Changeset 103250 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Dec 19, 2011, 11:36:37 AM (13 years ago)

Author:

[email protected]

Message:

Rolling r103120 back in with merge errors corrected.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (2 diffs)
• dfg/DFGAbstractState.cpp (modified) (2 diffs)
• dfg/DFGByteCodeParser.cpp (modified) (1 diff)
• dfg/DFGNode.h (modified) (2 diffs)
• dfg/DFGPropagator.cpp (modified) (17 diffs)
• dfg/DFGSpeculativeJIT.cpp (modified) (6 diffs)
• dfg/DFGSpeculativeJIT.h (modified) (2 diffs)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (19 diffs)
• dfg/DFGSpeculativeJIT64.cpp (modified) (14 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-12-16  Oliver Hunt  <[email protected]>
+
+        Rolling r103120 back in with merge errors corrected.
+
+        PutByVal[Alias] unnecessarily reloads the storage buffer
+        https://bugs.webkit.org/show_bug.cgi?id=74747
+
+        Reviewed by Gavin Barraclough.
+
+        Make PutByVal use GetIndexedStorage to load the storage buffer.
+        This required switching PutByVal to a vararg node (which is
+        responsible for most of the noise in this patch).  This fixes the
+        remaining portion of the kraken regression caused by the GetByVal
+        storage load elimination, and a 1-5% win on some of the sub tests of
+        the typed array benchmark at:
+        http://stepheneb.github.com/webgl-matrix-benchmarks/matrix_benchmark.html
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::byValIndexIsPure):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-12-15  Geoffrey Garen  <[email protected]>
 
@@ -333 +376 @@
         (WTF::lowerNibbleToASCIIHexDigit):
         (WTF::upperNibbleToASCIIHexDigit):
-
-2011-12-16  Gavin Barraclough  <[email protected]>
-
-        Reverted r103120, this breaks v8 on ARMv7 DFG.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGNode.h:
-        * dfg/DFGPropagator.cpp:
-        (JSC::DFG::Propagator::propagateArithNodeFlags):
-        (JSC::DFG::Propagator::fixupNode):
-        (JSC::DFG::Propagator::byValIsPure):
-        (JSC::DFG::Propagator::clobbersWorld):
-        (JSC::DFG::Propagator::getByValLoadElimination):
-        (JSC::DFG::Propagator::checkStructureLoadElimination):
-        (JSC::DFG::Propagator::getByOffsetLoadElimination):
-        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
-        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
-        (JSC::DFG::Propagator::performNodeCSE):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
-        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
-        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
-        * dfg/DFGSpeculativeJIT.h:
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
 
 2011-12-16  Filip Pizlo  <[email protected]>

trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

@@ -494 +494 @@
     case PutByVal:
     case PutByValAlias: {
-        PredictedType indexPrediction = m_graph[node.child2()].prediction();
+        NodeIndex child1 = m_graph.m_varArgChildren[node.firstChild()];
+        NodeIndex child2 = m_graph.m_varArgChildren[node.firstChild() + 1];
+        NodeIndex child3 = m_graph.m_varArgChildren[node.firstChild() + 2];
+        PredictedType indexPrediction = m_graph[child2].prediction();
         if (!(indexPrediction & PredictInt32) && indexPrediction) {
             clobberStructures(nodeIndex);
@@ -500 +503 @@
             break;
         }
-        if (m_graph[node.child1()].shouldSpeculateByteArray()) {
-            forNode(node.child1()).filter(PredictByteArray);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        
-        if (m_graph[node.child1()].shouldSpeculateInt8Array()) {
-            forNode(node.child1()).filter(PredictInt8Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateInt16Array()) {
-            forNode(node.child1()).filter(PredictInt16Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateInt32Array()) {
-            forNode(node.child1()).filter(PredictInt32Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint8Array()) {
-            forNode(node.child1()).filter(PredictUint8Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint16Array()) {
-            forNode(node.child1()).filter(PredictUint16Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint32Array()) {
-            forNode(node.child1()).filter(PredictUint32Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateFloat32Array()) {
-            forNode(node.child1()).filter(PredictFloat32Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateFloat64Array()) {
-            forNode(node.child1()).filter(PredictFloat64Array);
-            forNode(node.child2()).filter(PredictInt32);
-            forNode(node.child3()).filter(PredictNumber);
-            break;
-        }
-            
-        forNode(node.child1()).filter(PredictArray);
-        forNode(node.child2()).filter(PredictInt32);
+        if (m_graph[child1].shouldSpeculateByteArray()) {
+            forNode(child1).filter(PredictByteArray);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        
+        if (m_graph[child1].shouldSpeculateInt8Array()) {
+            forNode(child1).filter(PredictInt8Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateInt16Array()) {
+            forNode(child1).filter(PredictInt16Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateInt32Array()) {
+            forNode(child1).filter(PredictInt32Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateUint8Array()) {
+            forNode(child1).filter(PredictUint8Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateUint16Array()) {
+            forNode(child1).filter(PredictUint16Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateUint32Array()) {
+            forNode(child1).filter(PredictUint32Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateFloat32Array()) {
+            forNode(child1).filter(PredictFloat32Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+        if (m_graph[child1].shouldSpeculateFloat64Array()) {
+            forNode(child1).filter(PredictFloat64Array);
+            forNode(child2).filter(PredictInt32);
+            forNode(child3).filter(PredictNumber);
+            break;
+        }
+            
+        forNode(child1).filter(PredictArray);
+        forNode(child2).filter(PredictInt32);
         break;
     }

