Changeset 165098 in webkit for trunk/Source/JavaScriptCore/dfg


Ignore:
Timestamp:
Mar 4, 2014, 11:25:02 PM (11 years ago)
Author:
[email protected]
Message:

Unreviewed, rolling out r165085.
​http://trac.webkit.org/changeset/165085
​https://bugs.webkit.org/show_bug.cgi?id=129729

Broke imported/w3c/html-templates/template-element/template-
content.html (Requested by ap on #webkit).

Source/JavaScriptCore:

  • bytecode/SpeculatedType.cpp:

(JSC::speculationToAbbreviatedString):

  • bytecode/SpeculatedType.h:
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

  • dfg/DFGArrayMode.h:
  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):

  • dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateBoolean):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculate):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:
  • dfg/DFGSpeculativeJIT64.cpp:
  • dfg/DFGUseKind.cpp:

(WTF::printInternal):

  • dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::speculate):

  • tests/stress/float32-array-out-of-bounds.js: Removed.
  • tests/stress/weird-equality-folding-cases.js: Removed.

LayoutTests:

  • js/regress/fold-strict-eq-expected.txt: Removed.
  • js/regress/fold-strict-eq.html: Removed.
  • js/regress/misc-strict-eq-expected.txt: Removed.
  • js/regress/misc-strict-eq.html: Removed.
  • js/regress/script-tests/fold-strict-eq.js: Removed.
  • js/regress/script-tests/misc-strict-eq.js: Removed.
Location:
trunk/Source/JavaScriptCore/dfg
Files:
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r165085 r165098  
    918918            SpeculatedType leftType = forNode(node->child1()).m_type;
    919919            SpeculatedType rightType = forNode(node->child2()).m_type;
    920             if (!valuesCouldBeEqual(leftType, rightType)) {
     920            if ((isInt32Speculation(leftType) && isOtherSpeculation(rightType))
     921                || (isOtherSpeculation(leftType) && isInt32Speculation(rightType))) {
    921922                setConstant(node, jsBoolean(false));
    922923                break;
    … …  
    943944        JSValue right = forNode(rightNode).value();
    944945        if (left && right) {
     946            if (left.isNumber() && right.isNumber()) {
     947                setConstant(node, jsBoolean(left.asNumber() == right.asNumber()));
     948                break;
     949            }
    945950            if (left.isString() && right.isString()) {
    946                 // We need this case because JSValue::strictEqual is otherwise too racy for
    947                 // string comparisons.
    948951                const StringImpl* a = asString(left)->tryGetValueImpl();
    949952                const StringImpl* b = asString(right)->tryGetValueImpl();
    … …  
    952955                    break;
    953956                }
    954             } else {
    955                 setConstant(node, jsBoolean(JSValue::strictEqual(0, left, right)));
    956                 break;
    957             }
    958         }
    959        
    960         SpeculatedType leftLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(leftNode).m_type);
    961         SpeculatedType rightLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(rightNode).m_type);
    962         if (!(leftLUB & rightLUB)) {
    963             setConstant(node, jsBoolean(false));
    964             break;
    965         }
    966        
     957            }
     958        }
    967959        forNode(node).setType(SpecBoolean);
    968960        node->setCanExit(true); // This is overly conservative.

  • trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

    r165085 r165098  
    11/*
    2  * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    133133
    134134ArrayMode ArrayMode::refine(
    135     Graph& graph, Node* node,
     135    Graph& graph, CodeOrigin codeOrigin,
    136136    SpeculatedType base, SpeculatedType index, SpeculatedType value,
    137137    NodeFlags flags) const
    … …  
    200200       
    201201        ArrayMode result;
    202         switch (node->op()) {
    203         case PutByVal:
    204             if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
    205                 result = withSpeculation(Array::OutOfBounds);
    206             else
    207                 result = withSpeculation(Array::InBounds);
    208             break;
    209            
    210         default:
     202        if (graph.hasExitSite(codeOrigin, OutOfBounds) || !isInBounds())
     203            result = withSpeculation(Array::OutOfBounds);
     204        else
    211205            result = withSpeculation(Array::InBounds);
    212             break;
    213         }
    214206       
    215207        if (isInt8ArraySpeculation(base))

  • trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

    r165085 r165098  
    11/*
    2  * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    221221    }
    222222   
    223     ArrayMode refine(Graph&, Node*, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone, NodeFlags = 0) const;
     223    ArrayMode refine(Graph&, CodeOrigin, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone, NodeFlags = 0) const;
    224224   
    225225    bool alreadyChecked(Graph&, Node*, AbstractValue&) const;

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r165085 r165098  
    433433                break;
    434434            }
    435             if (node->child1()->shouldSpeculateMisc() && node->child2()->shouldSpeculateMisc()) {
    436                 fixEdge<MiscUse>(node->child1());
    437                 fixEdge<MiscUse>(node->child2());
    438                 break;
    439             }
    440435            break;
    441436        }
    … …  
    458453            node->setArrayMode(
    459454                node->arrayMode().refine(
    460                     m_graph, node,
     455                    m_graph, node->origin.semantic,
    461456                    node->child1()->prediction(),
    462457                    node->child2()->prediction(),
    … …  
    516511            node->setArrayMode(
    517512                node->arrayMode().refine(
    518                     m_graph, node,
     513                    m_graph, node->origin.semantic,
    519514                    child1->prediction(),
    520515                    child2->prediction(),
    … …  
    602597            node->setArrayMode(
    603598                node->arrayMode().refine(
    604                     m_graph, node,
     599                    m_graph, node->origin.semantic,
    605600                    node->child1()->prediction() & SpecCell,
    606601                    SpecInt32,
    … …  
    17561751           
    17571752        arrayMode = arrayMode.refine(
    1758             m_graph, node, node->child1()->prediction(), node->prediction());
     1753            m_graph, node->origin.semantic, node->child1()->prediction(), node->prediction());
    17591754           
    17601755        if (arrayMode.type() == Array::Generic) {

