Changeset 195488 in webkit


Ignore:
Timestamp:
Jan 22, 2016 3:30:07 PM (8 years ago)
Author:
mark.lam@apple.com
Message:

We should OSR exit with Int52Overflow when we fail to make an Int52 where we expect one.
​https://bugs.webkit.org/show_bug.cgi?id=153379

Reviewed by Filip Pizlo.

In DFG::Graph::addShouldSpeculateMachineInt(), we check
!hasExitSite(add, Int52Overflow) when determining whether it's ok to speculate
that an operand is of type Int52 or not. However, the Int52Rep code that
converts a double to Int52 will OSR exit with exit kind BadType instead.
This renders the hasExitSite() check in addShouldSpeculateMachineInt() useless.
This patch fixes this by changing Int52Rep to OSR exit with exit kind
Int52Overflow instead when it fails to convert a double to an Int52.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
(JSC::DFG::SpeculativeJIT::typeCheck):
(JSC::DFG::SpeculativeJIT::usedRegisters):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::needsTypeCheck):
(JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::typeCheck):
(JSC::FTL::DFG::LowerDFGToLLVM::appendTypeCheck):
(JSC::FTL::DFG::LowerDFGToLLVM::doubleToStrictInt52):

Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r195484 r195488  
     12016-01-22  Mark Lam  <mark.lam@apple.com>
     2
     3        We should OSR exit with Int52Overflow when we fail to make an Int52 where we expect one.
     4        https://bugs.webkit.org/show_bug.cgi?id=153379
     5
     6        Reviewed by Filip Pizlo.
     7
     8        In DFG::Graph::addShouldSpeculateMachineInt(), we check
     9        !hasExitSite(add, Int52Overflow) when determining whether it's ok to speculate
     10        that an operand is of type Int52 or not.  However, the Int52Rep code that
     11        converts a double to Int52 will OSR exit with exit kind BadType instead.
     12        This renders the hasExitSite() check in addShouldSpeculateMachineInt() useless.
     13        This patch fixes this by changing Int52Rep to OSR exit with exit kind
     14        Int52Overflow instead when it fails to convert a double to an Int52.
     15
     16        * dfg/DFGSpeculativeJIT.cpp:
     17        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
     18        (JSC::DFG::SpeculativeJIT::typeCheck):
     19        (JSC::DFG::SpeculativeJIT::usedRegisters):
     20        * dfg/DFGSpeculativeJIT.h:
     21        (JSC::DFG::SpeculativeJIT::needsTypeCheck):
     22        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
     23        * dfg/DFGSpeculativeJIT64.cpp:
     24        (JSC::DFG::SpeculativeJIT::compile):
     25        * ftl/FTLLowerDFGToLLVM.cpp:
     26        (JSC::FTL::DFG::LowerDFGToLLVM::typeCheck):
     27        (JSC::FTL::DFG::LowerDFGToLLVM::appendTypeCheck):
     28        (JSC::FTL::DFG::LowerDFGToLLVM::doubleToStrictInt52):
     29
    1302016-01-22  Saam barati  <sbarati@apple.com>
    231

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r194996 r195488  
    299299}
    300300
    301 void SpeculativeJIT::typeCheck(JSValueSource source, Edge edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail)
     301void SpeculativeJIT::typeCheck(JSValueSource source, Edge edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, ExitKind exitKind)
    302302{
    303303    ASSERT(needsTypeCheck(edge, typesPassedThrough));
    304304    m_interpreter.filter(edge, typesPassedThrough);
    305     speculationCheck(BadType, source, edge.node(), jumpToFail);
     305    speculationCheck(exitKind, source, edge.node(), jumpToFail);
    306306}
    307307