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -1663 +1663 @@
             NodeIndex property = get(currentInstruction[2].u.operand);
             NodeIndex value = get(currentInstruction[3].u.operand);
-
-            addToGraph(PutByVal, base, property, value);
+            NodeIndex propertyStorage = addToGraph(GetIndexedPropertyStorage, base, property);
+
+            addVarArgChild(base);
+            addVarArgChild(property);
+            addVarArgChild(value);
+            addVarArgChild(propertyStorage);
+            
+            addToGraph(Node::VarArg, PutByVal, OpInfo(0), OpInfo(0));
 
             NEXT_OPCODE(op_put_by_val);

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -227 +227 @@
     /* this must be the directly subsequent property put. */\
     macro(GetByVal, NodeResultJS | NodeMustGenerate | NodeMightClobber) \
-    macro(PutByVal, NodeMustGenerate | NodeClobbersWorld) \
-    macro(PutByValAlias, NodeMustGenerate | NodeClobbersWorld) \
+    macro(PutByVal, NodeMustGenerate | NodeClobbersWorld | NodeHasVarArgs) \
+    macro(PutByValAlias, NodeMustGenerate | NodeClobbersWorld | NodeHasVarArgs) \
     macro(GetById, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     macro(PutById, NodeMustGenerate | NodeClobbersWorld) \
@@ -235 +235 @@
     macro(PutStructure, NodeMustGenerate | NodeClobbersWorld) \
     macro(GetPropertyStorage, NodeResultStorage) \
-    macro(GetIndexedPropertyStorage, NodeMustGenerate | NodeResultStorage) \
+    macro(GetIndexedPropertyStorage, NodeResultStorage) \
     macro(GetByOffset, NodeResultJS) \
     macro(PutByOffset, NodeMustGenerate | NodeClobbersWorld) \

trunk/Source/JavaScriptCore/dfg/DFGPropagator.cpp

@@ -193 +193 @@
             
         case PutByVal: {
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags | NodeUsedAsNumber);
-            changed |= m_graph[node.child3()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
+            NodeIndex base = m_graph.m_varArgChildren[node.firstChild()];
+            NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+            NodeIndex value = m_graph.m_varArgChildren[node.firstChild() + 2];
+            changed |= m_graph[base].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
+            changed |= m_graph[property].mergeArithNodeFlags(flags | NodeUsedAsNumber);
+            changed |= m_graph[value].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
             break;
         }
@@ -931 +934 @@
             break;
         }
+        case PutByVal:
+        case PutByValAlias: {
+            NodeIndex storage = m_graph.m_varArgChildren[node.firstChild() + 3];
+            if (m_graph[storage].op == Nop)
+                node.children.variable.numChildren = 3;
+            break;
+        }
+            
         case GetByVal:
         case StringCharAt:
@@ -1086 +1097 @@
     }
     
