulGenerator.h: Added.
+ (JSC::JITMulGenerator::JITMulGenerator):
+ (JSC::JITMulGenerator::didEmitFastPath):
+ (JSC::JITMulGenerator::endJumpList):
+ (JSC::JITMulGenerator::slowPathJumpList):
+
+ * tests/stress/op_mul.js: Added.
+ (o1.valueOf):
+ (generateScenarios):
+ (printScenarios):
+ (testCases.func):
+ (func):
+ (initializeTestCases):
+ (stringifyIfNeeded):
+ (isIdentical):
+ (runTest):
+ - Tests that JIT op_mul results are equivalent to the expected values as
+ defined by the LLINT.
+
+2015-11-18 Mark Lam <mark....@apple.com>
+
Remove some unnecessary jumps in snippet code.
https://bugs.webkit.org/show_bug.cgi?id=151415
Modified: trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj (192599 => 192600)
--- trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj 2015-11-19 00:54:37 UTC (rev 192600)
@@ -649,6 +649,7 @@
<ClCompile Include="..\jit\JITDisassembler.cpp" />
<ClCompile Include="..\jit\JITExceptions.cpp" />
<ClCompile Include="..\jit\JITInlineCacheGenerator.cpp" />
+ <ClCompile Include="..\jit\JITMulGenerator.cpp" />
<ClCompile Include="..\jit\JITOpcodes.cpp" />
<ClCompile Include="..\jit\JITOpcodes32_64.cpp" />
<ClCompile Include="..\jit\JITOperations.cpp" />
@@ -1467,6 +1468,7 @@
<ClInclude Include="..\jit\JITExceptions.h" />
<ClInclude Include="..\jit\JITInlineCacheGenerator.h" />
<ClInclude Include="..\jit\JITInlines.h" />
+ <ClInclude Include="..\jit\JITMulGenerator.h" />
<ClInclude Include="..\jit\JITOperations.h" />
<ClInclude Include="..\jit\JITStubRoutine.h" />
<ClInclude Include="..\jit\JITSubGenerator.h" />
Modified: trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj.filters (192599 => 192600)
--- trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj.filters 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj.filters 2015-11-19 00:54:37 UTC (rev 192600)
@@ -444,6 +444,9 @@
<ClCompile Include="..\jit\JITExceptions.cpp">
<Filter>jit</Filter>
</ClCompile>
+ <ClCompile Include="..\jit\JITMulGenerator.cpp">
+ <Filter>jit</Filter>
+ </ClCompile>
<ClCompile Include="..\jit\JITOpcodes.cpp">
<Filter>jit</Filter>
</ClCompile>
@@ -2519,6 +2522,9 @@
<ClInclude Include="..\jit\JITInlines.h">
<Filter>jit</Filter>
</ClInclude>
+ <ClInclude Include="..\jit\JITMulGenerator.h">
+ <Filter>jit</Filter>
+ </ClInclude>
<ClInclude Include="..\jit\JITStubRoutine.h">
<Filter>jit</Filter>
</ClInclude>
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (192599 => 192600)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2015-11-19 00:54:37 UTC (rev 192600)
@@ -1962,6 +1962,8 @@
FE0D4A091ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */; };
FE1220271BE7F58C0039E6F2 /* JITAddGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */; };
FE1220281BE7F5910039E6F2 /* JITAddGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */; };
+ FE187A011BFBE55E0038BBCA /* JITMulGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */; settings = {ASSET_TAGS = (); }; };
+ FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */; settings = {ASSET_TAGS = (); }; };
FE1C0FFD1B193E9800B53FCA /* Exception.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1C0FFC1B193E9800B53FCA /* Exception.h */; settings = {ATTRIBUTES = (Private, ); }; };
FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1C0FFE1B194FD100B53FCA /* Exception.cpp */; };
FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
@@ -4092,6 +4094,8 @@
FE0D4A081ABA2437002F54BF /* GlobalContextWithFinalizerTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GlobalContextWithFinalizerTest.h; path = API/tests/GlobalContextWithFinalizerTest.h; sourceTree = "<group>"; };
FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITAddGenerator.cpp; sourceTree = "<group>"; };
FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITAddGenerator.h; sourceTree = "<group>"; };
+ FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITMulGenerator.cpp; sourceTree = "<group>"; };
+ FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITMulGenerator.h; sourceTree = "<group>"; };
FE1C0FFC1B193E9800B53FCA /* Exception.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Exception.h; sourceTree = "<group>"; };
FE1C0FFE1B194FD100B53FCA /* Exception.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Exception.cpp; sourceTree = "<group>"; };
FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = "<group>"; };
@@ -4774,6 +4778,8 @@
0FB14E1C18124ACE009B6B4D /* JITInlineCacheGenerator.cpp */,
0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */,
86CC85A00EE79A4700288682 /* JITInlines.h */,
+ FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */,
+ FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */,
BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */,
A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */,
0F24E54517EE274900ABB217 /* JITOperations.cpp */,
@@ -7417,6 +7423,7 @@
BC18C4520E16F5CD00B34460 /* LegacyProfiler.h in Headers */,
BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */,
BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
+ FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */,