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r165085 r165098  
    14001400        return isBooleanSpeculation(prediction());
    14011401    }
    1402    
    1403     bool shouldSpeculateMisc()
    1404     {
    1405         return isMiscSpeculation(prediction());
    1406     }
    14071402   
    14081403    bool shouldSpeculateStringIdent()

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r165085 r165098  
    6060        case NotCellUse:
    6161        case OtherUse:
    62         case MiscUse:
    6362        case MachineIntUse:
    6463            return;

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r165085 r165098  
    38033803    }
    38043804       
    3805     case MiscUse: {
    3806         compileMiscStrictEq(node);
    3807         return false;
    3808     }
    3809        
    38103805    case UntypedUse: {
    38113806        return nonSpeculativeStrictEq(node);
    … …  
    48364831}
    48374832
    4838 void SpeculativeJIT::speculateMisc(Edge edge, JSValueRegs regs)
    4839 {
    4840 #if USE(JSVALUE64)
    4841     typeCheck(
    4842         regs, edge, SpecMisc,
    4843         m_jit.branch64(MacroAssembler::Above, regs.gpr(), MacroAssembler::TrustedImm64(TagBitTypeOther | TagBitBool | TagBitUndefined)));
    4844 #else
    4845     typeCheck(
    4846         regs, edge, SpecMisc | SpecInt32,
    4847         m_jit.branch32(MacroAssembler::Equal, regs.tagGPR(), MacroAssembler::TrustedImm32(JSValue::Int32Tag)));
    4848     typeCheck(
    4849         regs, edge, SpecMisc,
    4850         m_jit.branch32(MacroAssembler::Below, regs.tagGPR(), MacroAssembler::TrustedImm32(JSValue::UndefinedTag)));
    4851 #endif
    4852 }
    4853 
    4854 void SpeculativeJIT::speculateMisc(Edge edge)
    4855 {
    4856     if (!needsTypeCheck(edge, SpecMisc))
    4857         return;
    4858    
    4859     JSValueOperand operand(this, edge, ManualOperandSpeculation);
    4860     speculateMisc(edge, operand.jsValueRegs());
    4861 }
    4862 
    48634833void SpeculativeJIT::speculate(Node*, Edge edge)
    48644834{
    … …  
    49224892    case OtherUse:
    49234893        speculateOther(edge);
    4924         break;
    4925     case MiscUse:
    4926         speculateMisc(edge);
    49274894        break;
    49284895    default:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r165085 r165098  
    19861986    void compileStringIdentEquality(Node*);
    19871987    void compileStringZeroLength(Node*);
    1988     void compileMiscStrictEq(Node*);
    19891988
    19901989    void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
    … …  
    22052204    void speculateNotCell(Edge);
    22062205    void speculateOther(Edge);
    2207     void speculateMisc(Edge, JSValueRegs);
    2208     void speculateMisc(Edge);
    22092206    void speculate(Node*, Edge);
    22102207   

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r165085 r165098  
    612612
    613613    booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
    614 }
    615 
    616 void SpeculativeJIT::compileMiscStrictEq(Node* node)
    617 {
    618     JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
    619     JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
    620     GPRTemporary result(this);
    621    
    622     speculateMisc(node->child1(), op1.jsValueRegs());
    623     speculateMisc(node->child2(), op2.jsValueRegs());
    624    
    625     m_jit.move(TrustedImm32(0), result.gpr());
    626     JITCompiler::Jump notEqual = m_jit.branch32(JITCompiler::NotEqual, op1.tagGPR(), op2.tagGPR());
    627     m_jit.compare32(JITCompiler::Equal, op1.payloadGPR(), op2.payloadGPR(), result.gpr());
    628     notEqual.link(&m_jit);
    629     booleanResult(result.gpr(), node);
    630614}
    631615

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r165085 r165098  
    647647   
    648648    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean, UseChildrenCalledExplicitly);
    649 }
    650 
    651 void SpeculativeJIT::compileMiscStrictEq(Node* node)
    652 {
    653     JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
    654     JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
    655     GPRTemporary result(this);
    656    
    657     speculateMisc(node->child1(), op1.jsValueRegs());
    658     speculateMisc(node->child2(), op2.jsValueRegs());
    659    
    660     m_jit.compare32(JITCompiler::Equal, op1.gpr(), op2.gpr(), result.gpr());
    661     m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
    662     jsValueResult(result.gpr(), node, DataFormatJSBoolean);
    663649}
    664650

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp

    r165085 r165098  
    11/*
    2  * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    9898        out.print("Other");
    9999        break;
    100     case MiscUse:
    101         out.print("Misc");
    102         break;
    103100    default:
    104101        RELEASE_ASSERT_NOT_REACHED();

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.h

    r165085 r165098  
    11/*
    2  * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5555    NotCellUse,
    5656    OtherUse,
    57     MiscUse,
    5857    LastUseKind // Must always be the last entry in the enum, as it is used to denote the number of enum elements.
    5958};
    … …  
    9897    case OtherUse:
    9998        return SpecOther;
    100     case MiscUse:
    101         return SpecMisc;
    10299    default:
    103100        RELEASE_ASSERT_NOT_REACHED();
Note: See TracChangeset for help on using the changeset viewer.