-    bool byValIsPure(Node& node)
-    {
-        PredictedType prediction = m_graph[node.child2()].prediction();
+    bool byValIndexIsPure(Node& node)
+    {
+        PredictedType prediction = node.prediction();
         return (prediction & PredictInt32) || !prediction;
     }
@@ -1110 +1121 @@
             return !logicalNotIsPure(node);
         case GetByVal:
-            return !byValIsPure(node);
+            return !byValIndexIsPure(m_graph[node.child2()]);
         default:
             ASSERT_NOT_REACHED();
@@ -1180 +1191 @@
             switch (node.op) {
             case GetByVal:
-                if (!byValIsPure(node))
+                if (!byValIndexIsPure(m_graph[node.child2()]))
                     return NoNode;
                 if (node.child1() == child1 && canonicalize(node.child2()) == canonicalize(child2))
@@ -1186 +1197 @@
                 break;
             case PutByVal:
-            case PutByValAlias:
-                if (!byValIsPure(node))
+            case PutByValAlias: {
+                
+                NodeIndex base = m_graph.m_varArgChildren[node.firstChild()];
+                    NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+                if (!byValIndexIsPure(m_graph[property]))
                     return NoNode;
-                if (node.child1() == child1 && canonicalize(node.child2()) == canonicalize(child2))
-                    return node.child3();
+                if (base == child1 && canonicalize(property) == canonicalize(child2))
+                    return m_graph.m_varArgChildren[node.firstChild() + 2];
                 // We must assume that the PutByVal will clobber the location we're getting from.
                 // FIXME: We can do better; if we know that the PutByVal is accessing an array of a
                 // different type than the GetByVal, then we know that they won't clobber each other.
                 return NoNode;
+            }
             case PutStructure:
             case PutByOffset:
@@ -1250 +1265 @@
                 
             case PutByVal:
-            case PutByValAlias:
-                if (byValIsPure(node)) {
+            case PutByValAlias: {
+                NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+                if (byValIndexIsPure(m_graph[property])) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -1258 +1274 @@
                 }
                 return false;
-                
+            }
+
             default:
                 if (clobbersWorld(index))
@@ -1293 +1310 @@
                 
             case PutByVal:
-            case PutByValAlias:
-                if (byValIsPure(node)) {
+            case PutByValAlias: {
+                NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+                if (byValIndexIsPure(m_graph[property])) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -1301 +1319 @@
                 }
                 return NoNode;
-                
+            }
+
             default:
                 if (clobbersWorld(index))
@@ -1329 +1348 @@
                 
             case PutByVal:
-            case PutByValAlias:
-                if (byValIsPure(node)) {
+            case PutByValAlias: {
+                NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+                if (byValIndexIsPure(m_graph[property])) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -1337 +1357 @@
                 }
                 return NoNode;
-                
+            }
+
             default:
                 if (clobbersWorld(index))
@@ -1347 +1368 @@
     }
 
-    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, bool hasIntegerIndexPrediction)
+    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1)
     {
         NodeIndex start = startIndexForChildren(child1);
@@ -1356 +1377 @@
                 PredictedType basePrediction = m_graph[node.child2()].prediction();
                 bool nodeHasIntegerIndexPrediction = !(!(basePrediction & PredictInt32) && basePrediction);
-                if (node.child1() == child1 && hasIntegerIndexPrediction == nodeHasIntegerIndexPrediction)
+                if (node.child1() == child1 && nodeHasIntegerIndexPrediction)
                     return index;
                 break;
@@ -1371 +1392 @@
                 break;
                 
-            case PutByVal:
-                if (isFixedIndexedStorageObjectPrediction(m_graph[node.child1()].prediction()) && byValIsPure(node))
+            case PutByVal: {
+                NodeIndex base = m_graph.m_varArgChildren[node.firstChild()];
+                NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+                if (isFixedIndexedStorageObjectPrediction(m_graph[base].prediction()) && byValIndexIsPure(m_graph[property]))
                     break;
                 return NoNode;
+            }
 
             default:
@@ -1555 +1579 @@
             
         case GetByVal:
-            if (byValIsPure(node))
+            if (byValIndexIsPure(m_graph[node.child2()]))
                 setReplacement(getByValLoadElimination(node.child1(), node.child2()));
             break;
             