86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */,
0F431738146BAC69007E3890 /* ListableHandler.h in Headers */,
A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
@@ -8961,6 +8968,7 @@
E18E3A590DF9278C00D90B34 /* VM.cpp in Sources */,
FE5932A7183C5A2600A1ECCC /* VMEntryScope.cpp in Sources */,
7B0247561B8682E100542440 /* WASMFunctionParser.cpp in Sources */,
+ FE187A011BFBE55E0038BBCA /* JITMulGenerator.cpp in Sources */,
7B39F76D1B62DE2E00360FB4 /* WASMModuleParser.cpp in Sources */,
7B39F7721B63574D00360FB4 /* WASMReader.cpp in Sources */,
26718BA41BE99F780052017B /* AirIteratedRegisterCoalescing.cpp in Sources */,
Modified: trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp (192599 => 192600)
--- trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp 2015-11-19 00:54:37 UTC (rev 192600)
@@ -1058,14 +1058,14 @@
jit.load32(CCallHelpers::Address(scratchGPR, ArrayStorage::lengthOffset()), scratchGPR);
state.failAndIgnore.append(
jit.branch32(CCallHelpers::LessThan, scratchGPR, CCallHelpers::TrustedImm32(0)));
- jit.boxInt32(scratchGPR, valueRegs);
+ jit.boxInt32(scratchGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
state.succeed();
return;
}
case StringLength: {
jit.load32(CCallHelpers::Address(baseGPR, JSString::offsetOfLength()), valueRegs.payloadGPR());
- jit.boxInt32(valueRegs.payloadGPR(), valueRegs);
+ jit.boxInt32(valueRegs.payloadGPR(), valueRegs, CCallHelpers::DoNotHaveTagRegisters);
state.succeed();
return;
}
Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.h (192599 => 192600)
--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2015-11-19 00:54:37 UTC (rev 192600)
@@ -1112,12 +1112,16 @@
#endif
}
- void boxInt32(GPRReg intGPR, JSValueRegs boxedRegs)
+ void boxInt32(GPRReg intGPR, JSValueRegs boxedRegs, TagRegistersMode mode = HaveTagRegisters)
{
#if USE(JSVALUE64)
- move(intGPR, boxedRegs.gpr());
- or64(TrustedImm64(TagTypeNumber), boxedRegs.gpr());
+ if (mode == DoNotHaveTagRegisters) {
+ move(intGPR, boxedRegs.gpr());
+ or64(TrustedImm64(TagTypeNumber), boxedRegs.gpr());
+ } else
+ or64(GPRInfo::tagTypeNumberRegister, intGPR, boxedRegs.gpr());
#else
+ UNUSED_PARAM(mode);
move(intGPR, boxedRegs.payloadGPR());
move(TrustedImm32(JSValue::Int32Tag), boxedRegs.tagGPR());
#endif
Modified: trunk/Source/_javascript_Core/jit/IntrinsicEmitter.cpp (192599 => 192600)
--- trunk/Source/_javascript_Core/jit/IntrinsicEmitter.cpp 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/jit/IntrinsicEmitter.cpp 2015-11-19 00:54:37 UTC (rev 192600)
@@ -77,7 +77,7 @@
switch (intrinsic()) {
case TypedArrayLengthIntrinsic: {
jit.load32(MacroAssembler::Address(state.baseGPR, JSArrayBufferView::offsetOfLength()), valueGPR);
- jit.boxInt32(valueGPR, valueRegs);
+ jit.boxInt32(valueGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
state.succeed();
return;
}
@@ -92,7 +92,7 @@
jit.lshift32(valueGPR, Imm32(logElementSize(type)), valueGPR);
}
- jit.boxInt32(valueGPR, valueRegs);
+ jit.boxInt32(valueGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
state.succeed();
return;
}
@@ -118,7 +118,7 @@
done.link(&jit);
- jit.boxInt32(valueGPR, valueRegs);
+ jit.boxInt32(valueGPR, valueRegs, CCallHelpers::DoNotHaveTagRegisters);
state.succeed();
return;
}
Modified: trunk/Source/_javascript_Core/jit/JIT.h (192599 => 192600)
--- trunk/Source/_javascript_Core/jit/JIT.h 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/jit/JIT.h 2015-11-19 00:54:37 UTC (rev 192600)
@@ -462,7 +462,6 @@
void emitJumpSlowCaseIfNotInt(RegisterID, RegisterID, RegisterID scratch);
void emitTagBool(RegisterID);
- void compileBinaryArithOp(OpcodeID, int dst, int src1, int src2, OperandTypes opi);
void compileBinaryArithOpSlowCase(Instruction*, OpcodeID, Vector<SlowCaseEntry>::iterator&, int dst, int src1, int src2, OperandTypes, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase);
void compileGetByIdHotPath(int baseVReg, const Identifier*);
Modified: trunk/Source/_javascript_Core/jit/JITArithmetic.cpp (192599 => 192600)
--- trunk/Source/_javascript_Core/jit/JITArithmetic.cpp 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/jit/JITArithmetic.cpp 2015-11-19 00:54:37 UTC (rev 192600)
@@ -31,6 +31,7 @@
#include "CodeBlock.h"
#include "JITAddGenerator.h"
#include "JITInlines.h"
+#include "JITMulGenerator.h"
#include "JITOperations.h"
#include "JITSubGenerator.h"
#include "JSArray.h"
@@ -662,38 +663,6 @@
/* ------------------------------ BEGIN: USE(JSVALUE64) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
-void JIT::compileBinaryArithOp(OpcodeID opcodeID, int, int op1, int op2, OperandTypes)
-{
- emitGetVirtualRegisters(op1, regT0, op2, regT1);
- emitJumpSlowCaseIfNotInt(regT0);
- emitJumpSlowCaseIfNotInt(regT1);
- ASSERT_UNUSED(opcodeID, opcodeID == op_mul);
- if (shouldEmitProfiling()) {
- // We want to be able to measure if this is taking the slow case just
- // because of negative zero. If this produces positive zero, then we
- // don't want the slow case to be taken because that will throw off
- // speculative compilation.
