Ignore:
Timestamp:
Sep 18, 2013, 12:25:52 AM (12 years ago)
Author:
[email protected]
Message:

Unreviewed, rolling out r156019 and r156020.
​http://trac.webkit.org/changeset/156019
​http://trac.webkit.org/changeset/156020
​https://bugs.webkit.org/show_bug.cgi?id=121540

Broke tests (Requested by ap on #webkit).

Source/JavaScriptCore:

  • assembler/MacroAssemblerX86_64.h:
  • assembler/X86Assembler.h:
  • bytecode/DataFormat.h:

(JSC::dataFormatToString):

  • bytecode/ExitKind.cpp:

(JSC::exitKindToString):

  • bytecode/ExitKind.h:
  • bytecode/OperandsInlines.h:

(JSC::::dumpInContext):

  • bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromValue):

  • bytecode/SpeculatedType.h:

(JSC::isInt32SpeculationForArithmetic):
(JSC::isInt48Speculation):
(JSC::isMachineIntSpeculationForArithmetic):
(JSC::isInt48AsDoubleSpeculation):
(JSC::isRealNumberSpeculation):
(JSC::isNumberSpeculation):
(JSC::isNumberSpeculationExpectingDefined):

  • bytecode/ValueRecovery.h:

(JSC::ValueRecovery::inGPR):
(JSC::ValueRecovery::displacedInJSStack):
(JSC::ValueRecovery::isAlreadyInJSStack):
(JSC::ValueRecovery::gpr):
(JSC::ValueRecovery::virtualRegister):
(JSC::ValueRecovery::dumpInContext):

  • dfg/DFGAbstractInterpreter.h:

(JSC::DFG::AbstractInterpreter::needsTypeCheck):
(JSC::DFG::AbstractInterpreter::filterByType):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::::executeEffects):

  • dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::checkConsistency):

  • dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::validateType):

  • dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

  • dfg/DFGAssemblyHelpers.h:

(JSC::DFG::AssemblyHelpers::unboxDouble):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):

  • dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::canonicalize):
(JSC::DFG::CSEPhase::pureCSE):
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGCommon.h:
  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixEdge):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
(JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):

  • dfg/DFGFlushFormat.cpp:

(WTF::printInternal):

  • dfg/DFGFlushFormat.h:

(JSC::DFG::resultFor):
(JSC::DFG::useKindFor):

  • dfg/DFGGenerationInfo.h:

(JSC::DFG::GenerationInfo::initInt32):
(JSC::DFG::GenerationInfo::fillInt32):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

  • dfg/DFGGraph.h:

(JSC::DFG::Graph::addShouldSpeculateMachineInt):
(JSC::DFG::Graph::mulShouldSpeculateMachineInt):
(JSC::DFG::Graph::negateShouldSpeculateMachineInt):

  • dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::mergeStateAtTail):

  • dfg/DFGJITCode.cpp:

(JSC::DFG::JITCode::reconstruct):

  • dfg/DFGMinifiedNode.h:

(JSC::DFG::belongsInMinifiedGraph):
(JSC::DFG::MinifiedNode::hasChild):

  • dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateNumber):
(JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
(JSC::DFG::Node::canSpeculateInt48):

  • dfg/DFGNodeFlags.h:

(JSC::DFG::nodeCanSpeculateInt48):

  • dfg/DFGNodeType.h:

(JSC::DFG::forwardRewiringSelectionScore):

  • dfg/DFGOSRExitCompiler.cpp:

(JSC::DFG::shortOperandsDump):

  • dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
(JSC::DFG::PredictionPropagationPhase::propagate):
(JSC::DFG::PredictionPropagationPhase::doDoubleVoting):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):

  • dfg/DFGSilentRegisterSavePlan.h:
  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compileInlineStart):
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileArithMul):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculateNumber):
(JSC::DFG::SpeculativeJIT::speculateRealNumber):
(JSC::DFG::SpeculativeJIT::speculate):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::canReuse):
(JSC::DFG::SpeculativeJIT::isFilled):
(JSC::DFG::SpeculativeJIT::isFilledDouble):
(JSC::DFG::SpeculativeJIT::use):
(JSC::DFG::SpeculativeJIT::boxDouble):
(JSC::DFG::SpeculativeJIT::isKnownInteger):
(JSC::DFG::SpeculativeJIT::isKnownCell):
(JSC::DFG::SpeculativeJIT::isKnownNotNumber):
(JSC::DFG::SpeculativeJIT::int32Result):
(JSC::DFG::SpeculativeJIT::initConstantInfo):
(JSC::DFG::SpeculativeJIT::isInteger):
(JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGUseKind.cpp:

