Changeset 93010 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Aug 12, 2011, 4:27:45 PM (14 years ago)

Author:

[email protected]

Message:

DFG JIT has inconsistent use of boxDouble and unboxDouble,
inconsistent use of assertions regarding doubles, and those
assertions are not turned on in debug builds
​https://bugs.webkit.org/show_bug.cgi?id=66160

Reviewed by Gavin Barraclough.

JIT assertions are now turned on in debug builds. JIT
assertions are now used for boxing and unboxing doubles, and boxing
and unboxing no longer involves code duplication.

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::fillDouble):

• dfg/DFGJITCodeGenerator.h:

(JSC::DFG::JITCodeGenerator::boxDouble):
(JSC::DFG::JITCodeGenerator::unboxDouble):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::fillNumericToDouble):
(JSC::DFG::GeneralizedRegister::moveTo):
(JSC::DFG::GeneralizedRegister::swapWith):

• dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::boxDouble):
(JSC::DFG::JITCompiler::unboxDouble):

• dfg/DFGNode.h:
• dfg/DFGNonSpeculativeJIT.cpp:

(JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
(JSC::DFG::NonSpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::convertToDouble):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -242 +242 @@
         // First, if we get here we have a double encoded as a JSValue
         m_jit.move(jsValueGpr, tempGpr);
-        m_jit.addPtr(GPRInfo::tagTypeNumberRegister, tempGpr);
-        m_jit.movePtrToDouble(tempGpr, fpr);
+        unboxDouble(tempGpr, fpr);
         JITCompiler::Jump hasUnboxedDouble = m_jit.jump();
 
@@ -394 +393 @@
     
     m_jit.move(value, tmp);
-    m_jit.addPtr(GPRInfo::tagTypeNumberRegister, tmp);
-    m_jit.movePtrToDouble(tmp, result);
+    unboxDouble(tmp, result);
     
     JITCompiler::Jump done = m_jit.jump();