- move(regT0, regT2);
- addSlowCase(branchMul32(Overflow, regT1, regT2));
- JumpList done;
- done.append(branchTest32(NonZero, regT2));
- Jump negativeZero = branch32(LessThan, regT0, TrustedImm32(0));
- done.append(branch32(GreaterThanOrEqual, regT1, TrustedImm32(0)));
- negativeZero.link(this);
- // We only get here if we have a genuine negative zero. Record this,
- // so that the speculative JIT knows that we failed speculation
- // because of a negative zero.
- add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->addSpecialFastCaseProfile(m_bytecodeOffset)->m_counter));
- addSlowCase(jump());
- done.link(this);
- move(regT2, regT0);
- } else {
- addSlowCase(branchMul32(Overflow, regT1, regT0));
- addSlowCase(branchTest32(Zero, regT0));
- }
- emitTagInt(regT0, regT0);
-}
-
void JIT::compileBinaryArithOpSlowCase(Instruction* currentInstruction, OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, int result, int op1, int op2, OperandTypes types, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase)
{
// We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
@@ -711,8 +680,6 @@
}
linkSlowCase(iter); // Integer overflow case - we could handle this in JIT code, but this is likely rare.
- if (opcodeID == op_mul && !op1HasImmediateIntFastCase && !op2HasImmediateIntFastCase) // op_mul has an extra slow case to handle 0 * negative number.
- linkSlowCase(iter);
Label stubFunctionCall(this);
@@ -760,12 +727,9 @@
op2wasInteger.link(this);
}
- if (opcodeID == op_mul)
- mulDouble(fpRegT2, fpRegT1);
- else {
- ASSERT(opcodeID == op_div);
- divDouble(fpRegT2, fpRegT1);
- }
+ ASSERT_UNUSED(opcodeID, opcodeID == op_div);
+ divDouble(fpRegT2, fpRegT1);
+
moveDoubleTo64(fpRegT1, regT0);
sub64(tagTypeNumberRegister, regT0);
emitPutVirtualRegister(result, regT0);
@@ -773,43 +737,6 @@
end.link(this);
}
-void JIT::emit_op_mul(Instruction* currentInstruction)
-{
- int result = currentInstruction[1].u.operand;
- int op1 = currentInstruction[2].u.operand;
- int op2 = currentInstruction[3].u.operand;
- OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
- // For now, only plant a fast int case if the constant operand is greater than zero.
- int32_t value;
- if (isOperandConstantInt(op1) && ((value = getOperandConstantInt(op1)) > 0)) {
- emitGetVirtualRegister(op2, regT0);
- emitJumpSlowCaseIfNotInt(regT0);
- addSlowCase(branchMul32(Overflow, regT0, Imm32(value), regT1));
- emitTagInt(regT1, regT0);
- } else if (isOperandConstantInt(op2) && ((value = getOperandConstantInt(op2)) > 0)) {
- emitGetVirtualRegister(op1, regT0);
- emitJumpSlowCaseIfNotInt(regT0);
- addSlowCase(branchMul32(Overflow, regT0, Imm32(value), regT1));
- emitTagInt(regT1, regT0);
- } else
- compileBinaryArithOp(op_mul, result, op1, op2, types);
-
- emitPutVirtualRegister(result);
-}
-
-void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
- int result = currentInstruction[1].u.operand;
- int op1 = currentInstruction[2].u.operand;
- int op2 = currentInstruction[3].u.operand;
- OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
- bool op1HasImmediateIntFastCase = isOperandConstantInt(op1) && getOperandConstantInt(op1) > 0;
- bool op2HasImmediateIntFastCase = !op1HasImmediateIntFastCase && isOperandConstantInt(op2) && getOperandConstantInt(op2) > 0;
- compileBinaryArithOpSlowCase(currentInstruction, op_mul, iter, result, op1, op2, types, op1HasImmediateIntFastCase, op2HasImmediateIntFastCase);
-}
-
void JIT::emit_op_div(Instruction* currentInstruction)
{
int dst = currentInstruction[1].u.operand;
@@ -979,6 +906,84 @@
slowPathCall.call();
}
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+ int result = currentInstruction[1].u.operand;
+ int op1 = currentInstruction[2].u.operand;
+ int op2 = currentInstruction[3].u.operand;
+ OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+#if USE(JSVALUE64)
+ JSValueRegs leftRegs = JSValueRegs(regT0);
+ JSValueRegs rightRegs = JSValueRegs(regT1);
+ JSValueRegs resultRegs = leftRegs;