(WTF::printInternal):

  • dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isNumerical):

  • dfg/DFGValueSource.cpp:

(JSC::DFG::ValueSource::dump):

  • dfg/DFGValueSource.h:

(JSC::DFG::dataFormatToValueSourceKind):
(JSC::DFG::valueSourceKindToDataFormat):
(JSC::DFG::ValueSource::forFlushFormat):
(JSC::DFG::ValueSource::valueRecovery):

  • dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
(JSC::DFG::VariableAccessData::flushFormat):

  • ftl/FTLCArgumentGetter.cpp:

(JSC::FTL::CArgumentGetter::loadNextAndBox):

  • ftl/FTLCArgumentGetter.h:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLExitValue.cpp:

(JSC::FTL::ExitValue::dumpInContext):

  • ftl/FTLExitValue.h:
  • ftl/FTLIntrinsicRepository.h:
  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::createPhiVariables):
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileUpsilon):
(JSC::FTL::LowerDFGToLLVM::compilePhi):
(JSC::FTL::LowerDFGToLLVM::compileSetLocal):
(JSC::FTL::LowerDFGToLLVM::compileAdd):
(JSC::FTL::LowerDFGToLLVM::compileArithSub):
(JSC::FTL::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::LowerDFGToLLVM::compileArithNegate):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareLess):
(JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
(JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
(JSC::FTL::LowerDFGToLLVM::lowInt32):
(JSC::FTL::LowerDFGToLLVM::lowCell):
(JSC::FTL::LowerDFGToLLVM::lowBoolean):
(JSC::FTL::LowerDFGToLLVM::lowDouble):
(JSC::FTL::LowerDFGToLLVM::lowJSValue):
(JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
(JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
(JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
(JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
(JSC::FTL::LowerDFGToLLVM::setInt32):

  • ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

  • ftl/FTLOutput.h:

(JSC::FTL::Output::mulWithOverflow32):

  • ftl/FTLValueFormat.cpp:

(WTF::printInternal):

  • ftl/FTLValueFormat.h:
  • ftl/FTLValueSource.cpp:

(JSC::FTL::ValueSource::dump):

  • ftl/FTLValueSource.h:
  • interpreter/Register.h:
  • runtime/Arguments.cpp:

(JSC::Arguments::tearOffForInlineCallFrame):

  • runtime/IndexingType.cpp:

(JSC::leastUpperBoundOfIndexingTypeAndType):

  • runtime/JSCJSValue.h:
  • runtime/JSCJSValueInlines.h:

Source/WTF:

  • wtf/PrintStream.h:

Tools:

  • Scripts/run-jsc-stress-tests:

LayoutTests:

