Changeset 156029 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

Timestamp:

Sep 18, 2013, 12:25:52 AM (12 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r156019 and r156020.
​http://trac.webkit.org/changeset/156019
​http://trac.webkit.org/changeset/156020
​https://bugs.webkit.org/show_bug.cgi?id=121540

Broke tests (Requested by ap on #webkit).

Source/JavaScriptCore:

• assembler/MacroAssemblerX86_64.h:
• assembler/X86Assembler.h:
• bytecode/DataFormat.h:

(JSC::dataFormatToString):

• bytecode/ExitKind.cpp:

(JSC::exitKindToString):

• bytecode/ExitKind.h:
• bytecode/OperandsInlines.h:

(JSC::::dumpInContext):

• bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromValue):

• bytecode/SpeculatedType.h:

(JSC::isInt32SpeculationForArithmetic):
(JSC::isInt48Speculation):
(JSC::isMachineIntSpeculationForArithmetic):
(JSC::isInt48AsDoubleSpeculation):
(JSC::isRealNumberSpeculation):
(JSC::isNumberSpeculation):
(JSC::isNumberSpeculationExpectingDefined):

• bytecode/ValueRecovery.h:

(JSC::ValueRecovery::inGPR):
(JSC::ValueRecovery::displacedInJSStack):
(JSC::ValueRecovery::isAlreadyInJSStack):
(JSC::ValueRecovery::gpr):
(JSC::ValueRecovery::virtualRegister):
(JSC::ValueRecovery::dumpInContext):

• dfg/DFGAbstractInterpreter.h:

(JSC::DFG::AbstractInterpreter::needsTypeCheck):
(JSC::DFG::AbstractInterpreter::filterByType):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::::executeEffects):

• dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::checkConsistency):

• dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::validateType):

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

• dfg/DFGAssemblyHelpers.h:

(JSC::DFG::AssemblyHelpers::unboxDouble):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::canonicalize):
(JSC::DFG::CSEPhase::pureCSE):
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGCommon.h:
• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixEdge):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
(JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):

• dfg/DFGFlushFormat.cpp:

(WTF::printInternal):

• dfg/DFGFlushFormat.h:

(JSC::DFG::resultFor):
(JSC::DFG::useKindFor):

• dfg/DFGGenerationInfo.h:

(JSC::DFG::GenerationInfo::initInt32):
(JSC::DFG::GenerationInfo::fillInt32):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGGraph.h:

(JSC::DFG::Graph::addShouldSpeculateMachineInt):
(JSC::DFG::Graph::mulShouldSpeculateMachineInt):
(JSC::DFG::Graph::negateShouldSpeculateMachineInt):

• dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::mergeStateAtTail):

• dfg/DFGJITCode.cpp:

(JSC::DFG::JITCode::reconstruct):

• dfg/DFGMinifiedNode.h:

(JSC::DFG::belongsInMinifiedGraph):
(JSC::DFG::MinifiedNode::hasChild):

• dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateNumber):
(JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
(JSC::DFG::Node::canSpeculateInt48):

• dfg/DFGNodeFlags.h:

(JSC::DFG::nodeCanSpeculateInt48):

• dfg/DFGNodeType.h:

(JSC::DFG::forwardRewiringSelectionScore):

• dfg/DFGOSRExitCompiler.cpp:

(JSC::DFG::shortOperandsDump):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
(JSC::DFG::PredictionPropagationPhase::propagate):
(JSC::DFG::PredictionPropagationPhase::doDoubleVoting):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):

• dfg/DFGSilentRegisterSavePlan.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compileInlineStart):
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileArithMul):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculateNumber):
(JSC::DFG::SpeculativeJIT::speculateRealNumber):
(JSC::DFG::SpeculativeJIT::speculate):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::canReuse):
(JSC::DFG::SpeculativeJIT::isFilled):
(JSC::DFG::SpeculativeJIT::isFilledDouble):
(JSC::DFG::SpeculativeJIT::use):
(JSC::DFG::SpeculativeJIT::boxDouble):
(JSC::DFG::SpeculativeJIT::isKnownInteger):
(JSC::DFG::SpeculativeJIT::isKnownCell):
(JSC::DFG::SpeculativeJIT::isKnownNotNumber):
(JSC::DFG::SpeculativeJIT::int32Result):
(JSC::DFG::SpeculativeJIT::initConstantInfo):
(JSC::DFG::SpeculativeJIT::isInteger):
(JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGUseKind.cpp:

(WTF::printInternal):

• dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isNumerical):

• dfg/DFGValueSource.cpp:

(JSC::DFG::ValueSource::dump):

• dfg/DFGValueSource.h:

