Changeset 189692 in webkit


Ignore:
Timestamp:
Sep 14, 2015 1:34:21 AM (9 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r188747 - DFG should have a KnownBooleanUse for cases where we are required to know that the child is a boolean and it's not OK to speculate
​https://bugs.webkit.org/show_bug.cgi?id=148286

Reviewed by Benjamin Poulain.

This enables us to ensure that the Branch or LogicalNot after an effectful CompareXYZ can
be marked as !mayExit(). I need that for ​https://bugs.webkit.org/show_bug.cgi?id=145204.

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::observeUseKindOnNode):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculate):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

  • dfg/DFGUseKind.cpp:

(WTF::printInternal):

  • dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::shouldNotHaveTypeCheck):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::boolify):
(JSC::FTL::DFG::LowerDFGToLLVM::lowBoolean):

Location:
releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/ChangeLog

    r189691 r189692  
     12015-08-20  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG should have a KnownBooleanUse for cases where we are required to know that the child is a boolean and it's not OK to speculate
     4        https://bugs.webkit.org/show_bug.cgi?id=148286
     5
     6        Reviewed by Benjamin Poulain.
     7
     8        This enables us to ensure that the Branch or LogicalNot after an effectful CompareXYZ can
     9        be marked as !mayExit(). I need that for https://bugs.webkit.org/show_bug.cgi?id=145204.
     10
     11        * dfg/DFGFixupPhase.cpp:
     12        (JSC::DFG::FixupPhase::fixupNode):
     13        (JSC::DFG::FixupPhase::observeUseKindOnNode):
     14        * dfg/DFGSafeToExecute.h:
     15        (JSC::DFG::SafeToExecuteEdge::operator()):
     16        * dfg/DFGSpeculativeJIT.cpp:
     17        (JSC::DFG::SpeculativeJIT::speculate):
     18        * dfg/DFGSpeculativeJIT.h:
     19        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
     20        * dfg/DFGSpeculativeJIT32_64.cpp:
     21        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
     22        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
     23        (JSC::DFG::SpeculativeJIT::emitBranch):
     24        * dfg/DFGSpeculativeJIT64.cpp:
     25        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
     26        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
     27        (JSC::DFG::SpeculativeJIT::emitBranch):
     28        * dfg/DFGUseKind.cpp:
     29        (WTF::printInternal):
     30        * dfg/DFGUseKind.h:
     31        (JSC::DFG::typeFilterFor):
     32        (JSC::DFG::shouldNotHaveTypeCheck):
     33        * ftl/FTLCapabilities.cpp:
     34        (JSC::FTL::canCompile):
     35        * ftl/FTLLowerDFGToLLVM.cpp:
     36        (JSC::FTL::DFG::LowerDFGToLLVM::boolify):
     37        (JSC::FTL::DFG::LowerDFGToLLVM::lowBoolean):
     38
    1392015-08-20  Filip Pizlo  <fpizlo@apple.com>
    240

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r188464 r189692  
    357357           
    358358        case LogicalNot: {
    359             if (node->child1()->shouldSpeculateBoolean())
    360                 fixEdge<BooleanUse>(node->child1());
    361             else if (node->child1()->shouldSpeculateObjectOrOther())
     359            if (node->child1()->shouldSpeculateBoolean()) {
     360                if (node->child1()->result() == NodeResultBoolean) {
     361                    // This is necessary in case we have a bytecode instruction implemented by:
     362                    //
     363                    // a: CompareEq(...)
     364                    // b: LogicalNot(@a)
     365                    //
     366                    // In that case, CompareEq might have a side-effect. Then, we need to make
     367                    // sure that we know that Branch does not exit.
     368                    fixEdge<KnownBooleanUse>(node->child1());
     369                } else
     370                    fixEdge<BooleanUse>(node->child1());
     371            } else if (node->child1()->shouldSpeculateObjectOrOther())
    362372                fixEdge<ObjectOrOtherUse>(node->child1());
    363373            else if (node->child1()->shouldSpeculateInt32OrBoolean())
    … …  
    797807           
    798808        case Branch: {
    799             if (node->child1()->shouldSpeculateBoolean())
    800                 fixEdge<BooleanUse>(node->child1());
    801             else if (node->child1()->shouldSpeculateObjectOrOther())
     809            if (node->child1()->shouldSpeculateBoolean()) {
     810                if (node->child1()->result() == NodeResultBoolean) {
     811                    // This is necessary in case we have a bytecode instruction implemented by:
     812                    //
     813                    // a: CompareEq(...)
     814                    // b: Branch(@a)
     815                    //
     816                    // In that case, CompareEq might have a side-effect. Then, we need to make
     817                    // sure that we know that Branch does not exit.
     818                    fixEdge<KnownBooleanUse>(node->child1());
     819                } else
     820                    fixEdge<BooleanUse>(node->child1());
     821            } else if (node->child1()->shouldSpeculateObjectOrOther())
    802822                fixEdge<ObjectOrOtherUse>(node->child1());
    803823            else if (node->child1()->shouldSpeculateInt32OrBoolean())
    … …  
    17441764        switch (useKind) {
    17451765        case Int32Use:
     1766        case KnownInt32Use:
    17461767            if (alwaysUnboxSimplePrimitives()
    17471768                || isInt32Speculation(variable->prediction()))
    … …  
    17561777            break;
    17571778        case BooleanUse:
     1779        case KnownBooleanUse:
    17581780            if (alwaysUnboxSimplePrimitives()
    17591781                || isBooleanSpeculation(variable->prediction()))

