[webkit-changes] [194048] trunk/Source/JavaScriptCore

Mon, 14 Dec 2015 12:25:38 -0800

Title: [194048] trunk/Source/_javascript_Core
Revision
194048
Author
[email protected]
Date
2015-12-14 12:25:30 -0800 (Mon, 14 Dec 2015)

Log Message

B3 should not give ValueReps for the non-stackmap children of a CheckValue to the generator callback
https://bugs.webkit.org/show_bug.cgi?id=152224

Reviewed by Geoffrey Garen.

Previously, a stackmap generator for a Check had to know how many children the B3 value for the
Check had at the time of code generation. That meant that B3 could not change the kind of Check
that it was - for example it cannot turn a Check into a Patchpoint and it cannot turn a CheckAdd
into a Check. But just changing the contract so that the stackmap generation params only get the
stackmap children of the check means that B3 can transform Checks as it likes.

This is meant to aid sinking values into checks.

Also, I found that the effects of a Check did not include HeapRange::top(). I think it's best if
exitsSideways does not imply reading top, the way that it does in DFG. In the DFG, that makes
sense because the exit analysis is orthogonal, so the clobber analysis tells you about the reads
not counting OSR exit - if you need to you can conditionally merge that with World based on a
separate exit analysis. But in B3, the Effects object tells you about both exiting and reading,
and it's computed by one analysis. Prior to this change, Check was not setting reads to top() so
we were effectively saying that Effects::reads is meaningless when exitsSideways is true. It
seems more sensible to instead force the analysis to set reads to top() when setting
exitsSideways to true, not least because we only have one such analysis and many users. But it
also makes sense for another reason: it allows us to bound the set of things that the program
will read after it exits. That might not be useful to us now, but it's a nice feature to get for
free. I've seen language features that have behave like exitsSideways that don't also read top,
like an array bounds check that causes sudden termination without making any promises about how
pretty the crash dump will look.

* b3/B3CheckSpecial.cpp:
(JSC::B3::CheckSpecial::generate):
* b3/B3Opcode.h:
* b3/B3Value.cpp:
(JSC::B3::Value::effects):
* b3/testb3.cpp:
(JSC::B3::testSimpleCheck):
(JSC::B3::testCheckLessThan):
(JSC::B3::testCheckMegaCombo):
(JSC::B3::testCheckAddImm):
(JSC::B3::testCheckAddImmCommute):
(JSC::B3::testCheckAddImmSomeRegister):
(JSC::B3::testCheckAdd):
(JSC::B3::testCheckAdd64):
(JSC::B3::testCheckSubImm):
(JSC::B3::testCheckSubBadImm):
(JSC::B3::testCheckSub):
(JSC::B3::testCheckSub64):
(JSC::B3::testCheckNeg):
(JSC::B3::testCheckNeg64):
(JSC::B3::testCheckMul):
(JSC::B3::testCheckMulMemory):
(JSC::B3::testCheckMul2):
(JSC::B3::testCheckMul64):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (194047 => 194048)


--- trunk/Source/_javascript_Core/ChangeLog	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/ChangeLog	2015-12-14 20:25:30 UTC (rev 194048)
@@ -1,5 +1,62 @@
 2015-12-14  Filip Pizlo  <[email protected]>
 
+        B3 should not give ValueReps for the non-stackmap children of a CheckValue to the generator callback
+        https://bugs.webkit.org/show_bug.cgi?id=152224
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, a stackmap generator for a Check had to know how many children the B3 value for the
+        Check had at the time of code generation. That meant that B3 could not change the kind of Check
+        that it was - for example it cannot turn a Check into a Patchpoint and it cannot turn a CheckAdd
+        into a Check. But just changing the contract so that the stackmap generation params only get the
+        stackmap children of the check means that B3 can transform Checks as it likes.
+
+        This is meant to aid sinking values into checks.
+
+        Also, I found that the effects of a Check did not include HeapRange::top(). I think it's best if
+        exitsSideways does not imply reading top, the way that it does in DFG. In the DFG, that makes
+        sense because the exit analysis is orthogonal, so the clobber analysis tells you about the reads
+        not counting OSR exit - if you need to you can conditionally merge that with World based on a
+        separate exit analysis. But in B3, the Effects object tells you about both exiting and reading,
+        and it's computed by one analysis. Prior to this change, Check was not setting reads to top() so
+        we were effectively saying that Effects::reads is meaningless when exitsSideways is true. It
+        seems more sensible to instead force the analysis to set reads to top() when setting
+        exitsSideways to true, not least because we only have one such analysis and many users. But it
+        also makes sense for another reason: it allows us to bound the set of things that the program
+        will read after it exits. That might not be useful to us now, but it's a nice feature to get for
+        free. I've seen language features that have behave like exitsSideways that don't also read top,
+        like an array bounds check that causes sudden termination without making any promises about how
+        pretty the crash dump will look.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3Opcode.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * b3/testb3.cpp:
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCheckLessThan):
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testCheckAddImmCommute):
+        (JSC::B3::testCheckAddImmSomeRegister):
+        (JSC::B3::testCheckAdd):
+        (JSC::B3::testCheckAdd64):
+        (JSC::B3::testCheckSubImm):
+        (JSC::B3::testCheckSubBadImm):
+        (JSC::B3::testCheckSub):
+        (JSC::B3::testCheckSub64):
+        (JSC::B3::testCheckNeg):
+        (JSC::B3::testCheckNeg64):
+        (JSC::B3::testCheckMul):
+        (JSC::B3::testCheckMulMemory):
+        (JSC::B3::testCheckMul2):
+        (JSC::B3::testCheckMul64):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+
+2015-12-14  Filip Pizlo  <[email protected]>
+
         Air: Support Architecture-specific forms and Opcodes
         https://bugs.webkit.org/show_bug.cgi?id=151736