(JSC::DFG::dataFormatToValueSourceKind):
(JSC::DFG::valueSourceKindToDataFormat):
(JSC::DFG::ValueSource::forFlushFormat):
(JSC::DFG::ValueSource::valueRecovery):

• dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
(JSC::DFG::VariableAccessData::flushFormat):

• ftl/FTLCArgumentGetter.cpp:

(JSC::FTL::CArgumentGetter::loadNextAndBox):

• ftl/FTLCArgumentGetter.h:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLExitValue.cpp:

(JSC::FTL::ExitValue::dumpInContext):

• ftl/FTLExitValue.h:
• ftl/FTLIntrinsicRepository.h:
• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::createPhiVariables):
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileUpsilon):
(JSC::FTL::LowerDFGToLLVM::compilePhi):
(JSC::FTL::LowerDFGToLLVM::compileSetLocal):
(JSC::FTL::LowerDFGToLLVM::compileAdd):
(JSC::FTL::LowerDFGToLLVM::compileArithSub):
(JSC::FTL::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::LowerDFGToLLVM::compileArithNegate):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareLess):
(JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
(JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
(JSC::FTL::LowerDFGToLLVM::lowInt32):
(JSC::FTL::LowerDFGToLLVM::lowCell):
(JSC::FTL::LowerDFGToLLVM::lowBoolean):
(JSC::FTL::LowerDFGToLLVM::lowDouble):
(JSC::FTL::LowerDFGToLLVM::lowJSValue):
(JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
(JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
(JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
(JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
(JSC::FTL::LowerDFGToLLVM::setInt32):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• ftl/FTLOutput.h:

(JSC::FTL::Output::mulWithOverflow32):

• ftl/FTLValueFormat.cpp:

(WTF::printInternal):

• ftl/FTLValueFormat.h:
• ftl/FTLValueSource.cpp:

(JSC::FTL::ValueSource::dump):

• ftl/FTLValueSource.h:
• interpreter/Register.h:
• runtime/Arguments.cpp:

(JSC::Arguments::tearOffForInlineCallFrame):

• runtime/IndexingType.cpp:

(JSC::leastUpperBoundOfIndexingTypeAndType):

• runtime/JSCJSValue.h:
• runtime/JSCJSValueInlines.h:

Source/WTF:

• wtf/PrintStream.h:

Tools:

• Scripts/run-jsc-stress-tests:

LayoutTests:

• js/regress/large-int-captured-expected.txt: Removed.
• js/regress/large-int-captured.html: Removed.
• js/regress/large-int-expected.txt: Removed.
• js/regress/large-int-neg-expected.txt: Removed.
• js/regress/large-int-neg.html: Removed.
• js/regress/large-int.html: Removed.
• js/regress/marsaglia-larger-ints-expected.txt: Removed.
• js/regress/marsaglia-larger-ints.html: Removed.
• js/regress/script-tests/large-int-captured.js: Removed.
• js/regress/script-tests/large-int-neg.js: Removed.
• js/regress/script-tests/large-int.js: Removed.
• js/regress/script-tests/marsaglia-larger-ints.js: Removed.

File:

• trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (modified) (15 diffs)

trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@ -117 +117 @@
     SpeculatedType speculatedDoubleTypeForPrediction(SpeculatedType value)
     {
-        if (!isFullNumberSpeculation(value))
+        if (!isNumberSpeculation(value))
             return SpecDouble;
         if (value & SpecDoubleNaN)
@@ -143 +143 @@
         case WeakJSConstant: {
             SpeculatedType type = speculationFromValue(m_graph.valueOfJSConstant(node));
-            if (type == SpecInt52AsDouble)
-                type = SpecInt52;
+            if (type == SpecInt48AsDouble)
+                type = SpecInt48;
             changed |= setPrediction(type);
             break;
@@ -150 +150 @@
             
         case GetLocal: {
-            VariableAccessData* variable = node->variableAccessData();
-            SpeculatedType prediction = variable->prediction();
-            if (variable->shouldNeverUnbox() && (prediction & SpecInt52))
-                prediction = (prediction | SpecInt52AsDouble) & ~SpecInt52;
+            VariableAccessData* variableAccessData = node->variableAccessData();
+            SpeculatedType prediction = variableAccessData->prediction();
             if (prediction)
                 changed |= mergePrediction(prediction);
@@ -206 +204 @@
                 changed |= mergePrediction(SpecInt32);
             else
-                changed |= mergePrediction(SpecBytecodeNumber);
+                changed |= mergePrediction(SpecNumber);
             break;
         }
@@ -215 +213 @@
             