  • js/regress/large-int-captured-expected.txt: Removed.
  • js/regress/large-int-captured.html: Removed.
  • js/regress/large-int-expected.txt: Removed.
  • js/regress/large-int-neg-expected.txt: Removed.
  • js/regress/large-int-neg.html: Removed.
  • js/regress/large-int.html: Removed.
  • js/regress/marsaglia-larger-ints-expected.txt: Removed.
  • js/regress/marsaglia-larger-ints.html: Removed.
  • js/regress/script-tests/large-int-captured.js: Removed.
  • js/regress/script-tests/large-int-neg.js: Removed.
  • js/regress/script-tests/large-int.js: Removed.
  • js/regress/script-tests/marsaglia-larger-ints.js: Removed.
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r156019 r156029  
    336336        else if (registerFormat == DataFormatCell || registerFormat == DataFormatStorage)
    337337            spillAction = StorePtr;
    338         else if (registerFormat == DataFormatInt52 || registerFormat == DataFormatStrictInt52)
    339             spillAction = Store64;
    340338        else {
    341339            ASSERT(registerFormat & DataFormatJS);
    … …  
    389387        ASSERT(info.gpr() == source);
    390388        fillAction = LoadPtr;
    391     } else if (registerFormat == DataFormatInt52) {
    392         if (node->hasConstant())
    393             fillAction = SetInt52Constant;
    394         else if (isJSInt32(info.spillFormat()) || info.spillFormat() == DataFormatJS)
    395             fillAction = Load32PayloadConvertToInt52;
    396         else if (info.spillFormat() == DataFormatInt52)
    397             fillAction = Load64;
    398         else if (info.spillFormat() == DataFormatStrictInt52)
    399             fillAction = Load64ShiftInt52Left;
    400         else if (info.spillFormat() == DataFormatNone)
    401             fillAction = Load64;
    402         else {
    403             // Should never happen. Anything that qualifies as an int32 will never
    404             // be turned into a cell (immediate spec fail) or a double (to-double
    405             // conversions involve a separate node).
    406             RELEASE_ASSERT_NOT_REACHED();
    407             fillAction = Load64; // Make GCC happy.
    408         }
    409     } else if (registerFormat == DataFormatStrictInt52) {
    410         if (node->hasConstant())
    411             fillAction = SetStrictInt52Constant;
    412         else if (isJSInt32(info.spillFormat()) || info.spillFormat() == DataFormatJS)
    413             fillAction = Load32PayloadSignExtend;
    414         else if (info.spillFormat() == DataFormatInt52)
    415             fillAction = Load64ShiftInt52Right;
    416         else if (info.spillFormat() == DataFormatStrictInt52)
    417             fillAction = Load64;
    418         else if (info.spillFormat() == DataFormatNone)
    419             fillAction = Load64;
    420         else {
    421             // Should never happen. Anything that qualifies as an int32 will never
    422             // be turned into a cell (immediate spec fail) or a double (to-double
    423             // conversions involve a separate node).
    424             RELEASE_ASSERT_NOT_REACHED();
    425             fillAction = Load64; // Make GCC happy.
    426         }
    427389    } else {
    428390        ASSERT(registerFormat & DataFormatJS);
    … …  
    432394            if (valueOfJSConstant(node).isCell())
    433395                fillAction = SetTrustedJSConstant;
     396            else
    434397                fillAction = SetJSConstant;
    435398        } else if (info.spillFormat() == DataFormatInt32) {
    … …  
    550513        m_jit.move(Imm32(valueOfInt32Constant(plan.node())), plan.gpr());
    551514        break;
    552 #if USE(JSVALUE64)
    553     case SetInt52Constant:
    554         m_jit.move(Imm64(valueOfJSConstant(plan.node()).asMachineInt() << JSValue::int52ShiftAmount), plan.gpr());
    555         break;
    556     case SetStrictInt52Constant:
    557         m_jit.move(Imm64(valueOfJSConstant(plan.node()).asMachineInt()), plan.gpr());
    558         break;
    559 #endif // USE(JSVALUE64)
    560515    case SetBooleanConstant:
    561516        m_jit.move(TrustedImm32(valueOfBooleanConstant(plan.node())), plan.gpr());
    … …  
    579534        m_jit.or64(GPRInfo::tagTypeNumberRegister, plan.gpr());
    580535        break;
    581     case Load32PayloadConvertToInt52:
    582         m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
    583         m_jit.signExtend32ToPtr(plan.gpr(), plan.gpr());
    584         m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), plan.gpr());
    585         break;
    586     case Load32PayloadSignExtend:
    587         m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
