Changeset 260651 in webkit

Timestamp:

Apr 24, 2020 10:20:03 AM (4 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] DFG AI for some bitops + BigInt32 should be precise
​https://bugs.webkit.org/show_bug.cgi?id=210956

Reviewed by Keith Miller.

JSTests:

• stress/bigint-bitops.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

Use SpecBigInt32 for ValueBitXor, ValueBitAnd, and ValueBitOr since they are always producing BigInt32 and they have inlined implementations in DFG / FTL.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/bigint-bitops.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-24  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] DFG AI for some bitops + BigInt32 should be precise
+        https://bugs.webkit.org/show_bug.cgi?id=210956
+
+        Reviewed by Keith Miller.
+
+        * stress/bigint-bitops.js: Added.
+        (shouldBe):
+        (test):
+
 2020-04-24  Paulo Matos  <pmatos@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-24  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] DFG AI for some bitops + BigInt32 should be precise
+        https://bugs.webkit.org/show_bug.cgi?id=210956
+
+        Reviewed by Keith Miller.
+
+        Use SpecBigInt32 for ValueBitXor, ValueBitAnd, and ValueBitOr since they are always producing BigInt32 and they have inlined implementations in DFG / FTL.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2020-04-23  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -542 +542 @@
 
         // FIXME: this use of binaryUseKind means that we cannot specialize to (for example) a HeapBigInt left-operand and a BigInt32 right-operand.
+        // https://bugs.webkit.org/show_bug.cgi?id=210977
         if (node->binaryUseKind() == BigInt32Use) {
 #if USE(BIGINT32)
+            switch (node->op()) {
+            case ValueBitXor:
+            case ValueBitAnd:
+            case ValueBitOr:
+                setTypeForNode(node, SpecBigInt32);
+                break;
+
             // FIXME: We should have inlined implementation that always returns BigInt32.
             // https://bugs.webkit.org/show_bug.cgi?id=210847
-            setTypeForNode(node, SpecBigInt);
+            case ValueBitRShift:
+            case ValueBitLShift:
+                setTypeForNode(node, SpecBigInt);
+                break;
+            default:
+                DFG_CRASH(m_graph, node, "Incorrect DFG op");
+            }
 #else
-            RELEASE_ASSERT_NOT_REACHED();
+            DFG_CRASH(m_graph, node, "No BigInt32 support");
 #endif
         } else if (node->binaryUseKind() == HeapBigIntUse)