Changeset 95170 in webkit

Timestamp:

Sep 14, 2011 10:44:07 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG JIT does not leverage integer speculations on branches
​https://bugs.webkit.org/show_bug.cgi?id=68140

Reviewed by Oliver Hunt.

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::isStrictInt32):

• dfg/DFGJITCodeGenerator.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGJITCodeGenerator.cpp (modified) (1 diff)
• dfg/DFGJITCodeGenerator.h (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not leverage integer speculations on branches
+        https://bugs.webkit.org/show_bug.cgi?id=68140
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isStrictInt32):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-09-14  Gavin Barraclough  <barraclough@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp

@@ -351 +351 @@
 }
 
+bool JITCodeGenerator::isStrictInt32(NodeIndex nodeIndex)
+{
+    if (isInt32Constant(nodeIndex))
+        return true;
+    
+    Node& node = m_jit.graph()[nodeIndex];
+    GenerationInfo& info = m_generationInfo[node.virtualRegister()];
+    
+    return info.registerFormat() == DataFormatInteger;
+}
+
 bool JITCodeGenerator::isKnownInteger(NodeIndex nodeIndex)
 {

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h

@@ -409 +409 @@
     }
     
+    bool isStrictInt32(NodeIndex);
+    
     bool isKnownInteger(NodeIndex);
     bool isKnownNumeric(NodeIndex);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1279 +1279 @@
 
     case Branch:
+        if (isStrictInt32(node.child1())) {
+            SpeculateStrictInt32Operand op(this, node.child1());
+            
+            BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+            BlockIndex notTaken = m_jit.graph().blockIndexForBytecodeOffset(node.notTakenBytecodeOffset());
+            
+            MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;
+            
+            if (taken == (m_block + 1)) {
+                condition = MacroAssembler::Zero;
+                BlockIndex tmp = taken;
+                taken = notTaken;
+                notTaken = tmp;
+            }
+            
+            addBranch(m_jit.branchTest32(condition, op.gpr()), taken);
+            if (notTaken != (m_block + 1))
+                addBranch(m_jit.jump(), notTaken);
+            
+            noResult(m_compileIndex);
+            break;
+        }
+        if (shouldSpeculateInteger(node.child1())) {
+            SpeculateIntegerOperand op(this, node.child1());
+
+            BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+            BlockIndex notTaken = m_jit.graph().blockIndexForBytecodeOffset(node.notTakenBytecodeOffset());
+            
+            MacroAssembler::RelationalCondition condition = MacroAssembler::NotEqual;
+
+            if (taken == (m_block + 1)) {
+                condition = MacroAssembler::Equal;
+                BlockIndex tmp = taken;
+                taken = notTaken;
+                notTaken = tmp;
+            }
+            
+            addBranch(m_jit.branchPtr(condition, op.gpr(), GPRInfo::tagTypeNumberRegister), taken);
+
+            if (notTaken != (m_block + 1))
+                addBranch(m_jit.jump(), notTaken);
+            
+            noResult(m_compileIndex);
+            break;
+        }
         emitBranch(node);
         break;