DFG SetLocal should use forwardSpeculationCheck instead of its own half-baked version of same
https://bugs.webkit.org/show_bug.cgi?id=103353
Reviewed by Oliver Hunt and Gavin Barraclough.
Source/JavaScriptCore:
Made it possible to use forward speculations for most of the operand classes. Changed the conditional
direction parameter from being 'bool isForward' to an enum (SpeculationDirection). Changed SetLocal
to use forward speculations and got rid of its half-baked version of same.
Also added the ability to force the DFG's disassembler to dump all nodes, even ones that are dead.
- dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::Disassembler::dump):
(JSC::DFG::compile):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculationCheck):
(DFG):
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
(JSC::DFG::SpeculativeJIT::speculationWatchpoint):
(JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
(JSC::DFG::SpeculativeJIT::fillStorage):
(SpeculativeJIT):
(JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
(JSC::DFG::SpeculateIntegerOperand::gpr):
(SpeculateIntegerOperand):
(JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
(JSC::DFG::SpeculateDoubleOperand::fpr):
(SpeculateDoubleOperand):
(JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
(JSC::DFG::SpeculateCellOperand::gpr):
(SpeculateCellOperand):
(JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
(JSC::DFG::SpeculateBooleanOperand::gpr):
(SpeculateBooleanOperand):
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):
(JSC):
LayoutTests:
- fast/js/dfg-intrinsic-side-effect-assignment-osr-exit-expected.txt: Added.
- fast/js/dfg-intrinsic-side-effect-assignment-osr-exit.html: Added.
- fast/js/dfg-side-effect-assignment-osr-exit-expected.txt: Added.
- fast/js/dfg-side-effect-assignment-osr-exit.html: Added.
- fast/js/jsc-test-list:
- fast/js/script-tests/dfg-intrinsic-side-effect-assignment-osr-exit.js: Added.
(foo):
- fast/js/script-tests/dfg-side-effect-assignment-osr-exit.js: Added.
(foo):
(bar):