Ignore:
Timestamp:
Dec 19, 2011, 12:22:31 PM (13 years ago)
Author:
[email protected]
Message:

Unreviewed, rolling out r103250.
​http://trac.webkit.org/changeset/103250
​https://bugs.webkit.org/show_bug.cgi?id=74877

it still breaks codegen (Requested by olliej on #webkit).

Patch by Sheriff Bot <​[email protected]> on 2011-12-19

  • dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGNode.h:
  • dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateArithNodeFlags):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::byValIsPure):
(JSC::DFG::Propagator::clobbersWorld):
(JSC::DFG::Propagator::getByValLoadElimination):
(JSC::DFG::Propagator::checkStructureLoadElimination):
(JSC::DFG::Propagator::getByOffsetLoadElimination):
(JSC::DFG::Propagator::getPropertyStorageLoadElimination):
(JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
(JSC::DFG::Propagator::performNodeCSE):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r103250 r103255  
    15541554}
    15551555
    1556 void SpeculativeJIT::compilePutByValForByteArray(Node& node)
    1557 {
    1558     NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
    1559     NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
    1560     NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
    1561     NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
    1562    
    1563     if (!isByteArrayPrediction(m_state.forNode(baseIndex).m_type)) {
    1564         SpeculateCellOperand base(this, baseIndex);
    1565         speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
    1566     }
     1556void SpeculativeJIT::compilePutByValForByteArray(GPRReg base, GPRReg property, Node& node)
     1557{
     1558    NodeIndex baseIndex = node.child1();
     1559    NodeIndex valueIndex = node.child3();
     1560   
     1561    if (!isByteArrayPrediction(m_state.forNode(baseIndex).m_type))
     1562        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
    15671563    GPRTemporary value;
    15681564    GPRReg valueGPR;
    … …  
    16111607        valueGPR = gpr;
    16121608    }
    1613     StorageOperand storage(this, storageIndex);
    1614     SpeculateIntegerOperand property(this, propertyIndex);
     1609    ASSERT_UNUSED(valueGPR, valueGPR != property);
     1610    ASSERT(valueGPR != base);
     1611    GPRTemporary storage(this);
    16151612    GPRReg storageReg = storage.gpr();
    1616     MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property.gpr(), MacroAssembler::Address(storageReg, ByteArray::offsetOfSize()));
    1617     m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property.gpr(), MacroAssembler::TimesOne, ByteArray::offsetOfData()));
     1613    ASSERT(valueGPR != storageReg);
     1614    m_jit.loadPtr(MacroAssembler::Address(base, JSByteArray::offsetOfStorage()), storageReg);
     1615    MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(storageReg, ByteArray::offsetOfSize()));
     1616    m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne, ByteArray::offsetOfData()));
    16181617    outOfBounds.link(&m_jit);
    16191618    noResult(m_compileIndex);
    … …  
    17121711}
    17131712
    1714 void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
    1715 {
    1716     NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
    1717     NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
    1718     NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
    1719     NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
    1720 
    1721     if (speculationRequirements != NoTypedArrayTypeSpecCheck) {
    1722         SpeculateCellOperand base(this, baseIndex);
    1723         speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
    1724     }
    1725    
    1726     StorageOperand storage(this, storageIndex);
    1727     GPRReg storageReg = storage.gpr();
    1728     SpeculateIntegerOperand property(this, propertyIndex);
    1729     GPRReg propertyReg = property.gpr();
    1730     MacroAssembler::Jump outOfBounds;
    1731     if (speculationRequirements != NoTypedArrayTypeSpecCheck || speculationRequirements != NoTypedArraySpecCheck) {
    1732         SpeculateCellOperand base(this, baseIndex);
    1733         if (speculationRequirements != NoTypedArrayTypeSpecCheck)
    1734             speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
    1735         if (speculationRequirements != NoTypedArraySpecCheck)
    1736             outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(base.gpr(), descriptor.m_lengthOffset));
    1737     }
     1713void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
     1714{
     1715    NodeIndex baseIndex = node.child1();
     1716    NodeIndex valueIndex = node.child3();
     1717   
     1718    if (speculationRequirements != NoTypedArrayTypeSpecCheck)
     1719        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
    17381720    GPRTemporary value;
    17391721    GPRReg valueGPR;
    … …  
    17771759        valueGPR = gpr;
    17781760    }
     1761    ASSERT_UNUSED(valueGPR, valueGPR != property);
     1762    ASSERT(valueGPR != base);
     1763    GPRTemporary storage(this);
     1764    GPRReg storageReg = storage.gpr();
     1765    ASSERT(valueGPR != storageReg);
     1766    m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
     1767    MacroAssembler::Jump outOfBounds;
     1768    if (speculationRequirements != NoTypedArraySpecCheck)
     1769        outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
    17791770
    17801771    switch (elementSize) {
    17811772    case 1:
    1782         m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne));
     1773        m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne));
    17831774        break;
    17841775    case 2:
    1785         m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo));
     1776        m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesTwo));
    17861777        break;
    17871778    case 4:
    1788         m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour));
     1779        m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
    17891780        break;
    17901781    default:
    … …  
    18411832}
    18421833
    1843 void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
    1844 {
    1845     NodeIndex baseIndex = m_jit.graph().m_varArgChildren[node.firstChild()];
    1846     NodeIndex propertyIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1];
    1847     NodeIndex valueIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 2];
    1848     NodeIndex storageIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 3];
     1834void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
     1835{
     1836    NodeIndex baseIndex = node.child1();
     1837    NodeIndex valueIndex = node.child3();
    18491838   
    18501839    SpeculateDoubleOperand valueOp(this, valueIndex);
    1851     SpeculateStrictInt32Operand property(this, propertyIndex);
    1852     StorageOperand storage(this, storageIndex);
     1840   
     1841    if (speculationRequirements != NoTypedArrayTypeSpecCheck)
     1842        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
     1843   
     1844    GPRTemporary result(this);
     1845   
     1846    GPRTemporary storage(this);
    18531847    GPRReg storageReg = storage.gpr();
    1854     GPRReg propertyReg = property.gpr();
    1855    
     1848   
     1849    m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
    18561850    MacroAssembler::Jump outOfBounds;
    1857     if (speculationRequirements != NoTypedArrayTypeSpecCheck || speculationRequirements != NoTypedArraySpecCheck) {
    1858         SpeculateCellOperand base(this, baseIndex);
    1859         if (speculationRequirements != NoTypedArrayTypeSpecCheck)
    1860             speculationCheck(BadType, JSValueSource::unboxedCell(base.gpr()), baseIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
    1861         if (speculationRequirements != NoTypedArraySpecCheck)
    1862             outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(base.gpr(), descriptor.m_lengthOffset));
    1863     }
    1864    
    1865 
     1851    if (speculationRequirements != NoTypedArraySpecCheck)
     1852        outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
    18661853   
    18671854    switch (elementSize) {
    … …  
    18701857        m_jit.moveDouble(valueOp.fpr(), scratch.fpr());
    18711858        m_jit.convertDoubleToFloat(valueOp.fpr(), scratch.fpr());
    1872         m_jit.storeFloat(scratch.fpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour));
     1859        m_jit.storeFloat(scratch.fpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
    18731860        break;
    18741861    }
    18751862    case 8:
    1876         m_jit.storeDouble(valueOp.fpr(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
     1863        m_jit.storeDouble(valueOp.fpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesEight));
    18771864        break;
    18781865    default:
Note: See TracChangeset for help on using the changeset viewer.