/*
- * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
* Copyright (C) 2011 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
#if ENABLE(DFG_JIT)
#include "ArrayPrototype.h"
+#include "DFGAbstractInterpreterInlines.h"
#include "DFGCallArrayAllocatorSlowPathGenerator.h"
+#include "DFGOperations.h"
#include "DFGSlowPathGenerator.h"
-#include "JSActivation.h"
+#include "Debugger.h"
+#include "DirectArguments.h"
+#include "GetterSetter.h"
+#include "JSEnvironmentRecord.h"
+#include "JSLexicalEnvironment.h"
+#include "JSPropertyNameEnumerator.h"
#include "ObjectPrototype.h"
-#include "Operations.h"
+#include "JSCInlines.h"
+#include "SetupVarargsFrame.h"
+#include "TypeProfilerLog.h"
namespace JSC { namespace DFG {
#if USE(JSVALUE32_64)
-GPRReg SpeculativeJIT::fillInteger(Edge edge, DataFormat& returnFormat)
-{
- ASSERT(!needsTypeCheck(edge, SpecInt32));
-
- VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = m_generationInfo[virtualRegister];
-
- if (info.registerFormat() == DataFormatNone) {
- GPRReg gpr = allocate();
-
- if (edge->hasConstant()) {
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- if (isInt32Constant(edge.node()))
- m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);
- else if (isNumberConstant(edge.node()))
- RELEASE_ASSERT_NOT_REACHED();
- else {
- ASSERT(isJSConstant(edge.node()));
- JSValue jsValue = valueOfJSConstant(edge.node());
- m_jit.move(MacroAssembler::Imm32(jsValue.payload()), gpr);
- }
- } else {
- ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger || info.spillFormat() == DataFormatInteger);
- m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
- m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
- }
-
- info.fillInteger(*m_stream, gpr);
- returnFormat = DataFormatInteger;
- return gpr;
- }
-
- switch (info.registerFormat()) {
- case DataFormatNone:
- // Should have filled, above.
- case DataFormatJSDouble:
- case DataFormatDouble:
- case DataFormatJS:
- case DataFormatCell:
- case DataFormatJSCell:
- case DataFormatBoolean:
- case DataFormatJSBoolean:
- case DataFormatStorage:
- // Should only be calling this function if we know this operand to be integer.
- RELEASE_ASSERT_NOT_REACHED();
-
- case DataFormatJSInteger: {
- GPRReg tagGPR = info.tagGPR();
- GPRReg payloadGPR = info.payloadGPR();
- m_gprs.lock(tagGPR);
- m_jit.jitAssertIsJSInt32(tagGPR);
- m_gprs.unlock(tagGPR);
- m_gprs.lock(payloadGPR);
- m_gprs.release(tagGPR);
- m_gprs.release(payloadGPR);
- m_gprs.retain(payloadGPR, virtualRegister, SpillOrderInteger);
- info.fillInteger(*m_stream, payloadGPR);
- returnFormat = DataFormatInteger;
- return payloadGPR;
- }
-
- case DataFormatInteger: {
- GPRReg gpr = info.gpr();
- m_gprs.lock(gpr);
- m_jit.jitAssertIsInt32(gpr);
- returnFormat = DataFormatInteger;
- return gpr;
- }
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return InvalidGPRReg;
- }
-}
-
bool SpeculativeJIT::fillJSValue(Edge edge, GPRReg& tagGPR, GPRReg& payloadGPR, FPRReg& fpr)
{
// FIXME: For double we could fill with a FPR.
UNUSED_PARAM(fpr);
VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = m_generationInfo[virtualRegister];
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
if (edge->hasConstant()) {
tagGPR = allocate();
payloadGPR = allocate();
- m_jit.move(Imm32(valueOfJSConstant(edge.node()).tag()), tagGPR);
- m_jit.move(Imm32(valueOfJSConstant(edge.node()).payload()), payloadGPR);
+ JSValue value = edge->asJSValue();
+ m_jit.move(Imm32(value.tag()), tagGPR);
+ m_jit.move(Imm32(value.payload()), payloadGPR);
m_gprs.retain(tagGPR, virtualRegister, SpillOrderConstant);
m_gprs.retain(payloadGPR, virtualRegister, SpillOrderConstant);
- info.fillJSValue(*m_stream, tagGPR, payloadGPR, isInt32Constant(edge.node()) ? DataFormatJSInteger : DataFormatJS);
+ info.fillJSValue(*m_stream, tagGPR, payloadGPR, DataFormatJS);
} else {
DataFormat spillFormat = info.spillFormat();
ASSERT(spillFormat != DataFormatNone && spillFormat != DataFormatStorage);
tagGPR = allocate();
payloadGPR = allocate();
switch (spillFormat) {
- case DataFormatInteger:
+ case DataFormatInt32:
m_jit.move(TrustedImm32(JSValue::Int32Tag), tagGPR);
- spillFormat = DataFormatJSInteger; // This will be used as the new register format.
+ spillFormat = DataFormatJSInt32; // This will be used as the new register format.
break;
case DataFormatCell:
m_jit.move(TrustedImm32(JSValue::CellTag), tagGPR);
return true;
}
- case DataFormatInteger:
+ case DataFormatInt32:
case DataFormatCell:
case DataFormatBoolean: {
GPRReg gpr = info.gpr();
m_gprs.lock(gpr);
}
tagGPR = allocate();
- uint32_t tag = JSValue::EmptyValueTag;
+ int32_t tag = JSValue::EmptyValueTag;
DataFormat fillFormat = DataFormatJS;
switch (info.registerFormat()) {
- case DataFormatInteger:
+ case DataFormatInt32:
tag = JSValue::Int32Tag;
- fillFormat = DataFormatJSInteger;
+ fillFormat = DataFormatJSInt32;
break;
case DataFormatCell:
tag = JSValue::CellTag;
}
case DataFormatJSDouble:
- case DataFormatDouble: {
- FPRReg oldFPR = info.fpr();
- m_fprs.lock(oldFPR);
- tagGPR = allocate();
- payloadGPR = allocate();
- boxDouble(oldFPR, tagGPR, payloadGPR);
- m_fprs.unlock(oldFPR);
- m_fprs.release(oldFPR);
- m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);
- m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);
- info.fillJSValue(*m_stream, tagGPR, payloadGPR, DataFormatJS);
- return true;
- }
-
case DataFormatJS:
- case DataFormatJSInteger:
+ case DataFormatJSInt32:
case DataFormatJSCell:
case DataFormatJSBoolean: {
tagGPR = info.tagGPR();
}
case DataFormatStorage:
+ case DataFormatDouble:
// this type currently never occurs
RELEASE_ASSERT_NOT_REACHED();
}
}
-void SpeculativeJIT::nonSpeculativeUInt32ToNumber(Node* node)
-{
- IntegerOperand op1(this, node->child1());
- FPRTemporary boxer(this);
- GPRTemporary resultTag(this, op1);
- GPRTemporary resultPayload(this);
-
- JITCompiler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, op1.gpr(), TrustedImm32(0));
-
- m_jit.convertInt32ToDouble(op1.gpr(), boxer.fpr());
- m_jit.move(JITCompiler::TrustedImmPtr(&AssemblyHelpers::twoToThe32), resultPayload.gpr()); // reuse resultPayload register here.
- m_jit.addDouble(JITCompiler::Address(resultPayload.gpr(), 0), boxer.fpr());
-
- boxDouble(boxer.fpr(), resultTag.gpr(), resultPayload.gpr());
-
- JITCompiler::Jump done = m_jit.jump();
-
- positive.link(&m_jit);
-
- m_jit.move(TrustedImm32(JSValue::Int32Tag), resultTag.gpr());
- m_jit.move(op1.gpr(), resultPayload.gpr());
-
- done.link(&m_jit);
-
- jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
-}
-
-void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseTagGPROrNone, GPRReg basePayloadGPR, GPRReg resultTagGPR, GPRReg resultPayloadGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
+void SpeculativeJIT::cachedGetById(
+ CodeOrigin codeOrigin, GPRReg baseTagGPROrNone, GPRReg basePayloadGPR, GPRReg resultTagGPR, GPRReg resultPayloadGPR,
+ unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
{
- JITCompiler::DataLabelPtr structureToCompare;
- JITCompiler::PatchableJump structureCheck = m_jit.patchableBranchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(basePayloadGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(unusedPointer)));
+ // This is a hacky fix for when the register allocator decides to alias the base payload with the result tag. This only happens
+ // in the case of GetByIdFlush, which has a relatively expensive register allocation story already so we probably don't need to
+ // trip over one move instruction.
+ if (basePayloadGPR == resultTagGPR) {
+ RELEASE_ASSERT(basePayloadGPR != resultPayloadGPR);
+
+ if (baseTagGPROrNone == resultPayloadGPR) {
+ m_jit.swap(basePayloadGPR, baseTagGPROrNone);
+ baseTagGPROrNone = resultTagGPR;
+ } else
+ m_jit.move(basePayloadGPR, resultPayloadGPR);
+ basePayloadGPR = resultPayloadGPR;
+ }
- JITCompiler::ConvertibleLoadLabel propertyStorageLoad = m_jit.convertibleLoadPtr(JITCompiler::Address(basePayloadGPR, JSObject::butterflyOffset()), resultPayloadGPR);
- JITCompiler::DataLabelCompact tagLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
- JITCompiler::DataLabelCompact payloadLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+ JITGetByIdGenerator gen(
+ m_jit.codeBlock(), codeOrigin, usedRegisters(),
+ JSValueRegs(baseTagGPROrNone, basePayloadGPR),
+ JSValueRegs(resultTagGPR, resultPayloadGPR), spillMode);
- JITCompiler::Label doneLabel = m_jit.label();
+ gen.generateFastPath(m_jit);
+
+ JITCompiler::JumpList slowCases;
+ if (slowPathTarget.isSet())
+ slowCases.append(slowPathTarget);
+ slowCases.append(gen.slowPathJump());
- OwnPtr<SlowPathGenerator> slowPath;
+ std::unique_ptr<SlowPathGenerator> slowPath;
if (baseTagGPROrNone == InvalidGPRReg) {
- if (!slowPathTarget.isSet()) {
- slowPath = slowPathCall(
- structureCheck.m_jump, this, operationGetByIdOptimize,
- JSValueRegs(resultTagGPR, resultPayloadGPR),
- static_cast<int32_t>(JSValue::CellTag), basePayloadGPR,
- identifier(identifierNumber));
- } else {
- JITCompiler::JumpList slowCases;
- slowCases.append(structureCheck.m_jump);
- slowCases.append(slowPathTarget);
- slowPath = slowPathCall(
- slowCases, this, operationGetByIdOptimize,
- JSValueRegs(resultTagGPR, resultPayloadGPR),
- static_cast<int32_t>(JSValue::CellTag), basePayloadGPR,
- identifier(identifierNumber));
- }
+ slowPath = slowPathCall(
+ slowCases, this, operationGetByIdOptimize,
+ JSValueRegs(resultTagGPR, resultPayloadGPR), gen.stubInfo(),
+ static_cast<int32_t>(JSValue::CellTag), basePayloadGPR,
+ identifierUID(identifierNumber));
} else {
- if (!slowPathTarget.isSet()) {
- slowPath = slowPathCall(
- structureCheck.m_jump, this, operationGetByIdOptimize,
- JSValueRegs(resultTagGPR, resultPayloadGPR), baseTagGPROrNone, basePayloadGPR,
- identifier(identifierNumber));
- } else {
- JITCompiler::JumpList slowCases;
- slowCases.append(structureCheck.m_jump);
- slowCases.append(slowPathTarget);
- slowPath = slowPathCall(
- slowCases, this, operationGetByIdOptimize,
- JSValueRegs(resultTagGPR, resultPayloadGPR), baseTagGPROrNone, basePayloadGPR,
- identifier(identifierNumber));
- }
+ slowPath = slowPathCall(
+ slowCases, this, operationGetByIdOptimize,
+ JSValueRegs(resultTagGPR, resultPayloadGPR), gen.stubInfo(), baseTagGPROrNone,
+ basePayloadGPR, identifierUID(identifierNumber));
}
- m_jit.addPropertyAccess(
- PropertyAccessRecord(
- codeOrigin, structureToCompare, structureCheck, propertyStorageLoad,
- tagLoadWithPatch, payloadLoadWithPatch, slowPath.get(), doneLabel,
- safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR),
- safeCast<int8_t>(resultPayloadGPR), usedRegisters(),
- spillMode == NeedToSpill ? PropertyAccessRecord::RegistersInUse : PropertyAccessRecord::RegistersFlushed));
- addSlowPathGenerator(slowPath.release());
+
+ m_jit.addGetById(gen, slowPath.get());
+ addSlowPathGenerator(WTF::move(slowPath));
}
-void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg basePayloadGPR, GPRReg valueTagGPR, GPRReg valuePayloadGPR, Edge valueUse, GPRReg scratchGPR, unsigned identifierNumber, PutKind putKind, JITCompiler::Jump slowPathTarget)
+void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg basePayloadGPR, GPRReg valueTagGPR, GPRReg valuePayloadGPR, GPRReg scratchGPR, unsigned identifierNumber, PutKind putKind, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
{
- JITCompiler::DataLabelPtr structureToCompare;
- JITCompiler::PatchableJump structureCheck = m_jit.patchableBranchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(basePayloadGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(unusedPointer)));
-
- writeBarrier(basePayloadGPR, valueTagGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);
+ JITPutByIdGenerator gen(
+ m_jit.codeBlock(), codeOrigin, usedRegisters(),
+ JSValueRegs::payloadOnly(basePayloadGPR), JSValueRegs(valueTagGPR, valuePayloadGPR),
+ scratchGPR, spillMode, m_jit.ecmaModeFor(codeOrigin), putKind);
+
+ gen.generateFastPath(m_jit);
+
+ JITCompiler::JumpList slowCases;
+ if (slowPathTarget.isSet())
+ slowCases.append(slowPathTarget);
+ slowCases.append(gen.slowPathJump());
- JITCompiler::ConvertibleLoadLabel propertyStorageLoad = m_jit.convertibleLoadPtr(JITCompiler::Address(basePayloadGPR, JSObject::butterflyOffset()), scratchGPR);
- JITCompiler::DataLabel32 tagStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valueTagGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
- JITCompiler::DataLabel32 payloadStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valuePayloadGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+ auto slowPath = slowPathCall(
+ slowCases, this, gen.slowPathFunction(), NoResult, gen.stubInfo(), valueTagGPR,
+ valuePayloadGPR, basePayloadGPR, identifierUID(identifierNumber));
- JITCompiler::Label doneLabel = m_jit.label();
- V_DFGOperation_EJCI optimizedCall;
- if (m_jit.strictModeFor(m_currentNode->codeOrigin)) {
- if (putKind == Direct)
- optimizedCall = operationPutByIdDirectStrictOptimize;
- else
- optimizedCall = operationPutByIdStrictOptimize;
- } else {
- if (putKind == Direct)
- optimizedCall = operationPutByIdDirectNonStrictOptimize;
- else
- optimizedCall = operationPutByIdNonStrictOptimize;
- }
- OwnPtr<SlowPathGenerator> slowPath;
- if (!slowPathTarget.isSet()) {
- slowPath = slowPathCall(
- structureCheck.m_jump, this, optimizedCall, NoResult, valueTagGPR, valuePayloadGPR,
- basePayloadGPR, identifier(identifierNumber));
- } else {
- JITCompiler::JumpList slowCases;
- slowCases.append(structureCheck.m_jump);
- slowCases.append(slowPathTarget);
- slowPath = slowPathCall(
- slowCases, this, optimizedCall, NoResult, valueTagGPR, valuePayloadGPR,
- basePayloadGPR, identifier(identifierNumber));
- }
- RegisterSet currentlyUsedRegisters = usedRegisters();
- currentlyUsedRegisters.clear(scratchGPR);
- ASSERT(currentlyUsedRegisters.get(basePayloadGPR));
- ASSERT(currentlyUsedRegisters.get(valueTagGPR));
- ASSERT(currentlyUsedRegisters.get(valuePayloadGPR));
- m_jit.addPropertyAccess(
- PropertyAccessRecord(
- codeOrigin, structureToCompare, structureCheck, propertyStorageLoad,
- JITCompiler::DataLabelCompact(tagStoreWithPatch.label()),
- JITCompiler::DataLabelCompact(payloadStoreWithPatch.label()),
- slowPath.get(), doneLabel, safeCast<int8_t>(basePayloadGPR),
- safeCast<int8_t>(valueTagGPR), safeCast<int8_t>(valuePayloadGPR),
- usedRegisters()));
- addSlowPathGenerator(slowPath.release());
+ m_jit.addPutById(gen, slowPath.get());
+ addSlowPathGenerator(WTF::move(slowPath));
}
void SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull(Edge operand, bool invert)
GPRReg argTagGPR = arg.tagGPR();
GPRReg argPayloadGPR = arg.payloadGPR();
- GPRTemporary resultPayload(this, arg, false);
+ GPRTemporary resultPayload(this, Reuse, arg, PayloadWord);
GPRReg resultPayloadGPR = resultPayload.gpr();
JITCompiler::Jump notCell;
JITCompiler::Jump notMasqueradesAsUndefined;
- if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (!isKnownCell(operand.node()))
- notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));
-
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+
m_jit.move(invert ? TrustedImm32(1) : TrustedImm32(0), resultPayloadGPR);
notMasqueradesAsUndefined = m_jit.jump();
} else {
GPRTemporary remoteGlobalObject(this);
if (!isKnownCell(operand.node()))
- notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));
-
- m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureOffset()), resultPayloadGPR);
- JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::NonZero, JITCompiler::Address(resultPayloadGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined));
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+
+ JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
+ JITCompiler::NonZero,
+ JITCompiler::Address(argPayloadGPR, JSCell::typeInfoFlagsOffset()),
+ JITCompiler::TrustedImm32(MasqueradesAsUndefined));
m_jit.move(invert ? TrustedImm32(1) : TrustedImm32(0), resultPayloadGPR);
notMasqueradesAsUndefined = m_jit.jump();
isMasqueradesAsUndefined.link(&m_jit);
GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
- m_jit.move(JITCompiler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)), localGlobalObjectGPR);
+ m_jit.move(JITCompiler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
+ m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureIDOffset()), resultPayloadGPR);
m_jit.loadPtr(JITCompiler::Address(resultPayloadGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
m_jit.compare32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, resultPayloadGPR);
}
notCell.link(&m_jit);
// null or undefined?
COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
- m_jit.move(argTagGPR, resultPayloadGPR);
- m_jit.or32(TrustedImm32(1), resultPayloadGPR);
+ m_jit.or32(TrustedImm32(1), argTagGPR, resultPayloadGPR);
m_jit.compare32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultPayloadGPR, TrustedImm32(JSValue::NullTag), resultPayloadGPR);
done.link(&m_jit);
void SpeculativeJIT::nonSpeculativePeepholeBranchNull(Edge operand, Node* branchNode, bool invert)
{
- BlockIndex taken = branchNode->takenBlockIndex();
- BlockIndex notTaken = branchNode->notTakenBlockIndex();
+ BasicBlock* taken = branchNode->branchData()->taken.block;
+ BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
if (taken == nextBlock()) {
invert = !invert;
- BlockIndex tmp = taken;
+ BasicBlock* tmp = taken;
taken = notTaken;
notTaken = tmp;
}
GPRReg argTagGPR = arg.tagGPR();
GPRReg argPayloadGPR = arg.payloadGPR();
- GPRTemporary result(this, arg);
+ GPRTemporary result(this, Reuse, arg, TagWord);
GPRReg resultGPR = result.gpr();
JITCompiler::Jump notCell;
- if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (!isKnownCell(operand.node()))
- notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));
-
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+
jump(invert ? taken : notTaken, ForceJump);
} else {
GPRTemporary localGlobalObject(this);
GPRTemporary remoteGlobalObject(this);
if (!isKnownCell(operand.node()))
- notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));
-
- m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureOffset()), resultGPR);
- branchTest8(JITCompiler::Zero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), invert ? taken : notTaken);
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+
+ branchTest8(JITCompiler::Zero,
+ JITCompiler::Address(argPayloadGPR, JSCell::typeInfoFlagsOffset()),
+ JITCompiler::TrustedImm32(MasqueradesAsUndefined),
+ invert ? taken : notTaken);
GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
- m_jit.move(TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)), localGlobalObjectGPR);
+ m_jit.move(TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
+ m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureIDOffset()), resultGPR);
m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
branchPtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, invert ? notTaken : taken);
}
notCell.link(&m_jit);
// null or undefined?
COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
- m_jit.move(argTagGPR, resultGPR);
- m_jit.or32(TrustedImm32(1), resultGPR);
+ m_jit.or32(TrustedImm32(1), argTagGPR, resultGPR);
branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(JSValue::NullTag), taken);
}
{
unsigned branchIndexInBlock = detectPeepHoleBranch();
if (branchIndexInBlock != UINT_MAX) {
- Node* branchNode = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
+ Node* branchNode = m_block->at(branchIndexInBlock);
ASSERT(node->adjustedRefCount() == 1);
return false;
}
-void SpeculativeJIT::nonSpeculativePeepholeBranch(Node* node, Node* branchNode, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)
+void SpeculativeJIT::nonSpeculativePeepholeBranch(Node* node, Node* branchNode, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
{
- BlockIndex taken = branchNode->takenBlockIndex();
- BlockIndex notTaken = branchNode->notTakenBlockIndex();
+ BasicBlock* taken = branchNode->branchData()->taken.block;
+ BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
JITCompiler::ResultCondition callResultCondition = JITCompiler::NonZero;
if (taken == nextBlock()) {
cond = JITCompiler::invert(cond);
callResultCondition = JITCompiler::Zero;
- BlockIndex tmp = taken;
+ BasicBlock* tmp = taken;
taken = notTaken;
notTaken = tmp;
}
JITCompiler::JumpList slowPath;
if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
GPRReg resultGPR = result.gpr();
arg1.use();
jump(notTaken);
- m_indexInBlock = m_jit.graph().m_blocks[m_block]->size() - 1;
+ m_indexInBlock = m_block->size() - 1;
m_currentNode = branchNode;
}
template<typename JumpType>
class CompareAndBoxBooleanSlowPathGenerator
- : public CallSlowPathGenerator<JumpType, S_DFGOperation_EJJ, GPRReg> {
+ : public CallSlowPathGenerator<JumpType, S_JITOperation_EJJ, GPRReg> {
public:
CompareAndBoxBooleanSlowPathGenerator(
JumpType from, SpeculativeJIT* jit,
- S_DFGOperation_EJJ function, GPRReg result, GPRReg arg1Tag, GPRReg arg1Payload,
+ S_JITOperation_EJJ function, GPRReg result, GPRReg arg1Tag, GPRReg arg1Payload,
GPRReg arg2Tag, GPRReg arg2Payload)
- : CallSlowPathGenerator<JumpType, S_DFGOperation_EJJ, GPRReg>(
+ : CallSlowPathGenerator<JumpType, S_JITOperation_EJJ, GPRReg>(
from, jit, function, NeedToSpill, result)
, m_arg1Tag(arg1Tag)
, m_arg1Payload(arg1Payload)
GPRReg m_arg2Payload;
};
-void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node* node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)
+void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node* node, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
{
JSValueOperand arg1(this, node->child1());
JSValueOperand arg2(this, node->child2());
JITCompiler::JumpList slowPath;
if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
GPRReg resultPayloadGPR = result.gpr();
arg1.use();
booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
} else {
- GPRTemporary resultPayload(this, arg1, false);
+ GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
GPRReg resultPayloadGPR = resultPayload.gpr();
arg1.use();
m_jit.compare32(cond, arg1PayloadGPR, arg2PayloadGPR, resultPayloadGPR);
if (!isKnownInteger(node->child1().node()) || !isKnownInteger(node->child2().node())) {
- addSlowPathGenerator(adoptPtr(
- new CompareAndBoxBooleanSlowPathGenerator<JITCompiler::JumpList>(
+ addSlowPathGenerator(std::make_unique<CompareAndBoxBooleanSlowPathGenerator<JITCompiler::JumpList>>(
slowPath, this, helperFunction, resultPayloadGPR, arg1TagGPR,
- arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR)));
+ arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR));
}
booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node* node, Node* branchNode, bool invert)
{
- BlockIndex taken = branchNode->takenBlockIndex();
- BlockIndex notTaken = branchNode->notTakenBlockIndex();
+ BasicBlock* taken = branchNode->branchData()->taken.block;
+ BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
// The branch instruction will branch to the taken block.
// If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
if (taken == nextBlock()) {
invert = !invert;
- BlockIndex tmp = taken;
+ BasicBlock* tmp = taken;
taken = notTaken;
notTaken = tmp;
}
GPRReg arg2TagGPR = arg2.tagGPR();
GPRReg arg2PayloadGPR = arg2.payloadGPR();
- GPRTemporary resultPayload(this, arg1, false);
+ GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
GPRReg resultPayloadGPR = resultPayload.gpr();
arg1.use();
GPRReg arg2TagGPR = arg2.tagGPR();
GPRReg arg2PayloadGPR = arg2.payloadGPR();
- GPRTemporary resultPayload(this, arg1, false);
+ GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
GPRReg resultPayloadGPR = resultPayload.gpr();
arg1.use();
booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
}
+void SpeculativeJIT::compileMiscStrictEq(Node* node)
+{
+ JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+ JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
+ GPRTemporary result(this);
+
+ if (node->child1().useKind() == MiscUse)
+ speculateMisc(node->child1(), op1.jsValueRegs());
+ if (node->child2().useKind() == MiscUse)
+ speculateMisc(node->child2(), op2.jsValueRegs());
+
+ m_jit.move(TrustedImm32(0), result.gpr());
+ JITCompiler::Jump notEqual = m_jit.branch32(JITCompiler::NotEqual, op1.tagGPR(), op2.tagGPR());
+ m_jit.compare32(JITCompiler::Equal, op1.payloadGPR(), op2.payloadGPR(), result.gpr());
+ notEqual.link(&m_jit);
+ booleanResult(result.gpr(), node);
+}
+
void SpeculativeJIT::emitCall(Node* node)
{
- if (node->op() != Call)
- ASSERT(node->op() == Construct);
+ CallLinkInfo::CallType callType;
+ bool isVarargs = false;
+ bool isForwardVarargs = false;
+ switch (node->op()) {
+ case Call:
+ callType = CallLinkInfo::Call;
+ break;
+ case Construct:
+ callType = CallLinkInfo::Construct;
+ break;
+ case CallVarargs:
+ callType = CallLinkInfo::CallVarargs;
+ isVarargs = true;
+ break;
+ case ConstructVarargs:
+ callType = CallLinkInfo::ConstructVarargs;
+ isVarargs = true;
+ break;
+ case CallForwardVarargs:
+ callType = CallLinkInfo::CallVarargs;
+ isForwardVarargs = true;
+ break;
+ case ConstructForwardVarargs:
+ callType = CallLinkInfo::ConstructVarargs;
+ isForwardVarargs = true;
+ break;
+ default:
+ DFG_CRASH(m_jit.graph(), node, "bad node type");
+ break;
+ }
- // For constructors, the this argument is not passed but we have to make space
- // for it.
- int dummyThisArgument = node->op() == Call ? 0 : 1;
+ Edge calleeEdge = m_jit.graph().child(node, 0);
+
+ // Gotta load the arguments somehow. Varargs is trickier.
+ if (isVarargs || isForwardVarargs) {
+ CallVarargsData* data = node->callVarargsData();
+
+ GPRReg resultGPR;
+ unsigned numUsedStackSlots = m_jit.graph().m_nextMachineLocal;
+
+ if (isForwardVarargs) {
+ flushRegisters();
+ use(node->child2());
+
+ GPRReg scratchGPR1;
+ GPRReg scratchGPR2;
+ GPRReg scratchGPR3;
+
+ scratchGPR1 = JITCompiler::selectScratchGPR();
+ scratchGPR2 = JITCompiler::selectScratchGPR(scratchGPR1);
+ scratchGPR3 = JITCompiler::selectScratchGPR(scratchGPR1, scratchGPR2);
+
+ m_jit.move(TrustedImm32(numUsedStackSlots), scratchGPR2);
+ JITCompiler::JumpList slowCase;
+ emitSetupVarargsFrameFastCase(m_jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, node->child2()->origin.semantic.inlineCallFrame, data->firstVarArgOffset, slowCase);
+ JITCompiler::Jump done = m_jit.jump();
+ slowCase.link(&m_jit);
+ callOperation(operationThrowStackOverflowForVarargs);
+ m_jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
+ done.link(&m_jit);
+ resultGPR = scratchGPR2;
+ } else {
+ GPRReg argumentsPayloadGPR;
+ GPRReg argumentsTagGPR;
+ GPRReg scratchGPR1;
+ GPRReg scratchGPR2;
+ GPRReg scratchGPR3;
+
+ auto loadArgumentsGPR = [&] (GPRReg reservedGPR) {
+ if (reservedGPR != InvalidGPRReg)
+ lock(reservedGPR);
+ JSValueOperand arguments(this, node->child2());
+ argumentsTagGPR = arguments.tagGPR();
+ argumentsPayloadGPR = arguments.payloadGPR();
+ if (reservedGPR != InvalidGPRReg)
+ unlock(reservedGPR);
+ flushRegisters();
+
+ scratchGPR1 = JITCompiler::selectScratchGPR(argumentsPayloadGPR, argumentsTagGPR, reservedGPR);
+ scratchGPR2 = JITCompiler::selectScratchGPR(argumentsPayloadGPR, argumentsTagGPR, scratchGPR1, reservedGPR);
+ scratchGPR3 = JITCompiler::selectScratchGPR(argumentsPayloadGPR, argumentsTagGPR, scratchGPR1, scratchGPR2, reservedGPR);
+ };
+
+ loadArgumentsGPR(InvalidGPRReg);
+
+ DFG_ASSERT(m_jit.graph(), node, isFlushed());
- CallLinkInfo::CallType callType = node->op() == Call ? CallLinkInfo::Call : CallLinkInfo::Construct;
+ // Right now, arguments is in argumentsTagGPR/argumentsPayloadGPR and the register file is
+ // flushed.
+ callOperation(operationSizeFrameForVarargs, GPRInfo::returnValueGPR, argumentsTagGPR, argumentsPayloadGPR, numUsedStackSlots, data->firstVarArgOffset);
+
+ // Now we have the argument count of the callee frame, but we've lost the arguments operand.
+ // Reconstruct the arguments operand while preserving the callee frame.
+ loadArgumentsGPR(GPRInfo::returnValueGPR);
+ m_jit.move(TrustedImm32(numUsedStackSlots), scratchGPR1);
+ emitSetVarargsFrame(m_jit, GPRInfo::returnValueGPR, false, scratchGPR1, scratchGPR1);
+ m_jit.addPtr(TrustedImm32(-(sizeof(CallerFrameAndPC) + WTF::roundUpToMultipleOf(stackAlignmentBytes(), 6 * sizeof(void*)))), scratchGPR1, JITCompiler::stackPointerRegister);
+
+ callOperation(operationSetupVarargsFrame, GPRInfo::returnValueGPR, scratchGPR1, argumentsTagGPR, argumentsPayloadGPR, data->firstVarArgOffset, GPRInfo::returnValueGPR);
+ resultGPR = GPRInfo::returnValueGPR;
+ }
+
+ m_jit.addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), resultGPR, JITCompiler::stackPointerRegister);
+
+ DFG_ASSERT(m_jit.graph(), node, isFlushed());
+
+ // We don't need the arguments array anymore.
+ if (isVarargs)
+ use(node->child2());
+
+ // Now set up the "this" argument.
