Changeset 111481 in webkit for trunk/Source/JavaScriptCore/jit/JIT.h

Timestamp:

Mar 20, 2012, 6:29:28 PM (13 years ago)

Author:

[email protected]

Message:

op_mod fails on many interesting corner cases
​https://bugs.webkit.org/show_bug.cgi?id=81648

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Removed most strength reduction for op_mod, and fixed the integer handling
to do the right thing for corner cases. Oddly, this revealed bugs in OSR,
which this patch also fixes.

This patch is performance neutral on all of the major benchmarks we track.

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGSpeculativeJIT.cpp:

(DFG):
(JSC::DFG::SpeculativeJIT::compileSoftModulo):
(JSC::DFG::SpeculativeJIT::compileArithMod):

• jit/JIT.h:

(JIT):

• jit/JITArithmetic.cpp:

(JSC):
(JSC::JIT::emit_op_mod):
(JSC::JIT::emitSlow_op_mod):

• jit/JITArithmetic32_64.cpp:

(JSC::JIT::emit_op_mod):
(JSC::JIT::emitSlow_op_mod):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTIMachineTrampolines):
(JSC):

• jit/JITStubs.h:

(TrampolineStructure):
(JSC::JITThunks::ctiNativeConstruct):

• llint/LowLevelInterpreter64.asm:
• wtf/Platform.h:
• wtf/SimpleStats.h:

(WTF::SimpleStats::variance):

LayoutTests:

Reviewed by Oliver Hunt.

• fast/js/integer-division-neg2tothe32-by-neg1-expected.txt: Added.
• fast/js/integer-division-neg2tothe32-by-neg1.html: Added.
• fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js: Added.

(myDiv):
(myDivByNeg1):
(myDivNeg2ToThe31):
(myMod):
(myModByNeg1):
(myModNeg2ToThe31):
(myOtherDiv):
(myOtherDivByNeg1):
(myOtherDivNeg2ToThe31):
(myOtherMod):
(myOtherModByNeg1):
(myOtherModNeg2ToThe31):

File:

• trunk/Source/JavaScriptCore/jit/JIT.h (modified) (1 diff)

trunk/Source/JavaScriptCore/jit/JIT.h

@@ -899 +899 @@
         void emit_op_unexpected_load(Instruction*);
         void emit_op_urshift(Instruction*);
-#if ENABLE(JIT_USE_SOFT_MODULO)
-        void softModulo();
-#endif
 
         void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);