Changeset 111481 in webkit for trunk/Source/JavaScriptCore/llint


Ignore:
Timestamp:
Mar 20, 2012, 6:29:28 PM (13 years ago)
Author:
[email protected]
Message:

op_mod fails on many interesting corner cases
​https://bugs.webkit.org/show_bug.cgi?id=81648

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Removed most strength reduction for op_mod, and fixed the integer handling
to do the right thing for corner cases. Oddly, this revealed bugs in OSR,
which this patch also fixes.

This patch is performance neutral on all of the major benchmarks we track.

  • dfg/DFGOperations.cpp:
  • dfg/DFGOperations.h:
  • dfg/DFGSpeculativeJIT.cpp:

(DFG):
(JSC::DFG::SpeculativeJIT::compileSoftModulo):
(JSC::DFG::SpeculativeJIT::compileArithMod):

  • jit/JIT.h:

(JIT):

  • jit/JITArithmetic.cpp:

(JSC):
(JSC::JIT::emit_op_mod):
(JSC::JIT::emitSlow_op_mod):

  • jit/JITArithmetic32_64.cpp:

(JSC::JIT::emit_op_mod):
(JSC::JIT::emitSlow_op_mod):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTIMachineTrampolines):
(JSC):

  • jit/JITStubs.h:

(TrampolineStructure):
(JSC::JITThunks::ctiNativeConstruct):

  • llint/LowLevelInterpreter64.asm:
  • wtf/Platform.h:
  • wtf/SimpleStats.h:

(WTF::SimpleStats::variance):

LayoutTests:

Reviewed by Oliver Hunt.

  • fast/js/integer-division-neg2tothe32-by-neg1-expected.txt: Added.
  • fast/js/integer-division-neg2tothe32-by-neg1.html: Added.
  • fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js: Added.

(myDiv):
(myDivByNeg1):
(myDivNeg2ToThe31):
(myMod):
(myModByNeg1):
(myModNeg2ToThe31):
(myOtherDiv):
(myOtherDivByNeg1):
(myOtherDivNeg2ToThe31):
(myOtherMod):
(myOtherModByNeg1):
(myOtherModNeg2ToThe31):

File:
1 edited

Legend:

Unmodified
Added
Removed
Note: See TracChangeset for help on using the changeset viewer.