Changeset 184624 in webkit

Timestamp:

May 20, 2015 12:55:58 AM (9 years ago)

Author:

bshafiei@apple.com

Message:

Merged r184540. rdar://problem/20679710

Location:

branches/safari-601.1.32-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/SpeculatedType.cpp (modified) (3 diffs)
• bytecode/SpeculatedType.h (modified) (3 diffs)
• dfg/DFGAbstractInterpreterInlines.h (modified) (3 diffs)

branches/safari-601.1.32-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-05-20  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r184540.
+
+    2015-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+            Add SpecBoolInt32 type that means "I'm an int and I'm either 0 or 1"
+            https://bugs.webkit.org/show_bug.cgi?id=145137
+
+            Reviewed by Benjamin Poulain.
+
+            It's super useful to know if an integer value could be either zero or one. We have an
+            immediate need for this because of Int32|Boolean uses, where knowing that the Int32 is
+            either 0 or 1 means that there is no actual polymorphism if you just look at the low bit
+            (1 behaves like true, 0 behaves like false, and the low bit of 1|true is 1, and the low
+            bit of 0|false is 0).
+
+            We do this by splitting the SpecInt32 type into SpecBoolInt32 and SpecNonBoolInt32. This
+            change doesn't have any effect on behavior, yet. But it does give us the ability to
+            predict and prove when values are SpecBoolInt32; it's just we don't leverage this yet.
+
+            This is perf-neutral.
+
+            * bytecode/SpeculatedType.cpp:
+            (JSC::dumpSpeculation):
+            (JSC::speculationToAbbreviatedString):
+            (JSC::speculationFromValue):
+            * bytecode/SpeculatedType.h:
+            (JSC::isStringOrStringObjectSpeculation):
+            (JSC::isBoolInt32Speculation):
+            (JSC::isInt32Speculation):
+            (JSC::isInt32OrBooleanSpeculation):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2015-05-18  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-601.1.32-branch/Source/JavaScriptCore/bytecode/SpeculatedType.cpp

@@ -159 +159 @@
     }
     
-    if (value & SpecInt32)
+    if (value == SpecInt32)
         myOut.print("Int32");
-    else
-        isTop = false;
+    else {
+        if (value & SpecBoolInt32)
+            myOut.print("Boolint32");
+        else
+            isTop = false;
+        
+        if (value & SpecNonBoolInt32)
+            myOut.print("Nonboolint32");
+        else
+            isTop = false;
+    }
     
     if (value & SpecInt52)
@@ -250 +259 @@
     if (isCellSpeculation(prediction))
         return "<Cell>";
+    if (isBoolInt32Speculation(prediction))
+        return "<BoolInt32>";
     if (isInt32Speculation(prediction))
         return "<Int32>";
@@ -357 +368 @@
     if (value.isEmpty())
         return SpecEmpty;
-    if (value.isInt32())
-        return SpecInt32;
+    if (value.isInt32()) {
+        if (value.asInt32() & ~1)
+            return SpecNonBoolInt32;
+        return SpecBoolInt32;
+    }
     if (value.isDouble()) {
         double number = value.asNumber();

branches/safari-601.1.32-branch/Source/JavaScriptCore/bytecode/SpeculatedType.h

@@ -63 +63 @@
 static const SpeculatedType SpecCellOther          = 0x00040000; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString. FIXME: This shouldn't be part of heap-top or bytecode-top. https://bugs.webkit.org/show_bug.cgi?id=133078
 static const SpeculatedType SpecCell               = 0x0007ffff; // It's definitely a JSCell.
-static const SpeculatedType SpecInt32              = 0x00200000; // It's definitely an Int32.
+static const SpeculatedType SpecBoolInt32          = 0x00100000; // It's definitely an Int32 with value 0 or 1.
+static const SpeculatedType SpecNonBoolInt32       = 0x00200000; // It's definitely an Int32 with value other than 0 or 1.
+static const SpeculatedType SpecInt32              = 0x00300000; // It's definitely an Int32.
 static const SpeculatedType SpecInt52              = 0x00400000; // It's definitely an Int52 and we intend it to unbox it.
-static const SpeculatedType SpecMachineInt         = 0x00600000; // It's something that we can do machine int arithmetic on.
+static const SpeculatedType SpecMachineInt         = 0x00700000; // It's something that we can do machine int arithmetic on.
 static const SpeculatedType SpecInt52AsDouble      = 0x00800000; // It's definitely an Int52 and it's inside a double.
-static const SpeculatedType SpecInteger            = 0x00e00000; // It's definitely some kind of integer.
+static const SpeculatedType SpecInteger            = 0x00f00000; // It's definitely some kind of integer.
 static const SpeculatedType SpecNonIntAsDouble     = 0x01000000; // It's definitely not an Int52 but it's a real number and it's a double.
 static const SpeculatedType SpecDoubleReal         = 0x01800000; // It's definitely a non-NaN double.
@@ -75 +77 @@
 static const SpeculatedType SpecBytecodeDouble     = 0x03800000; // It's either a non-NaN or a NaN double, but it's definitely not impure NaN.
 static const SpeculatedType SpecFullDouble         = 0x07800000; // It's either a non-NaN or a NaN double.
-static const SpeculatedType SpecBytecodeRealNumber = 0x01a00000; // It's either an Int32 or a DoubleReal.
-static const SpeculatedType SpecFullRealNumber     = 0x01e00000; // It's either an Int32 or a DoubleReal, or a Int52.
-static const SpeculatedType SpecBytecodeNumber     = 0x03a00000; // It's either an Int32 or a Double, and the Double cannot be an impure NaN.
-static const SpeculatedType SpecFullNumber         = 0x07e00000; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN.
+static const SpeculatedType SpecBytecodeRealNumber = 0x01b00000; // It's either an Int32 or a DoubleReal.
+static const SpeculatedType SpecFullRealNumber     = 0x01f00000; // It's either an Int32 or a DoubleReal, or a Int52.
+static const SpeculatedType SpecBytecodeNumber     = 0x03b00000; // It's either an Int32 or a Double, and the Double cannot be an impure NaN.
+static const SpeculatedType SpecFullNumber         = 0x07f00000; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN.
 static const SpeculatedType SpecBoolean            = 0x10000000; // It's definitely a Boolean.
 static const SpeculatedType SpecOther              = 0x20000000; // It's definitely either Null or Undefined.
@@ -257 +259 @@
 }
 
+inline bool isBoolInt32Speculation(SpeculatedType value)
+{
+    return value == SpecBoolInt32;
+}
+
 inline bool isInt32Speculation(SpeculatedType value)
 {
-    return value == SpecInt32;
+    return value && !(value & ~SpecInt32);
 }
 

branches/safari-601.1.32-branch/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -258 +258 @@
             break;
         }
+        
+        if (node->op() == BitAnd
+            && (isBoolInt32Speculation(forNode(node->child1()).m_type) ||
+                isBoolInt32Speculation(forNode(node->child2()).m_type))) {
+            forNode(node).setType(SpecBoolInt32);
+            break;
+        }
+        
         forNode(node).setType(SpecInt32);
         break;
@@ -298 +306 @@
             m_state.setFoundConstants(true);
         if (value.m_type & SpecBoolean) {
-            value.merge(SpecInt32);
+            value.merge(SpecBoolInt32);
             value.filter(~SpecBoolean);
         }
@@ -336 +344 @@
                 break;
             }
+        }
+        
+        if (isBooleanSpeculation(forNode(node->child1()).m_type)) {
+            forNode(node).setType(SpecBoolInt32);
+            break;
         }