Changeset 193793 in webkit
- Timestamp:
- Dec 8, 2015 4:12:48 PM (8 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r193788 r193793 1 2015-12-08 Mark Lam <mark.lam@apple.com> 2 3 DFG and FTL should be resilient against cases where both snippet operands are constant. 4 https://bugs.webkit.org/show_bug.cgi?id=152017 5 6 Reviewed by Michael Saboff. 7 8 The DFG front end may not always constant fold cases where both operands are 9 constant. As a result, the DFG and FTL back ends needs to be resilient against 10 this when using snippet generators since the generators do not support the case 11 where both operands are constant. The strategy for handling this 2 const operands 12 case is to treat at least one of them as a variable if both are constant. 13 14 * dfg/DFGSpeculativeJIT.cpp: 15 (JSC::DFG::SpeculativeJIT::compileValueAdd): 16 - Also remove the case for folding 2 constant operands. It is the front end's 17 job to do so, not the back end here. 18 19 (JSC::DFG::SpeculativeJIT::compileArithSub): 20 (JSC::DFG::SpeculativeJIT::compileArithMul): 21 * ftl/FTLLowerDFGToLLVM.cpp: 22 (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd): 23 (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul): 24 1 25 2015-12-08 Mark Lam <mark.lam@apple.com> 2 26 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r193781 r193793 2789 2789 void SpeculativeJIT::compileValueAdd(Node* node) 2790 2790 { 2791 if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node())) { 2792 JSValueOperand left(this, node->child1()); 2793 JSValueOperand right(this, node->child2()); 2791 Edge& leftChild = node->child1(); 2792 Edge& rightChild = node->child2(); 2793 2794 if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) { 2795 JSValueOperand left(this, leftChild); 2796 JSValueOperand right(this, rightChild); 2794 2797 JSValueRegs leftRegs = left.jsValueRegs(); 2795 2798 JSValueRegs rightRegs = right.jsValueRegs(); … … 2806 2809 m_jit.exceptionCheck(); 2807 2810 2808 jsValueResult(resultRegs, node);2809 return;2810 }2811 2812 bool leftIsConstInt32 = node->child1()->isInt32Constant();2813 bool rightIsConstInt32 = node->child2()->isInt32Constant();2814 2815 // The DFG does not always fold the sum of 2 constant int operands together.2816 if (leftIsConstInt32 && rightIsConstInt32) {2817 #if USE(JSVALUE64)2818 GPRTemporary result(this);2819 JSValueRegs resultRegs = JSValueRegs(result.gpr());2820 #else2821 GPRTemporary resultTag(this);2822 GPRTemporary resultPayload(this);2823 JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());2824 #endif2825 int64_t leftConst = node->child1()->asInt32();2826 int64_t rightConst = node->child2()->asInt32();2827 int64_t resultConst = leftConst + rightConst;2828 m_jit.moveValue(JSValue(resultConst), resultRegs);2829 2811 jsValueResult(resultRegs, node); 2830 2812 return; … … 2857 2839 #endif 2858 2840 2859 SnippetOperand leftOperand(m_state.forNode(node->child1()).resultType()); 2860 SnippetOperand rightOperand(m_state.forNode(node->child2()).resultType()); 2861 2862 if (leftIsConstInt32) 2863 leftOperand.setConstInt32(node->child1()->asInt32()); 2864 if (rightIsConstInt32) 2865 rightOperand.setConstInt32(node->child2()->asInt32()); 2841 SnippetOperand leftOperand(m_state.forNode(leftChild).resultType()); 2842 SnippetOperand rightOperand(m_state.forNode(rightChild).resultType()); 2843 2844 // The snippet generator does not support both operands being constant. If the left 2845 // operand is already const, we'll ignore the right operand's constness. 