    588         m_jit.signExtend32ToPtr(plan.gpr(), plan.gpr());
    589         break;
    590536    case LoadDoubleBoxDouble:
    591537        m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
    … …  
    628574    case Load64:
    629575        m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
    630         break;
    631     case Load64ShiftInt52Right:
    632         m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
    633         m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), plan.gpr());
    634         break;
    635     case Load64ShiftInt52Left:
    636         m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
    637         m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), plan.gpr());
    638576        break;
    639577#endif
    … …  
    14791417        if (node->isBinaryUseKind(Int32Use))
    14801418            compilePeepHoleInt32Branch(node, branchNode, condition);
    1481 #if USE(JSVALUE64)
    1482         else if (node->isBinaryUseKind(MachineIntUse))
    1483             compilePeepHoleInt52Branch(node, branchNode, condition);
    1484 #endif // USE(JSVALUE64)
    14851419        else if (node->isBinaryUseKind(NumberUse))
    14861420            compilePeepHoleDoubleBranch(node, branchNode, doubleCondition);
    … …  
    15731507            case FlushedInt32:
    15741508                valueSource = ValueSource(Int32InJSStack);
    1575                 break;
    1576             case FlushedInt52:
    1577                 valueSource = ValueSource(Int52InJSStack);
    15781509                break;
    15791510            case FlushedCell:
    … …  
    19431874   
    19441875    DFG_TYPE_CHECK(
    1945         JSValueRegs(), child3, SpecFullRealNumber,
     1876        JSValueRegs(), child3, SpecRealNumber,
    19461877        m_jit.branchDouble(
    19471878            MacroAssembler::DoubleNotEqualOrUnordered, valueReg, valueReg));
    … …  
    22192150        return;
    22202151    }
    2221        
    2222 #if USE(JSVALUE64)
    2223     case MachineIntUse: {
    2224         SpeculateStrictInt52Operand op1(this, node->child1());
    2225         GPRTemporary result(this, Reuse, op1);
    2226         GPRReg op1GPR = op1.gpr();
    2227         GPRReg resultGPR = result.gpr();
    2228         m_jit.zeroExtend32ToPtr(op1GPR, resultGPR);
    2229         int32Result(resultGPR, node, DataFormatInt32);
    2230         return;
    2231     }
    2232 #endif // USE(JSVALUE64)
    22332152   
    22342153    case NumberUse:
    … …  
    22692188            if (node->child1().useKind() == NumberUse) {
    22702189                DFG_TYPE_CHECK(
    2271                     JSValueRegs(gpr), node->child1(), SpecFullNumber,
     2190                    JSValueRegs(gpr), node->child1(), SpecNumber,
    22722191                    m_jit.branchTest64(
    22732192                        MacroAssembler::Zero, gpr, GPRInfo::tagTypeNumberRegister));
    … …  
    23252244                if (node->child1().useKind() == NumberUse) {
    23262245                    DFG_TYPE_CHECK(
    2327                         JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecFullNumber,
     2246                        JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecNumber,
    23282247                        m_jit.branch32(
    23292248                            MacroAssembler::AboveOrEqual, tagGPR,
    … …  
    24712390        MacroAssembler::AboveOrEqual, op1GPR, GPRInfo::tagTypeNumberRegister);
    24722391   
    2473     if (needsTypeCheck(node->child1(), SpecFullNumber)) {
     2392    if (needsTypeCheck(node->child1(), SpecNumber)) {
    24742393        if (node->flags() & NodeExitsForward) {
    24752394            forwardTypeCheck(
    2476                 JSValueRegs(op1GPR), node->child1(), SpecFullNumber,
     2395                JSValueRegs(op1GPR), node->child1(), SpecNumber,
    24772396                m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister),
    24782397                ValueRecovery::inGPR(op1GPR, DataFormatJS));
    24792398        } else {
    24802399            backwardTypeCheck(
    2481                 JSValueRegs(op1GPR), node->child1(), SpecFullNumber,
     2400                JSValueRegs(op1GPR), node->child1(), SpecNumber,
    24822401                m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister));
    24832402        }
    … …  
    25022421        MacroAssembler::Equal, op1TagGPR, TrustedImm32(JSValue::Int32Tag));
    25032422   
    2504     if (needsTypeCheck(node->child1(), SpecFullNumber)) {
     2423    if (needsTypeCheck(node->child1(), SpecNumber)) {
    25052424        if (node->flags() & NodeExitsForward) {
