Changeset 284788 in webkit

Timestamp:

Oct 25, 2021, 10:02:25 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC][32bit] Don't speculate Cell on PutByVal
​https://bugs.webkit.org/show_bug.cgi?id=232242

Patch by Mikhail R. Gadelha <Mikhail R. Gadelha> on 2021-10-25
Reviewed by Yusuke Suzuki.

This patch is similar to ​https://bugs.webkit.org/show_bug.cgi?id=232052
but smaller: given that we have more registers available, we don't have
to speculate Cells anymore.

This patch removes the Cell speculation during the DFG FixUp phase and
adjust the operationPutByVal* calls to use the generic version (instead
of the Cell versions).

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGFixupPhase.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-25  Mikhail R. Gadelha  <mikhail@igalia.com>
+
+        [JSC][32bit] Don't speculate Cell on PutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=232242
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch is similar to https://bugs.webkit.org/show_bug.cgi?id=232052
+        but smaller: given that we have more registers available, we don't have
+        to speculate Cells anymore.
+
+        This patch removes the Cell speculation during the DFG FixUp phase and
+        adjust the operationPutByVal* calls to use the generic version (instead
+        of the Cell versions).
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2021-10-25  Geza Lore  <gezalore@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -1253 +1253 @@
                     }
                 }
-#if USE(JSVALUE32_64)
-                // Due to register pressure on 32-bit, we speculate cell and
-                // ignore the base-is-not-cell case entirely by letting the
-                // baseline JIT handle it.
-                fixEdge<CellUse>(child1);
-#endif
                 break;
             case Array::Int32:

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -2741 +2741 @@
                 }
 
-                SpeculateCellOperand base(this, child1); // Save a register, speculate cell. We'll probably be right.
+                JSValueOperand base(this, child1);
                 JSValueOperand property(this, child2);
                 JSValueOperand value(this, child3);
-                GPRReg baseGPR = base.gpr();
+                JSValueRegs baseRegs = base.jsValueRegs();
                 JSValueRegs propertyRegs = property.jsValueRegs();
                 JSValueRegs valueRegs = value.jsValueRegs();
@@ -2750 +2750 @@
                 flushRegisters();
                 if (node->op() == PutByValDirect)
-                    callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectCellStrict : operationPutByValDirectCellNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, valueRegs);
+                    callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs,  propertyRegs, valueRegs);
                 else
-                    callOperation(node->ecmaMode().isStrict() ? operationPutByValCellStrict : operationPutByValCellNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, valueRegs);
+                    callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs,  propertyRegs, valueRegs);
                 m_jit.exceptionCheck();