+ JSValueOperand thisArgument(this, node->child3());
+ GPRReg thisArgumentTagGPR = thisArgument.tagGPR();
+ GPRReg thisArgumentPayloadGPR = thisArgument.payloadGPR();
+ thisArgument.use();
+
+ m_jit.store32(thisArgumentTagGPR, JITCompiler::calleeArgumentTagSlot(0));
+ m_jit.store32(thisArgumentPayloadGPR, JITCompiler::calleeArgumentPayloadSlot(0));
+ } else {
+ // The call instruction's first child is either the function (normal call) or the
+ // receiver (method call). subsequent children are the arguments.
+ int numPassedArgs = node->numChildren() - 1;
+
+ m_jit.store32(MacroAssembler::TrustedImm32(numPassedArgs), m_jit.calleeFramePayloadSlot(JSStack::ArgumentCount));
+
+ for (int i = 0; i < numPassedArgs; i++) {
+ Edge argEdge = m_jit.graph().m_varArgChildren[node->firstChild() + 1 + i];
+ JSValueOperand arg(this, argEdge);
+ GPRReg argTagGPR = arg.tagGPR();
+ GPRReg argPayloadGPR = arg.payloadGPR();
+ use(argEdge);
+
+ m_jit.store32(argTagGPR, m_jit.calleeArgumentTagSlot(i));
+ m_jit.store32(argPayloadGPR, m_jit.calleeArgumentPayloadSlot(i));
+ }
+ }
- Edge calleeEdge = m_jit.graph().m_varArgChildren[node->firstChild()];
JSValueOperand callee(this, calleeEdge);
GPRReg calleeTagGPR = callee.tagGPR();
GPRReg calleePayloadGPR = callee.payloadGPR();
use(calleeEdge);
-
- // The call instruction's first child is either the function (normal call) or the
- // receiver (method call). subsequent children are the arguments.
- int numPassedArgs = node->numChildren() - 1;
-
- m_jit.store32(MacroAssembler::TrustedImm32(numPassedArgs + dummyThisArgument), callFramePayloadSlot(JSStack::ArgumentCount));
- m_jit.storePtr(GPRInfo::callFrameRegister, callFramePayloadSlot(JSStack::CallerFrame));
- m_jit.store32(calleePayloadGPR, callFramePayloadSlot(JSStack::Callee));
- m_jit.store32(calleeTagGPR, callFrameTagSlot(JSStack::Callee));
-
- for (int i = 0; i < numPassedArgs; i++) {
- Edge argEdge = m_jit.graph().m_varArgChildren[node->firstChild() + 1 + i];
- JSValueOperand arg(this, argEdge);
- GPRReg argTagGPR = arg.tagGPR();
- GPRReg argPayloadGPR = arg.payloadGPR();
- use(argEdge);
-
- m_jit.store32(argTagGPR, argumentTagSlot(i + dummyThisArgument));
- m_jit.store32(argPayloadGPR, argumentPayloadSlot(i + dummyThisArgument));
- }
+ m_jit.store32(calleePayloadGPR, m_jit.calleeFramePayloadSlot(JSStack::Callee));
+ m_jit.store32(calleeTagGPR, m_jit.calleeFrameTagSlot(JSStack::Callee));
flushRegisters();
- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
GPRReg resultPayloadGPR = resultPayload.gpr();
GPRReg resultTagGPR = resultTag.gpr();
JITCompiler::DataLabelPtr targetToCheck;
JITCompiler::JumpList slowPath;
- CallBeginToken token;
- m_jit.beginCall(node->codeOrigin, token);
+ m_jit.emitStoreCodeOrigin(node->origin.semantic);
- m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
-
- slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, calleeTagGPR, TrustedImm32(JSValue::CellTag)));
+ CallLinkInfo* info = m_jit.codeBlock()->addCallLinkInfo();
+
+ slowPath.append(m_jit.branchIfNotCell(callee.jsValueRegs()));
slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));
- m_jit.loadPtr(MacroAssembler::Address(calleePayloadGPR, OBJECT_OFFSETOF(JSFunction, m_scope)), resultPayloadGPR);
- m_jit.storePtr(resultPayloadGPR, MacroAssembler::Address(GPRInfo::callFrameRegister, static_cast<ptrdiff_t>(sizeof(Register)) * JSStack::ScopeChain + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
- m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag), MacroAssembler::Address(GPRInfo::callFrameRegister, static_cast<ptrdiff_t>(sizeof(Register)) * JSStack::ScopeChain + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
- CodeOrigin codeOrigin = node->codeOrigin;
JITCompiler::Call fastCall = m_jit.nearCall();
- m_jit.notifyCall(fastCall, codeOrigin, token);
JITCompiler::Jump done = m_jit.jump();
slowPath.link(&m_jit);
- if (calleeTagGPR == GPRInfo::nonArgGPR0) {
- if (calleePayloadGPR == GPRInfo::nonArgGPR1)
- m_jit.swap(GPRInfo::nonArgGPR1, GPRInfo::nonArgGPR0);
+ // Callee payload needs to be in regT0, tag in regT1
+ if (calleeTagGPR == GPRInfo::regT0) {
+ if (calleePayloadGPR == GPRInfo::regT1)
+ m_jit.swap(GPRInfo::regT1, GPRInfo::regT0);
else {
- m_jit.move(calleeTagGPR, GPRInfo::nonArgGPR1);
- m_jit.move(calleePayloadGPR, GPRInfo::nonArgGPR0);
+ m_jit.move(calleeTagGPR, GPRInfo::regT1);
+ m_jit.move(calleePayloadGPR, GPRInfo::regT0);
}
} else {
- m_jit.move(calleePayloadGPR, GPRInfo::nonArgGPR0);
- m_jit.move(calleeTagGPR, GPRInfo::nonArgGPR1);
+ m_jit.move(calleePayloadGPR, GPRInfo::regT0);
+ m_jit.move(calleeTagGPR, GPRInfo::regT1);
}
- m_jit.prepareForExceptionCheck();
+ m_jit.move(MacroAssembler::TrustedImmPtr(info), GPRInfo::regT2);
JITCompiler::Call slowCall = m_jit.nearCall();
- m_jit.notifyCall(slowCall, codeOrigin, token);
done.link(&m_jit);
jsValueResult(resultTagGPR, resultPayloadGPR, node, DataFormatJS, UseChildrenCalledExplicitly);
- m_jit.addJSCall(fastCall, slowCall, targetToCheck, callType, calleePayloadGPR, node->codeOrigin);
+ info->setUpCall(callType, node->origin.semantic, calleePayloadGPR);
+ m_jit.addJSCall(fastCall, slowCall, targetToCheck, info);
+
+ // If we were varargs, then after the calls are done, we need to reestablish our stack pointer.
+ if (isVarargs || isForwardVarargs)
+ m_jit.addPtr(TrustedImm32(m_jit.graph().stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, JITCompiler::stackPointerRegister);
}
template<bool strict>
-GPRReg SpeculativeJIT::fillSpeculateIntInternal(Edge edge, DataFormat& returnFormat)
+GPRReg SpeculativeJIT::fillSpeculateInt32Internal(Edge edge, DataFormat& returnFormat)
{
-#if DFG_ENABLE(DEBUG_VERBOSE)
- dataLogF("SpecInt@%d ", edge->index());
-#endif
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));
- value.filter(SpecInt32);
+
+ m_interpreter.filter(value, SpecInt32);
+ if (value.isClear()) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ returnFormat = DataFormatInt32;
+ return allocate();
+ }
+
VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = m_generationInfo[virtualRegister];
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
- if ((edge->hasConstant() && !isInt32Constant(edge.node())) || info.spillFormat() == DataFormatDouble) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- returnFormat = DataFormatInteger;
- return allocate();
- }
-
if (edge->hasConstant()) {
- ASSERT(isInt32Constant(edge.node()));
+ ASSERT(edge->isInt32Constant());
GPRReg gpr = allocate();
- m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);
+ m_jit.move(MacroAssembler::Imm32(edge->asInt32()), gpr);
m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- info.fillInteger(*m_stream, gpr);
- returnFormat = DataFormatInteger;
+ info.fillInt32(*m_stream, gpr);
+ returnFormat = DataFormatInt32;
return gpr;
}
DataFormat spillFormat = info.spillFormat();
- ASSERT_UNUSED(spillFormat, (spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);
+
+ ASSERT_UNUSED(spillFormat, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
// If we know this was spilled as an integer we can fill without checking.
if (type & ~SpecInt32)
GPRReg gpr = allocate();
m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
- info.fillInteger(*m_stream, gpr);
- returnFormat = DataFormatInteger;
+ info.fillInt32(*m_stream, gpr);
+ returnFormat = DataFormatInt32;
return gpr;
}
- case DataFormatJSInteger:
+ case DataFormatJSInt32:
case DataFormatJS: {
// Check the value is an integer.
GPRReg tagGPR = info.tagGPR();
m_gprs.release(tagGPR);
m_gprs.release(payloadGPR);
m_gprs.retain(payloadGPR, virtualRegister, SpillOrderInteger);
- info.fillInteger(*m_stream, payloadGPR);
+ info.fillInt32(*m_stream, payloadGPR);
// If !strict we're done, return.
- returnFormat = DataFormatInteger;
+ returnFormat = DataFormatInt32;
return payloadGPR;
}
- case DataFormatInteger: {
+ case DataFormatInt32: {
GPRReg gpr = info.gpr();
m_gprs.lock(gpr);
- returnFormat = DataFormatInteger;
+ returnFormat = DataFormatInt32;
return gpr;
}
- case DataFormatDouble:
case DataFormatCell:
case DataFormatBoolean:
case DataFormatJSDouble:
case DataFormatJSCell:
case DataFormatJSBoolean:
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- returnFormat = DataFormatInteger;
- return allocate();
-
+ case DataFormatDouble:
case DataFormatStorage:
default:
RELEASE_ASSERT_NOT_REACHED();
}
}
-GPRReg SpeculativeJIT::fillSpeculateInt(Edge edge, DataFormat& returnFormat)
+GPRReg SpeculativeJIT::fillSpeculateInt32(Edge edge, DataFormat& returnFormat)
{
- return fillSpeculateIntInternal<false>(edge, returnFormat);
+ return fillSpeculateInt32Internal<false>(edge, returnFormat);
}
-GPRReg SpeculativeJIT::fillSpeculateIntStrict(Edge edge)
+GPRReg SpeculativeJIT::fillSpeculateInt32Strict(Edge edge)
{
- DataFormat mustBeDataFormatInteger;
- GPRReg result = fillSpeculateIntInternal<true>(edge, mustBeDataFormatInteger);
- ASSERT(mustBeDataFormatInteger == DataFormatInteger);
+ DataFormat mustBeDataFormatInt32;
+ GPRReg result = fillSpeculateInt32Internal<true>(edge, mustBeDataFormatInt32);
+ ASSERT(mustBeDataFormatInt32 == DataFormatInt32);
return result;
}
FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge)
{
-#if DFG_ENABLE(DEBUG_VERBOSE)
- dataLogF("SpecDouble@%d ", edge->index());
-#endif
- AbstractValue& value = m_state.forNode(edge);
- SpeculatedType type = value.m_type;
- ASSERT(edge.useKind() != KnownNumberUse || !(value.m_type & ~SpecNumber));
- value.filter(SpecNumber);
+ ASSERT(isDouble(edge.useKind()));
+ ASSERT(edge->hasDoubleResult());
VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = m_generationInfo[virtualRegister];
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
if (info.registerFormat() == DataFormatNone) {
if (edge->hasConstant()) {
- if (isInt32Constant(edge.node())) {
- GPRReg gpr = allocate();
- m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- info.fillInteger(*m_stream, gpr);
- unlock(gpr);
- } else if (isNumberConstant(edge.node())) {
- FPRReg fpr = fprAllocate();
- m_jit.loadDouble(addressOfDoubleConstant(edge.node()), fpr);
- m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
- info.fillDouble(*m_stream, fpr);
- return fpr;
- } else {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return fprAllocate();
- }
- } else {
- DataFormat spillFormat = info.spillFormat();
- ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);
- if (spillFormat == DataFormatJSDouble || spillFormat == DataFormatDouble) {
- FPRReg fpr = fprAllocate();
- m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
- m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
- info.fillDouble(*m_stream, fpr);
- return fpr;
- }
-
+ RELEASE_ASSERT(edge->isNumberConstant());
FPRReg fpr = fprAllocate();
- JITCompiler::Jump hasUnboxedDouble;
-
- if (spillFormat != DataFormatJSInteger && spillFormat != DataFormatInteger) {
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag));
- if (type & ~SpecNumber)
- speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::AboveOrEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::LowestTag)));
- m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
- hasUnboxedDouble = m_jit.jump();
-
- isInteger.link(&m_jit);
- }
-
- m_jit.convertInt32ToDouble(JITCompiler::payloadFor(virtualRegister), fpr);
-
- if (hasUnboxedDouble.isSet())
- hasUnboxedDouble.link(&m_jit);
-
- m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
+ m_jit.loadDouble(TrustedImmPtr(m_jit.addressOfDoubleConstant(edge.node())), fpr);
+ m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
info.fillDouble(*m_stream, fpr);
- info.killSpilled();
return fpr;
}
- }
-
- switch (info.registerFormat()) {
- case DataFormatJS:
- case DataFormatJSInteger: {
- GPRReg tagGPR = info.tagGPR();
- GPRReg payloadGPR = info.payloadGPR();
+
+ RELEASE_ASSERT(info.spillFormat() == DataFormatDouble);
FPRReg fpr = fprAllocate();
-
- m_gprs.lock(tagGPR);
- m_gprs.lock(payloadGPR);
-
- JITCompiler::Jump hasUnboxedDouble;
-
- if (info.registerFormat() != DataFormatJSInteger) {
- FPRTemporary scratch(this);
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));
- if (type & ~SpecNumber)
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)));
- unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());
- hasUnboxedDouble = m_jit.jump();
- isInteger.link(&m_jit);
- }
-
- m_jit.convertInt32ToDouble(payloadGPR, fpr);
-
- if (hasUnboxedDouble.isSet())
- hasUnboxedDouble.link(&m_jit);
-
- m_gprs.release(tagGPR);
- m_gprs.release(payloadGPR);
- m_gprs.unlock(tagGPR);
- m_gprs.unlock(payloadGPR);
- m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+ m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
+ m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
info.fillDouble(*m_stream, fpr);
- info.killSpilled();
- return fpr;
- }
-
- case DataFormatInteger: {
- FPRReg fpr = fprAllocate();
- GPRReg gpr = info.gpr();
- m_gprs.lock(gpr);
- m_jit.convertInt32ToDouble(gpr, fpr);
- m_gprs.unlock(gpr);
- return fpr;
- }
-
- case DataFormatJSDouble:
- case DataFormatDouble: {
- FPRReg fpr = info.fpr();
- m_fprs.lock(fpr);
return fpr;
}
- case DataFormatNone:
- case DataFormatStorage:
- RELEASE_ASSERT_NOT_REACHED();
-
- case DataFormatCell:
- case DataFormatJSCell:
- case DataFormatBoolean:
- case DataFormatJSBoolean:
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return fprAllocate();
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return InvalidFPRReg;
- }
+ RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
+ FPRReg fpr = info.fpr();
+ m_fprs.lock(fpr);
+ return fpr;
}
GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
{
-#if DFG_ENABLE(DEBUG_VERBOSE)
- dataLogF("SpecCell@%d ", edge->index());
-#endif
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