Modified: trunk/Source/_javascript_Core/b3/B3CheckSpecial.cpp (194047 => 194048)


--- trunk/Source/_javascript_Core/b3/B3CheckSpecial.cpp	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/b3/B3CheckSpecial.cpp	2015-12-14 20:25:30 UTC (rev 194048)
@@ -143,9 +143,6 @@
     ASSERT(value);
 
     Vector<ValueRep> reps;
-    for (unsigned i = numB3Args(value); i--;)
-        reps.append(ValueRep());
-
     appendRepsImpl(context, m_numCheckArgs + 1, inst, reps);
 
     // Set aside the args that are relevant to undoing the operation. This is because we don't want to

Modified: trunk/Source/_javascript_Core/b3/B3Effects.h (194047 => 194048)


--- trunk/Source/_javascript_Core/b3/B3Effects.h	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/b3/B3Effects.h	2015-12-14 20:25:30 UTC (rev 194048)
@@ -38,10 +38,11 @@
     bool terminal { false };
 
     // True if this value can cause execution to terminate abruptly, and that this abrupt termination is
-    // observable. Note that if exitsSideways is set to true but reads is bottom, then B3 is free to
-    // assume that after abrupt termination of this procedure, none of the heap will be read. That's
-    // usually false, so make sure that reads corresponds to the set of things that are readable after
-    // this function terminates abruptly.
+    // observable. An example of how this gets used is to limit the hoisting of controlDependent values.
+    // Note that if exitsSideways is set to true but reads is bottom, then B3 is free to assume that
+    // after abrupt termination of this procedure, none of the heap will be read. That's usually false,
+    // so make sure that reads corresponds to the set of things that are readable after this function
+    // terminates abruptly.
     bool exitsSideways { false };
 
     // True if the instruction may change semantics if hoisted above some control flow.

Modified: trunk/Source/_javascript_Core/b3/B3Opcode.h (194047 => 194048)


--- trunk/Source/_javascript_Core/b3/B3Opcode.h	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/b3/B3Opcode.h	2015-12-14 20:25:30 UTC (rev 194048)
@@ -174,9 +174,8 @@
     // after the first CheckAdd executes, the second CheckAdd could not have possibly taken slow
     // path. Therefore, the second CheckAdd's callback is irrelevant.
     //
-    // Note that the first two children of these operations have ValueRep's, both as input constraints and
-    // in the reps provided to the generator. The output constraints could be anything, and should not be
-    // inspected for meaning. If you want to capture the values of the inputs, use stackmap arguments.
+    // Note that the first two children of these operations have ValueRep's as input constraints but do
+    // not have output constraints.
     CheckAdd,
     CheckSub,
     CheckMul,
@@ -184,8 +183,8 @@
     // Check that side-exits. Use the CheckValue class. Like CheckAdd and friends, this has a
     // stackmap with a generation callback. This takes an int argument that this branches on, with
     // full branch fusion in the instruction selector. A true value jumps to the generator's slow
-    // path. Note that the predicate child is has both an input and output ValueRep. The input constraint
-    // must be Any, and the output could be anything.
+    // path. Note that the predicate child is has both an input ValueRep. The input constraint must be
+    // WarmAny. It will not have an output constraint.
     Check,
 
     // SSA support, in the style of DFG SSA.