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r188299 r189692  
    7373        case KnownInt32Use:
    7474            if (m_state.forNode(edge).m_type & ~SpecInt32)
     75                m_result = false;
     76            return;
     77
     78        case KnownBooleanUse:
     79            if (m_state.forNode(edge).m_type & ~SpecBoolean)
    7580                m_result = false;
    7681            return;

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r188464 r189692  
    58655865        speculateBoolean(edge);
    58665866        break;
     5867    case KnownBooleanUse:
     5868        ASSERT(!needsTypeCheck(edge, SpecBoolean));
     5869        break;
    58675870    case CellUse:
    58685871        speculateCell(edge);

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r188299 r189692  
    32273227    {
    32283228        ASSERT(m_jit);
    3229         ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse);
     3229        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse || edge.useKind() == KnownBooleanUse);
    32303230        if (jit->isFilled(node()))
    32313231            gpr();

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r188464 r189692  
    10561056    AbstractValue& value = m_state.forNode(edge);
    10571057    SpeculatedType type = value.m_type;
     1058    ASSERT(edge.useKind() != KnownBooleanUse || !(value.m_type & ~SpecBoolean));
    10581059
    10591060    m_interpreter.filter(value, SpecBoolean);
    … …  
    14861487{
    14871488    switch (node->child1().useKind()) {
    1488     case BooleanUse: {
     1489    case BooleanUse:
     1490    case KnownBooleanUse: {
    14891491        SpeculateBooleanOperand value(this, node->child1());
    14901492        GPRTemporary result(this, Reuse, value);
    … …  
    16051607
    16061608    switch (node->child1().useKind()) {
    1607     case BooleanUse: {
     1609    case BooleanUse:
     1610    case KnownBooleanUse: {
    16081611        SpeculateBooleanOperand value(this, node->child1());
    16091612        MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r188464 r189692  
    11681168    AbstractValue& value = m_state.forNode(edge);
    11691169    SpeculatedType type = value.m_type;
     1170    ASSERT(edge.useKind() != KnownBooleanUse || !(value.m_type & ~SpecBoolean));
    11701171
    11711172    m_interpreter.filter(value, SpecBoolean);
    … …  
    16461647    }
    16471648   
    1648     case BooleanUse: {
     1649    case BooleanUse:
     1650    case KnownBooleanUse: {
    16491651        if (!needsTypeCheck(node->child1(), SpecBoolean)) {
    16501652            SpeculateBooleanOperand value(this, node->child1());
    … …  
    17981800
    17991801    case UntypedUse:
    1800     case BooleanUse: {
     1802    case BooleanUse:
     1803    case KnownBooleanUse: {
    18011804        JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
    18021805        GPRReg valueGPR = value.gpr();
    18031806       
    1804         if (node->child1().useKind() == BooleanUse) {
     1807        if (node->child1().useKind() == BooleanUse || node->child1().useKind() == KnownBooleanUse) {
    18051808            if (!needsTypeCheck(node->child1(), SpecBoolean)) {
    18061809                MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGUseKind.cpp

    r188299 r189692  
    7171        out.print("Boolean");
    7272        return;
     73    case KnownBooleanUse:
     74        out.print("KnownBoolean");
     75        return;
    7376    case CellUse:
    7477        out.print("Cell");

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/dfg/DFGUseKind.h

    r188299 r189692  
    4949    RealNumberUse,
    5050    BooleanUse,
     51    KnownBooleanUse,
    5152    CellUse,
    5253    KnownCellUse,
    … …  
    102103        return SpecInt52AsDouble;
    103104    case BooleanUse:
     105    case KnownBooleanUse:
    104106        return SpecBoolean;
    105107    case CellUse:
    … …  
    146148    case KnownCellUse:
    147149    case KnownStringUse:
     150    case KnownBooleanUse:
    148151    case Int52RepUse:
    149152    case DoubleRepUse:

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r188464 r189692  
    409409                case DoubleRepRealUse:
    410410                case BooleanUse:
     411                case KnownBooleanUse:
    411412                case CellUse:
    412413                case KnownCellUse:

  • releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

    r188464 r189692  
    60776077        switch (edge.useKind()) {
    60786078        case BooleanUse:
     6079        case KnownBooleanUse:
    60796080            return lowBoolean(edge);
    60806081        case Int32Use:
    … …  
    70677068    LValue lowBoolean(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
    70687069    {
    7069         ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse);
     7070        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse || edge.useKind() == KnownBooleanUse);
    70707071       
    70717072        if (edge->hasConstant()) {
Note: See TracChangeset for help on using the changeset viewer.