Changeset 149152 in webkit for trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

Timestamp:

Apr 25, 2013, 3:52:34 PM (12 years ago)

Author:

[email protected]

Message:

Source/JavaScriptCore: Fix problems with processing negative zero on DFG.
​https://bugs.webkit.org/show_bug.cgi?id=113862

Patch by Roman Zhuykov <​[email protected]> on 2013-04-25
Reviewed by Filip Pizlo.

Fix NodeNeedsNegZero flag propagation in BackwardPropagationPhase.
Function arithNodeFlags should not mask NodeNeedsNegZero flag for ArithNegate and DoubleAsInt32
nodes and this flag should be always used to decide where we need to generate nezative-zero checks.
Remove unnecessary negative-zero checks from integer ArithDiv on ARM.
Also remove such checks from integer ArithMod on ARM and X86, and make them always to
check not only "modulo_result == 0" but also "dividend < 0".
Generate faster code for case when ArithMod operation divisor is constant power of 2 on ARMv7
in the same way as on ARMv7s, and add negative-zero checks into this code when needed.
Change speculationCheck ExitKind from Overflow to NegativeZero where applicable.

This shows 30% speedup of math-spectral-norm, and 5% speedup
on SunSpider overall on ARMv7 Linux.

• assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::branchConvertDoubleToInt32):

• assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):

• assembler/MacroAssemblerMIPS.h:

(JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):

• assembler/MacroAssemblerSH4.h:

(JSC::MacroAssemblerSH4::branchConvertDoubleToInt32):

• assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):

• dfg/DFGBackwardsPropagationPhase.cpp:

(JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
(JSC::DFG::BackwardsPropagationPhase::isNotPosZero):
(JSC::DFG::BackwardsPropagationPhase::propagate):

• dfg/DFGNode.h:

(JSC::DFG::Node::arithNodeFlags):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
(JSC::DFG::SpeculativeJIT::compileSoftModulo):
(JSC::DFG::SpeculativeJIT::compileArithNegate):

LayoutTests: Arithmetic operations with negative zero should be optimized correclty.
​https://bugs.webkit.org/show_bug.cgi?id=113862

Patch by Roman Zhuykov <​[email protected]> on 2013-04-25
Reviewed by Filip Pizlo.

• fast/js/regress/negative-zero-divide-expected.txt: Added.
• fast/js/regress/negative-zero-divide.html: Added.
• fast/js/regress/negative-zero-modulo-expected.txt: Added.
• fast/js/regress/negative-zero-modulo.html: Added.
• fast/js/regress/negative-zero-negate-expected.txt: Added.
• fast/js/regress/negative-zero-negate.html: Added.
• fast/js/regress/script-tests/negative-zero-divide.js: Added.

(foo):

• fast/js/regress/script-tests/negative-zero-modulo.js: Added.

(foo):

• fast/js/regress/script-tests/negative-zero-negate.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

@@ -886 +886 @@
     // May also branch for some values that are representable in 32 bits
     // (specifically, in this case, 0).
-    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp, bool negZeroCheck = true)
     {
         ASSERT(isSSE2Present());
@@ -892 +892 @@
 
         // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
-        failureCases.append(branchTest32(Zero, dest));
+        if (negZeroCheck)
+            failureCases.append(branchTest32(Zero, dest));
 
         // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.