    25062425            forwardTypeCheck(
    2507                 JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecFullNumber,
     2426                JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecNumber,
    25082427                m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)),
    25092428                ValueRecovery::inPair(op1TagGPR, op1PayloadGPR));
    25102429        } else {
    25112430            backwardTypeCheck(
    2512                 JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecFullNumber,
     2431                JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecNumber,
    25132432                m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));
    25142433        }
    … …  
    26302549        return;
    26312550    }
    2632    
    2633 #if USE(JSVALUE64)
    2634     if (node->shouldSpeculateMachineInt()) {
    2635         m_jit.zeroExtend32ToPtr(resultReg, resultReg);
    2636         strictInt52Result(resultReg, node);
    2637         return;
    2638     }
    2639 #endif
    26402551   
    26412552    FPRTemporary fresult(this);
    … …  
    26912602            break;
    26922603        }
    2693            
    2694 #if USE(JSVALUE64)
    2695         case MachineIntUse: {
    2696             SpeculateStrictInt52Operand valueOp(this, valueUse);
    2697             GPRTemporary scratch(this);
    2698             GPRReg scratchReg = scratch.gpr();
    2699             m_jit.move(valueOp.gpr(), scratchReg);
    2700             if (isClamped(type)) {
    2701                 ASSERT(elementSize(type) == 1);
    2702                 MacroAssembler::Jump inBounds = m_jit.branch64(
    2703                     MacroAssembler::BelowOrEqual, scratchReg, JITCompiler::TrustedImm64(0xff));
    2704                 MacroAssembler::Jump tooBig = m_jit.branch64(
    2705                     MacroAssembler::GreaterThan, scratchReg, JITCompiler::TrustedImm64(0xff));
    2706                 m_jit.move(TrustedImm32(0), scratchReg);
    2707                 MacroAssembler::Jump clamped = m_jit.jump();
    2708                 tooBig.link(&m_jit);
    2709                 m_jit.move(JITCompiler::TrustedImm32(255), scratchReg);
    2710                 clamped.link(&m_jit);
    2711                 inBounds.link(&m_jit);
    2712             }
    2713             value.adopt(scratch);
    2714             valueGPR = scratchReg;
    2715             break;
    2716         }
    2717 #endif // USE(JSVALUE64)
    27182604           
    27192605        case NumberUse: {
    … …  
    29852871            return;
    29862872        }
    2987        
     2873               
    29882874        if (isNumberConstant(node->child2().node())) {
    29892875            SpeculateInt32Operand op1(this, node->child1());
    … …  
    30302916        return;
    30312917    }
    3032        
    3033 #if USE(JSVALUE64)
    3034     case MachineIntUse: {
    3035         // Will we need an overflow check? If we can prove that neither input can be
    3036         // Int52 then the overflow check will not be necessary.
    3037         if (!m_state.forNode(node->child1()).couldBeType(SpecInt52)
    3038             && !m_state.forNode(node->child2()).couldBeType(SpecInt52)) {
    3039             SpeculateWhicheverInt52Operand op1(this, node->child1());
    3040             SpeculateWhicheverInt52Operand op2(this, node->child2(), op1);
    3041             GPRTemporary result(this, Reuse, op1);
    3042             m_jit.move(op1.gpr(), result.gpr());
    3043             m_jit.add64(op2.gpr(), result.gpr());
    3044             int52Result(result.gpr(), node, op1.format());
    3045             return;
    3046         }
    3047        
    3048         SpeculateInt52Operand op1(this, node->child1());
    3049         SpeculateInt52Operand op2(this, node->child2());
    3050         GPRTemporary result(this, Reuse, op1, op2);
    3051         m_jit.move(op1.gpr(), result.gpr());
    3052         speculationCheck(
    3053             Int52Overflow, JSValueRegs(), 0,
    3054             m_jit.branchAdd64(MacroAssembler::Overflow, op2.gpr(), result.gpr()));
    3055         int52Result(result.gpr(), node);
    3056         return;
    3057     }
    3058 #endif // USE(JSVALUE64)
    30592918   
    30602919    case NumberUse: {
    … …  
    32023061    }
    32033062       
    3204 #if USE(JSVALUE64)
    3205     case MachineIntUse: {
    3206         // Will we need an overflow check? If we can prove that neither input can be
    3207         // Int52 then the overflow check will not be necessary.
    3208         if (!m_state.forNode(node->child1()).couldBeType(SpecInt52)
    3209             && !m_state.forNode(node->child2()).couldBeType(SpecInt52)) {