+ GPRReg scratchGPR = regT2;
+ FPRReg scratchFPR = InvalidFPRReg;
+#else
+ JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+ JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+ JSValueRegs resultRegs = leftRegs;
+ GPRReg scratchGPR = regT4;
+ FPRReg scratchFPR = fpRegT2;
+#endif
+
+ bool leftIsConstInt32 = isOperandConstantInt(op1);
+ bool rightIsConstInt32 = isOperandConstantInt(op2);
+ ResultType leftType = types.first();
+ ResultType rightType = types.second();
+ int32_t leftConstInt32 = 0;
+ int32_t rightConstInt32 = 0;
+
+ uint32_t* profilingCounter = nullptr;
+ if (shouldEmitProfiling())
+ profilingCounter = &m_codeBlock->addSpecialFastCaseProfile(m_bytecodeOffset)->m_counter;
+
+ ASSERT(!leftIsConstInt32 || !rightIsConstInt32);
+
+ if (leftIsConstInt32)
+ leftConstInt32 = getOperandConstantInt(op1);
+ if (rightIsConstInt32)
+ rightConstInt32 = getOperandConstantInt(op2);
+
+ bool leftIsPositiveConstInt32 = leftIsConstInt32 && (leftConstInt32 > 0);
+ bool rightIsPositiveConstInt32 = rightIsConstInt32 && (rightConstInt32 > 0);
+
+ if (leftIsPositiveConstInt32)
+ emitGetVirtualRegister(op2, rightRegs);
+ else if (rightIsPositiveConstInt32)
+ emitGetVirtualRegister(op1, leftRegs);
+ else {
+ emitGetVirtualRegister(op1, leftRegs);
+ emitGetVirtualRegister(op2, rightRegs);
+ }
+
+ JITMulGenerator gen(resultRegs, leftRegs, rightRegs, leftType, rightType,
+ leftIsPositiveConstInt32, rightIsPositiveConstInt32, leftConstInt32, rightConstInt32,
+ fpRegT0, fpRegT1, scratchGPR, scratchFPR, profilingCounter);
+
+ gen.generateFastPath(*this);
+
+ if (gen.didEmitFastPath()) {
+ gen.endJumpList().link(this);
+ emitPutVirtualRegister(result, resultRegs);
+
+ addSlowCase(gen.slowPathJumpList());
+ } else {
+ ASSERT(gen.endJumpList().empty());
+ ASSERT(gen.slowPathJumpList().empty());
+ JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mul);
+ slowPathCall.call();
+ }
+}
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+ linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+ JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mul);
+ slowPathCall.call();
+}
+
void JIT::emit_op_sub(Instruction* currentInstruction)
{
int result = currentInstruction[1].u.operand;
Modified: trunk/Source/_javascript_Core/jit/JITArithmetic32_64.cpp (192599 => 192600)
--- trunk/Source/_javascript_Core/jit/JITArithmetic32_64.cpp 2015-11-19 00:30:37 UTC (rev 192599)
+++ trunk/Source/_javascript_Core/jit/JITArithmetic32_64.cpp 2015-11-19 00:54:37 UTC (rev 192600)
@@ -512,11 +512,6 @@
// Do the math.
doTheMath.link(this);
switch (opcodeID) {
- case op_mul:
- emitLoadDouble(op1, fpRegT2);
- mulDouble(fpRegT2, fpRegT0);
- emitStoreDouble(dst, fpRegT0);
- break;
case op_div: {
emitLoadDouble(op1, fpRegT1);
divDouble(fpRegT0, fpRegT1);
@@ -603,11 +598,6 @@
// Do the math.
switch (opcodeID) {
- case op_mul:
- emitLoadDouble(op2, fpRegT2);
- mulDouble(fpRegT2, fpRegT0);
- emitStoreDouble(dst, fpRegT0);
- break;
case op_div: {
emitLoadDouble(op2, fpRegT2);
divDouble(fpRegT2, fpRegT0);
@@ -676,83 +666,6 @@
end.link(this);
}
-// Multiplication (*)
-
-void JIT::emit_op_mul(Instruction* currentInstruction)
-{
- int dst = currentInstruction[1].u.operand;
- int op1 = currentInstruction[2].u.operand;
- int op2 = currentInstruction[3].u.operand;
- OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
- m_codeBlock->addSpecialFastCaseProfile(m_bytecodeOffset);
-
- JumpList notInt32Op1;
- JumpList notInt32Op2;
-
- emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
- notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
- notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
-
- // Int32 case.
- move(regT0, regT3);
- addSlowCase(branchMul32(Overflow, regT2, regT0));
- addSlowCase(branchTest32(Zero, regT0));
- emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
-
- if (!supportsFloatingPoint()) {
- addSlowCase(notInt32Op1);
- addSlowCase(notInt32Op2);
- return;
- }
- Jump end = jump();
-
- // Double case.