- value.filter(SpecCell);
+
+ m_interpreter.filter(value, SpecCell);
+ if (value.isClear()) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = m_generationInfo[virtualRegister];
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
- if (info.spillFormat() == DataFormatInteger || info.spillFormat() == DataFormatDouble) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
if (edge->hasConstant()) {
- JSValue jsValue = valueOfJSConstant(edge.node());
+ JSValue jsValue = edge->asJSValue();
GPRReg gpr = allocate();
- if (jsValue.isCell()) {
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
- info.fillCell(*m_stream, gpr);
- return gpr;
- }
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
+ info.fillCell(*m_stream, gpr);
return gpr;
}
ASSERT((info.spillFormat() & DataFormatJS) || info.spillFormat() == DataFormatCell);
- if (type & ~SpecCell)
- speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)));
+ if (type & ~SpecCell) {
+ speculationCheck(
+ BadType,
+ JSValueSource(JITCompiler::addressFor(virtualRegister)),
+ edge,
+ m_jit.branch32(
+ MacroAssembler::NotEqual,
+ JITCompiler::tagFor(virtualRegister),
+ TrustedImm32(JSValue::CellTag)));
+ }
GPRReg gpr = allocate();
m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
GPRReg payloadGPR = info.payloadGPR();
m_gprs.lock(tagGPR);
m_gprs.lock(payloadGPR);
- if (type & ~SpecCell)
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::CellTag)));
+ if (type & ~SpecCell) {
+ speculationCheck(
+ BadType, JSValueRegs(tagGPR, payloadGPR), edge,
+ m_jit.branchIfNotCell(info.jsValueRegs()));
+ }
m_gprs.unlock(tagGPR);
m_gprs.release(tagGPR);
m_gprs.release(payloadGPR);
return payloadGPR;
}
- case DataFormatJSInteger:
- case DataFormatInteger:
+ case DataFormatJSInt32:
+ case DataFormatInt32:
case DataFormatJSDouble:
- case DataFormatDouble:
case DataFormatJSBoolean:
case DataFormatBoolean:
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
-
+ case DataFormatDouble:
case DataFormatStorage:
RELEASE_ASSERT_NOT_REACHED();
GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
{
-#if DFG_ENABLE(DEBUG_VERBOSE)
- dataLogF("SpecBool@%d ", edge.node()->index());
-#endif
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
- value.filter(SpecBoolean);
+
+ m_interpreter.filter(value, SpecBoolean);
+ if (value.isClear()) {
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
VirtualRegister virtualRegister = edge->virtualRegister();
- GenerationInfo& info = m_generationInfo[virtualRegister];
+ GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
switch (info.registerFormat()) {
case DataFormatNone: {
- if (info.spillFormat() == DataFormatInteger || info.spillFormat() == DataFormatDouble) {
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
if (edge->hasConstant()) {
- JSValue jsValue = valueOfJSConstant(edge.node());
+ JSValue jsValue = edge->asJSValue();
GPRReg gpr = allocate();
- if (jsValue.isBoolean()) {
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
- info.fillBoolean(*m_stream, gpr);
- return gpr;
- }
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
+ info.fillBoolean(*m_stream, gpr);
return gpr;
}
return payloadGPR;
}
- case DataFormatJSInteger:
- case DataFormatInteger:
+ case DataFormatJSInt32:
+ case DataFormatInt32:
case DataFormatJSDouble:
- case DataFormatDouble:
case DataFormatJSCell:
case DataFormatCell:
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
-
+ case DataFormatDouble:
case DataFormatStorage:
RELEASE_ASSERT_NOT_REACHED();
}
}
-JITCompiler::Jump SpeculativeJIT::convertToDouble(JSValueOperand& op, FPRReg result)
+void SpeculativeJIT::compileBaseValueStoreBarrier(Edge& baseEdge, Edge& valueEdge)
{
- FPRTemporary scratch(this);
+#if ENABLE(GGC)
+ ASSERT(!isKnownNotCell(valueEdge.node()));
- GPRReg opPayloadGPR = op.payloadGPR();
- GPRReg opTagGPR = op.tagGPR();
- FPRReg scratchFPR = scratch.fpr();
+ SpeculateCellOperand base(this, baseEdge);
+ JSValueOperand value(this, valueEdge);
+ GPRTemporary scratch1(this);
+ GPRTemporary scratch2(this);
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, opTagGPR, TrustedImm32(JSValue::Int32Tag));
- JITCompiler::Jump notNumber = m_jit.branch32(MacroAssembler::AboveOrEqual, opPayloadGPR, TrustedImm32(JSValue::LowestTag));
-
- unboxDouble(opTagGPR, opPayloadGPR, result, scratchFPR);
- JITCompiler::Jump done = m_jit.jump();
-
- isInteger.link(&m_jit);
- m_jit.convertInt32ToDouble(opPayloadGPR, result);
-
- done.link(&m_jit);
-
- return notNumber;
-}
+ writeBarrier(base.gpr(), value.tagGPR(), valueEdge, scratch1.gpr(), scratch2.gpr());
+#else
+ UNUSED_PARAM(baseEdge);
+ UNUSED_PARAM(valueEdge);
+#endif
+}
void SpeculativeJIT::compileObjectEquality(Node* node)
{
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
- if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
- m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ if (masqueradesAsUndefinedWatchpointIsStillValid()) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
} else {
- GPRTemporary structure(this);
- GPRReg structureGPR = structure.gpr();
-
- m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+ JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
m_jit.branchTest8(
MacroAssembler::NonZero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
- m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+ JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
m_jit.branchTest8(
- MacroAssembler::NonZero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(op2GPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
- GPRTemporary resultPayload(this, op2);
+ GPRTemporary resultPayload(this, Reuse, op2);
GPRReg resultPayloadGPR = resultPayload.gpr();
MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR);
booleanResult(resultPayloadGPR, node);
}
+void SpeculativeJIT::compileObjectStrictEquality(Edge objectChild, Edge otherChild)
+{
+ SpeculateCellOperand op1(this, objectChild);
+ JSValueOperand op2(this, otherChild);
+
+ GPRReg op1GPR = op1.gpr();
+ GPRReg op2GPR = op2.payloadGPR();
+
+ DFG_TYPE_CHECK(JSValueSource::unboxedCell(op1GPR), objectChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+
+ GPRTemporary resultPayload(this, Reuse, op1);
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+
+ MacroAssembler::Jump op2CellJump = m_jit.branchIfCell(op2.jsValueRegs());
+
+ m_jit.move(TrustedImm32(0), resultPayloadGPR);
+ MacroAssembler::Jump op2NotCellJump = m_jit.jump();
+
+ // At this point we know that we can perform a straight-forward equality comparison on pointer
+ // values because we are doing strict equality.
+ op2CellJump.link(&m_jit);
+ m_jit.compare32(MacroAssembler::Equal, op1GPR, op2GPR, resultPayloadGPR);
+
+ op2NotCellJump.link(&m_jit);
+ booleanResult(resultPayloadGPR, m_currentNode);
+}
+
+void SpeculativeJIT::compilePeepHoleObjectStrictEquality(Edge objectChild, Edge otherChild, Node* branchNode)
+{
+ BasicBlock* taken = branchNode->branchData()->taken.block;
+ BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+ SpeculateCellOperand op1(this, objectChild);
+ JSValueOperand op2(this, otherChild);
+
+ GPRReg op1GPR = op1.gpr();
+ GPRReg op2GPR = op2.payloadGPR();
+
+ DFG_TYPE_CHECK(JSValueSource::unboxedCell(op1GPR), objectChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+
+ branch32(MacroAssembler::NotEqual, op2.tagGPR(), TrustedImm32(JSValue::CellTag), notTaken);
+
+ if (taken == nextBlock()) {
+ branch32(MacroAssembler::NotEqual, op1GPR, op2GPR, notTaken);
+ jump(taken);
+ } else {
+ branch32(MacroAssembler::Equal, op1GPR, op2GPR, taken);
+ jump(notTaken);
+ }
+}
+
void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
{
SpeculateCellOperand op1(this, leftChild);
GPRReg op2TagGPR = op2.tagGPR();
GPRReg op2PayloadGPR = op2.payloadGPR();
GPRReg resultGPR = result.gpr();
- GPRTemporary structure;
- GPRReg structureGPR = InvalidGPRReg;
- bool masqueradesAsUndefinedWatchpointValid = m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid();
-
- if (!masqueradesAsUndefinedWatchpointValid) {
- // The masquerades as undefined case will use the structure register, so allocate it here.
- // Do this at the top of the function to avoid branching around a register allocation.
- GPRTemporary realStructure(this);
- structure.adopt(realStructure);
- structureGPR = structure.gpr();
- }
+ bool masqueradesAsUndefinedWatchpointValid =
+ masqueradesAsUndefinedWatchpointIsStillValid();
if (masqueradesAsUndefinedWatchpointValid) {
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
} else {
- m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
- MacroAssembler::Jump rightNotCell =
- m_jit.branch32(MacroAssembler::NotEqual, op2TagGPR, TrustedImm32(JSValue::CellTag));
+ MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(op2.jsValueRegs());
// We know that within this branch, rightChild must be a cell.
if (masqueradesAsUndefinedWatchpointValid) {
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
DFG_TYPE_CHECK(
- JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2PayloadGPR));
} else {
- m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
DFG_TYPE_CHECK(
- JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2PayloadGPR));
speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::Address(op2PayloadGPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
if (needsTypeCheck(rightChild, SpecCell | SpecOther)) {
- m_jit.move(op2TagGPR, resultGPR);
- m_jit.or32(TrustedImm32(1), resultGPR);
+ m_jit.or32(TrustedImm32(1), op2TagGPR, resultGPR);
typeCheck(
JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, SpecCell | SpecOther,
void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, Node* branchNode)
{
- BlockIndex taken = branchNode->takenBlockIndex();
- BlockIndex notTaken = branchNode->notTakenBlockIndex();
+ BasicBlock* taken = branchNode->branchData()->taken.block;
+ BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
SpeculateCellOperand op1(this, leftChild);
JSValueOperand op2(this, rightChild, ManualOperandSpeculation);
GPRReg op2TagGPR = op2.tagGPR();
GPRReg op2PayloadGPR = op2.payloadGPR();
GPRReg resultGPR = result.gpr();
- GPRTemporary structure;
- GPRReg structureGPR = InvalidGPRReg;
- bool masqueradesAsUndefinedWatchpointValid = m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid();
-
- if (!masqueradesAsUndefinedWatchpointValid) {
- // The masquerades as undefined case will use the structure register, so allocate it here.
- // Do this at the top of the function to avoid branching around a register allocation.
- GPRTemporary realStructure(this);
- structure.adopt(realStructure);
- structureGPR = structure.gpr();
- }
+ bool masqueradesAsUndefinedWatchpointValid =
+ masqueradesAsUndefinedWatchpointIsStillValid();
if (masqueradesAsUndefinedWatchpointValid) {
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
} else {
- m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
- MacroAssembler::Jump rightNotCell =
- m_jit.branch32(MacroAssembler::NotEqual, op2TagGPR, TrustedImm32(JSValue::CellTag));
+ MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(op2.jsValueRegs());
// We know that within this branch, rightChild must be a cell.
if (masqueradesAsUndefinedWatchpointValid) {
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
DFG_TYPE_CHECK(
JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ m_jit.branchIfNotObject(op2PayloadGPR));
} else {
- m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
DFG_TYPE_CHECK(
JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ m_jit.branchIfNotObject(op2PayloadGPR));
speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::Address(op2PayloadGPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
jump(notTaken, ForceJump);
rightNotCell.link(&m_jit);
- m_jit.move(op2TagGPR, resultGPR);
- m_jit.or32(TrustedImm32(1), resultGPR);
+ m_jit.or32(TrustedImm32(1), op2TagGPR, resultGPR);
typeCheck(
JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, SpecCell | SpecOther,
jump(notTaken);
}
-void SpeculativeJIT::compileIntegerCompare(Node* node, MacroAssembler::RelationalCondition condition)
+void SpeculativeJIT::compileInt32Compare(Node* node, MacroAssembler::RelationalCondition condition)
{
- SpeculateIntegerOperand op1(this, node->child1());
- SpeculateIntegerOperand op2(this, node->child2());
+ SpeculateInt32Operand op1(this, node->child1());
+ SpeculateInt32Operand op2(this, node->child2());
GPRTemporary resultPayload(this);
m_jit.compare32(condition, op1.gpr(), op2.gpr(), resultPayload.gpr());
booleanResult(resultPayload.gpr(), node);
}
-void SpeculativeJIT::compileValueAdd(Node* node)
-{
- JSValueOperand op1(this, node->child1());
- JSValueOperand op2(this, node->child2());
-
- GPRReg op1TagGPR = op1.tagGPR();
- GPRReg op1PayloadGPR = op1.payloadGPR();
- GPRReg op2TagGPR = op2.tagGPR();
- GPRReg op2PayloadGPR = op2.payloadGPR();
-
- flushRegisters();
-
- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
- if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
- callOperation(operationValueAddNotNumber, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
- else
- callOperation(operationValueAdd, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
-
- jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
-}
-
void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)
{
JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
GPRTemporary structure;
GPRReg structureGPR = InvalidGPRReg;
- bool masqueradesAsUndefinedWatchpointValid = m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid();
+ bool masqueradesAsUndefinedWatchpointValid =
+ masqueradesAsUndefinedWatchpointIsStillValid();
if (!masqueradesAsUndefinedWatchpointValid) {
// The masquerades as undefined case will use the structure register, so allocate it here.
