Changeset 102723 in webkit for trunk/Source/JavaScriptCore/bytecode

Timestamp:

Dec 13, 2011, 5:46:36 PM (13 years ago)

Author:

[email protected]

Message:

DFG OSR exit for UInt32ToNumber should roll forward, not roll backward
​https://bugs.webkit.org/show_bug.cgi?id=74463

Source/JavaScriptCore:

Reviewed by Gavin Barraclough.

Implements roll-forward OSR exit for UInt32ToNumber, which requires ValueRecoveries knowing
how to execute the slow path of UInt32ToNumber.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::lastOSRExit):

• bytecode/CodeOrigin.h:

(JSC::CodeOrigin::operator!=):

• bytecode/ValueRecovery.h:

(JSC::ValueRecovery::uint32InGPR):
(JSC::ValueRecovery::gpr):
(JSC::ValueRecovery::dump):

• dfg/DFGAssemblyHelpers.cpp:
• dfg/DFGAssemblyHelpers.h:
• dfg/DFGOSRExit.h:

(JSC::DFG::OSRExit::valueRecoveryForOperand):

• dfg/DFGOSRExitCompiler32_64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Gavin Barraclough.

• fast/js/dfg-uint32-to-number-expected.txt: Added.
• fast/js/dfg-uint32-to-number.html: Added.
• fast/js/script-tests/dfg-uint32-to-number.js: Added.

(foo):

Location:

trunk/Source/JavaScriptCore/bytecode

Files:

• CodeBlock.h (modified) (1 diff)
• CodeOrigin.h (modified) (1 diff)
• ValueRecovery.h (modified) (4 diffs)

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -428 +428 @@
         }
         
+        DFG::OSRExit& lastOSRExit()
+        {
+            return m_dfgData->osrExit.last();
+        }
+        
         void appendSpeculationRecovery(const DFG::SpeculationRecovery& recovery)
         {

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

@@ -74 +74 @@
     bool operator==(const CodeOrigin& other) const;
     
+    bool operator!=(const CodeOrigin& other) const { return !(*this == other); }
+    
 #ifndef NDEBUG
     // Get the inline stack. This is slow, and is intended for debugging only.

trunk/Source/JavaScriptCore/bytecode/ValueRecovery.h

@@ -56 +56 @@
 #endif
     InFPR,
+    UInt32InGPR,
     // It's in the register file, but at a different location.
     DisplacedInRegisterFile,
@@ -119 +120 @@
     }
     
+    static ValueRecovery uint32InGPR(MacroAssembler::RegisterID gpr)
+    {
+        ValueRecovery result;
+        result.m_technique = UInt32InGPR;
+        result.m_source.gpr = gpr;
+        return result;
+    }
+    
 #if USE(JSVALUE32_64)
     static ValueRecovery inPair(MacroAssembler::RegisterID tagGPR, MacroAssembler::RegisterID payloadGPR)
@@ -187 +196 @@
     MacroAssembler::RegisterID gpr() const
     {
-        ASSERT(m_technique == InGPR || m_technique == UnboxedInt32InGPR || m_technique == UnboxedBooleanInGPR);
+        ASSERT(m_technique == InGPR || m_technique == UnboxedInt32InGPR || m_technique == UnboxedBooleanInGPR || m_technique == UInt32InGPR);
         return m_source.gpr;
     }
@@ -248 +257 @@
             fprintf(out, "bool(%%r%d)", gpr());
             break;
+        case UInt32InGPR:
+            fprintf(out, "uint32(%%r%d)", gpr());
+            break;
         case InFPR:
-            fprintf(out, "%%r%d", fpr());
+            fprintf(out, "%%fr%d", fpr());
             break;
 #if USE(JSVALUE32_64)