Changeset 94914 in webkit for trunk/Source/JavaScriptCore/dfg

Timestamp:

Sep 10, 2011, 2:23:45 PM (14 years ago)

Author:

[email protected]

Message:

DFG JIT completely undoes speculative compilation even in the case of
a partial static speculation failure
​https://bugs.webkit.org/show_bug.cgi?id=67798

Reviewed by Geoffrey Garen.

This is a regression with static speculation, so it is turned off by
default. But it is a necessary prerequisite for further work on
dynamic speculation.

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::clearGenerationInfo):

• dfg/DFGJITCodeGenerator.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):

Location:

trunk/Source/JavaScriptCore/dfg

Files:

• DFGJITCodeGenerator.cpp (modified) (1 diff)
• DFGJITCodeGenerator.h (modified) (1 diff)
• DFGJITCompiler.cpp (modified) (1 diff)
• DFGSpeculativeJIT.cpp (modified) (5 diffs)
• DFGSpeculativeJIT.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp

@@ -35 +35 @@
 namespace JSC { namespace DFG {
 
+void JITCodeGenerator::clearGenerationInfo()
+{
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i)
+        m_generationInfo[i] = GenerationInfo();
+    m_gprs = RegisterBank<GPRInfo>();
+    m_fprs = RegisterBank<FPRInfo>();
+}
+
 GPRReg JITCodeGenerator::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat)
 {

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h

@@ -203 +203 @@
     {
     }
+    
+    void clearGenerationInfo();
 
     // These methods are used when generating 'unexpected'

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -852 +852 @@
         linkSpeculationChecks(speculative, nonSpeculative);
     } else {
-#if DFG_DEBUG_VERBOSE
-        fprintf(stderr, "SpeculativeJIT was terminated.\n");
-#endif
-
         // If compilation through the SpeculativeJIT failed, throw away the code we generated.
         m_calls.clear();

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -40 +40 @@
     switch (info.registerFormat()) {
     case DataFormatNone: {
-        GPRReg gpr = allocate();
-
-        if (node.isConstant()) {
-            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-            if (isInt32Constant(nodeIndex)) {
-                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
-                info.fillInteger(gpr);
-                returnFormat = DataFormatInteger;
-                return gpr;
-            }
+        if (node.isConstant() && !isInt32Constant(nodeIndex)) {
             terminateSpeculativeExecution();
             returnFormat = DataFormatInteger;
             return allocate();
+        }
+        
+        GPRReg gpr = allocate();
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            ASSERT(isInt32Constant(nodeIndex));
+            m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
+            info.fillInteger(gpr);
+            returnFormat = DataFormatInteger;
+            return gpr;
         } else {
             DataFormat spillFormat = info.spillFormat();
@@ -1375 +1377 @@
 void SpeculativeJIT::compile(BasicBlock& block)
 {
+    ASSERT(m_compileOkay);
     ASSERT(m_compileIndex == block.begin);
     m_blockHeads[m_block] = m_jit.label();
@@ -1385 +1388 @@
         if (!node.shouldGenerate())
             continue;
-
+        
 #if DFG_DEBUG_VERBOSE
         fprintf(stderr, "SpeculativeJIT generating Node @%d at JIT offset 0x%x   ", (int)m_compileIndex, m_jit.debugOffset());
@@ -1394 +1397 @@
         checkConsistency();
         compile(node);
-        if (!m_compileOkay)
+        if (!m_compileOkay) {
+#if ENABLE(DYNAMIC_TERMINATE_SPECULATION)
+            m_compileOkay = true;
+            m_compileIndex = block.end;
+            clearGenerationInfo();
+#endif
             return;
+        }
 #if DFG_DEBUG_VERBOSE
         if (node.hasResult())
@@ -1446 +1455 @@
     for (m_block = 0; m_block < m_jit.graph().m_blocks.size(); ++m_block) {
         compile(*m_jit.graph().m_blocks[m_block]);
+#if !ENABLE(DYNAMIC_OPTIMIZATION)
         if (!m_compileOkay)
             return false;
+#endif
     }
     linkBranches();

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -218 +218 @@
     void terminateSpeculativeExecution()
     {
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "SpeculativeJIT was terminated.\n");
+#endif
+#if ENABLE(DYNAMIC_TERMINATE_SPECULATION)
+        if (!m_compileOkay)
+            return;
+        speculationCheck(m_jit.jump());
         m_compileOkay = false;
+#else
+        // Under static speculation, it's more profitable to give up entirely at this
+        // point.
+        m_compileOkay = false;
+#endif
     }