-        case PutByVal:
-            if (byValIsPure(node) && getByValLoadElimination(node.child1(), node.child2()) != NoNode)
+        case PutByVal: {
+            NodeIndex base = m_graph.m_varArgChildren[node.firstChild()];
+            NodeIndex property = m_graph.m_varArgChildren[node.firstChild() + 1];
+            if (byValIndexIsPure(m_graph[property]) && getByValLoadElimination(base, property) != NoNode)
                 node.op = PutByValAlias;
             break;
+        }
             
         case CheckStructure:
@@ -1577 +1604 @@
             PredictedType basePrediction = m_graph[node.child2()].prediction();
             bool nodeHasIntegerIndexPrediction = !(!(basePrediction & PredictInt32) && basePrediction);
-            setReplacement(getIndexedPropertyStorageLoadElimination(node.child1(), nodeHasIntegerIndexPrediction));
+            if (nodeHasIntegerIndexPrediction)
+                setReplacement(getIndexedPropertyStorageLoadElimination(node.child1()));
             break;
         }

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1554 +1554 @@
 }
 
-void SpeculativeJIT::compilePutByValForByteArray(GPRReg base, GPRReg property, Node& node)
-{
-    NodeIndex baseIndex = node.child1();
-    NodeIndex valueIndex = node.child3();
-    
-    if (!isByteArrayPrediction(m_state.forNode(baseIndex).m_type))
-        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
+void SpeculativeJIT::compilePutByValForByteArray(Node& node)
+{
+    NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
+    NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+    NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+    NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
+    
+    if (!isByteArrayPrediction(m_state.forNode(baseIndex).m_type)) {
+        SpeculateCellOperand base(this, baseIndex);
+        speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
+    }
     GPRTemporary value;
     GPRReg valueGPR;
@@ -1607 +1611 @@
         valueGPR = gpr;
     }
-    ASSERT_UNUSED(valueGPR, valueGPR != property);
-    ASSERT(valueGPR != base);
-    GPRTemporary storage(this);
+    StorageOperand storage(this, storageIndex);
+    SpeculateIntegerOperand property(this, propertyIndex);
     GPRReg storageReg = storage.gpr();
-    ASSERT(valueGPR != storageReg);
-    m_jit.loadPtr(MacroAssembler::Address(base, JSByteArray::offsetOfStorage()), storageReg);
-    MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(storageReg, ByteArray::offsetOfSize()));
-    m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne, ByteArray::offsetOfData()));
+    MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property.gpr(), MacroAssembler::Address(storageReg, ByteArray::offsetOfSize()));
+    m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property.gpr(), MacroAssembler::TimesOne, ByteArray::offsetOfData()));
     outOfBounds.link(&m_jit);
     noResult(m_compileIndex);
@@ -1711 +1712 @@
 }
 
-void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
-{
-    NodeIndex baseIndex = node.child1();
-    NodeIndex valueIndex = node.child3();
-    
-    if (speculationRequirements != NoTypedArrayTypeSpecCheck)
-        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
+void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
+{
+    NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
+    NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+    NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+    NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
+
+    if (speculationRequirements != NoTypedArrayTypeSpecCheck) {
+        SpeculateCellOperand base(this, baseIndex);
+        speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
+    }
+    
+    StorageOperand storage(this, storageIndex);
+    GPRReg storageReg = storage.gpr();
+    SpeculateIntegerOperand property(this, propertyIndex);
+    GPRReg propertyReg = property.gpr();
+    MacroAssembler::Jump outOfBounds;
+    if (speculationRequirements != NoTypedArrayTypeSpecCheck || speculationRequirements != NoTypedArraySpecCheck) {
+        SpeculateCellOperand base(this, baseIndex);
+        if (speculationRequirements != NoTypedArrayTypeSpecCheck)
+            speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
+        if (speculationRequirements != NoTypedArraySpecCheck)
+            outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(base.gpr(), descriptor.m_lengthOffset));
+    }
     GPRTemporary value;
     GPRReg valueGPR;
@@ -1759 +1777 @@
         valueGPR = gpr;
     }
-    ASSERT_UNUSED(valueGPR, valueGPR != property);
-    ASSERT(valueGPR != base);
-    GPRTemporary storage(this);
-    GPRReg storageReg = storage.gpr();
-    ASSERT(valueGPR != storageReg);
-    m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
-    MacroAssembler::Jump outOfBounds;
-    if (speculationRequirements != NoTypedArraySpecCheck)
-        outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
 
     switch (elementSize) {
     case 1:
-        m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne));
+        m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne));
         break;
     case 2:
-        m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesTwo));
+        m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo));
         break;
     case 4:
-        m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
+        m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour));
         break;
     default:
@@ -1832 +1841 @@
 }
 
