Changeset 95594 in webkit


Ignore:
Timestamp:
Sep 20, 2011 7:22:52 PM (13 years ago)
Author:
fpizlo@apple.com
Message:

DFG JIT always speculates integer on modulo
https://bugs.webkit.org/show_bug.cgi?id=68485

Reviewed by Oliver Hunt.

Added support for double modulo, which is a call to fmod().
Also added support for recording the old JIT's statistics
on op_mod and propagating them along the graph. Finally,
fixed a goof in the ArithNodeFlags propagation logic that
was made obvious when I started testing ArithMod.

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):
(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGNode.h:

(JSC::DFG::Node::hasArithNodeFlags):

  • dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateArithNodeFlags):
(JSC::DFG::Propagator::propagateNodePredictions):
(JSC::DFG::Propagator::fixupNode):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r95564 r95594  
     12011-09-20  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG JIT always speculates integer on modulo
     4        https://bugs.webkit.org/show_bug.cgi?id=68485
     5
     6        Reviewed by Oliver Hunt.
     7       
     8        Added support for double modulo, which is a call to fmod().
     9        Also added support for recording the old JIT's statistics
     10        on op_mod and propagating them along the graph. Finally,
     11        fixed a goof in the ArithNodeFlags propagation logic that
     12        was made obvious when I started testing ArithMod.
     13
     14        * dfg/DFGByteCodeParser.cpp:
     15        (JSC::DFG::ByteCodeParser::makeSafe):
     16        (JSC::DFG::ByteCodeParser::parseBlock):
     17        * dfg/DFGNode.h:
     18        (JSC::DFG::Node::hasArithNodeFlags):
     19        * dfg/DFGPropagator.cpp:
     20        (JSC::DFG::Propagator::propagateArithNodeFlags):
     21        (JSC::DFG::Propagator::propagateNodePredictions):
     22        (JSC::DFG::Propagator::fixupNode):
     23        * dfg/DFGSpeculativeJIT.cpp:
     24        (JSC::DFG::SpeculativeJIT::compile):
     25
    1262011-09-20  ChangSeok Oh  <shivamidow@gmail.com>
    227
  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r95563 r95594  
    522522        case ArithSub:
    523523        case ValueAdd:
     524        case ArithMod: // for ArithMode "MayOverflow" means we tried to divide by zero, or we saw double.
    524525            m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow);
    525526            break;
     
    898899            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
    899900            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
    900             set(currentInstruction[1].u.operand, addToGraph(ArithMod, op1, op2));
     901            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithMod, OpInfo(NodeUseBottom), op1, op2)));
    901902            NEXT_OPCODE(op_mod);
    902903        }
  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r95563 r95594  
    481481        case ArithMin:
    482482        case ArithMax:
     483        case ArithMod:
    483484        case ValueAdd:
    484485            return true;
  • trunk/Source/JavaScriptCore/dfg/DFGPropagator.cpp

    r95563 r95594  
    262262                if (node.child2() == NoNode)
    263263                    break;
    264                 changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
     264                changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
    265265                if (node.child3() == NoNode)
    266266                    break;
     
    361361        case BitLShift:
    362362        case BitURShift:
    363         case ValueToInt32:
     363        case ValueToInt32: {
     364            changed |= setPrediction(makePrediction(PredictInt32, StrongPrediction));
     365            break;
     366        }
     367
    364368        case ArithMod: {
    365             changed |= setPrediction(makePrediction(PredictInt32, StrongPrediction));
     369            PredictedType left = m_predictions[node.child1()];
     370            PredictedType right = m_predictions[node.child2()];
     371           
     372            if (isStrongPrediction(left) && isStrongPrediction(right)) {
     373                if (isInt32Prediction(mergePredictions(left, right)) && nodeCanSpeculateInteger(node.arithNodeFlags()))
     374                    changed |= mergePrediction(makePrediction(PredictInt32, StrongPrediction));
     375                else
     376                    changed |= mergePrediction(makePrediction(PredictDouble, StrongPrediction));
     377            }
    366378            break;
    367379        }
     
    622634        case ArithMul:
    623635        case ArithMin:
    624         case ArithMax: {
     636        case ArithMax:
     637        case ArithMod: {
    625638            if (!nodeCanSpeculateInteger(node.arithNodeFlags())) {
    626639                toDouble(node.child1());
  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r95563 r95594  
    11061106
    11071107    case ArithMod: {
     1108        if (shouldNotSpeculateInteger(node.child1()) || shouldNotSpeculateInteger(node.child2())
     1109            || !nodeCanSpeculateInteger(node.arithNodeFlags())) {
     1110            SpeculateDoubleOperand op1(this, node.child1());
     1111            SpeculateDoubleOperand op2(this, node.child2());
     1112           
     1113            FPRReg op1FPR = op1.fpr();
     1114            FPRReg op2FPR = op2.fpr();
     1115           
     1116            flushRegisters();
     1117           
     1118            FPRResult result(this);
     1119
     1120            callOperation(fmod, result.fpr(), op1FPR, op2FPR);
     1121           
     1122            doubleResult(result.fpr(), m_compileIndex);
     1123            break;
     1124        }
     1125       
    11081126        SpeculateIntegerOperand op1(this, node.child1());
    11091127        SpeculateIntegerOperand op2(this, node.child2());
Note: See TracChangeset for help on using the changeset viewer.