             if (left && right) {
-                if (isFullNumberSpeculationExpectingDefined(left) && isFullNumberSpeculationExpectingDefined(right)) {
+                if (isNumberSpeculationExpectingDefined(left) && isNumberSpeculationExpectingDefined(right)) {
                     if (m_graph.addSpeculationMode(node) != DontSpeculateInt32)
                         changed |= mergePrediction(SpecInt32);
                     else if (m_graph.addShouldSpeculateMachineInt(node))
-                        changed |= mergePrediction(SpecInt52);
+                        changed |= mergePrediction(SpecInt48);
                     else
                         changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
-                } else if (!(left & SpecFullNumber) || !(right & SpecFullNumber)) {
+                } else if (!(left & SpecNumber) || !(right & SpecNumber)) {
                     // left or right is definitely something other than a number.
                     changed |= mergePrediction(SpecString);
@@ -239 +237 @@
                     changed |= mergePrediction(SpecInt32);
                 else if (m_graph.addShouldSpeculateMachineInt(node))
-                    changed |= mergePrediction(SpecInt52);
+                    changed |= mergePrediction(SpecInt48);
                 else
                     changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
@@ -254 +252 @@
                     changed |= mergePrediction(SpecInt32);
                 else if (m_graph.addShouldSpeculateMachineInt(node))
-                    changed |= mergePrediction(SpecInt52);
+                    changed |= mergePrediction(SpecInt48);
                 else
                     changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
@@ -266 +264 @@
                     changed |= mergePrediction(SpecInt32);
                 else if (m_graph.negateShouldSpeculateMachineInt(node))
-                    changed |= mergePrediction(SpecInt52);
+                    changed |= mergePrediction(SpecInt48);
                 else
                     changed |= mergePrediction(speculatedDoubleTypeForPrediction(node->child1()->prediction()));
@@ -295 +293 @@
                     changed |= mergePrediction(SpecInt32);
                 else if (m_graph.mulShouldSpeculateMachineInt(node))
-                    changed |= mergePrediction(SpecInt52);
+                    changed |= mergePrediction(SpecInt48);
                 else
                     changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
@@ -371 +369 @@
 
         case GetByVal: {
-            if (!node->child1()->prediction())
-                break;
-            if (!node->getHeapPrediction())
-                break;
-            
             if (node->child1()->shouldSpeculateFloat32Array()
                 || node->child1()->shouldSpeculateFloat64Array())
                 changed |= mergePrediction(SpecDouble);
-            else if (node->child1()->shouldSpeculateUint32Array()) {
-                if (isInt32Speculation(node->getHeapPrediction()))
-                    changed |= mergePrediction(SpecInt32);
-                else
-                    changed |= mergePrediction(SpecInt52);
-            } else
+            else
                 changed |= mergePrediction(node->getHeapPrediction());
             break;
@@ -579 +567 @@
         case Unreachable:
         case LoopHint:
-        case Int52ToValue:
-        case Int52ToDouble:
             break;
             
@@ -655 +641 @@
             DoubleBallot ballot;
                 
-            if (isFullNumberSpeculationExpectingDefined(left) && isFullNumberSpeculationExpectingDefined(right)
-                && !m_graph.addShouldSpeculateInt32(node)
-                && !m_graph.addShouldSpeculateMachineInt(node))
+            if (isNumberSpeculationExpectingDefined(left) && isNumberSpeculationExpectingDefined(right)
+                && !m_graph.addShouldSpeculateInt32(node))
                 ballot = VoteDouble;
             else
@@ -673 +658 @@
             DoubleBallot ballot;
                 
-            if (isFullNumberSpeculation(left) && isFullNumberSpeculation(right)
-                && !m_graph.mulShouldSpeculateInt32(node)
-                && !m_graph.mulShouldSpeculateMachineInt(node))
+            if (isNumberSpeculation(left) && isNumberSpeculation(right)
+                && !m_graph.mulShouldSpeculateInt32(node))
                 ballot = VoteDouble;
             else
@@ -694 +678 @@
             DoubleBallot ballot;
                 
-            if (isFullNumberSpeculation(left) && isFullNumberSpeculation(right)
+            if (isNumberSpeculation(left) && isNumberSpeculation(right)
                 && !(Node::shouldSpeculateInt32ForArithmetic(node->child1().node(), node->child2().node()) && node->canSpeculateInt32()))
                 ballot = VoteDouble;
@@ -723 +707 @@
             if (isDoubleSpeculation(prediction))
                 node->variableAccessData()->vote(VoteDouble);
-            else if (
-                !isFullNumberSpeculation(prediction)
-                || isInt32Speculation(prediction) || isMachineIntSpeculation(prediction))
+            else if (!isNumberSpeculation(prediction) || isInt32Speculation(prediction))
                 node->variableAccessData()->vote(VoteValue);
             break;