-void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
-{
-    NodeIndex baseIndex = node.child1();
-    NodeIndex valueIndex = node.child3();
+void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
+{
+    NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
+    NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+    NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+    NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
     
     SpeculateDoubleOperand valueOp(this, valueIndex);
-    
-    if (speculationRequirements != NoTypedArrayTypeSpecCheck)
-        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-    
-    GPRTemporary result(this);
-    
-    GPRTemporary storage(this);
+    SpeculateStrictInt32Operand property(this, propertyIndex);
+    StorageOperand storage(this, storageIndex);
     GPRReg storageReg = storage.gpr();
-    
-    m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
+    GPRReg propertyReg = property.gpr();
+    
     MacroAssembler::Jump outOfBounds;
-    if (speculationRequirements != NoTypedArraySpecCheck)
-        outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
+    if (speculationRequirements != NoTypedArrayTypeSpecCheck || speculationRequirements != NoTypedArraySpecCheck) {
+        SpeculateCellOperand base(this, baseIndex);
+        if (speculationRequirements != NoTypedArrayTypeSpecCheck)
+            speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
+        if (speculationRequirements != NoTypedArraySpecCheck)
+            outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(base.gpr(), descriptor.m_lengthOffset));
+    }
+    
+
     
     switch (elementSize) {
@@ -1857 +1870 @@
         m_jit.moveDouble(valueOp.fpr(), scratch.fpr());
         m_jit.convertDoubleToFloat(valueOp.fpr(), scratch.fpr());
-        m_jit.storeFloat(scratch.fpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
+        m_jit.storeFloat(scratch.fpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour));
         break;
     }
     case 8:
-        m_jit.storeDouble(valueOp.fpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesEight));
+        m_jit.storeDouble(valueOp.fpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
         break;
     default:

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -1971 +1971 @@
     void compileUInt32ToNumber(Node&);
     void compileGetByValOnByteArray(Node&);
-    void compilePutByValForByteArray(GPRReg base, GPRReg property, Node&);
+    void compilePutByValForByteArray(Node&);
     void compileArithMul(Node&);
     void compileArithMod(Node&);
@@ -1987 +1987 @@
     void compileGetIndexedPropertyStorage(Node&);
     void compileGetByValOnIntTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements, TypedArraySignedness);
-    void compilePutByValForIntTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySpeculationRequirements, TypedArraySignedness);
+    void compilePutByValForIntTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements, TypedArraySignedness);
     void compileGetByValOnFloatTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements);
-    void compilePutByValForFloatTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySpeculationRequirements);
+    void compilePutByValForFloatTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements);
     
     // It is acceptable to have structure be equal to scratch, so long as you're fine

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -2694 +2694 @@
 
     case PutByVal: {
-        PredictedType basePrediction = at(node.child2()).prediction();
+        NodeIndex child1 = m_jit.graph().m_varArgChildren[node.firstChild()];
+        NodeIndex child2 = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+        NodeIndex child3 = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+        NodeIndex child4 = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
+
+        PredictedType basePrediction = at(child2).prediction();
         if (!(basePrediction & PredictInt32) && basePrediction) {
-            SpeculateCellOperand base(this, node.child1()); // Save a register, speculate cell. We'll probably be right.
-            JSValueOperand property(this, node.child2());
-            JSValueOperand value(this, node.child3());
+            SpeculateCellOperand base(this, child1); // Save a register, speculate cell. We'll probably be right.
+            JSValueOperand property(this, child2);
+            JSValueOperand value(this, child3);
             GPRReg baseGPR = base.gpr();
             GPRReg propertyTagGPR = property.tagGPR();
@@ -2712 +2717 @@
         }
 
-        SpeculateCellOperand base(this, node.child1());
-        SpeculateStrictInt32Operand property(this, node.child2());
-        if (at(node.child1()).shouldSpeculateByteArray()) {
-            compilePutByValForByteArray(base.gpr(), property.gpr(), node);
+        if (at(child1).shouldSpeculateByteArray()) {
+            compilePutByValForByteArray(node);
             break;
         }
-        if (at(node.child1()).shouldSpeculateByteArray()) {
-            compilePutByValForByteArray(base.gpr(), property.gpr(), node);
-            break;
-        }
-        
-        if (at(node.child1()).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), isInt8ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
+        
+        if (at(child1).shouldSpeculateInt8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), isInt8ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2730 +2729 @@
         }
         
