Changeset 207369 in webkit for trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Timestamp:

Oct 14, 2016, 7:19:16 PM (9 years ago)

Author:

[email protected]

Message:

[JSC] op_negate should with any type
​https://bugs.webkit.org/show_bug.cgi?id=162587

Patch by Benjamin Poulain <​[email protected]> on 2016-10-14
Reviewed by Saam Barati.

JSTests:

• stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.

Cover OSR Exits when converting Math.abs() into ArithNegate.

• stress/arith-negate-on-various-types.js: Added.

Cover ArithNegate with all types.

Source/JavaScriptCore:

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
ArithNegate is quite simple. If the input is double, the output
is double. The other cases are set from the LLInt slow case.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

Tweak a bit the IntegerRangeOptimizationPhase when simplifying
ArithAbs to ArithNegate.
We should not do the conversion if the target nodes OSR Exits
on different input than the source node.

In particular, Checked ArithNegate exits on zero while
ArithAbs has not problem with it.
Unchecked ArithAbs() do not OSR Exit on INT_MIN, ArithNeg
should not either.

• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileMathIC):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):

• jit/JITNegGenerator.cpp:

(JSC::JITNegGenerator::generateFastPath):

• jit/JITOperations.cpp:

Add result profiling in baseline to have types we can use
in DFG and FTL.

File:

• trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1253 +1253 @@
                         break;
                     }
-                    if (maxValue <= 0) {
+                    bool absIsUnchecked = !shouldCheckOverflow(node->arithMode());
+                    if (maxValue < 0 || (absIsUnchecked && maxValue <= 0)) {
                         node->convertToArithNegate();
-                        if (minValue > std::numeric_limits<int>::min())
+                        if (absIsUnchecked || minValue > std::numeric_limits<int>::min())
                             node->setArithMode(Arith::Unchecked);
                         changed = true;