    3210             SpeculateWhicheverInt52Operand op1(this, node->child1());
    3211             SpeculateWhicheverInt52Operand op2(this, node->child2(), op1);
    3212             GPRTemporary result(this, Reuse, op1);
    3213             m_jit.move(op1.gpr(), result.gpr());
    3214             m_jit.sub64(op2.gpr(), result.gpr());
    3215             int52Result(result.gpr(), node, op1.format());
    3216             return;
    3217         }
    3218        
    3219         SpeculateInt52Operand op1(this, node->child1());
    3220         SpeculateInt52Operand op2(this, node->child2());
    3221         GPRTemporary result(this, Reuse, op1, op2);
    3222         m_jit.move(op1.gpr(), result.gpr());
    3223         speculationCheck(
    3224             Int52Overflow, JSValueRegs(), 0,
    3225             m_jit.branchSub64(MacroAssembler::Overflow, op2.gpr(), result.gpr()));
    3226         int52Result(result.gpr(), node);
    3227         return;
    3228     }
    3229 #endif // USE(JSVALUE64)
    3230 
    32313063    case NumberUse: {
    32323064        SpeculateDoubleOperand op1(this, node->child1());
    … …  
    32573089        m_jit.move(op1.gpr(), result.gpr());
    32583090
    3259         // Note: there is no notion of being not used as a number, but someone
    3260         // caring about negative zero.
    3261        
    32623091        if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
    32633092            m_jit.neg32(result.gpr());
    … …  
    32723101        return;
    32733102    }
    3274 
    3275 #if USE(JSVALUE64)
    3276     case MachineIntUse: {
    3277         if (!m_state.forNode(node->child1()).couldBeType(SpecInt52)) {
    3278             SpeculateWhicheverInt52Operand op1(this, node->child1());
    3279             GPRTemporary result(this);
    3280             GPRReg op1GPR = op1.gpr();
    3281             GPRReg resultGPR = result.gpr();
    3282             m_jit.move(op1GPR, resultGPR);
    3283             m_jit.neg64(resultGPR);
    3284             if (!bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
    3285                 speculationCheck(
    3286                     NegativeZero, JSValueRegs(), 0,
    3287                     m_jit.branchTest64(MacroAssembler::Zero, resultGPR));
    3288             }
    3289             int52Result(resultGPR, node, op1.format());
    3290             return;
    3291         }
    3292        
    3293         SpeculateInt52Operand op1(this, node->child1());
    3294         GPRTemporary result(this);
    3295         GPRReg op1GPR = op1.gpr();
    3296         GPRReg resultGPR = result.gpr();
    3297         m_jit.move(op1GPR, resultGPR);
    3298         speculationCheck(
    3299             Int52Overflow, JSValueRegs(), 0,
    3300             m_jit.branchNeg64(MacroAssembler::Overflow, resultGPR));
    3301         if (!bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
    3302             speculationCheck(
    3303                 NegativeZero, JSValueRegs(), 0,
    3304                 m_jit.branchTest64(MacroAssembler::Zero, resultGPR));
    3305         }
    3306         int52Result(resultGPR, node);
    3307         return;
    3308     }
    3309 #endif // USE(JSVALUE64)
    33103103       
    33113104    case NumberUse: {
    … …  
    33733166        return;
    33743167    }
    3375    
    3376 #if USE(JSVALUE64)   
    3377     case MachineIntUse: {
    3378         // This is super clever. We want to do an int52 multiplication and check the
    3379         // int52 overflow bit. There is no direct hardware support for this, but we do
    3380         // have the ability to do an int64 multiplication and check the int64 overflow
    3381         // bit. We leverage that. Consider that a, b are int52 numbers inside int64
    3382         // registers, with the high 12 bits being sign-extended. We can do:
    3383         //
    3384         //     (a * (b << 12))
    3385         //
    3386         // This will give us a left-shifted int52 (value is in high 52 bits, low 16
    3387         // bits are zero) plus the int52 overflow bit. I.e. whether this 64-bit
    3388         // multiplication overflows is identical to whether the 'a * b' 52-bit
    3389         // multiplication overflows.
    3390         //
    3391         // In our nomenclature, this is:
    3392         //
    3393         //     strictInt52(a) * int52(b) => int52
    3394         //
    3395         // That is "strictInt52" means unshifted and "int52" means left-shifted by 16
    3396         // bits.
    3397         //
    3398         // We don't care which of op1 or op2 serves as the left-shifted operand, so