-        if (at(node.child1()).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), isInt16ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), isInt16ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2737 +2736 @@
         }
         
-        if (at(node.child1()).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), isInt32ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), isInt32ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2744 +2743 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), isUint8ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), isUint8ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2751 +2750 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), isUint16ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), isUint16ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2758 +2757 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), isUint32ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), isUint32ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2765 +2764 @@
         }
         
-        if (at(node.child1()).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), isFloat32ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
+        if (at(child1).shouldSpeculateFloat32Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float), isFloat32ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
             if (!m_compileOkay)
                 return;
@@ -2772 +2771 @@
         }
         
-        if (at(node.child1()).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), isFloat64ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
+        if (at(child1).shouldSpeculateFloat64Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double), isFloat64ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
             if (!m_compileOkay)
                 return;
@@ -2779 +2778 @@
         }
 
-        JSValueOperand value(this, node.child3());
-        GPRTemporary scratch(this);
+        SpeculateCellOperand base(this, child1);
+        SpeculateStrictInt32Operand property(this, child2);
+        JSValueOperand value(this, child3);
 
         // Map base, property & value into registers, allocate a scratch register.
@@ -2787 +2787 @@
         GPRReg valueTagReg = value.tagGPR();
         GPRReg valuePayloadReg = value.payloadGPR();
-        GPRReg scratchReg = scratch.gpr();
         
         if (!m_compileOkay)
             return;
-        
-        writeBarrier(baseReg, valueTagReg, node.child3(), WriteBarrierForPropertyAccess, scratchReg);
+
+        {
+            GPRTemporary scratch(this);
+            writeBarrier(baseReg, valueTagReg, child3, WriteBarrierForPropertyAccess, scratch.gpr());
+        }
 
         // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
         // If we have predicted the base to be type array, we can skip the check.
-        if (!isArrayPrediction(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+        if (!isArrayPrediction(m_state.forNode(child1).m_type))
+            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), child1, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+
+        StorageOperand storage(this, child4);
+        GPRReg storageReg = storage.gpr();
 
         base.use();
         property.use();
         value.use();
+        storage.use();
         
         MacroAssembler::Jump withinArrayBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
 
         // Code to handle put beyond array bounds.
-        silentSpillAllRegisters(scratchReg);
+        silentSpillAllRegisters(InvalidGPRReg);
         callOperation(operationPutByValBeyondArrayBounds, baseReg, propertyReg, valueTagReg, valuePayloadReg);
-        silentFillAllRegisters(scratchReg);
+        silentFillAllRegisters(InvalidGPRReg);
         JITCompiler::Jump wasBeyondArrayBounds = m_jit.jump();
 
         withinArrayBounds.link(&m_jit);
-
-        // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
 
         // Check if we're writing to a hole; if so increment m_numValuesInVector.
@@ -2841 +2843 @@
 
     case PutByValAlias: {
-        SpeculateCellOperand base(this, node.child1());
-        SpeculateStrictInt32Operand property(this, node.child2());
-
-        if (at(node.child1()).shouldSpeculateByteArray()) {
-            compilePutByValForByteArray(base.gpr(), property.gpr(), node);
+        NodeIndex child1 = m_jit.graph().m_varArgChildren[node.firstChild()];
+        NodeIndex child2 = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+        NodeIndex child3 = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+        NodeIndex child4 = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
+
+        if (at(child1).shouldSpeculateByteArray()) {
+            compilePutByValForByteArray(node);
             break;
         }
         
-        if (at(node.child1()).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), NoTypedArraySpecCheck, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2856 +2860 @@
         }
         
-        if (at(node.child1()).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), NoTypedArraySpecCheck, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2863 +2867 @@
         }
         
-        if (at(node.child1()).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), NoTypedArraySpecCheck, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2870 +2874 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2877 +2881 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), NoTypedArraySpecCheck, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), NoTypedArraySpecCheck, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2884 +2888 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), NoTypedArraySpecCheck, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), NoTypedArraySpecCheck, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2891 +2895 @@
         }
         
-        if (at(node.child1()).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), NoTypedArraySpecCheck);
+        if (at(child1).shouldSpeculateFloat32Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float), NoTypedArraySpecCheck);
             if (!m_compileOkay)
                 return;
@@ -2898 +2902 @@
         }
         