structureGPR = structure.gpr();
}
- MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(value.jsValueRegs());
if (masqueradesAsUndefinedWatchpointValid) {
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
-
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ m_jit.branchIfNotObject(valuePayloadGPR));
} else {
- m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), structureGPR);
-
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- structureGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ m_jit.branchIfNotObject(valuePayloadGPR));
MacroAssembler::Jump isNotMasqueradesAsUndefined =
m_jit.branchTest8(
MacroAssembler::Zero,
- MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::Address(valuePayloadGPR, JSCell::typeInfoFlagsOffset()),
MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+ m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureIDOffset()), structureGPR);
speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
m_jit.branchPtr(
MacroAssembler::Equal,
MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->codeOrigin))));
+ MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->origin.semantic))));
isNotMasqueradesAsUndefined.link(&m_jit);
}
COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {
- m_jit.move(valueTagGPR, resultPayloadGPR);
- m_jit.or32(TrustedImm32(1), resultPayloadGPR);
+ m_jit.or32(TrustedImm32(1), valueTagGPR, resultPayloadGPR);
typeCheck(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, SpecCell | SpecOther,
m_jit.branch32(
switch (node->child1().useKind()) {
case BooleanUse: {
SpeculateBooleanOperand value(this, node->child1());
- GPRTemporary result(this, value);
+ GPRTemporary result(this, Reuse, value);
m_jit.xor32(TrustedImm32(1), value.gpr(), result.gpr());
booleanResult(result.gpr(), node);
return;
}
case Int32Use: {
- SpeculateIntegerOperand value(this, node->child1());
- GPRTemporary resultPayload(this, value);
+ SpeculateInt32Operand value(this, node->child1());
+ GPRTemporary resultPayload(this, Reuse, value);
m_jit.compare32(MacroAssembler::Equal, value.gpr(), MacroAssembler::TrustedImm32(0), resultPayload.gpr());
booleanResult(resultPayload.gpr(), node);
return;
}
- case NumberUse: {
+ case DoubleRepUse: {
SpeculateDoubleOperand value(this, node->child1());
FPRTemporary scratch(this);
GPRTemporary resultPayload(this);
case UntypedUse: {
JSValueOperand arg1(this, node->child1());
- GPRTemporary resultPayload(this, arg1, false);
+ GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
GPRReg arg1TagGPR = arg1.tagGPR();
GPRReg arg1PayloadGPR = arg1.payloadGPR();
GPRReg resultPayloadGPR = resultPayload.gpr();
addSlowPathGenerator(
slowPathCall(
- slowCase, this, dfgConvertJSValueToBoolean, resultPayloadGPR, arg1TagGPR,
+ slowCase, this, operationConvertJSValueToBoolean, resultPayloadGPR, arg1TagGPR,
arg1PayloadGPR));
m_jit.xor32(TrustedImm32(1), resultPayloadGPR);
booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
return;
}
-
+ case StringUse:
+ return compileStringZeroLength(node);
+
default:
RELEASE_ASSERT_NOT_REACHED();
break;
}
}
-void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken)
+void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
{
JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
GPRTemporary scratch(this);
GPRReg valuePayloadGPR = value.payloadGPR();
GPRReg scratchGPR = scratch.gpr();
- MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
- if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
- m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
-
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(value.jsValueRegs());
+ if (masqueradesAsUndefinedWatchpointIsStillValid()) {
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ m_jit.branchIfNotObject(valuePayloadGPR));
} else {
- m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), scratchGPR);
-
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- m_jit.branchPtr(
- MacroAssembler::Equal,
- scratchGPR,
- MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get())));
+ m_jit.branchIfNotObject(valuePayloadGPR));
- JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+ JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(
+ JITCompiler::Zero,
+ MacroAssembler::Address(valuePayloadGPR, JSCell::typeInfoFlagsOffset()),
+ TrustedImm32(MasqueradesAsUndefined));
+ m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureIDOffset()), scratchGPR);
speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
m_jit.branchPtr(
MacroAssembler::Equal,
MacroAssembler::Address(scratchGPR, Structure::globalObjectOffset()),
- MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->codeOrigin))));
+ MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_currentNode->origin.semantic))));
isNotMasqueradesAsUndefined.link(&m_jit);
}
COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {
- m_jit.move(valueTagGPR, scratchGPR);
- m_jit.or32(TrustedImm32(1), scratchGPR);
+ m_jit.or32(TrustedImm32(1), valueTagGPR, scratchGPR);
typeCheck(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, SpecCell | SpecOther,
m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));
void SpeculativeJIT::emitBranch(Node* node)
{
- BlockIndex taken = node->takenBlockIndex();
- BlockIndex notTaken = node->notTakenBlockIndex();
+ BasicBlock* taken = node->branchData()->taken.block;
+ BasicBlock* notTaken = node->branchData()->notTaken.block;
switch (node->child1().useKind()) {
case BooleanUse: {
if (taken == nextBlock()) {
condition = MacroAssembler::Zero;
- BlockIndex tmp = taken;
+ BasicBlock* tmp = taken;
taken = notTaken;
notTaken = tmp;
}
emitObjectOrOtherBranch(node->child1(), taken, notTaken);
return;
}
-
- case NumberUse:
+
+ case StringUse: {
+ emitStringBranch(node->child1(), taken, notTaken);
+ return;
+ }
+
+ case DoubleRepUse:
case Int32Use: {
if (node->child1().useKind() == Int32Use) {
bool invert = false;
if (taken == nextBlock()) {
invert = true;
- BlockIndex tmp = taken;
+ BasicBlock* tmp = taken;
taken = notTaken;
notTaken = tmp;
}
- SpeculateIntegerOperand value(this, node->child1());
+ SpeculateInt32Operand value(this, node->child1());
branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr(), taken);
} else {
SpeculateDoubleOperand value(this, node->child1());
slowPath.link(&m_jit);
silentSpillAllRegisters(resultGPR);
- callOperation(dfgConvertJSValueToBoolean, resultGPR, valueTagGPR, valuePayloadGPR);
+ callOperation(operationConvertJSValueToBoolean, resultGPR, valueTagGPR, valuePayloadGPR);
silentFillAllRegisters(resultGPR);
branchTest32(JITCompiler::NonZero, resultGPR, taken);
if (arrayMode.isInBounds()) {
speculationCheck(
- StoreToHoleOrOutOfBounds, JSValueRegs(), 0,
+ OutOfBounds, JSValueRegs(), 0,
m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
} else {
MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
storage.use();
if (arrayMode.isOutOfBounds()) {
- addSlowPathGenerator(
- slowPathCall(
+ if (node->op() == PutByValDirect) {
+ addSlowPathGenerator(slowPathCall(
+ slowCase, this,
+ m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,
+ NoResult, baseReg, propertyReg, valueTag, valuePayloadReg));
+ } else {
+ addSlowPathGenerator(slowPathCall(
slowCase, this,
m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
NoResult, baseReg, propertyReg, valueTag, valuePayloadReg));
+ }
}
noResult(node, UseChildrenCalledExplicitly);
switch (op) {
case JSConstant:
- initConstantInfo(node);
- break;
-
- case PhantomArguments:
- initConstantInfo(node);
- break;
-
- case WeakJSConstant:
- m_jit.addWeakReference(node->weakConstant());
+ case DoubleConstant:
+ case PhantomDirectArguments:
+ case PhantomClonedArguments:
initConstantInfo(node);
break;
case Identity: {
- RELEASE_ASSERT_NOT_REACHED();
+ speculate(node, node->child1());
+ switch (node->child1().useKind()) {
+ case DoubleRepUse:
+ case DoubleRepRealUse: {
+ SpeculateDoubleOperand op(this, node->child1());
+ doubleResult(op.fpr(), node);
+ break;
+ }
+ case Int52RepUse:
+ case MachineIntUse:
+ case DoubleRepMachineIntUse: {
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+ default: {
+ JSValueOperand op(this, node->child1());
+ jsValueResult(op.tagGPR(), op.payloadGPR(), node);
+ break;
+ }
+ } // switch
break;
}
case GetLocal: {
- SpeculatedType prediction = node->variableAccessData()->prediction();
AbstractValue& value = m_state.variables().operand(node->local());
- // If we have no prediction for this local, then don't attempt to compile.
- if (prediction == SpecNone) {
- terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
- break;
- }
-
// If the CFA is tracking this variable and it found that the variable
// cannot have been assigned, then don't attempt to proceed.
if (value.isClear()) {
- // FIXME: We should trap instead.
- // https://bugs.webkit.org/show_bug.cgi?id=110383
- terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+ m_compileOkay = false;
break;
}
- if (node->variableAccessData()->shouldUseDoubleFormat()) {
+ switch (node->variableAccessData()->flushFormat()) {
+ case FlushedDouble: {
FPRTemporary result(this);
- m_jit.loadDouble(JITCompiler::addressFor(node->local()), result.fpr());
+ m_jit.loadDouble(JITCompiler::addressFor(node->machineLocal()), result.fpr());
VirtualRegister virtualRegister = node->virtualRegister();
m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
- m_generationInfo[virtualRegister].initDouble(node, node->refCount(), result.fpr());
+ generationInfoFromVirtualRegister(virtualRegister).initDouble(node, node->refCount(), result.fpr());
break;
}
- if (isInt32Speculation(value.m_type)) {
+ case FlushedInt32: {
GPRTemporary result(this);
- m_jit.load32(JITCompiler::payloadFor(node->local()), result.gpr());
+ m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
- // Like integerResult, but don't useChildren - our children are phi nodes,
+ // Like int32Result, but don't useChildren - our children are phi nodes,
// and don't represent values within this dataflow with virtual registers.
VirtualRegister virtualRegister = node->virtualRegister();
m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
- m_generationInfo[virtualRegister].initInteger(node, node->refCount(), result.gpr());
+ generationInfoFromVirtualRegister(virtualRegister).initInt32(node, node->refCount(), result.gpr());
break;
}
- if (isCellSpeculation(value.m_type)) {
+ case FlushedCell: {
GPRTemporary result(this);
- m_jit.load32(JITCompiler::payloadFor(node->local()), result.gpr());
+ m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
// Like cellResult, but don't useChildren - our children are phi nodes,
// and don't represent values within this dataflow with virtual registers.
VirtualRegister virtualRegister = node->virtualRegister();
m_gprs.retain(result.gpr(), virtualRegister, SpillOrderCell);
- m_generationInfo[virtualRegister].initCell(node, node->refCount(), result.gpr());
+ generationInfoFromVirtualRegister(virtualRegister).initCell(node, node->refCount(), result.gpr());
break;
}
-
- if (isBooleanSpeculation(value.m_type)) {
+
+ case FlushedBoolean: {
GPRTemporary result(this);
- m_jit.load32(JITCompiler::payloadFor(node->local()), result.gpr());
+ m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
// Like booleanResult, but don't useChildren - our children are phi nodes,
// and don't represent values within this dataflow with virtual registers.
VirtualRegister virtualRegister = node->virtualRegister();
m_gprs.retain(result.gpr(), virtualRegister, SpillOrderBoolean);
- m_generationInfo[virtualRegister].initBoolean(node, node->refCount(), result.gpr());
+ generationInfoFromVirtualRegister(virtualRegister).initBoolean(node, node->refCount(), result.gpr());
break;
}
-
- GPRTemporary result(this);
- GPRTemporary tag(this);
- m_jit.load32(JITCompiler::payloadFor(node->local()), result.gpr());
- m_jit.load32(JITCompiler::tagFor(node->local()), tag.gpr());
-
- // Like jsValueResult, but don't useChildren - our children are phi nodes,
- // and don't represent values within this dataflow with virtual registers.
- VirtualRegister virtualRegister = node->virtualRegister();
- m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
- m_gprs.retain(tag.gpr(), virtualRegister, SpillOrderJS);
-
- m_generationInfo[virtualRegister].initJSValue(node, node->refCount(), tag.gpr(), result.gpr(), DataFormatJS);
+
+ case FlushedJSValue: {
+ GPRTemporary result(this);
+ GPRTemporary tag(this);
+ m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
+ m_jit.load32(JITCompiler::tagFor(node->machineLocal()), tag.gpr());
+
+ // Like jsValueResult, but don't useChildren - our children are phi nodes,
+ // and don't represent values within this dataflow with virtual registers.
+ VirtualRegister virtualRegister = node->virtualRegister();
+ m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
+ m_gprs.retain(tag.gpr(), virtualRegister, SpillOrderJS);
+
+ generationInfoFromVirtualRegister(virtualRegister).initJSValue(node, node->refCount(), tag.gpr(), result.gpr(), DataFormatJS);
+ break;
+ }
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ }
break;
}
case GetLocalUnlinked: {
GPRTemporary payload(this);
GPRTemporary tag(this);
- m_jit.load32(JITCompiler::payloadFor(node->unlinkedLocal()), payload.gpr());
- m_jit.load32(JITCompiler::tagFor(node->unlinkedLocal()), tag.gpr());
+ m_jit.load32(JITCompiler::payloadFor(node->unlinkedMachineLocal()), payload.gpr());
+ m_jit.load32(JITCompiler::tagFor(node->unlinkedMachineLocal()), tag.gpr());
jsValueResult(tag.gpr(), payload.gpr(), node);
break;
}
- case MovHintAndCheck: {
- compileMovHintAndCheck(node);
+ case MovHint: {
+ compileMovHint(m_currentNode);
+ noResult(node);
break;
}
- case InlineStart: {
- compileInlineStart(node);
- break;
- }
-
- case MovHint:
case ZombieHint: {
- RELEASE_ASSERT_NOT_REACHED();
+ recordSetLocal(m_currentNode->unlinkedLocal(), VirtualRegister(), DataFormatDead);
+ noResult(node);
break;
}
-
+
case SetLocal: {
- // SetLocal doubles as a hint as to where a node will be stored and
- // as a speculation point. So before we speculate make sure that we
- // know where the child of this node needs to go in the virtual
- // stack.
- compileMovHint(node);
-
- if (node->variableAccessData()->shouldUnboxIfPossible()) {
- if (node->variableAccessData()->shouldUseDoubleFormat()) {
- SpeculateDoubleOperand value(this, node->child1());
- m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->local()));
- noResult(node);
- // Indicate that it's no longer necessary to retrieve the value of
- // this bytecode variable from registers or other locations in the stack,
- // but that it is stored as a double.
- recordSetLocal(node->local(), ValueSource(DoubleInJSStack));
- break;
- }
- SpeculatedType predictedType = node->variableAccessData()->argumentAwarePrediction();
- if (m_generationInfo[node->child1()->virtualRegister()].registerFormat() == DataFormatDouble) {
- SpeculateDoubleOperand value(this, node->child1(), ManualOperandSpeculation);
- m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->local()));
- noResult(node);
- recordSetLocal(node->local(), ValueSource(DoubleInJSStack));
- break;
- }
- if (isInt32Speculation(predictedType)) {
- SpeculateIntegerOperand value(this, node->child1());
- m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->local()));
- noResult(node);
- recordSetLocal(node->local(), ValueSource(Int32InJSStack));
- break;
- }
- if (isCellSpeculation(predictedType)) {
- SpeculateCellOperand cell(this, node->child1());
- GPRReg cellGPR = cell.gpr();
- m_jit.storePtr(cellGPR, JITCompiler::payloadFor(node->local()));
- noResult(node);
- recordSetLocal(node->local(), ValueSource(CellInJSStack));
- break;
- }
- if (isBooleanSpeculation(predictedType)) {
- SpeculateBooleanOperand value(this, node->child1());
- m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->local()));
- noResult(node);
- recordSetLocal(node->local(), ValueSource(BooleanInJSStack));
- break;
- }
+ switch (node->variableAccessData()->flushFormat()) {
+ case FlushedDouble: {
+ SpeculateDoubleOperand value(this, node->child1());
+ m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->machineLocal()));
+ noResult(node);
+ // Indicate that it's no longer necessary to retrieve the value of
+ // this bytecode variable from registers or other locations in the stack,
+ // but that it is stored as a double.
+ recordSetLocal(DataFormatDouble);
+ break;
+ }
+
+ case FlushedInt32: {
+ SpeculateInt32Operand value(this, node->child1());
+ m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->machineLocal()));
+ noResult(node);
+ recordSetLocal(DataFormatInt32);
+ break;
+ }
+
+ case FlushedCell: {
+ SpeculateCellOperand cell(this, node->child1());
+ GPRReg cellGPR = cell.gpr();
+ m_jit.storePtr(cellGPR, JITCompiler::payloadFor(node->machineLocal()));
+ noResult(node);
+ recordSetLocal(DataFormatCell);
+ break;
+ }
+
+ case FlushedBoolean: {
+ SpeculateBooleanOperand value(this, node->child1());
+ m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->machineLocal()));
+ noResult(node);
+ recordSetLocal(DataFormatBoolean);
+ break;
+ }
+
+ case FlushedJSValue: {
+ JSValueOperand value(this, node->child1());
+ m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node->machineLocal()));
+ m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node->machineLocal()));
+ noResult(node);
+ recordSetLocal(dataFormatFor(node->variableAccessData()->flushFormat()));
+ break;
+ }
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
}
- JSValueOperand value(this, node->child1());
- m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node->local()));
- m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node->local()));
- noResult(node);
- recordSetLocal(node->local(), ValueSource(ValueInJSStack));
-
- // If we're storing an arguments object that has been optimized away,
- // our variable event stream for OSR exit now reflects the optimized
- // value (JSValue()). On the slow path, we want an arguments object
- // instead. We add an additional move hint to show OSR exit that it
- // needs to reconstruct the arguments object.
- if (node->child1()->op() == PhantomArguments)
- compileMovHint(node);
-
break;
}
// But it may be profitable to use this as a hook to run speculation checks
// on arguments, thereby allowing us to trivially eliminate such checks if
// the argument is not used.