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r194996 r195488  
    24482448    // Helpers for performing type checks on an edge stored in the given registers.
    24492449    bool needsTypeCheck(Edge edge, SpeculatedType typesPassedThrough) { return m_interpreter.needsTypeCheck(edge, typesPassedThrough); }
    2450     void typeCheck(JSValueSource, Edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail);
     2450    void typeCheck(JSValueSource, Edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, ExitKind = BadType);
    24512451   
    24522452    void speculateCellTypeWithoutTypeFiltering(Edge, GPRReg cellGPR, JSType);
    … …  
    33803380}
    33813381
    3382 #define DFG_TYPE_CHECK(source, edge, typesPassedThrough, jumpToFail) do { \
     3382#define DFG_TYPE_CHECK_WITH_EXIT_KIND(exitKind, source, edge, typesPassedThrough, jumpToFail) do { \
    33833383        JSValueSource _dtc_source = (source);                           \
    33843384        Edge _dtc_edge = (edge);                                        \
    … …  
    33863386        if (!needsTypeCheck(_dtc_edge, _dtc_typesPassedThrough))        \
    33873387            break;                                                      \
    3388         typeCheck(_dtc_source, _dtc_edge, _dtc_typesPassedThrough, (jumpToFail)); \
     3388        typeCheck(_dtc_source, _dtc_edge, _dtc_typesPassedThrough, (jumpToFail), exitKind); \
    33893389    } while (0)
    33903390
     3391#define DFG_TYPE_CHECK(source, edge, typesPassedThrough, jumpToFail) \
     3392    DFG_TYPE_CHECK_WITH_EXIT_KIND(BadType, source, edge, typesPassedThrough, jumpToFail)
     3393
    33913394} } // namespace JSC::DFG
    33923395

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r194863 r195488  
    22122212            callOperation(operationConvertDoubleToInt52, resultGPR, valueFPR);
    22132213           
    2214             DFG_TYPE_CHECK(
     2214            DFG_TYPE_CHECK_WITH_EXIT_KIND(Int52Overflow,
    22152215                JSValueRegs(), node->child1(), SpecInt52AsDouble,
    22162216                m_jit.branch64(

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

    r195298 r195488  
    110110// Using this instead of typeCheck() helps to reduce the load on LLVM, by creating
    111111// significantly less dead code.
    112 #define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) do { \
     112#define FTL_TYPE_CHECK_WITH_EXIT_KIND(exitKind, lowValue, highValue, typesPassedThrough, failCondition) do { \
    113113        FormattedValue _ftc_lowValue = (lowValue);                      \
    114114        Edge _ftc_highValue = (highValue);                              \
    … …  
    116116        if (!m_interpreter.needsTypeCheck(_ftc_highValue, _ftc_typesPassedThrough)) \
    117117            break;                                                      \
    118         typeCheck(_ftc_lowValue, _ftc_highValue, _ftc_typesPassedThrough, (failCondition)); \
     118        typeCheck(_ftc_lowValue, _ftc_highValue, _ftc_typesPassedThrough, (failCondition), exitKind); \
    119119    } while (false)
     120
     121#define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) \
     122    FTL_TYPE_CHECK_WITH_EXIT_KIND(BadType, lowValue, highValue, typesPassedThrough, failCondition)
    120123
    121124class LowerDFGToLLVM {
    … …  
    89758978    void typeCheck(
    89768979        FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
    8977         LValue failCondition)
    8978     {
    8979         appendTypeCheck(lowValue, highValue, typesPassedThrough, failCondition);
     8980        LValue failCondition, ExitKind exitKind = BadType)
     8981    {
     8982        appendTypeCheck(lowValue, highValue, typesPassedThrough, failCondition, exitKind);
    89808983    }
    89818984   
    89828985    void appendTypeCheck(
    89838986        FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
    8984         LValue failCondition)
     8987        LValue failCondition, ExitKind exitKind)
    89858988    {
    89868989        if (!m_interpreter.needsTypeCheck(highValue, typesPassedThrough))
    89878990            return;
    89888991        ASSERT(mayHaveTypeCheck(highValue.useKind()));
    8989         appendOSRExit(BadType, lowValue, highValue.node(), failCondition, m_origin);
     8992        appendOSRExit(exitKind, lowValue, highValue.node(), failCondition, m_origin);
    89908993        m_interpreter.filter(highValue, typesPassedThrough);
    89918994    }
    … …  
    94009403        LValue possibleResult = m_out.call(
    94019404            m_out.int64, m_out.operation(operationConvertDoubleToInt52), value);
    9402         FTL_TYPE_CHECK(
     9405        FTL_TYPE_CHECK_WITH_EXIT_KIND(Int52Overflow,
    94039406            doubleValue(value), edge, SpecInt52AsDouble,
    94049407            m_out.equal(possibleResult, m_out.constInt64(JSValue::notInt52)));
Note: See TracChangeset for help on using the changeset viewer.