-        if (at(node.child1()).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), NoTypedArraySpecCheck);
+        if (at(child1).shouldSpeculateFloat64Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double), NoTypedArraySpecCheck);
             if (!m_compileOkay)
                 return;
             break;            
         }
-
-        JSValueOperand value(this, node.child3());
-        GPRTemporary scratch(this, base);
-        
-        GPRReg baseReg = base.gpr();
-        GPRReg scratchReg = scratch.gpr();
-
-        writeBarrier(baseReg, value.tagGPR(), node.child3(), WriteBarrierForPropertyAccess, scratchReg);
-
-        // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
+        
+        JSValueOperand value(this, child3);
+        {
+            SpeculateCellOperand base(this, child1);
+            GPRTemporary scratch(this, base);
+            GPRReg baseReg = base.gpr();
+            GPRReg scratchReg = scratch.gpr();
+            writeBarrier(baseReg, value.tagGPR(), child3, WriteBarrierForPropertyAccess, scratchReg);
+        }
+    
+        SpeculateStrictInt32Operand property(this, child2);
+        StorageOperand storage(this, child4);
         // Store the value to the array.
         GPRReg propertyReg = property.gpr();
-        m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-        m_jit.store32(value.payloadGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storage.gpr(), propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+        m_jit.store32(value.payloadGPR(), MacroAssembler::BaseIndex(storage.gpr(), propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
 
         noResult(m_compileIndex);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -2598 +2598 @@
             break;
         }
-        
+        ASSERT(node.child3() != NoNode);
         if (at(node.child1()).prediction() == PredictString) {
             compileGetByValOnString(node);
@@ -2696 +2696 @@
 
     case PutByVal: {
-        PredictedType basePrediction = at(node.child2()).prediction();
+        NodeIndex child1 = m_jit.graph().m_varArgChildren[node.firstChild()];
+        NodeIndex child2 = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+        NodeIndex child3 = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+
+        PredictedType basePrediction = at(child2).prediction();
         if (!(basePrediction & PredictInt32) && basePrediction) {
-            JSValueOperand arg1(this, node.child1());
-            JSValueOperand arg2(this, node.child2());
-            JSValueOperand arg3(this, node.child3());
+            JSValueOperand arg1(this, child1);
+            JSValueOperand arg2(this, child2);
+            JSValueOperand arg3(this, child3);
             GPRReg arg1GPR = arg1.gpr();
             GPRReg arg2GPR = arg2.gpr();
@@ -2712 +2716 @@
         }
 
-        SpeculateCellOperand base(this, node.child1());
-        SpeculateStrictInt32Operand property(this, node.child2());
-        if (at(node.child1()).shouldSpeculateByteArray()) {
-            compilePutByValForByteArray(base.gpr(), property.gpr(), node);
+        if (at(child1).shouldSpeculateByteArray()) {
+            compilePutByValForByteArray(node);
             break;
         }
         
-        if (at(node.child1()).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), isInt8ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), isInt8ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2726 +2728 @@
         }
         
-        if (at(node.child1()).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), isInt16ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), isInt16ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2733 +2735 @@
         }
 
-        if (at(node.child1()).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), isInt32ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), isInt32ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2740 +2742 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), isUint8ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), isUint8ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2747 +2749 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), isUint16ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), isUint16ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2754 +2756 @@
         }
         
-        if (at(node.child1()).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), isUint32ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
+        if (at(child1).shouldSpeculateUint32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), isUint32ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
@@ -2761 +2763 @@
         }
         
-        if (at(node.child1()).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), isFloat32ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
+        if (at(child1).shouldSpeculateFloat32Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float), isFloat32ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
             if (!m_compileOkay)
                 return;
@@ -2768 +2770 @@
         }
         
-        if (at(node.child1()).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), isFloat64ArrayPrediction(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
+        if (at(child1).shouldSpeculateFloat64Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double), isFloat64ArrayPrediction(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
             if (!m_compileOkay)
                 return;
             break;            
         }
-
-        JSValueOperand value(this, node.child3());
+        
+        SpeculateCellOperand base(this, child1);
+        SpeculateStrictInt32Operand property(this, child2);
+        JSValueOperand value(this, child3);
+        NodeIndex child4 = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
+        StorageOperand storage(this, child4);
         GPRTemporary scratch(this);
-
+        
         // Map base, property & value into registers, allocate a scratch register.
         GPRReg baseReg = base.gpr();
         GPRReg propertyReg = property.gpr();
         GPRReg valueReg = value.gpr();
+        GPRReg storageReg = storage.gpr();
         GPRReg scratchReg = scratch.gpr();
         
