Changeset 163027 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Jan 29, 2014, 11:18:54 AM (12 years ago)

Author:

[email protected]

Message:

Merge the jsCStack branch
​https://bugs.webkit.org/show_bug.cgi?id=127763

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

Changes from ​http://svn.webkit.org/repository/webkit/branches/jsCStack
up to changeset 162958.

Source/WebCore:

Changes from ​http://svn.webkit.org/repository/webkit/branches/jsCStack
up to changeset 162958.

Source/WTF:

Changes from ​http://svn.webkit.org/repository/webkit/branches/jsCStack
up to changeset 162958.

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (8 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1347 +1347 @@
     
     m_jit.jitAssertHasValidCallFrame();
+    m_jit.jitAssertTagsInPlace();
+    m_jit.jitAssertArgumentCountSane();
 
     for (size_t i = 0; i < m_block->variablesAtHead.numberOfArguments(); ++i) {
@@ -1533 +1535 @@
 }
 
+void SpeculativeJIT::prepareJITCodeForTierUp()
+{
+    unsigned numberOfCalls = 0;
+    
+    for (BlockIndex blockIndex = m_jit.graph().numBlocks(); blockIndex--;) {
+        BasicBlock* block = m_jit.graph().block(blockIndex);
+        if (!block)
+            continue;
+        
+        for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+            Node* node = block->at(nodeIndex);
+            
+            switch (node->op()) {
+            case Call:
+            case Construct:
+                numberOfCalls++;
+                break;
+                
+            default:
+                break;
+            }
+        }
+    }
+    
+    m_jit.jitCode()->slowPathCalls.fill(0, numberOfCalls);
+}
+
 bool SpeculativeJIT::compile()
 {
     checkArgumentTypes();
-
+    
+    if (m_jit.graph().m_plan.willTryToTierUp)
+        prepareJITCodeForTierUp();
+    
     ASSERT(!m_currentNode);
     for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
@@ -2391 +2423 @@
     ASSERT(valueGPR != storageReg);
     MacroAssembler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, base, property);
+    if (node->arrayMode().isInBounds() && outOfBounds.isSet()) {
+        speculationCheck(OutOfBounds, JSValueSource(), 0, outOfBounds);
+        outOfBounds = MacroAssembler::Jump();
+    }
 
     switch (elementSize(type)) {
@@ -2466 +2502 @@
     
     MacroAssembler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, base, property);
+    if (node->arrayMode().isInBounds() && outOfBounds.isSet()) {
+        speculationCheck(OutOfBounds, JSValueSource(), 0, outOfBounds);
+        outOfBounds = MacroAssembler::Jump();
+    }
     
     switch (elementSize(type)) {
@@ -3430 +3470 @@
         GPRReg multiplyAnswerGPR = multiplyAnswer.gpr();
 
+        JITCompiler::JumpList done;
+        
+        if (shouldCheckOverflow(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, divisorGPR));
+        else {
+            JITCompiler::Jump denominatorNotZero = m_jit.branchTest32(JITCompiler::NonZero, divisorGPR);
+            m_jit.move(divisorGPR, quotientThenRemainderGPR);
+            done.append(m_jit.jump());
+            denominatorNotZero.link(&m_jit);
+        }
+
         m_jit.assembler().sdiv(quotientThenRemainderGPR, dividendGPR, divisorGPR);
         // FIXME: It seems like there are cases where we don't need this? What if we have
@@ -3446 +3497 @@
         }
 
+        done.link(&m_jit);
+        
         int32Result(quotientThenRemainderGPR, node);
 #elif CPU(ARM64)
@@ -3456 +3509 @@
         GPRReg multiplyAnswerGPR = multiplyAnswer.gpr();
 
+        JITCompiler::JumpList done;
+    
+        if (shouldCheckOverflow(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, divisorGPR));
+        else {
+            JITCompiler::Jump denominatorNotZero = m_jit.branchTest32(JITCompiler::NonZero, divisorGPR);
+            m_jit.move(divisorGPR, quotientThenRemainderGPR);
+            done.append(m_jit.jump());
+            denominatorNotZero.link(&m_jit);
+        }
+
         m_jit.assembler().sdiv<32>(quotientThenRemainderGPR, dividendGPR, divisorGPR);
         // FIXME: It seems like there are cases where we don't need this? What if we have
@@ -3471 +3535 @@
             numeratorPositive.link(&m_jit);
         }
+
+        done.link(&m_jit);
 
         int32Result(quotientThenRemainderGPR, node);