2846 if (leftChild->isInt32Constant()) 2847 leftOperand.setConstInt32(leftChild->asInt32()); 2848 else if (rightChild->isInt32Constant()) 2849 rightOperand.setConstInt32(rightChild->asInt32()); 2866 2850 2867 2851 ASSERT(!leftOperand.isConst() || !rightOperand.isConst()); 2868 2852 2869 2853 if (!leftOperand.isConst()) { 2870 left = JSValueOperand(this, node->child1());2854 left = JSValueOperand(this, leftChild); 2871 2855 leftRegs = left->jsValueRegs(); 2872 2856 } 2873 2857 if (!rightOperand.isConst()) { 2874 right = JSValueOperand(this, node->child2());2858 right = JSValueOperand(this, rightChild); 2875 2859 rightRegs = right->jsValueRegs(); 2876 2860 } … … 2887 2871 silentSpillAllRegisters(resultRegs); 2888 2872 2889 if (left IsConstInt32) {2873 if (leftOperand.isConst()) { 2890 2874 leftRegs = resultRegs; 2891 int64_t leftConst = node->child1()->asInt32(); 2892 m_jit.moveValue(JSValue(leftConst), leftRegs); 2893 } else if (rightIsConstInt32) { 2875 m_jit.moveValue(leftChild->asJSValue(), leftRegs); 2876 } else if (rightOperand.isConst()) { 2894 2877 rightRegs = resultRegs; 2895 int64_t rightConst = node->child2()->asInt32(); 2896 m_jit.moveValue(JSValue(rightConst), rightRegs); 2878 m_jit.moveValue(rightChild->asJSValue(), rightRegs); 2897 2879 } 2898 2880 … … 3210 3192 3211 3193 case UntypedUse: { 3212 JSValueOperand left(this, node->child1()); 3213 JSValueOperand right(this, node->child2()); 3194 Edge& leftChild = node->child1(); 3195 Edge& rightChild = node->child2(); 3196 3197 JSValueOperand left(this, leftChild); 3198 JSValueOperand right(this, rightChild); 3214 3199 3215 3200 JSValueRegs leftRegs = left.jsValueRegs(); … … 3236 3221 #endif 3237 3222 3238 SnippetOperand leftOperand(m_state.forNode( node->child1()).resultType());3239 SnippetOperand rightOperand(m_state.forNode( node->child2()).resultType());3223 SnippetOperand leftOperand(m_state.forNode(leftChild).resultType()); 3224 SnippetOperand rightOperand(m_state.forNode(rightChild).resultType()); 3240 3225 3241 3226 JITSubGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, … … 3502 3487 SnippetOperand rightOperand(m_state.forNode(rightChild).resultType()); 3503 3488 3489 // The snippet generator does not support both operands being constant. If the left 3490 // operand is already const, we'll ignore the right operand's constness. 3504 3491 if (leftChild->isInt32Constant()) 3505 3492 leftOperand.setConstInt32(leftChild->asInt32()); 3506 if (rightChild->isInt32Constant())3493 else if (rightChild->isInt32Constant()) 3507 3494 rightOperand.setConstInt32(rightChild->asInt32()); 3508 3495 3509 RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());3496 ASSERT(!leftOperand.isConst() || !rightOperand.isConst()); 3510 3497 3511 3498 if (!leftOperand.isPositiveConstInt32()) { … … 3532 3519 int64_t leftConst = leftOperand.asConstInt32(); 3533 3520 m_jit.moveValue(JSValue(leftConst), leftRegs); 3534 } 3535 if (rightOperand.isPositiveConstInt32()) { 3521 } else if (rightOperand.isPositiveConstInt32()) { 3536 3522 rightRegs = resultRegs; 3537 3523 int64_t rightConst = rightOperand.asConstInt32(); -
trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
r193781 r193793 1528 1528 SnippetOperand rightOperand(abstractValue(rightChild).resultType()); 1529 1529 1530 // The DFG does not always fold the sum of 2 constant int operands together.1531 1530 // Because the snippet does not support both operands being constant, if the left 1532 1531 // operand is already a constant, we'll just pretend the right operand is not. 1533 1532 if (leftChild->isInt32Constant()) 1534 1533 leftOperand.setConstInt32(leftChild->asInt32()); 1535 if (!leftOperand.isConst() &&rightChild->isInt32Constant())1534 else if (rightChild->isInt32Constant()) 1536 1535 rightOperand.setConstInt32(rightChild->asInt32()); 1537 1536 … … 1853 1852 SnippetOperand rightOperand(abstractValue(rightChild).resultType()); 1854 1853 1854 // Because the snippet does not support both operands being constant, if the left 1855 // operand is already a constant, we'll just pretend the right operand is not. 1855 1856 if (leftChild->isInt32Constant()) 1856 1857 leftOperand.setConstInt32(leftChild->asInt32()); 1857 if (rightChild->isInt32Constant())1858 else if (rightChild->isInt32Constant()) 1858 1859 rightOperand.setConstInt32(rightChild->asInt32()); 1859 1860
Note: See TracChangeset
for help on using the changeset viewer.