Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (194319 => 194320)
--- trunk/Source/_javascript_Core/ChangeLog 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-12-20 19:53:40 UTC (rev 194320)
@@ -1,3 +1,37 @@
+2015-12-18 Filip Pizlo <[email protected]>
+
+ Implement compareDouble in B3/Air
+ https://bugs.webkit.org/show_bug.cgi?id=150903
+
+ Reviewed by Benjamin Poulain.
+
+ A hole in our coverage is that we don't fuse a double comparison into a branch, then we will
+ crash in the instruction selector. Obviously, we *really* want to fuse double comparisons,
+ but we can't guarantee that this will always happen.
+
+ This also removes all uses of WTF::Dominators verification, since it's extremely slow even in
+ a release build. This speeds up testb3 with validateGraphAtEachPhase=true by an order of
+ magnitude.
+
+ * assembler/MacroAssembler.h:
+ (JSC::MacroAssembler::moveDoubleConditionallyFloat):
+ (JSC::MacroAssembler::compareDouble):
+ (JSC::MacroAssembler::compareFloat):
+ (JSC::MacroAssembler::lea):
+ * b3/B3Dominators.h:
+ (JSC::B3::Dominators::Dominators):
+ * b3/B3LowerToAir.cpp:
+ (JSC::B3::Air::LowerToAir::createCompare):
+ (JSC::B3::Air::LowerToAir::lower):
+ * b3/air/AirOpcode.opcodes:
+ * b3/testb3.cpp:
+ (JSC::B3::testCompare):
+ (JSC::B3::testEqualDouble):
+ (JSC::B3::simpleFunction):
+ (JSC::B3::run):
+ * dfg/DFGDominators.h:
+ (JSC::DFG::Dominators::Dominators):
+
2015-12-19 Dan Bernstein <[email protected]>
[Mac] WebKit contains dead source code for OS X Mavericks and earlier
Modified: trunk/Source/_javascript_Core/assembler/MacroAssembler.h (194319 => 194320)
--- trunk/Source/_javascript_Core/assembler/MacroAssembler.h 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/assembler/MacroAssembler.h 2015-12-20 19:53:40 UTC (rev 194320)
@@ -1363,6 +1363,23 @@
moveDouble(src, dest);
falseCase.link(this);
}
+
+ // We should implement this the right way eventually, but for now, it's fine because it arises so
+ // infrequently.
+ void compareDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID dest)
+ {
+ move(TrustedImm32(0), dest);
+ Jump falseCase = branchDouble(invert(cond), left, right);
+ move(TrustedImm32(1), dest);
+ falseCase.link(this);
+ }
+ void compareFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID dest)
+ {
+ move(TrustedImm32(0), dest);
+ Jump falseCase = branchFloat(invert(cond), left, right);
+ move(TrustedImm32(1), dest);
+ falseCase.link(this);
+ }
#endif
void lea(Address address, RegisterID dest)
Modified: trunk/Source/_javascript_Core/b3/B3Dominators.h (194319 => 194320)
--- trunk/Source/_javascript_Core/b3/B3Dominators.h 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/b3/B3Dominators.h 2015-12-20 19:53:40 UTC (rev 194320)
@@ -29,7 +29,6 @@
#if ENABLE(B3_JIT)
#include "B3CFG.h"
-#include "B3Common.h"
#include "B3Procedure.h"
#include <wtf/Dominators.h>
#include <wtf/FastMalloc.h>
@@ -42,7 +41,7 @@
WTF_MAKE_FAST_ALLOCATED;
public:
Dominators(Procedure& proc)
- : WTF::Dominators<CFG>(proc.cfg(), shouldValidateIR())
+ : WTF::Dominators<CFG>(proc.cfg())
{
}
};
Modified: trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp (194319 => 194320)
--- trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp 2015-12-20 19:53:40 UTC (rev 194320)
@@ -1425,13 +1425,20 @@
return Inst();
}
},
- [this] (const Arg&, const ArgPromise&, const ArgPromise&) -> Inst {
- // FIXME: Implement this.