+ recordSetLocal(dataFormatFor(node->variableAccessData()->flushFormat()));
break;
case BitAnd:
case BitOr:
case BitXor:
- if (isInt32Constant(node->child1().node())) {
- SpeculateIntegerOperand op2(this, node->child2());
- GPRTemporary result(this, op2);
+ if (node->child1()->isInt32Constant()) {
+ SpeculateInt32Operand op2(this, node->child2());
+ GPRTemporary result(this, Reuse, op2);
- bitOp(op, valueOfInt32Constant(node->child1().node()), op2.gpr(), result.gpr());
+ bitOp(op, node->child1()->asInt32(), op2.gpr(), result.gpr());
- integerResult(result.gpr(), node);
- } else if (isInt32Constant(node->child2().node())) {
- SpeculateIntegerOperand op1(this, node->child1());
- GPRTemporary result(this, op1);
+ int32Result(result.gpr(), node);
+ } else if (node->child2()->isInt32Constant()) {
+ SpeculateInt32Operand op1(this, node->child1());
+ GPRTemporary result(this, Reuse, op1);
- bitOp(op, valueOfInt32Constant(node->child2().node()), op1.gpr(), result.gpr());
+ bitOp(op, node->child2()->asInt32(), op1.gpr(), result.gpr());
- integerResult(result.gpr(), node);
+ int32Result(result.gpr(), node);
} else {
- SpeculateIntegerOperand op1(this, node->child1());
- SpeculateIntegerOperand op2(this, node->child2());
- GPRTemporary result(this, op1, op2);
+ SpeculateInt32Operand op1(this, node->child1());
+ SpeculateInt32Operand op2(this, node->child2());
+ GPRTemporary result(this, Reuse, op1, op2);
GPRReg reg1 = op1.gpr();
GPRReg reg2 = op2.gpr();
bitOp(op, reg1, reg2, result.gpr());
- integerResult(result.gpr(), node);
+ int32Result(result.gpr(), node);
}
break;
case BitRShift:
case BitLShift:
case BitURShift:
- if (isInt32Constant(node->child2().node())) {
- SpeculateIntegerOperand op1(this, node->child1());
- GPRTemporary result(this, op1);
+ if (node->child2()->isInt32Constant()) {
+ SpeculateInt32Operand op1(this, node->child1());
+ GPRTemporary result(this, Reuse, op1);
- shiftOp(op, op1.gpr(), valueOfInt32Constant(node->child2().node()) & 0x1f, result.gpr());
+ shiftOp(op, op1.gpr(), node->child2()->asInt32() & 0x1f, result.gpr());
- integerResult(result.gpr(), node);
+ int32Result(result.gpr(), node);
} else {
// Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
- SpeculateIntegerOperand op1(this, node->child1());
- SpeculateIntegerOperand op2(this, node->child2());
- GPRTemporary result(this, op1);
+ SpeculateInt32Operand op1(this, node->child1());
+ SpeculateInt32Operand op2(this, node->child2());
+ GPRTemporary result(this, Reuse, op1);
GPRReg reg1 = op1.gpr();
GPRReg reg2 = op2.gpr();
shiftOp(op, reg1, reg2, result.gpr());
- integerResult(result.gpr(), node);
+ int32Result(result.gpr(), node);
}
break;
break;
}
- case Int32ToDouble:
- case ForwardInt32ToDouble: {
- compileInt32ToDouble(node);
+ case DoubleRep: {
+ compileDoubleRep(node);
+ break;
+ }
+
+ case ValueRep: {
+ compileValueRep(node);
break;
}
- case ValueAdd:
+ case ValueAdd: {
+ JSValueOperand op1(this, node->child1());
+ JSValueOperand op2(this, node->child2());
+
+ GPRReg op1TagGPR = op1.tagGPR();
+ GPRReg op1PayloadGPR = op1.payloadGPR();
+ GPRReg op2TagGPR = op2.tagGPR();
+ GPRReg op2PayloadGPR = op2.payloadGPR();
+
+ flushRegisters();
+
+ GPRFlushedCallResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
+ if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
+ callOperation(operationValueAddNotNumber, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
+ else
+ callOperation(operationValueAdd, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
+
+ jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+ break;
+ }
+
case ArithAdd:
compileAdd(node);
break;
+ case ArithClz32:
+ compileArithClz32(node);
+ break;
+
case MakeRope:
compileMakeRope(node);
break;
compileArithMul(node);
break;
- case ArithIMul:
- compileArithIMul(node);
- break;
-
case ArithDiv: {
- switch (node->binaryUseKind()) {
- case Int32Use: {
-#if CPU(X86)
- compileIntegerArithDivForX86(node);
-#elif CPU(ARM64)
- compileIntegerArithDivForARM64(node);
-#elif CPU(APPLE_ARMV7S)
- compileIntegerArithDivForARMv7s(node);
-#else // CPU type without integer divide
- RELEASE_ASSERT_NOT_REACHED(); // should have been coverted into a double divide.
-#endif
- break;
- }
-
- case NumberUse: {
- SpeculateDoubleOperand op1(this, node->child1());
- SpeculateDoubleOperand op2(this, node->child2());
- FPRTemporary result(this, op1);
-
- FPRReg reg1 = op1.fpr();
- FPRReg reg2 = op2.fpr();
- m_jit.divDouble(reg1, reg2, result.fpr());
-
- doubleResult(result.fpr(), node);
- break;
- }
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
+ compileArithDiv(node);
break;
}
break;
}
+ case ArithPow: {
+ compileArithPow(node);
+ break;
+ }
+
case ArithAbs: {
switch (node->child1().useKind()) {
case Int32Use: {
- SpeculateIntegerOperand op1(this, node->child1());
- GPRTemporary result(this, op1);
+ SpeculateStrictInt32Operand op1(this, node->child1());
+ GPRTemporary result(this, Reuse, op1);
GPRTemporary scratch(this);
- m_jit.zeroExtend32ToPtr(op1.gpr(), result.gpr());
+ m_jit.move(op1.gpr(), result.gpr());
m_jit.rshift32(result.gpr(), MacroAssembler::TrustedImm32(31), scratch.gpr());
m_jit.add32(scratch.gpr(), result.gpr());
m_jit.xor32(scratch.gpr(), result.gpr());
speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::Equal, result.gpr(), MacroAssembler::TrustedImm32(1 << 31)));
- integerResult(result.gpr(), node);
+ int32Result(result.gpr(), node);
break;
}
- case NumberUse: {
+ case DoubleRepUse: {
SpeculateDoubleOperand op1(this, node->child1());
FPRTemporary result(this);
case Int32Use: {
SpeculateStrictInt32Operand op1(this, node->child1());
SpeculateStrictInt32Operand op2(this, node->child2());
- GPRTemporary result(this, op1);
+ GPRTemporary result(this, Reuse, op1);
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
} else
op1Less.link(&m_jit);
- integerResult(resultGPR, node);
+ int32Result(resultGPR, node);
break;
}
- case NumberUse: {
+ case DoubleRepUse: {
SpeculateDoubleOperand op1(this, node->child1());
SpeculateDoubleOperand op2(this, node->child2());
FPRTemporary result(this, op1);
}
break;
}
-
- case ArithSqrt: {
+
+ case ArithSqrt:
+ compileArithSqrt(node);
+ break;
+
+ case ArithFRound: {
SpeculateDoubleOperand op1(this, node->child1());
FPRTemporary result(this, op1);
- m_jit.sqrtDouble(op1.fpr(), result.fpr());
+ m_jit.convertDoubleToFloat(op1.fpr(), result.fpr());
+ m_jit.convertFloatToDouble(result.fpr(), result.fpr());
doubleResult(result.fpr(), node);
break;
}
- case LogicalNot:
- compileLogicalNot(node);
+ case ArithRound:
+ compileArithRound(node);
break;
- case CompareLess:
- if (compare(node, JITCompiler::LessThan, JITCompiler::DoubleLessThan, operationCompareLess))
- return;
- break;
+ case ArithSin: {
+ SpeculateDoubleOperand op1(this, node->child1());
+ FPRReg op1FPR = op1.fpr();
- case CompareLessEq:
- if (compare(node, JITCompiler::LessThanOrEqual, JITCompiler::DoubleLessThanOrEqual, operationCompareLessEq))
+ flushRegisters();
+
+ FPRResult result(this);
+ callOperation(sin, result.fpr(), op1FPR);
+ doubleResult(result.fpr(), node);
+ break;
+ }
+
+ case ArithCos: {
+ SpeculateDoubleOperand op1(this, node->child1());
+ FPRReg op1FPR = op1.fpr();
+
+ flushRegisters();
+
+ FPRResult result(this);
+ callOperation(cos, result.fpr(), op1FPR);
+ doubleResult(result.fpr(), node);
+ break;
+ }
+
+ case ArithLog:
+ compileArithLog(node);
+ break;
+
+ case LogicalNot:
+ compileLogicalNot(node);
+ break;
+
+ case CompareLess:
+ if (compare(node, JITCompiler::LessThan, JITCompiler::DoubleLessThan, operationCompareLess))
+ return;
+ break;
+
+ case CompareLessEq:
+ if (compare(node, JITCompiler::LessThanOrEqual, JITCompiler::DoubleLessThanOrEqual, operationCompareLessEq))
return;
break;
break;
case CompareEqConstant:
- ASSERT(isNullConstant(node->child2().node()));
+ ASSERT(node->child2()->asJSValue().isNull());
if (nonSpeculativeCompareNull(node, node->child1()))
return;
break;
return;
break;
- case CompareStrictEqConstant:
- if (compileStrictEqForConstant(node, node->child1(), valueOfJSConstant(node->child2().node())))
- return;
- break;
-
case CompareStrictEq:
if (compileStrictEq(node))
return;
case Array::SelectUsingPredictions:
case Array::ForceExit:
RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+#endif
break;
case Array::Generic: {
SpeculateCellOperand base(this, node->child1()); // Save a register, speculate cell. We'll probably be right.
GPRReg propertyPayloadGPR = property.payloadGPR();
flushRegisters();
- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
callOperation(operationGetByValCell, resultTag.gpr(), resultPayload.gpr(), baseGPR, propertyTagGPR, propertyPayloadGPR);
jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
GPRTemporary resultPayload(this);
if (node->arrayMode().type() == Array::Int32) {
+ ASSERT(!node->arrayMode().isSaneChain());
+
speculationCheck(
OutOfBounds, JSValueRegs(), 0,
m_jit.branch32(
MacroAssembler::Equal,
- MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)),
+ MacroAssembler::BaseIndex(
+ storageReg, propertyReg, MacroAssembler::TimesEight, TagOffset),
TrustedImm32(JSValue::EmptyValueTag)));
- m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
- integerResult(resultPayload.gpr(), node);
+ m_jit.load32(
+ MacroAssembler::BaseIndex(
+ storageReg, propertyReg, MacroAssembler::TimesEight, PayloadOffset),
+ resultPayload.gpr());
+ int32Result(resultPayload.gpr(), node);
break;
}
GPRTemporary resultTag(this);
- m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
- speculationCheck(LoadFromHole, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
- m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
+ m_jit.load32(
+ MacroAssembler::BaseIndex(
+ storageReg, propertyReg, MacroAssembler::TimesEight, TagOffset),
+ resultTag.gpr());
+ m_jit.load32(
+ MacroAssembler::BaseIndex(
+ storageReg, propertyReg, MacroAssembler::TimesEight, PayloadOffset),
+ resultPayload.gpr());
+ if (node->arrayMode().isSaneChain()) {
+ JITCompiler::Jump notHole = m_jit.branch32(
+ MacroAssembler::NotEqual, resultTag.gpr(),
+ TrustedImm32(JSValue::EmptyValueTag));
+ m_jit.move(TrustedImm32(JSValue::UndefinedTag), resultTag.gpr());
+ m_jit.move(TrustedImm32(0), resultPayload.gpr());
+ notHole.link(&m_jit);
+ } else {
+ speculationCheck(
+ LoadFromHole, JSValueRegs(), 0,
+ m_jit.branch32(
+ MacroAssembler::Equal, resultTag.gpr(),
+ TrustedImm32(JSValue::EmptyValueTag)));
+ }
jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
break;
}
}
case Array::Double: {
if (node->arrayMode().isInBounds()) {
- if (node->arrayMode().isSaneChain()) {
- JSGlobalObject* globalObject = m_jit.globalObjectFor(node->codeOrigin);
- ASSERT(globalObject->arrayPrototypeChainIsSane());
- globalObject->arrayPrototype()->structure()->addTransitionWatchpoint(speculationWatchpoint());
- globalObject->objectPrototype()->structure()->addTransitionWatchpoint(speculationWatchpoint());
- }
-
SpeculateStrictInt32Operand property(this, node->child2());
StorageOperand storage(this, node->child3());
case Array::String:
compileGetByValOnString(node);
break;
- case Array::Arguments:
- compileGetByValOnArguments(node);
- break;
- case Array::Int8Array:
- compileGetByValOnIntTypedArray(m_jit.vm()->int8ArrayDescriptor(), node, sizeof(int8_t), SignedTypedArray);
- break;
- case Array::Int16Array:
- compileGetByValOnIntTypedArray(m_jit.vm()->int16ArrayDescriptor(), node, sizeof(int16_t), SignedTypedArray);
- break;
- case Array::Int32Array:
- compileGetByValOnIntTypedArray(m_jit.vm()->int32ArrayDescriptor(), node, sizeof(int32_t), SignedTypedArray);
- break;
- case Array::Uint8Array:
- compileGetByValOnIntTypedArray(m_jit.vm()->uint8ArrayDescriptor(), node, sizeof(uint8_t), UnsignedTypedArray);
- break;
- case Array::Uint8ClampedArray:
- compileGetByValOnIntTypedArray(m_jit.vm()->uint8ClampedArrayDescriptor(), node, sizeof(uint8_t), UnsignedTypedArray);
- break;
- case Array::Uint16Array:
- compileGetByValOnIntTypedArray(m_jit.vm()->uint16ArrayDescriptor(), node, sizeof(uint16_t), UnsignedTypedArray);
- break;
- case Array::Uint32Array:
- compileGetByValOnIntTypedArray(m_jit.vm()->uint32ArrayDescriptor(), node, sizeof(uint32_t), UnsignedTypedArray);
+ case Array::DirectArguments:
+ compileGetByValOnDirectArguments(node);
break;
- case Array::Float32Array:
- compileGetByValOnFloatTypedArray(m_jit.vm()->float32ArrayDescriptor(), node, sizeof(float));
+ case Array::ScopedArguments:
+ compileGetByValOnScopedArguments(node);
break;
- case Array::Float64Array:
- compileGetByValOnFloatTypedArray(m_jit.vm()->float64ArrayDescriptor(), node, sizeof(double));
- break;
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
+ default: {
+ TypedArrayType type = node->arrayMode().typedArrayType();
+ if (isInt(type))
+ compileGetByValOnIntTypedArray(node, type);
+ else
+ compileGetByValOnFloatTypedArray(node, type);
+ } }
break;
}
+ case PutByValDirect:
case PutByVal:
case PutByValAlias: {
Edge child1 = m_jit.graph().varArgChild(node, 0);
case Array::SelectUsingPredictions:
case Array::ForceExit:
RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
alreadyHandled = true;
+#endif
break;
case Array::Generic: {
- ASSERT(node->op() == PutByVal);
+ ASSERT(node->op() == PutByVal || node->op() == PutByValDirect);
SpeculateCellOperand base(this, child1); // Save a register, speculate cell. We'll probably be right.
JSValueOperand property(this, child2);
GPRReg valuePayloadGPR = value.payloadGPR();
flushRegisters();
- callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValCellStrict : operationPutByValCellNonStrict, baseGPR, propertyTagGPR, propertyPayloadGPR, valueTagGPR, valuePayloadGPR);
+ if (node->op() == PutByValDirect)
+ callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectCellStrict : operationPutByValDirectCellNonStrict, baseGPR, propertyTagGPR, propertyPayloadGPR, valueTagGPR, valuePayloadGPR);
+ else
+ callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValCellStrict : operationPutByValCellNonStrict, baseGPR, propertyTagGPR, propertyPayloadGPR, valueTagGPR, valuePayloadGPR);
noResult(node);
alreadyHandled = true;
switch (arrayMode.type()) {
case Array::Int32: {
- SpeculateIntegerOperand value(this, child3);
+ SpeculateInt32Operand value(this, child3);
GPRReg valuePayloadReg = value.gpr();
if (!m_compileOkay)
return;
-
- if (Heap::isWriteBarrierEnabled()) {
- GPRTemporary scratch(this);
- writeBarrier(baseReg, valueTagReg, child3, WriteBarrierForPropertyAccess, scratch.gpr());
- }
-
+
compileContiguousPutByVal(node, base, property, value, valuePayloadReg, valueTagReg);
break;
}
if (!m_compileOkay)
return;
-
- {
- GPRTemporary scratch(this);
- GPRReg scratchReg = scratch.gpr();
- writeBarrier(baseReg, valueTagReg, child3, WriteBarrierForPropertyAccess, scratchReg);
- }
-
+
StorageOperand storage(this, child4);
GPRReg storageReg = storage.gpr();
storage.use();
if (!slowCases.empty()) {
- addSlowPathGenerator(
- slowPathCall(
+ if (node->op() == PutByValDirect) {
+ addSlowPathGenerator(slowPathCall(
+ slowCases, this,
+ m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,
+ NoResult, baseReg, propertyReg, valueTagReg, valuePayloadReg));
+ } else {
+ addSlowPathGenerator(slowPathCall(
slowCases, this,
m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
NoResult, baseReg, propertyReg, valueTagReg, valuePayloadReg));
+ }
}
noResult(node, UseChildrenCalledExplicitly);
break;
}
- case Array::Arguments:
- // FIXME: we could at some point make this work. Right now we're assuming that the register
- // pressure would be too great.
