Changeset 96280 in webkit

Timestamp:

Sep 28, 2011 5:47:07 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG JIT falls back on numerical comparisons when it does not
recognize a prediction
​https://bugs.webkit.org/show_bug.cgi?id=68977

Reviewed by Geoffrey Garen.

This fixes both the way comparison implementations are selected. It
also fixes a bug where comparisons other than equality (like < or >)
on objects are compiled as if the comparison was equality.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compare):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT falls back on numerical comparisons when it does not
+        recognize a prediction
+        https://bugs.webkit.org/show_bug.cgi?id=68977
+
+        Reviewed by Geoffrey Garen.
+        
+        This fixes both the way comparison implementations are selected. It
+        also fixes a bug where comparisons other than equality (like < or >)
+        on objects are compiled as if the comparison was equality.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+
 2011-09-28  Gavin Barraclough  <barraclough@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -651 +651 @@
         return true;
     }
-    
-    if (shouldSpeculateFinalObject(node.child1(), node.child2()))
-        compileObjectEquality(node, m_jit.globalData()->jsFinalObjectVPtr);
-    else if (shouldSpeculateArray(node.child1(), node.child2()))
-        compileObjectEquality(node, m_jit.globalData()->jsArrayVPtr);
-    else if (!shouldSpeculateNumber(node.child1()) && !shouldSpeculateNumber(node.child2()))
-        nonSpeculativeNonPeepholeCompare(node, condition, operation);
-    else if ((shouldSpeculateNumber(node.child1()) || shouldSpeculateNumber(node.child2())) && !shouldSpeculateInteger(node.child1(), node.child2())) {
-        // Normal case, not fused to branch.
+
+    if (shouldSpeculateInteger(node.child1(), node.child2())) {
+        SpeculateIntegerOperand op1(this, node.child1());
+        SpeculateIntegerOperand op2(this, node.child2());
+        GPRTemporary result(this, op1, op2);
+        
+        m_jit.compare32(condition, op1.gpr(), op2.gpr(), result.gpr());
+        
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), m_compileIndex, DataFormatJSBoolean);
+    } else if (shouldSpeculateNumber(node.child1(), node.child2())) {
         SpeculateDoubleOperand op1(this, node.child1());
         SpeculateDoubleOperand op2(this, node.child2());
@@ -670 +673 @@
 
         jsValueResult(result.gpr(), m_compileIndex, DataFormatJSBoolean);
-    } else {
-        // Normal case, not fused to branch.
-        SpeculateIntegerOperand op1(this, node.child1());
-        SpeculateIntegerOperand op2(this, node.child2());
-        GPRTemporary result(this, op1, op2);
-        
-        m_jit.compare32(condition, op1.gpr(), op2.gpr(), result.gpr());
-        
-        // If we add a DataFormatBool, we should use it here.
-        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
-        jsValueResult(result.gpr(), m_compileIndex, DataFormatJSBoolean);
-    }
+    } else if (node.op == CompareEq && shouldSpeculateFinalObject(node.child1(), node.child2()))
+        compileObjectEquality(node, m_jit.globalData()->jsFinalObjectVPtr);
+    else if (node.op == CompareEq && shouldSpeculateArray(node.child1(), node.child2()))
+        compileObjectEquality(node, m_jit.globalData()->jsArrayVPtr);
+    else
+        nonSpeculativeNonPeepholeCompare(node, condition, operation);
     
     return false;