- emitBinaryDoubleOp(op_mul, dst, op1, op2, types, notInt32Op1, notInt32Op2);
- end.link(this);
-}
-
-void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
- int dst = currentInstruction[1].u.operand;
- int op1 = currentInstruction[2].u.operand;
- int op2 = currentInstruction[3].u.operand;
- OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
- Jump overflow = getSlowCase(iter); // overflow check
- linkSlowCase(iter); // zero result check
-
- Jump negZero = branchOr32(Signed, regT2, regT3);
- emitStoreInt32(dst, TrustedImm32(0), (op1 == dst || op2 == dst));
-
- emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_mul));
-
- negZero.link(this);
- // We only get here if we have a genuine negative zero. Record this,
- // so that the speculative JIT knows that we failed speculation
- // because of a negative zero.
- add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
- overflow.link(this);
-
- if (!supportsFloatingPoint()) {
- linkSlowCase(iter); // int32 check
- linkSlowCase(iter); // int32 check
- }
-
- if (supportsFloatingPoint()) {
- if (!types.first().definitelyIsNumber())
- linkSlowCase(iter); // double check
-
- if (!types.second().definitelyIsNumber()) {
- linkSlowCase(iter); // int32 check
- linkSlowCase(iter); // double check
- }
- }
-
- JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mul);
- slowPathCall.call();
-}
-
// Division (/)
void JIT::emit_op_div(Instruction* currentInstruction)
Added: trunk/Source/_javascript_Core/jit/JITMulGenerator.cpp (0 => 192600)
--- trunk/Source/_javascript_Core/jit/JITMulGenerator.cpp (rev 0)
+++ trunk/Source/_javascript_Core/jit/JITMulGenerator.cpp 2015-11-19 00:54:37 UTC (rev 192600)
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#include "JITMulGenerator.h"
+
+namespace JSC {
+
+void JITMulGenerator::generateFastPath(CCallHelpers& jit)
+{
+ ASSERT(m_scratchGPR != InvalidGPRReg);
+ ASSERT(m_scratchGPR != m_left.payloadGPR());
+ ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+ ASSERT(m_scratchGPR != m_left.tagGPR());
+ ASSERT(m_scratchGPR != m_right.tagGPR());
+ ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+ ASSERT(!m_leftIsPositiveConstInt32 || !m_rightIsPositiveConstInt32);
+
+ if (!m_leftType.mightBeNumber() || !m_rightType.mightBeNumber()) {
+ ASSERT(!m_didEmitFastPath);
+ return;
+ }
+
+ m_didEmitFastPath = true;
+
+ if (m_leftIsPositiveConstInt32 || m_rightIsPositiveConstInt32) {
+ JSValueRegs var;
+ ResultType varType = ResultType::unknownType();
+ int32_t constInt32;
+
+ if (m_leftIsPositiveConstInt32) {
+ var = m_right;
+ varType = m_rightType;
+ constInt32 = m_leftConstInt32;
+ } else {
+ var = m_left;
+ varType = m_leftType;
+ constInt32 = m_rightConstInt32;
+ }
+
+ // Try to do intVar * intConstant.
+ CCallHelpers::Jump notInt32 = jit.branchIfNotInt32(var);
+
+ m_slowPathJumpList.append(jit.branchMul32(CCallHelpers::Overflow, var.payloadGPR(), CCallHelpers::Imm32(constInt32), m_scratchGPR));
+
+ jit.boxInt32(m_scratchGPR, m_result);
+ m_endJumpList.append(jit.jump());
+
+ if (!jit.supportsFloatingPoint()) {
+ m_slowPathJumpList.append(notInt32);
+ return;
+ }
+
+ // Try to do doubleVar * double(intConstant).
+ notInt32.link(&jit);
+ if (!varType.definitelyIsNumber())
+ m_slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
+
+ jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
+
+ jit.move(CCallHelpers::Imm32(constInt32), m_scratchGPR);
+ jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
+
+ // Fall thru to doubleVar * doubleVar.
+
+ } else {
+ ASSERT(!m_leftIsPositiveConstInt32 && !m_rightIsPositiveConstInt32);
+
+ CCallHelpers::Jump leftNotInt;
+ CCallHelpers::Jump rightNotInt;
+
+ // Try to do intVar * intVar.
+ leftNotInt = jit.branchIfNotInt32(m_left);
+ rightNotInt = jit.branchIfNotInt32(m_right);
+
+ m_slowPathJumpList.append(jit.branchMul32(CCallHelpers::Overflow, m_right.payloadGPR(), m_left.payloadGPR(), m_scratchGPR));
+ if (!m_profilingCounter) {
+ m_slowPathJumpList.append(jit.branchTest32(CCallHelpers::Zero, m_scratchGPR)); // Go slow if potential negative zero.
+
+ } else {
+ CCallHelpers::JumpList notNegativeZero;
+ notNegativeZero.append(jit.branchTest32(CCallHelpers::NonZero, m_scratchGPR));
+
+ CCallHelpers::Jump negativeZero = jit.branch32(CCallHelpers::LessThan, m_left.payloadGPR(), CCallHelpers::TrustedImm32(0));
+ notNegativeZero.append(jit.branch32(CCallHelpers::GreaterThanOrEqual, m_right.payloadGPR(), CCallHelpers::TrustedImm32(0)));
+
+ negativeZero.link(&jit);
+ // Record this, so that the speculative JIT knows that we failed speculation
+ // because of a negative zero.