    3399         // we just do whatever is more convenient for op1 and have op2 do the
    3400         // opposite. This ensures that we do at most one shift.
    3401 
    3402         SpeculateWhicheverInt52Operand op1(this, node->child1());
    3403         SpeculateWhicheverInt52Operand op2(this, node->child2(), OppositeShift, op1);
    3404         GPRTemporary result(this);
    3405        
    3406         GPRReg op1GPR = op1.gpr();
    3407         GPRReg op2GPR = op2.gpr();
    3408         GPRReg resultGPR = result.gpr();
    3409        
    3410         m_jit.move(op1GPR, resultGPR);
    3411         speculationCheck(
    3412             Int52Overflow, JSValueRegs(), 0,
    3413             m_jit.branchMul64(MacroAssembler::Overflow, op2GPR, resultGPR));
    3414        
    3415         if (!bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
    3416             MacroAssembler::Jump resultNonZero = m_jit.branchTest64(
    3417                 MacroAssembler::NonZero, resultGPR);
    3418             speculationCheck(
    3419                 NegativeZero, JSValueRegs(), 0,
    3420                 m_jit.branch64(MacroAssembler::LessThan, op1GPR, TrustedImm64(0)));
    3421             speculationCheck(
    3422                 NegativeZero, JSValueRegs(), 0,
    3423                 m_jit.branch64(MacroAssembler::LessThan, op2GPR, TrustedImm64(0)));
    3424             resultNonZero.link(&m_jit);
    3425         }
    3426        
    3427         int52Result(resultGPR, node);
    3428         return;
    3429     }
    3430 #endif // USE(JSVALUE64)
    34313168       
    34323169    case NumberUse: {
    … …  
    38523589        return false;
    38533590    }
    3854    
    3855 #if USE(JSVALUE64)
    3856     if (node->isBinaryUseKind(MachineIntUse)) {
    3857         compileInt52Compare(node, condition);
    3858         return false;
    3859     }
    3860 #endif // USE(JSVALUE64)
    3861    
     3591
    38623592    if (node->isBinaryUseKind(NumberUse)) {
    38633593        compileDoubleCompare(node, doubleCondition);
    … …  
    40093739        return false;
    40103740    }
    4011    
    4012 #if USE(JSVALUE64)   
    4013     case MachineIntUse: {
    4014         unsigned branchIndexInBlock = detectPeepHoleBranch();
    4015         if (branchIndexInBlock != UINT_MAX) {
    4016             Node* branchNode = m_block->at(branchIndexInBlock);
    4017             compilePeepHoleInt52Branch(node, branchNode, MacroAssembler::Equal);
    4018             use(node->child1());
    4019             use(node->child2());
    4020             m_indexInBlock = branchIndexInBlock;
    4021             m_currentNode = branchNode;
    4022             return true;
    4023         }
    4024         compileInt52Compare(node, MacroAssembler::Equal);
    4025         return false;
    4026     }
    4027 #endif // USE(JSVALUE64)
    40283741       
    40293742    case NumberUse: {
    … …  
    47814494}
    47824495
    4783 void SpeculativeJIT::speculateMachineInt(Edge edge)
    4784 {
    4785 #if USE(JSVALUE64)
    4786     if (!needsTypeCheck(edge, SpecMachineInt))
    4787         return;
    4788    
    4789     (SpeculateWhicheverInt52Operand(this, edge)).gpr();
    4790 #else // USE(JSVALUE64)
    4791     UNUSED_PARAM(edge);
    4792     UNREACHABLE_FOR_PLATFORM();
    4793 #endif // USE(JSVALUE64)
    4794 }
    4795 
    47964496void SpeculativeJIT::speculateNumber(Edge edge)
    47974497{
    4798     if (!needsTypeCheck(edge, SpecFullNumber))
     4498    if (!needsTypeCheck(edge, SpecNumber))
    47994499        return;
    48004500   
    … …  
    48044504void SpeculativeJIT::speculateRealNumber(Edge edge)
    48054505{
    4806     if (!needsTypeCheck(edge, SpecFullRealNumber))
     4506    if (!needsTypeCheck(edge, SpecRealNumber))
    48074507        return;
    48084508   
    … …  
    48104510    FPRReg fpr = operand.fpr();
    48114511    DFG_TYPE_CHECK(
    4812         JSValueRegs(), edge, SpecFullRealNumber,
     4512        JSValueRegs(), edge, SpecRealNumber,
    48134513        m_jit.branchDouble(
    48144514            MacroAssembler::DoubleNotEqualOrUnordered, fpr, fpr));
    … …  
    50724772        break;
    50734773    case KnownNumberUse:
    5074         ASSERT(!needsTypeCheck(edge, SpecFullNumber));
     4774        ASSERT(!needsTypeCheck(edge, SpecNumber));
    50754775        break;
    50764776    case KnownCellUse:
    … …  
    50824782    case Int32Use:
    50834783        speculateInt32(edge);
    5084         break;
    5085     case MachineIntUse:
    5086         speculateMachineInt(edge);
    50874784        break;
    50884785    case RealNumberUse:
Note: See TracChangeset for help on using the changeset viewer.