- // https://bugs.webkit.org/show_bug.cgi?id=150903
+ [this] (const Arg& doubleCond, const ArgPromise& left, const ArgPromise& right) -> Inst {
+ if (isValidForm(CompareDouble, Arg::DoubleCond, left.kind(), right.kind(), Arg::Tmp)) {
+ return Inst(
+ CompareDouble, m_value, doubleCond,
+ left.consume(*this), right.consume(*this), tmp(m_value));
+ }
return Inst();
},
- [this] (const Arg&, const ArgPromise&, const ArgPromise&) -> Inst {
- // FIXME: Implement this.
+ [this] (const Arg& doubleCond, const ArgPromise& left, const ArgPromise& right) -> Inst {
+ if (isValidForm(CompareFloat, Arg::DoubleCond, left.kind(), right.kind(), Arg::Tmp)) {
+ return Inst(
+ CompareFloat, m_value, doubleCond,
+ left.consume(*this), right.consume(*this), tmp(m_value));
+ }
return Inst();
},
inverted);
@@ -1652,6 +1659,9 @@
}
case BitXor: {
+ // FIXME: If canBeInternal(child), we should generate this using the comparison path.
+ // https://bugs.webkit.org/show_bug.cgi?id=152367
+
if (m_value->child(1)->isInt(-1)) {
appendUnOp<Not32, Not64>(m_value->child(0));
return;
Modified: trunk/Source/_javascript_Core/b3/air/AirOpcode.opcodes (194319 => 194320)
--- trunk/Source/_javascript_Core/b3/air/AirOpcode.opcodes 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/b3/air/AirOpcode.opcodes 2015-12-20 19:53:40 UTC (rev 194320)
@@ -435,6 +435,12 @@
ResCond, Tmp, Imm, Tmp
ResCond, Tmp, Tmp, Tmp
+CompareDouble U:G, U:F, U:F, D:G
+ DoubleCond, Tmp, Tmp, Tmp
+
+CompareFloat U:G, U:F, U:F, D:G
+ DoubleCond, Tmp, Tmp, Tmp
+
# Note that branches have some logic in AirOptimizeBlockOrder.cpp. If you add new branches, please make sure
# you opt them into the block order optimizations.
Modified: trunk/Source/_javascript_Core/b3/testb3.cpp (194319 => 194320)
--- trunk/Source/_javascript_Core/b3/testb3.cpp 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/b3/testb3.cpp 2015-12-20 19:53:40 UTC (rev 194320)
@@ -7455,6 +7455,20 @@
variants(-left, -right);
}
+void testEqualDouble(double left, double right, bool result)
+{
+ Procedure proc;
+ BasicBlock* root = proc.addBlock();
+ root->appendNew<ControlValue>(
+ proc, Return, Origin(),
+ root->appendNew<Value>(
+ proc, Equal, Origin(),
+ root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+ root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)));
+
+ CHECK(compileAndRun<bool>(proc, left, right) == result);
+}
+
int simpleFunction(int a, int b)
{
return a + b;
@@ -9498,6 +9512,13 @@
RUN(testCompare(BitAnd, 42, 42));
RUN(testCompare(BitAnd, 42, 0));
+ RUN(testEqualDouble(42, 42, true));
+ RUN(testEqualDouble(0, -0, true));
+ RUN(testEqualDouble(42, 43, false));
+ RUN(testEqualDouble(PNaN, 42, false));
+ RUN(testEqualDouble(42, PNaN, false));
+ RUN(testEqualDouble(PNaN, PNaN, false));
+
RUN(testLoad<Int32>(60));
RUN(testLoad<Int32>(-60));
RUN(testLoad<Int32>(1000));
Modified: trunk/Source/_javascript_Core/dfg/DFGDominators.h (194319 => 194320)
--- trunk/Source/_javascript_Core/dfg/DFGDominators.h 2015-12-20 10:27:02 UTC (rev 194319)
+++ trunk/Source/_javascript_Core/dfg/DFGDominators.h 2015-12-20 19:53:40 UTC (rev 194320)
@@ -45,7 +45,7 @@
WTF_MAKE_FAST_ALLOCATED;
public:
Dominators(Graph& graph)
- : WTF::Dominators<CFG>(*graph.m_cfg, validationEnabled())
+ : WTF::Dominators<CFG>(*graph.m_cfg)
{
}
};