+ jit.add32(CCallHelpers::TrustedImm32(1), CCallHelpers::AbsoluteAddress(m_profilingCounter));
+ m_slowPathJumpList.append(jit.jump());
+
+ notNegativeZero.link(&jit);
+ }
+
+ jit.boxInt32(m_scratchGPR, m_result);
+ m_endJumpList.append(jit.jump());
+
+ if (!jit.supportsFloatingPoint()) {
+ m_slowPathJumpList.append(leftNotInt);
+ m_slowPathJumpList.append(rightNotInt);
+ return;
+ }
+
+ leftNotInt.link(&jit);
+ if (!m_leftType.definitelyIsNumber())
+ m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+ if (!m_rightType.definitelyIsNumber())
+ m_slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+ jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+ CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
+
+ jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
+ CCallHelpers::Jump rightWasInteger = jit.jump();
+
+ rightNotInt.link(&jit);
+ if (!m_rightType.definitelyIsNumber())
+ m_slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+ jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
+
+ rightIsDouble.link(&jit);
+ jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+
+ rightWasInteger.link(&jit);
+
+ // Fall thru to doubleVar * doubleVar.
+ }
+
+ // Do doubleVar * doubleVar.
+ jit.mulDouble(m_rightFPR, m_leftFPR);
+ jit.boxDouble(m_leftFPR, m_result);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
Added: trunk/Source/_javascript_Core/jit/JITMulGenerator.h (0 => 192600)
--- trunk/Source/_javascript_Core/jit/JITMulGenerator.h (rev 0)
+++ trunk/Source/_javascript_Core/jit/JITMulGenerator.h 2015-11-19 00:54:37 UTC (rev 192600)
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JITMulGenerator_h
+#define JITMulGenerator_h
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "ResultType.h"
+
+namespace JSC {
+
+class JITMulGenerator {
+public:
+ JITMulGenerator(JSValueRegs result, JSValueRegs left, JSValueRegs right,
+ ResultType leftType, ResultType rightType, bool leftIsPositiveConstInt32, bool rightIsPositiveConstInt32,
+ int32_t leftConstInt32, int32_t rightConstInt32, FPRReg leftFPR, FPRReg rightFPR,
+ GPRReg scratchGPR, FPRReg scratchFPR, uint32_t* profilingCounter)
+ : m_result(result)
+ , m_left(left)
+ , m_right(right)
+ , m_leftType(leftType)
+ , m_rightType(rightType)
+ , m_leftIsPositiveConstInt32(leftIsPositiveConstInt32)
+ , m_rightIsPositiveConstInt32(rightIsPositiveConstInt32)
+ , m_leftConstInt32(leftConstInt32)
+ , m_rightConstInt32(rightConstInt32)
+ , m_leftFPR(leftFPR)
+ , m_rightFPR(rightFPR)
+ , m_scratchGPR(scratchGPR)
+ , m_scratchFPR(scratchFPR)
+ , m_profilingCounter(profilingCounter)
+ {
+ ASSERT(!leftIsPositiveConstInt32 || !rightIsPositiveConstInt32);
+ }
+
+ void generateFastPath(CCallHelpers&);
+
+ bool didEmitFastPath() const { return m_didEmitFastPath; }
+ CCallHelpers::JumpList endJumpList() { return m_endJumpList; }
+ CCallHelpers::JumpList slowPathJumpList() { return m_slowPathJumpList; }
+
+private:
+ JSValueRegs m_result;
+ JSValueRegs m_left;
+ JSValueRegs m_right;
+ ResultType m_leftType;
+ ResultType m_rightType;
+ bool m_leftIsPositiveConstInt32;
+ bool m_rightIsPositiveConstInt32;
+ int32_t m_leftConstInt32;
+ int32_t m_rightConstInt32;
+ FPRReg m_leftFPR;
+ FPRReg m_rightFPR;
+ GPRReg m_scratchGPR;
+ FPRReg m_scratchFPR;
+ uint32_t* m_profilingCounter;
+ bool m_didEmitFastPath { false };
+
+ CCallHelpers::JumpList m_endJumpList;
+ CCallHelpers::JumpList m_slowPathJumpList;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // JITMulGenerator_h
Added: trunk/Source/_javascript_Core/tests/stress/op_mul.js (0 => 192600)
--- trunk/Source/_javascript_Core/tests/stress/op_mul.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/op_mul.js 2015-11-19 00:54:37 UTC (rev 192600)
@@ -0,0 +1,386 @@
+//@ runFTLNoCJIT
+
+// This test module aims to test the multiplication operator by comparing its runtime
+// behavior (using the different tiers) with expected values computed at initialization
+// time using the LLINT / bytecode generator.
+//
+// It works by generating test scenarios from permutations of value pairs to exercise
+// the multiplication operator. It computes the expected results by evaluating an
+// _expression_ to multiply the values in an initialization pass. The scenarios are later
+// applied to a set of test functions of the forms:
+//
+// variable * variable
+// constant * variable
+// variable * constant
+//
+// See generateScenarios() and initializeTestCases() for details on how the test
+// cases are generated.
