Changeset 223584 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Oct 17, 2017, 4:34:29 PM (8 years ago)

Author:

Ryan Haddad

Message:

Unreviewed, rolling out r223523.

A test for this change is failing on debug JSC bots.

Reverted changeset:

"[JSC] proto getter should be fast"
​https://bugs.webkit.org/show_bug.cgi?id=178067
​https://trac.webkit.org/changeset/223523

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -9187 +9187 @@
 }
 
-void SpeculativeJIT::speculateFunction(Edge edge, GPRReg cell)
-{
-    speculateCellType(edge, cell, SpecFunction, JSFunctionType);
-}
-
 void SpeculativeJIT::speculateFunction(Edge edge)
 {
@@ -9198 +9193 @@
     
     SpeculateCellOperand operand(this, edge);
-    speculateFunction(edge, operand.gpr());
-}
-
-void SpeculativeJIT::speculateFinalObject(Edge edge, GPRReg cell)
-{
-    speculateCellType(edge, cell, SpecFinalObject, FinalObjectType);
+    speculateCellType(edge, operand.gpr(), SpecFunction, JSFunctionType);
 }
 
@@ -9212 +9202 @@
     
     SpeculateCellOperand operand(this, edge);
-    speculateFinalObject(edge, operand.gpr());
+    speculateCellType(edge, operand.gpr(), SpecFinalObject, FinalObjectType);
 }
 
@@ -10778 +10768 @@
 }
 
-void SpeculativeJIT::compileGetPrototypeOf(Node* node)
-{
-    switch (node->child1().useKind()) {
-    case ArrayUse:
-    case FunctionUse:
-    case FinalObjectUse: {
-        SpeculateCellOperand object(this, node->child1());
-        GPRTemporary temp(this);
-        GPRTemporary temp2(this);
-
-        GPRReg objectGPR = object.gpr();
-        GPRReg tempGPR = temp.gpr();
-        GPRReg temp2GPR = temp2.gpr();
-
-        switch (node->child1().useKind()) {
-        case ArrayUse:
-            speculateArray(node->child1(), objectGPR);
-            break;
-        case FunctionUse:
-            speculateFunction(node->child1(), objectGPR);
-            break;
-        case FinalObjectUse:
-            speculateFinalObject(node->child1(), objectGPR);
-            break;
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-            break;
-        }
-
-        m_jit.emitLoadStructure(*m_jit.vm(), objectGPR, tempGPR, temp2GPR);
-
-        AbstractValue& value = m_state.forNode(node->child1());
-        if ((value.m_type && !(value.m_type & ~SpecObject)) && value.m_structure.isFinite()) {
-            bool hasPolyProto = false;
-            bool hasMonoProto = false;
-            value.m_structure.forEach([&] (RegisteredStructure structure) {
-                if (structure->hasPolyProto())
-                    hasPolyProto = true;
-                else
-                    hasMonoProto = true;
-            });
-
-            if (hasMonoProto && !hasPolyProto) {
-#if USE(JSVALUE64)
-                m_jit.load64(MacroAssembler::Address(tempGPR, Structure::prototypeOffset()), tempGPR);
-                jsValueResult(tempGPR, node);
-#else
-                m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + TagOffset), temp2GPR);
-                m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + PayloadOffset), tempGPR);
-                jsValueResult(temp2GPR, tempGPR, node);
-#endif
-                return;
-            }
-
-            if (hasPolyProto && !hasMonoProto) {
-#if USE(JSVALUE64)
-                m_jit.load64(MacroAssembler::Address(tempGPR, Structure::prototypeOffset()), tempGPR);
-                m_jit.zeroExtend32ToPtr(tempGPR, tempGPR);
-                m_jit.load64(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage()), tempGPR);
-                jsValueResult(tempGPR, node);
-#else
-                m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + PayloadOffset), tempGPR);
-                m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + TagOffset), temp2GPR);
-                m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + PayloadOffset), tempGPR);
-                jsValueResult(temp2GPR, tempGPR, node);
-#endif
-                return;
-            }
-        }
-
-#if USE(JSVALUE64)
-        m_jit.load64(MacroAssembler::Address(tempGPR, Structure::prototypeOffset()), tempGPR);
-        auto isMonoProto = m_jit.branchIfNotInt32(JSValueRegs(tempGPR));
-        m_jit.zeroExtend32ToPtr(tempGPR, tempGPR);
-        m_jit.load64(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage()), tempGPR);
-        isMonoProto.link(&m_jit);
-        jsValueResult(tempGPR, node);
-#else
-        m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + TagOffset), temp2GPR);
-        m_jit.load32(MacroAssembler::Address(tempGPR, Structure::prototypeOffset() + PayloadOffset), tempGPR);
-        auto isMonoProto = m_jit.branch32(CCallHelpers::NotEqual, temp2GPR, TrustedImm32(JSValue::Int32Tag));
-        m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + TagOffset), temp2GPR);
-        m_jit.load32(JITCompiler::BaseIndex(objectGPR, tempGPR, JITCompiler::TimesEight, JSObject::offsetOfInlineStorage() + PayloadOffset), tempGPR);
-        isMonoProto.link(&m_jit);
-        jsValueResult(temp2GPR, tempGPR, node);
-#endif
-        return;
-    }
-    case ObjectUse: {
-        SpeculateCellOperand value(this, node->child1());
-        JSValueRegsTemporary result(this);
-
-        GPRReg valueGPR = value.gpr();
-        JSValueRegs resultRegs = result.regs();
-
-        speculateObject(node->child1(), valueGPR);
-
-        flushRegisters();
-        callOperation(operationGetPrototypeOfObject, resultRegs, valueGPR);
-        m_jit.exceptionCheck();
-        jsValueResult(resultRegs, node);
-        return;
-    }
-    default: {
-        JSValueOperand value(this, node->child1());
-        JSValueRegsTemporary result(this);
-
-        JSValueRegs valueRegs = value.jsValueRegs();
-        JSValueRegs resultRegs = result.regs();
-
-        flushRegisters();
-        callOperation(operationGetPrototypeOf, resultRegs, valueRegs);
-        m_jit.exceptionCheck();
-        jsValueResult(resultRegs, node);
-        return;
-    }
-    }
-}
-
 } } // namespace JSC::DFG