Ignore:
Timestamp:
Dec 19, 2011, 11:36:37 AM (13 years ago)
Author:
[email protected]
Message:

Rolling r103120 back in with merge errors corrected.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r103218 r103250  
    15541554}
    15551555
    1556 void SpeculativeJIT::compilePutByValForByteArray(GPRReg base, GPRReg property, Node& node)
    1557 {
    1558     NodeIndex baseIndex = node.child1();
    1559     NodeIndex valueIndex = node.child3();
    1560    
    1561     if (!isByteArrayPrediction(m_state.forNode(baseIndex).m_type))
    1562         speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
     1556void SpeculativeJIT::compilePutByValForByteArray(Node& node)
     1557{
     1558    NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
     1559    NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
     1560    NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
     1561    NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
     1562   
     1563    if (!isByteArrayPrediction(m_state.forNode(baseIndex).m_type)) {
     1564        SpeculateCellOperand base(this, baseIndex);
     1565        speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
     1566    }
    15631567    GPRTemporary value;
    15641568    GPRReg valueGPR;
    … …  
    16071611        valueGPR = gpr;
    16081612    }
    1609     ASSERT_UNUSED(valueGPR, valueGPR != property);
    1610     ASSERT(valueGPR != base);
    1611     GPRTemporary storage(this);
     1613    StorageOperand storage(this, storageIndex);
     1614    SpeculateIntegerOperand property(this, propertyIndex);
    16121615    GPRReg storageReg = storage.gpr();
    1613     ASSERT(valueGPR != storageReg);
    1614     m_jit.loadPtr(MacroAssembler::Address(base, JSByteArray::offsetOfStorage()), storageReg);
    1615     MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(storageReg, ByteArray::offsetOfSize()));
    1616     m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne, ByteArray::offsetOfData()));
     1616    MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property.gpr(), MacroAssembler::Address(storageReg, ByteArray::offsetOfSize()));
     1617    m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property.gpr(), MacroAssembler::TimesOne, ByteArray::offsetOfData()));
    16171618    outOfBounds.link(&m_jit);
    16181619    noResult(m_compileIndex);
    … …  
    17111712}
    17121713
    1713 void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
    1714 {
    1715     NodeIndex baseIndex = node.child1();
    1716     NodeIndex valueIndex = node.child3();
    1717    
    1718     if (speculationRequirements != NoTypedArrayTypeSpecCheck)
    1719         speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
     1714void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
     1715{
     1716    NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
     1717    NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
     1718    NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
     1719    NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
     1720
     1721    if (speculationRequirements != NoTypedArrayTypeSpecCheck) {
     1722        SpeculateCellOperand base(this, baseIndex);
     1723        speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
     1724    }
     1725   
     1726    StorageOperand storage(this, storageIndex);
     1727    GPRReg storageReg = storage.gpr();
     1728    SpeculateIntegerOperand property(this, propertyIndex);
     1729    GPRReg propertyReg = property.gpr();
     1730    MacroAssembler::Jump outOfBounds;
     1731    if (speculationRequirements != NoTypedArrayTypeSpecCheck || speculationRequirements != NoTypedArraySpecCheck) {
     1732        SpeculateCellOperand base(this, baseIndex);
     1733        if (speculationRequirements != NoTypedArrayTypeSpecCheck)
     1734            speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
     1735        if (speculationRequirements != NoTypedArraySpecCheck)
     1736            outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(base.gpr(), descriptor.m_lengthOffset));
     1737    }
    17201738    GPRTemporary value;
    17211739    GPRReg valueGPR;
    … …  
    17591777        valueGPR = gpr;
    17601778    }
    1761     ASSERT_UNUSED(valueGPR, valueGPR != property);
    1762     ASSERT(valueGPR != base);
    1763     GPRTemporary storage(this);
    1764     GPRReg storageReg = storage.gpr();
    1765     ASSERT(valueGPR != storageReg);
    1766     m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
    1767     MacroAssembler::Jump outOfBounds;
    1768     if (speculationRequirements != NoTypedArraySpecCheck)
    1769         outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
    17701779
    17711780    switch (elementSize) {
    17721781    case 1:
    1773         m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne));
     1782        m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne));
    17741783        break;
    17751784    case 2:
    1776         m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesTwo));
     1785        m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo));
    17771786        break;
    17781787    case 4:
    1779         m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
     1788        m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour));
    17801789        break;
    17811790    default:
    … …  
    18321841}
    18331842
    1834 void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
    1835 {
    1836     NodeIndex baseIndex = node.child1();
    1837     NodeIndex valueIndex = node.child3();
     1843void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
     1844{
     1845    NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
     1846    NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
     1847    NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
     1848    NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
    18381849   
    18391850    SpeculateDoubleOperand valueOp(this, valueIndex);
    1840    
    1841     if (speculationRequirements != NoTypedArrayTypeSpecCheck)
    1842         speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
    1843    
    1844     GPRTemporary result(this);
    1845    
    1846     GPRTemporary storage(this);
     1851    SpeculateStrictInt32Operand property(this, propertyIndex);
     1852    StorageOperand storage(this, storageIndex);
    18471853    GPRReg storageReg = storage.gpr();
    1848    
    1849     m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
     1854    GPRReg propertyReg = property.gpr();
     1855   
    18501856    MacroAssembler::Jump outOfBounds;
    1851     if (speculationRequirements != NoTypedArraySpecCheck)
    1852         outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
     1857    if (speculationRequirements != NoTypedArrayTypeSpecCheck || speculationRequirements != NoTypedArraySpecCheck) {
     1858        SpeculateCellOperand base(this, baseIndex);
     1859        if (speculationRequirements != NoTypedArrayTypeSpecCheck)
     1860            speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
     1861        if (speculationRequirements != NoTypedArraySpecCheck)
     1862            outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(base.gpr(), descriptor.m_lengthOffset));
     1863    }
     1864   
     1865
    18531866   
    18541867    switch (elementSize) {
    … …  
    18571870        m_jit.moveDouble(valueOp.fpr(), scratch.fpr());
    18581871        m_jit.convertDoubleToFloat(valueOp.fpr(), scratch.fpr());
    1859         m_jit.storeFloat(scratch.fpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
     1872        m_jit.storeFloat(scratch.fpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour));
    18601873        break;
    18611874    }
    18621875    case 8:
    1863         m_jit.storeDouble(valueOp.fpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesEight));
     1876        m_jit.storeDouble(valueOp.fpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
    18641877        break;
    18651878    default:
Note: See TracChangeset for help on using the changeset viewer.