+//
+// If all goes well, this test module will terminate silently. If not, it will print
+// errors.
+
+var verbose = false;
+var abortOnFirstFail = false;
+
+var o1 = {
+ valueOf: function() { return 10; }
+};
+
+var posInfinity = 1 / 0;
+var negInfinity = -1 / 0;
+
+var set1 = [
+ 'o1',
+ 'null',
+ 'undefined',
+ 'NaN',
+ 'posInfinity',
+ 'negInfinity',
+ '"abc"',
+];
+
+var set2 = [
+ '0',
+ '-0',
+ '1',
+ '-1',
+ '0x3fff',
+ '-0x3fff',
+ '0x7fff',
+ '-0x7fff',
+ '0x10000',
+ '-0x10000',
+ '2147483647',
+ '-2147483647',
+ '4294967296',
+ '-4294967296',
+ '100.2',
+ '-100.2',
+ 'true',
+ 'false',
+];
+
+// Assemble the values that we'll be testing with:
+var values = [];
+for (var i = 0; i < set1.length; i++)
+ values.push(set1[i]);
+for (var i = 0; i < set2.length; i++)
+ values.push(set2[i]);
+for (var i = 0; i < set2.length; i++)
+ values.push('"' + set2[i] + '"');
+
+function generateScenarios(xvalues, yvalues) {
+ var scenarios = [];
+ for (var i = 0; i < xvalues.length; i++) {
+ for (var j = 0; j < yvalues.length; j++) {
+ var xStr = xvalues[i];
+ var yStr = yvalues[j];
+ var x = eval(xStr);
+ var y = eval(yStr);
+ var name = "(" + xStr + " * " + yStr + ")";
+ var expected = eval("" + xStr + " * " + yStr);
+ var scenario = { name: name, x: x, y: y, expected: expected };
+
+ scenarios.push(scenario);
+ }
+ }
+ return scenarios;
+}
+
+function printScenarios(scenarios) {
+ for (var i = 0; i < scenarios.length; i++) {
+ var scenario = scenarios[i];
+ print("scenario[" + i + "]: { name: " + scenario.name + ", x: " + scenario.x, ", y: " + scenario.y + ", expected: " + scenario.expected + " }");
+ }
+}
+
+var testCases = [
+ {
+ name: "mul",
+ func: function(x, y) { return x * y; },
+ xvalues: values,
+ yvalues: values
+ },
+ {
+ name: "mulI32V",
+ func: function(x, y) { return 1 * y; },
+ xvalues: [ '1' ],
+ yvalues: values
+ },
+ {
+ name: "mulVI32",
+ func: function(x, y) { return x * 1; },
+ xvalues: values,
+ yvalues: [ '1' ]
+ },
+ {
+ name: "mulI32oV",
+ func: function(x, y) { return 2147483647 * y; },
+ xvalues: [ '2147483647' ],
+ yvalues: values
+ },
+ {
+ name: "mulVI32o",
+ func: function(x, y) { return x * 2147483647; },
+ xvalues: values,
+ yvalues: [ '2147483647' ]
+ },
+ {
+ name: "mulI32onV",
+ func: function(x, y) { return -2147483647 * y; },
+ xvalues: [ '-2147483647' ],
+ yvalues: values
+ },
+ {
+ name: "mulVI32on",
+ func: function(x, y) { return x * (-2147483647); },
+ xvalues: values,
+ yvalues: [ '-2147483647' ]
+ },
+ {
+ name: "mulI52V",
+ func: function(x, y) { return 4294967296 * y; },
+ xvalues: [ '4294967296' ],
+ yvalues: values
+ },
+ {
+ name: "mulVI52",
+ func: function(x, y) { return x * 4294967296; },
+ xvalues: values,
+ yvalues: [ '4294967296' ]
+ },
+ {
+ name: "mulI52nV",
+ func: function(x, y) { return -4294967296 * y; },
+ xvalues: [ '-4294967296' ],
+ yvalues: values
+ },
+ {
+ name: "mulVI52n",
+ func: function(x, y) { return x * (-4294967296); },
+ xvalues: values,
+ yvalues: [ '-4294967296' ]
+ },
+ {
+ name: "mulDV",
+ func: function(x, y) { return 100.2 * y; },
+ xvalues: [ '100.2' ],
+ yvalues: values
+ },
+ {
+ name: "mulVD",
+ func: function(x, y) { return x * 100.2; },
+ xvalues: values,
+ yvalues: [ '100.2' ]
+ },
+ {
+ name: "mulBV",
+ func: function(x, y) { return true * y; },
+ xvalues: [ 'true' ],
+ yvalues: values
+ },
+ {
+ name: "mulVB",
+ func: function(x, y) { return x * true; },
+ xvalues: values,
+ yvalues: [ 'true' ]
+ },
+ {
+ name: "mulSi32V",
+ func: function(x, y) { return "10" * y; },
+ xvalues: [ '"10"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSi32",
+ func: function(x, y) { return x * "10"; },
+ xvalues: values,
+ yvalues: [ '"10"' ]
+ },
+
+ {
+ name: "mulSi32oV",
+ func: function(x, y) { return "2147483647" * y; },
+ xvalues: [ '"2147483647"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSi32o",
+ func: function(x, y) { return x * "2147483647"; },
+ xvalues: values,