@@ -2787 +2794 @@
             return;
         
-        writeBarrier(baseReg, value.gpr(), node.child3(), WriteBarrierForPropertyAccess, scratchReg);
+        writeBarrier(baseReg, value.gpr(), child3, WriteBarrierForPropertyAccess, scratchReg);
 
         // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
         // If we have predicted the base to be type array, we can skip the check.
-        if (!isArrayPrediction(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueRegs(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+        if (!isArrayPrediction(m_state.forNode(child1).m_type))
+            speculationCheck(BadType, JSValueRegs(baseReg), child1, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
 
         base.use();
         property.use();
         value.use();
-        
+        storage.use();
+
         MacroAssembler::Jump withinArrayBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
 
@@ -2808 +2816 @@
         withinArrayBounds.link(&m_jit);
 
-        // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
         // Check if we're writing to a hole; if so increment m_numValuesInVector.
         MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
@@ -2835 +2839 @@
 
     case PutByValAlias: {
-        PredictedType basePrediction = at(node.child2()).prediction();
+        NodeIndex child1 = m_jit.graph().m_varArgChildren[node.firstChild()];
+        NodeIndex child2 = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
+        NodeIndex child3 = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
+        NodeIndex child4 = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
+
+        PredictedType basePrediction = at(child2).prediction();
         ASSERT_UNUSED(basePrediction, (basePrediction & PredictInt32) || !basePrediction);
 
-        SpeculateCellOperand base(this, node.child1());
-        SpeculateStrictInt32Operand property(this, node.child2());
-        if (at(node.child1()).shouldSpeculateByteArray()) {
-            compilePutByValForByteArray(base.gpr(), property.gpr(), node);
+        if (at(child1).shouldSpeculateByteArray()) {
+            compilePutByValForByteArray(node);
             break;
         }
 
-        if (at(node.child1()).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), NoTypedArraySpecCheck, SignedTypedArray);
+        if (at(child1).shouldSpeculateInt8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), NoTypedArraySpecCheck, SignedTypedArray);
+    
+        if (at(child1).shouldSpeculateInt16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), NoTypedArraySpecCheck, SignedTypedArray);
+    
+        if (at(child1).shouldSpeculateInt32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray);
+    
+        if (at(child1).shouldSpeculateUint8Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), NoTypedArraySpecCheck, UnsignedTypedArray);
+    
+        if (at(child1).shouldSpeculateUint16Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), NoTypedArraySpecCheck, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), NoTypedArraySpecCheck, UnsignedTypedArray);
+    
+        if (at(child1).shouldSpeculateUint32Array()) {
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), NoTypedArraySpecCheck, UnsignedTypedArray);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), NoTypedArraySpecCheck);
+    
+        if (at(child1).shouldSpeculateFloat32Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float), NoTypedArraySpecCheck);
             if (!m_compileOkay)
                 return;
             break;            
         }
-        
-        if (at(node.child1()).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), NoTypedArraySpecCheck);
+    
+        if (at(child1).shouldSpeculateFloat64Array()) {
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double), NoTypedArraySpecCheck);
             if (!m_compileOkay)
                 return;
@@ -2901 +2908 @@
         }
 
-        JSValueOperand value(this, node.child3());
-        GPRTemporary scratch(this);
-        
-        GPRReg baseReg = base.gpr();
-        GPRReg scratchReg = scratch.gpr();
-
-        writeBarrier(base.gpr(), value.gpr(), node.child3(), WriteBarrierForPropertyAccess, scratchReg);
-
+        SpeculateCellOperand base(this, child1);
+        SpeculateStrictInt32Operand property(this, child2);
+        JSValueOperand value(this, child3);
+
+        {
+            GPRTemporary scratch(this);
+            GPRReg scratchReg = scratch.gpr();
+            writeBarrier(base.gpr(), value.gpr(), child3, WriteBarrierForPropertyAccess, scratchReg);
+        }
+        StorageOperand storage(this, child4);
         // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+        GPRReg storageReg = storage.gpr();
 
         // Store the value to the array.