Changeset 121307 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Jun 26, 2012, 6:34:01 PM (13 years ago)

Author:

[email protected]

Message:

DFG PutByValAlias is too aggressive
​https://bugs.webkit.org/show_bug.cgi?id=90026
<rdar://problem/11751830>

Source/JavaScriptCore:

Reviewed by Gavin Barraclough.

For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
performance by much.

For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
is within bounds. This also has the effect of making our out-of-bounds handling consistent
with WebCore.

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::performNodeCSE):

• dfg/DFGGraph.h:

(JSC::DFG::Graph::byValIsPure):
(JSC::DFG::Graph::clobbersWorld):

• dfg/DFGNodeType.h:

(DFG):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):

LayoutTests:

Reviewed by Gavin Barraclough.

• fast/js/dfg-put-by-val-setter-then-get-by-val-expected.txt: Added.
• fast/js/dfg-put-by-val-setter-then-get-by-val.html: Added.
• fast/js/dfg-uint8clampedarray-out-of-bounds-put-by-val-alias-expected.txt: Added.
• fast/js/dfg-uint8clampedarray-out-of-bounds-put-by-val-alias.html: Added.
• fast/js/script-tests/dfg-put-by-val-setter-then-get-by-val.js: Added.

(foo):
(for):

• fast/js/script-tests/dfg-uint8clampedarray-out-of-bounds-put-by-val-alias.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2001 +2001 @@
     }
 
-    MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(baseReg, descriptor.m_lengthOffset));
-    m_jit.xorPtr(resultReg, resultReg);
-    MacroAssembler::Jump outOfBounds = m_jit.jump();
-    inBounds.link(&m_jit);
+    speculationCheck(
+        Uncountable, JSValueRegs(), NoNode,
+        m_jit.branch32(
+            MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, descriptor.m_lengthOffset)));
     switch (elementSize) {
     case 1:
@@ -2024 +2024 @@
         ASSERT_NOT_REACHED();
     }
-    outOfBounds.link(&m_jit);
     if (elementSize < 4 || signedness == SignedTypedArray) {
         integerResult(resultReg, m_compileIndex);
@@ -2163 +2162 @@
     FPRReg resultReg = result.fpr();
     ASSERT(speculationRequirements != NoTypedArraySpecCheck);
-    MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(baseReg, descriptor.m_lengthOffset));
-    static const double zero = 0;
-    m_jit.loadDouble(&zero, resultReg);
-    MacroAssembler::Jump outOfBounds = m_jit.jump();
-    inBounds.link(&m_jit);
+    speculationCheck(
+        Uncountable, JSValueRegs(), NoNode,
+        m_jit.branch32(
+            MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, descriptor.m_lengthOffset)));
     switch (elementSize) {
     case 4:
@@ -2184 +2182 @@
         ASSERT_NOT_REACHED();
     }
-    outOfBounds.link(&m_jit);
     doubleResult(resultReg, m_compileIndex);
 }