- RELEASE_ASSERT_NOT_REACHED();
- break;
-
- case Array::Int8Array:
- compilePutByValForIntTypedArray(m_jit.vm()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), SignedTypedArray);
- break;
-
- case Array::Int16Array:
- compilePutByValForIntTypedArray(m_jit.vm()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), SignedTypedArray);
- break;
-
- case Array::Int32Array:
- compilePutByValForIntTypedArray(m_jit.vm()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), SignedTypedArray);
- break;
-
- case Array::Uint8Array:
- compilePutByValForIntTypedArray(m_jit.vm()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), UnsignedTypedArray);
- break;
-
- case Array::Uint8ClampedArray:
- compilePutByValForIntTypedArray(m_jit.vm()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), UnsignedTypedArray, ClampRounding);
- break;
-
- case Array::Uint16Array:
- compilePutByValForIntTypedArray(m_jit.vm()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), UnsignedTypedArray);
- break;
-
- case Array::Uint32Array:
- compilePutByValForIntTypedArray(m_jit.vm()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), UnsignedTypedArray);
- break;
-
- case Array::Float32Array:
- compilePutByValForFloatTypedArray(m_jit.vm()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float));
- break;
-
- case Array::Float64Array:
- compilePutByValForFloatTypedArray(m_jit.vm()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double));
- break;
-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
+ default: {
+ TypedArrayType type = arrayMode.typedArrayType();
+ if (isInt(type))
+ compilePutByValForIntTypedArray(base.gpr(), property.gpr(), node, type);
+ else
+ compilePutByValForFloatTypedArray(base.gpr(), property.gpr(), node, type);
+ } }
break;
}
GPRReg argumentGPR = argument.gpr();
flushRegisters();
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
// Must use jsValueResult because otherwise we screw up register
GPRReg argumentGPR = argument.gpr();
flushRegisters();
- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
callOperation(operationRegExpExec, resultTag.gpr(), resultPayload.gpr(), baseGPR, argumentGPR);
jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
GPRReg argumentGPR = argument.gpr();
flushRegisters();
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
// If we add a DataFormatBool, we should use it here.
switch (node->arrayMode().type()) {
case Array::Int32: {
- SpeculateIntegerOperand value(this, node->child2());
+ SpeculateInt32Operand value(this, node->child2());
GPRReg valuePayloadGPR = value.gpr();
m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
GPRReg valueTagGPR = value.tagGPR();
GPRReg valuePayloadGPR = value.payloadGPR();
- if (Heap::isWriteBarrierEnabled()) {
- GPRTemporary scratch(this);
- writeBarrier(baseGPR, valueTagGPR, node->child2(), WriteBarrierForPropertyAccess, scratch.gpr(), storageLengthGPR);
- }
-
m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
m_jit.store32(valueTagGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
FPRReg valueFPR = value.fpr();
DFG_TYPE_CHECK(
- JSValueRegs(), node->child2(), SpecRealNumber,
+ JSValueRegs(), node->child2(), SpecDoubleReal,
m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));
m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
GPRReg valueTagGPR = value.tagGPR();
GPRReg valuePayloadGPR = value.payloadGPR();
- if (Heap::isWriteBarrierEnabled()) {
- GPRTemporary scratch(this);
- writeBarrier(baseGPR, valueTagGPR, node->child2(), WriteBarrierForPropertyAccess, scratch.gpr(), storageLengthGPR);
- }
-
m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
// Refuse to handle bizarre lengths.
MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight),
tempFPR);
MacroAssembler::Jump slowCase = m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, tempFPR, tempFPR);
- JSValue nan = JSValue(JSValue::EncodeAsDouble, QNaN);
+ JSValue nan = JSValue(JSValue::EncodeAsDouble, PNaN);
m_jit.store32(
MacroAssembler::TrustedImm32(nan.u.asBits.tag),
MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
}
case DFG::Jump: {
- BlockIndex taken = node->takenBlockIndex();
- jump(taken);
+ jump(node->targetBlock());
noResult(node);
break;
}
case Branch:
emitBranch(node);
break;
+
+ case Switch:
+ emitSwitch(node);
+ break;
case Return: {
ASSERT(GPRInfo::callFrameRegister != GPRInfo::regT2);
ASSERT(GPRInfo::regT1 != GPRInfo::returnValueGPR);
ASSERT(GPRInfo::returnValueGPR != GPRInfo::callFrameRegister);
-#if DFG_ENABLE(SUCCESS_STATS)
- static SamplingCounter counter("SpeculativeJIT");
- m_jit.emitCount(counter);
-#endif
-
// Return the result in returnValueGPR.
JSValueOperand op1(this, node->child1());
op1.fill();
}
}
- // Grab the return address.
- m_jit.emitGetFromCallFrameHeaderPtr(JSStack::ReturnPC, GPRInfo::regT2);
- // Restore our caller's "r".
- m_jit.emitGetFromCallFrameHeaderPtr(JSStack::CallerFrame, GPRInfo::callFrameRegister);
- // Return.
- m_jit.restoreReturnAddressBeforeReturn(GPRInfo::regT2);
+ m_jit.emitFunctionEpilogue();
m_jit.ret();
noResult(node);
break;
}
+ case BooleanToNumber: {
+ switch (node->child1().useKind()) {
+ case BooleanUse: {
+ SpeculateBooleanOperand value(this, node->child1());
+ GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
+
+ m_jit.move(value.gpr(), result.gpr());
+
+ int32Result(result.gpr(), node);
+ break;
+ }
+
+ case UntypedUse: {
+ JSValueOperand value(this, node->child1());
+
+ if (!m_interpreter.needsTypeCheck(node->child1(), SpecBoolInt32 | SpecBoolean)) {
+ GPRTemporary result(this);
+
+ GPRReg valueGPR = value.payloadGPR();
+ GPRReg resultGPR = result.gpr();
+
+ m_jit.move(valueGPR, resultGPR);
+ int32Result(result.gpr(), node);
+ break;
+ }
+
+ GPRTemporary resultTag(this);
+ GPRTemporary resultPayload(this);
+
+ GPRReg valueTagGPR = value.tagGPR();
+ GPRReg valuePayloadGPR = value.payloadGPR();
+ GPRReg resultTagGPR = resultTag.gpr();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+
+ m_jit.move(valuePayloadGPR, resultPayloadGPR);
+ JITCompiler::Jump isBoolean = m_jit.branch32(
+ JITCompiler::Equal, valueTagGPR, TrustedImm32(JSValue::BooleanTag));
+ m_jit.move(valueTagGPR, resultTagGPR);
+ JITCompiler::Jump done = m_jit.jump();
+ isBoolean.link(&m_jit);
+ m_jit.move(TrustedImm32(JSValue::Int32Tag), resultTagGPR);
+ done.link(&m_jit);
+
+ jsValueResult(resultTagGPR, resultPayloadGPR, node);
+ break;
+ }
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+ break;
+ }
+
case ToPrimitive: {
RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
JSValueOperand op1(this, node->child1());
- GPRTemporary resultTag(this, op1);
- GPRTemporary resultPayload(this, op1, false);
+ GPRTemporary resultTag(this, Reuse, op1, TagWord);
+ GPRTemporary resultPayload(this, Reuse, op1, PayloadWord);
GPRReg op1TagGPR = op1.tagGPR();
GPRReg op1PayloadGPR = op1.payloadGPR();
op1.use();
- if (!(m_state.forNode(node->child1()).m_type & ~(SpecNumber | SpecBoolean))) {
+ if (!(m_state.forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean))) {
m_jit.move(op1TagGPR, resultTagGPR);
m_jit.move(op1PayloadGPR, resultPayloadGPR);
} else {
- MacroAssembler::Jump alreadyPrimitive = m_jit.branch32(MacroAssembler::NotEqual, op1TagGPR, TrustedImm32(JSValue::CellTag));
- MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1PayloadGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.vm()->stringStructure.get()));
+ MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(op1.jsValueRegs());
+ MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(op1PayloadGPR);
alreadyPrimitive.link(&m_jit);
m_jit.move(op1TagGPR, resultTagGPR);
break;
}
- case ToString: {
+ case ToString:
+ case CallStringConstructor: {
if (node->child1().useKind() == UntypedUse) {
JSValueOperand op1(this, node->child1());
GPRReg op1PayloadGPR = op1.payloadGPR();
GPRReg op1TagGPR = op1.tagGPR();
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
GPRReg resultGPR = result.gpr();
flushRegisters();
JITCompiler::Jump done;
if (node->child1()->prediction() & SpecString) {
- JITCompiler::Jump slowPath1 = m_jit.branch32(
- JITCompiler::NotEqual, op1TagGPR, TrustedImm32(JSValue::CellTag));
- JITCompiler::Jump slowPath2 = m_jit.branchPtr(
- JITCompiler::NotEqual,
- JITCompiler::Address(op1PayloadGPR, JSCell::structureOffset()),
- TrustedImmPtr(m_jit.vm()->stringStructure.get()));
+ JITCompiler::Jump slowPath1 = m_jit.branchIfNotCell(op1.jsValueRegs());
+ JITCompiler::Jump slowPath2 = m_jit.branchIfNotString(op1PayloadGPR);
m_jit.move(op1PayloadGPR, resultGPR);
done = m_jit.jump();
slowPath1.link(&m_jit);
slowPath2.link(&m_jit);
}
- callOperation(operationToString, resultGPR, op1TagGPR, op1PayloadGPR);
+ if (op == ToString)
+ callOperation(operationToString, resultGPR, op1TagGPR, op1PayloadGPR);
+ else {
+ ASSERT(op == CallStringConstructor);
+ callOperation(operationCallStringConstructor, resultGPR, op1TagGPR, op1PayloadGPR);
+ }
if (done.isSet())
done.link(&m_jit);
cellResult(resultGPR, node);
break;
}
- compileToStringOnCell(node);
+ compileToStringOrCallStringConstructorOnCell(node);
break;
}
}
case NewArray: {
- JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->codeOrigin);
- if (!globalObject->isHavingABadTime() && !hasArrayStorage(node->indexingType())) {
- globalObject->havingABadTimeWatchpoint()->add(speculationWatchpoint());
-
+ JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+ if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType());
ASSERT(structure->indexingType() == node->indexingType());
ASSERT(
SpeculateDoubleOperand operand(this, use);
FPRReg opFPR = operand.fpr();
DFG_TYPE_CHECK(
- JSValueRegs(), use, SpecRealNumber,
+ JSValueRegs(), use, SpecDoubleReal,
m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
m_jit.storeDouble(opFPR, MacroAssembler::Address(storageGPR, sizeof(double) * operandIdx));
break;
}
case ALL_INT32_INDEXING_TYPES: {
- SpeculateIntegerOperand operand(this, use);
+ SpeculateInt32Operand operand(this, use);
m_jit.store32(TrustedImm32(JSValue::Int32Tag), MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
m_jit.store32(operand.gpr(), MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
break;
if (!node->numChildren()) {
flushRegisters();
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
callOperation(
operationNewEmptyArray, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
cellResult(result.gpr(), node);
SpeculateDoubleOperand operand(this, use);
FPRReg opFPR = operand.fpr();
DFG_TYPE_CHECK(
- JSValueRegs(), use, SpecRealNumber,
+ JSValueRegs(), use, SpecFullRealNumber,
m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
- m_jit.storeDouble(opFPR, reinterpret_cast<char*>(buffer + operandIdx));
+ m_jit.storeDouble(opFPR, TrustedImmPtr(reinterpret_cast<char*>(buffer + operandIdx)));
break;
}
case ALL_INT32_INDEXING_TYPES: {
- SpeculateIntegerOperand operand(this, use);
+ SpeculateInt32Operand operand(this, use);
GPRReg opGPR = operand.gpr();
m_jit.store32(TrustedImm32(JSValue::Int32Tag), reinterpret_cast<char*>(buffer + operandIdx) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
m_jit.store32(opGPR, reinterpret_cast<char*>(buffer + operandIdx) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
m_jit.storePtr(TrustedImmPtr(scratchSize), scratch.gpr());
}
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
callOperation(
operationNewArray, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()),
}
case NewArrayWithSize: {
- JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->codeOrigin);
- if (!globalObject->isHavingABadTime() && !hasArrayStorage(node->indexingType())) {
- globalObject->havingABadTimeWatchpoint()->add(speculationWatchpoint());
-
+ JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+ if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
SpeculateStrictInt32Operand size(this, node->child1());
GPRTemporary result(this);
GPRTemporary storage(this);
GPRReg scratch2GPR = scratch2.gpr();
MacroAssembler::JumpList slowCases;
- slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_SPARSE_ARRAY_INDEX)));
+ slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)));
ASSERT((1 << 3) == sizeof(JSValue));
m_jit.move(sizeGPR, scratchGPR);
m_jit.store32(sizeGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
if (hasDouble(node->indexingType())) {
- JSValue nan = JSValue(JSValue::EncodeAsDouble, QNaN);
+ JSValue nan = JSValue(JSValue::EncodeAsDouble, PNaN);
m_jit.move(sizeGPR, scratchGPR);
MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, scratchGPR);
done.link(&m_jit);
}
- addSlowPathGenerator(adoptPtr(
- new CallArrayAllocatorWithVariableSizeSlowPathGenerator(
+ addSlowPathGenerator(std::make_unique<CallArrayAllocatorWithVariableSizeSlowPathGenerator>(
slowCases, this, operationNewArrayWithSize, resultGPR,
globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()),
globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage),
- sizeGPR)));
+ sizeGPR));
cellResult(resultGPR, node);
break;
SpeculateStrictInt32Operand size(this, node->child1());
GPRReg sizeGPR = size.gpr();
flushRegisters();
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
GPRReg resultGPR = result.gpr();
GPRReg structureGPR = selectScratchGPR(sizeGPR);
- MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_SPARSE_ARRAY_INDEX));
+ MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
m_jit.move(TrustedImmPtr(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())), structureGPR);
MacroAssembler::Jump done = m_jit.jump();
bigLength.link(&m_jit);
}
case NewArrayBuffer: {
- JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->codeOrigin);
+ JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
IndexingType indexingType = node->indexingType();
- if (!globalObject->isHavingABadTime() && !hasArrayStorage(indexingType)) {
- globalObject->havingABadTimeWatchpoint()->add(speculationWatchpoint());
-
+ if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(indexingType)) {
unsigned numElements = node->numConstants();
GPRTemporary result(this);
}
flushRegisters();
- GPRResult result(this);
+ GPRFlushedCallResult result(this);
callOperation(operationNewArrayBuffer, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()), node->startConstant(), node->numConstants());
break;
}
+ case NewTypedArray: {
+ switch (node->child1().useKind()) {
+ case Int32Use:
+ compileNewTypedArray(node);
+ break;
+ case UntypedUse: {
+ JSValueOperand argument(this, node->child1());
+ GPRReg argumentTagGPR = argument.tagGPR();
+ GPRReg argumentPayloadGPR = argument.payloadGPR();
+
+ flushRegisters();
+
+ GPRFlushedCallResult result(this);
+ GPRReg resultGPR = result.gpr();
+
+ JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+ callOperation(
+ operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
+ resultGPR, globalObject->typedArrayStructure(node->typedArrayType()),
+ argumentTagGPR, argumentPayloadGPR);
+
+ cellResult(resultGPR, node);
+ break;
+ }
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+ break;
+ }
+
case NewRegexp: {
flushRegisters();
- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
callOperation(operationNewRegexp, resultTag.gpr(), resultPayload.gpr(), m_jit.codeBlock()->regexp(node->regexpIndex()));
break;
}
- case ConvertThis: {
+ case ToThis: {
ASSERT(node->child1().useKind() == UntypedUse);
-
JSValueOperand thisValue(this, node->child1());
- GPRReg thisValueTagGPR = thisValue.tagGPR();
+ GPRTemporary temp(this);