+ yvalues: [ '"2147483647"' ]
+ },
+ {
+ name: "mulSi32onV",
+ func: function(x, y) { return "-2147483647" * y; },
+ xvalues: [ '"-2147483647"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSi32on",
+ func: function(x, y) { return x * "-2147483647"; },
+ xvalues: values,
+ yvalues: [ '"-2147483647"' ]
+ },
+ {
+ name: "mulSi52V",
+ func: function(x, y) { return "4294967296" * y; },
+ xvalues: [ '"4294967296"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSi52",
+ func: function(x, y) { return x * "4294967296"; },
+ xvalues: values,
+ yvalues: [ '"4294967296"' ]
+ },
+ {
+ name: "mulSi52nV",
+ func: function(x, y) { return "-4294967296" * y; },
+ xvalues: [ '"-4294967296"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSi52n",
+ func: function(x, y) { return x * "-4294967296"; },
+ xvalues: values,
+ yvalues: [ '"-4294967296"' ]
+ },
+ {
+ name: "mulSdV",
+ func: function(x, y) { return "100.2" * y; },
+ xvalues: [ '"100.2"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSd",
+ func: function(x, y) { return x * "100.2"; },
+ xvalues: values,
+ yvalues: [ '"100.2"' ]
+ },
+ {
+ name: "mulSbV",
+ func: function(x, y) { return "true" * y; },
+ xvalues: [ '"true"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVSb",
+ func: function(x, y) { return x * "true"; },
+ xvalues: values,
+ yvalues: [ '"true"' ]
+ },
+
+ {
+ name: "mulSV",
+ func: function(x, y) { return "abc" * y; },
+ xvalues: [ '"abc"' ],
+ yvalues: values
+ },
+ {
+ name: "mulVS",
+ func: function(x, y) { return x * "abc"; },
+ xvalues: values,
+ yvalues: [ '"abc"' ]
+ },
+ {
+ name: "mulNV",
+ func: function(x, y) { return null * y; },
+ xvalues: [ 'null' ],
+ yvalues: values
+ },
+ {
+ name: "mulVN",
+ func: function(x, y) { return x * null; },
+ xvalues: values,
+ yvalues: [ 'null' ]
+ },
+ {
+ name: "mulOV",
+ func: function(x, y) { return o1 * y; },
+ xvalues: [ 'o1' ],
+ yvalues: values
+ },
+ {
+ name: "mulVO",
+ func: function(x, y) { return x * o1; },
+ xvalues: values,
+ yvalues: [ 'o1' ]
+ },
+ {
+ name: "mulNaNV",
+ func: function(x, y) { return NaN * y; },
+ xvalues: [ 'NaN' ],
+ yvalues: values
+ },
+ {
+ name: "mulVNaN",
+ func: function(x, y) { return x * NaN; },
+ xvalues: values,
+ yvalues: [ 'NaN' ]
+ },
+];
+
+function initializeTestCases() {
+ for (var test of testCases) {
+ noInline(test.func);
+ test.scenarios = generateScenarios(test.xvalues, test.yvalues);
+ }
+}
+initializeTestCases();
+
+var errorReport = "";
+
+function stringifyIfNeeded(x) {
+ if (typeof x == "string")
+ return '"' + x + '"';
+ return x;
+}
+
+function isIdentical(x, y) {
+ if (x == y) {
+ if (x)
+ return true;
+ // Distinguish between 0 and negative 0.
+ if (1 / x == 1 / y)
+ return true;
+ } else if (Number.isNaN(x) && Number.isNaN(y))
+ return true;
+ return false;
+}
+
+function runTest(test) {
+ var failedScenario = [];
+ var scenarios = test.scenarios;
+ var testFunc = test.func;
+ try {
+ for (var i = 0; i < 10000; i++) {
+ for (var scenarioID = 0; scenarioID < scenarios.length; scenarioID++) {
+ var scenario = scenarios[scenarioID];
+ if (verbose)
+ print("Testing " + test.name + ":" + scenario.name + " on iteration " + i + ": expecting " + stringifyIfNeeded(scenario.expected));
+
+ var result = testFunc(scenario.x, scenario.y);
+ if (isIdentical(result, scenario.expected))
+ continue;
+ if (!failedScenario[scenarioID]) {
+ errorReport += "FAIL: " + test.name + ":" + scenario.name + " started failing on iteration " + i
+ + ": expected " + stringifyIfNeeded(scenario.expected) + ", actual " + stringifyIfNeeded(result) + "\n";
+ if (abortOnFirstFail)
+ throw errorReport;
+ failedScenario[scenarioID] = scenario;
+ }
+ }
+ }
+ } catch(e) {
+ if (abortOnFirstFail)
+ throw e; // Negate the catch by re-throwing.
+ errorReport += "Unexpected exception: " + e + "\n";
+ }
+}
+
+for (var test of testCases)
+ runTest(test);
+
+if (errorReport !== "")
+ throw "Error: bad result:\n" + errorReport;