Modified: trunk/Source/_javascript_Core/b3/B3Value.cpp (194047 => 194048)


--- trunk/Source/_javascript_Core/b3/B3Value.cpp	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/b3/B3Value.cpp	2015-12-14 20:25:30 UTC (rev 194048)
@@ -415,6 +415,8 @@
     case CheckMul:
     case Check:
         result.exitsSideways = true;
+        // The program could read anything after exiting, and it's on us to declare this.
+        result.reads = HeapRange::top();
         break;
     case Upsilon:
         result.writesSSAState = true;

Modified: trunk/Source/_javascript_Core/b3/testb3.cpp (194047 => 194048)


--- trunk/Source/_javascript_Core/b3/testb3.cpp	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/b3/testb3.cpp	2015-12-14 20:25:30 UTC (rev 194048)
@@ -5597,7 +5597,7 @@
     check->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 1);
+            CHECK(!params.size());
 
             // This should always work because a function this simple should never have callee
             // saves.
@@ -5629,7 +5629,7 @@
     check->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 1);
+            CHECK(!params.size());
 
             // This should always work because a function this simple should never have callee
             // saves.
@@ -5675,7 +5675,7 @@
     check->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 1);
+            CHECK(!params.size());
 
             // This should always work because a function this simple should never have callee
             // saves.
@@ -5872,11 +5872,11 @@
     checkAdd->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isConstant());
-            CHECK(params[3].value() == 42);
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 42);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
             jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(42), FPRInfo::fpRegT1);
             jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
@@ -5908,11 +5908,11 @@
     checkAdd->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isConstant());
-            CHECK(params[3].value() == 42);
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 42);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
             jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(42), FPRInfo::fpRegT1);
             jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
@@ -5944,11 +5944,11 @@
     checkAdd->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt32ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -5981,11 +5981,11 @@
     checkAdd->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt32ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6014,11 +6014,11 @@
     checkAdd->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt64ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt64ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6088,11 +6088,11 @@
     checkSub->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isConstant());
-            CHECK(params[3].value() == 42);
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 42);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
             jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(42), FPRInfo::fpRegT1);
             jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
@@ -6125,11 +6125,11 @@
     checkSub->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isConstant());
-            CHECK(params[3].value() == badImm);
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == badImm);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
             jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(badImm), FPRInfo::fpRegT1);
             jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
@@ -6163,11 +6163,11 @@
     checkSub->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt32ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6201,11 +6201,11 @@
     checkSub->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt64ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt64ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6274,9 +6274,9 @@
     checkNeg->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 3);
-            CHECK(params[2].isGPR());
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 1);
+            CHECK(params[0].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT1);
             jit.negateDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6304,9 +6304,9 @@
     checkNeg->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 3);
-            CHECK(params[2].isGPR());
-            jit.convertInt64ToDouble(params[2].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 1);
+            CHECK(params[0].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT1);
             jit.negateDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6339,11 +6339,11 @@
     checkMul->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt32ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6380,11 +6380,11 @@
     checkMul->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt32ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();
@@ -6426,11 +6426,11 @@
     checkMul->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isConstant());
-            CHECK(params[3].value() == 2);
-            jit.convertInt32ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 2);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
             jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(2), FPRInfo::fpRegT1);
             jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
@@ -6460,11 +6460,11 @@
     checkMul->setGenerator(
         [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             AllowMacroScratchRegisterUsage allowScratch(jit);
-            CHECK(params.size() == 4);
-            CHECK(params[2].isGPR());
-            CHECK(params[3].isGPR());
-            jit.convertInt64ToDouble(params[2].gpr(), FPRInfo::fpRegT0);
-            jit.convertInt64ToDouble(params[3].gpr(), FPRInfo::fpRegT1);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
             jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
             jit.emitFunctionEpilogue();
             jit.ret();

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (194047 => 194048)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp	2015-12-14 19:58:14 UTC (rev 194047)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp	2015-12-14 20:25:30 UTC (rev 194048)
@@ -9442,14 +9442,13 @@
     {
         OSRExitDescriptor* exitDescriptor = appendOSRExitDescriptor(lowValue, highValue);
         
-        unsigned offset = value->numChildren();
         value->appendColdAnys(buildExitArguments(exitDescriptor, origin.forExit, lowValue));
 
         State* state = &m_ftlState;
         value->setGenerator(
             [=] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
                 exitDescriptor->emitOSRExit(
-                    *state, kind, origin, jit, params, offset, isExceptionHandler);
+                    *state, kind, origin, jit, params, 0, isExceptionHandler);
             });
     }
 #endif

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to