+ GPRTemporary tempTag(this);
GPRReg thisValuePayloadGPR = thisValue.payloadGPR();
-
- flushRegisters();
-
- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
- callOperation(operationConvertThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);
-
- cellResult(resultPayload.gpr(), node);
+ GPRReg thisValueTagGPR = thisValue.tagGPR();
+ GPRReg tempGPR = temp.gpr();
+ GPRReg tempTagGPR = tempTag.gpr();
+
+ MacroAssembler::JumpList slowCases;
+ slowCases.append(m_jit.branchIfNotCell(thisValue.jsValueRegs()));
+ slowCases.append(m_jit.branch8(
+ MacroAssembler::NotEqual,
+ MacroAssembler::Address(thisValuePayloadGPR, JSCell::typeInfoTypeOffset()),
+ TrustedImm32(FinalObjectType)));
+ m_jit.move(thisValuePayloadGPR, tempGPR);
+ m_jit.move(thisValueTagGPR, tempTagGPR);
+ J_JITOperation_EJ function;
+ if (m_jit.graph().executableFor(node->origin.semantic)->isStrictMode())
+ function = operationToThisStrict;
+ else
+ function = operationToThis;
+ addSlowPathGenerator(
+ slowPathCall(
+ slowCases, this, function,
+ JSValueRegs(tempTagGPR, tempGPR), thisValueTagGPR, thisValuePayloadGPR));
+
+ jsValueResult(tempTagGPR, tempGPR, node);
break;
}
GPRReg allocatorGPR = allocator.gpr();
GPRReg structureGPR = structure.gpr();
GPRReg scratchGPR = scratch.gpr();
+ // Rare data is only used to access the allocator & structure
+ // We can avoid using an additional GPR this way
+ GPRReg rareDataGPR = structureGPR;
MacroAssembler::JumpList slowPath;
- m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
- m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
+ m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
+ slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
+ m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
+ m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, allocatorGPR));
emitAllocateJSObject(resultGPR, allocatorGPR, structureGPR, TrustedImmPtr(0), scratchGPR, slowPath);
break;
}
- case AllocationProfileWatchpoint: {
- jsCast<JSFunction*>(node->function())->addAllocationProfileWatchpoint(speculationWatchpoint());
- noResult(node);
- break;
- }
-
case NewObject: {
GPRTemporary result(this);
GPRTemporary allocator(this);
MacroAssembler::JumpList slowPath;
Structure* structure = node->structure();
- size_t allocationSize = JSObject::allocationSize(structure->inlineCapacity());
+ size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
MarkedAllocator* allocatorPtr = &m_jit.vm()->heap.allocatorForObjectWithoutDestructor(allocationSize);
m_jit.move(TrustedImmPtr(allocatorPtr), allocatorGPR);
case GetCallee: {
GPRTemporary result(this);
- m_jit.loadPtr(JITCompiler::payloadFor(static_cast<VirtualRegister>(node->codeOrigin.stackOffset() + static_cast<int>(JSStack::Callee))), result.gpr());
- cellResult(result.gpr(), node);
- break;
- }
-
- case SetCallee: {
- SpeculateCellOperand callee(this, node->child1());
- m_jit.storePtr(callee.gpr(), JITCompiler::payloadFor(static_cast<VirtualRegister>(node->codeOrigin.stackOffset() + static_cast<int>(JSStack::Callee))));
- m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag), JITCompiler::tagFor(static_cast<VirtualRegister>(node->codeOrigin.stackOffset() + static_cast<int>(JSStack::Callee))));
- noResult(node);
- break;
- }
-
- case GetScope: {
- SpeculateCellOperand function(this, node->child1());
- GPRTemporary result(this, function);
- m_jit.loadPtr(JITCompiler::Address(function.gpr(), JSFunction::offsetOfScopeChain()), result.gpr());
+ m_jit.loadPtr(JITCompiler::payloadFor(JSStack::Callee), result.gpr());
cellResult(result.gpr(), node);
break;
}
- case GetMyScope: {
+ case GetArgumentCount: {
GPRTemporary result(this);
- GPRReg resultGPR = result.gpr();
-
- m_jit.loadPtr(JITCompiler::payloadFor(static_cast<VirtualRegister>(node->codeOrigin.stackOffset() + static_cast<int>(JSStack::ScopeChain))), resultGPR);
- cellResult(resultGPR, node);
- break;
- }
-
- case SetMyScope: {
- SpeculateCellOperand callee(this, node->child1());
- m_jit.storePtr(callee.gpr(), JITCompiler::payloadFor(static_cast<VirtualRegister>(node->codeOrigin.stackOffset() + static_cast<int>(JSStack::ScopeChain))));
- noResult(node);
+ m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), result.gpr());
+ int32Result(result.gpr(), node);
break;
}
- case SkipTopScope: {
- SpeculateCellOperand scope(this, node->child1());
- GPRTemporary result(this, scope);
- GPRReg resultGPR = result.gpr();
- m_jit.move(scope.gpr(), resultGPR);
- JITCompiler::Jump activationNotCreated =
- m_jit.branchTestPtr(
- JITCompiler::Zero,
- JITCompiler::payloadFor(
- static_cast<VirtualRegister>(m_jit.codeBlock()->activationRegister())));
- m_jit.loadPtr(JITCompiler::Address(resultGPR, JSScope::offsetOfNext()), resultGPR);
- activationNotCreated.link(&m_jit);
- cellResult(resultGPR, node);
+ case GetScope:
+ compileGetScope(node);
break;
- }
- case SkipScope: {
- SpeculateCellOperand scope(this, node->child1());
- GPRTemporary result(this, scope);
- m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSScope::offsetOfNext()), result.gpr());
- cellResult(result.gpr(), node);
+ case SkipScope:
+ compileSkipScope(node);
break;
- }
- case GetScopeRegisters: {
- SpeculateCellOperand scope(this, node->child1());
- GPRTemporary result(this);
- GPRReg scopeGPR = scope.gpr();
- GPRReg resultGPR = result.gpr();
-
- m_jit.loadPtr(JITCompiler::Address(scopeGPR, JSVariableObject::offsetOfRegisters()), resultGPR);
- storageResult(resultGPR, node);
- break;
- }
- case GetScopedVar: {
- StorageOperand registers(this, node->child1());
+ case GetClosureVar: {
+ SpeculateCellOperand base(this, node->child1());
GPRTemporary resultTag(this);
GPRTemporary resultPayload(this);
- GPRReg registersGPR = registers.gpr();
+ GPRReg baseGPR = base.gpr();
GPRReg resultTagGPR = resultTag.gpr();
GPRReg resultPayloadGPR = resultPayload.gpr();
- m_jit.load32(JITCompiler::Address(registersGPR, node->varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
- m_jit.load32(JITCompiler::Address(registersGPR, node->varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+ m_jit.load32(JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + TagOffset), resultTagGPR);
+ m_jit.load32(JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + PayloadOffset), resultPayloadGPR);
jsValueResult(resultTagGPR, resultPayloadGPR, node);
break;
}
- case PutScopedVar: {
- SpeculateCellOperand scope(this, node->child1());
- StorageOperand registers(this, node->child2());
- JSValueOperand value(this, node->child3());
- GPRTemporary scratchRegister(this);
- GPRReg scopeGPR = scope.gpr();
- GPRReg registersGPR = registers.gpr();
+
+ case PutClosureVar: {
+ SpeculateCellOperand base(this, node->child1());
+ JSValueOperand value(this, node->child2());
+
+ GPRReg baseGPR = base.gpr();
GPRReg valueTagGPR = value.tagGPR();
GPRReg valuePayloadGPR = value.payloadGPR();
- GPRReg scratchGPR = scratchRegister.gpr();
- m_jit.store32(valueTagGPR, JITCompiler::Address(registersGPR, node->varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
- m_jit.store32(valuePayloadGPR, JITCompiler::Address(registersGPR, node->varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
- writeBarrier(scopeGPR, valueTagGPR, node->child2(), WriteBarrierForVariableAccess, scratchGPR);
+ m_jit.store32(valueTagGPR, JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + TagOffset));
+ m_jit.store32(valuePayloadGPR, JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + PayloadOffset));
noResult(node);
break;
}
case GetById: {
- if (!node->prediction()) {
- terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
- break;
- }
+ ASSERT(node->prediction());
- if (isCellSpeculation(node->child1()->prediction())) {
+ switch (node->child1().useKind()) {
+ case CellUse: {
SpeculateCellOperand base(this, node->child1());
- GPRTemporary resultTag(this, base);
- GPRTemporary resultPayload(this);
+ GPRTemporary resultTag(this);
+ GPRTemporary resultPayload(this, Reuse, base);
GPRReg baseGPR = base.gpr();
GPRReg resultTagGPR = resultTag.gpr();
base.use();
- cachedGetById(node->codeOrigin, InvalidGPRReg, baseGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber());
+ cachedGetById(node->origin.semantic, InvalidGPRReg, baseGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber());
jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
break;
}
- JSValueOperand base(this, node->child1());
- GPRTemporary resultTag(this, base);
- GPRTemporary resultPayload(this);
+ case UntypedUse: {
+ JSValueOperand base(this, node->child1());
+ GPRTemporary resultTag(this);
+ GPRTemporary resultPayload(this, Reuse, base, TagWord);
- GPRReg baseTagGPR = base.tagGPR();
- GPRReg basePayloadGPR = base.payloadGPR();
- GPRReg resultTagGPR = resultTag.gpr();
- GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg baseTagGPR = base.tagGPR();
+ GPRReg basePayloadGPR = base.payloadGPR();
+ GPRReg resultTagGPR = resultTag.gpr();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
- base.use();
+ base.use();
- JITCompiler::Jump notCell = m_jit.branch32(JITCompiler::NotEqual, baseTagGPR, TrustedImm32(JSValue::CellTag));
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(base.jsValueRegs());
- cachedGetById(node->codeOrigin, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell);
+ cachedGetById(node->origin.semantic, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell);
- jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+ jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+ break;
+ }
+
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
break;
}
GPRReg baseGPR = base.gpr();
- GPRResult resultTag(this);
- GPRResult2 resultPayload(this);
- GPRReg resultTagGPR = resultTag.gpr();
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg resultTagGPR = resultTag.gpr();
base.use();
flushRegisters();
- cachedGetById(node->codeOrigin, InvalidGPRReg, baseGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), JITCompiler::Jump(), DontSpill);
+ cachedGetById(node->origin.semantic, InvalidGPRReg, baseGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), JITCompiler::Jump(), DontSpill);
jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
break;
GPRReg baseTagGPR = base.tagGPR();
GPRReg basePayloadGPR = base.payloadGPR();
- GPRResult resultTag(this);
- GPRResult2 resultPayload(this);
- GPRReg resultTagGPR = resultTag.gpr();
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg resultTagGPR = resultTag.gpr();
base.use();
flushRegisters();
- JITCompiler::Jump notCell = m_jit.branch32(JITCompiler::NotEqual, baseTagGPR, TrustedImm32(JSValue::CellTag));
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(base.jsValueRegs());
- cachedGetById(node->codeOrigin, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell, DontSpill);
+ cachedGetById(node->origin.semantic, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell, DontSpill);
jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
break;
compileGetArrayLength(node);
break;
- case CheckFunction: {
- SpeculateCellOperand function(this, node->child1());
- speculationCheck(BadFunction, JSValueSource::unboxedCell(function.gpr()), node->child1(), m_jit.branchWeakPtr(JITCompiler::NotEqual, function.gpr(), node->function()));
+ case CheckCell: {
+ SpeculateCellOperand cell(this, node->child1());
+ speculationCheck(BadCell, JSValueSource::unboxedCell(cell.gpr()), node->child1(), m_jit.branchWeakPtr(JITCompiler::NotEqual, cell.gpr(), node->cellOperand()->cell()));
noResult(node);
break;
}
- case CheckExecutable: {
- SpeculateCellOperand function(this, node->child1());
- speculationCheck(BadExecutable, JSValueSource::unboxedCell(function.gpr()), node->child1(), m_jit.branchWeakPtr(JITCompiler::NotEqual, JITCompiler::Address(function.gpr(), JSFunction::offsetOfExecutable()), node->executable()));
+ case CheckNotEmpty: {
+ JSValueOperand operand(this, node->child1());
+ GPRReg tagGPR = operand.tagGPR();
+ speculationCheck(TDZFailure, JSValueSource(), nullptr, m_jit.branch32(JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::EmptyValueTag)));
noResult(node);
break;
}
-
- case CheckStructure:
- case ForwardCheckStructure: {
- SpeculateCellOperand base(this, node->child1());
+
+ case GetExecutable: {
+ SpeculateCellOperand function(this, node->child1());
+ GPRTemporary result(this, Reuse, function);
+ GPRReg functionGPR = function.gpr();
+ GPRReg resultGPR = result.gpr();
+ speculateCellType(node->child1(), functionGPR, SpecFunction, JSFunctionType);
+ m_jit.loadPtr(JITCompiler::Address(functionGPR, JSFunction::offsetOfExecutable()), resultGPR);
+ cellResult(resultGPR, node);
+ break;
+ }
+
+ case CheckStructure: {
+ SpeculateCellOperand base(this, node->child1());
ASSERT(node->structureSet().size());
BadCache, JSValueSource::unboxedCell(base.gpr()), 0,
m_jit.branchWeakPtr(
JITCompiler::NotEqual,
- JITCompiler::Address(base.gpr(), JSCell::structureOffset()),
+ JITCompiler::Address(base.gpr(), JSCell::structureIDOffset()),
node->structureSet()[0]));
} else {
GPRTemporary structure(this);
- m_jit.loadPtr(JITCompiler::Address(base.gpr(), JSCell::structureOffset()), structure.gpr());
+ m_jit.loadPtr(JITCompiler::Address(base.gpr(), JSCell::structureIDOffset()), structure.gpr());
JITCompiler::JumpList done;
break;
}
- case StructureTransitionWatchpoint:
- case ForwardStructureTransitionWatchpoint: {
- // There is a fascinating question here of what to do about array profiling.
- // We *could* try to tell the OSR exit about where the base of the access is.
- // The DFG will have kept it alive, though it may not be in a register, and
- // we shouldn't really load it since that could be a waste. For now though,
- // we'll just rely on the fact that when a watchpoint fires then that's
- // quite a hint already.
-
- m_jit.addWeakReference(node->structure());
- node->structure()->addTransitionWatchpoint(
- speculationWatchpoint(
- node->child1()->op() == WeakJSConstant ? BadWeakConstantCache : BadCache));
-
-#if !ASSERT_DISABLED
- SpeculateCellOperand op1(this, node->child1());
- JITCompiler::Jump isOK = m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(op1.gpr(), JSCell::structureOffset()), TrustedImmPtr(node->structure()));
- m_jit.breakpoint();
- isOK.link(&m_jit);
-#else
- speculateCell(node->child1());
-#endif
-
- noResult(node);
- break;
- }
-
- case PhantomPutStructure: {
- ASSERT(isKnownCell(node->child1().node()));
- ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
- m_jit.addWeakReferenceTransition(
- node->codeOrigin.codeOriginOwner(),
- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
- noResult(node);
- break;
- }
-
case PutStructure: {
- ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());
+ Structure* oldStructure = node->transition()->previous;
+ Structure* newStructure = node->transition()->next;
+
+ m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
SpeculateCellOperand base(this, node->child1());
GPRReg baseGPR = base.gpr();
- m_jit.addWeakReferenceTransition(
- node->codeOrigin.codeOriginOwner(),
- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
-
-#if ENABLE(WRITE_BARRIER_PROFILING)
- // Must always emit this write barrier as the structure transition itself requires it
- writeBarrier(baseGPR, node->structureTransitionData().newStructure, WriteBarrierForGenericAccess);
-#endif
-
- m_jit.storePtr(MacroAssembler::TrustedImmPtr(node->structureTransitionData().newStructure), MacroAssembler::Address(baseGPR, JSCell::structureOffset()));
+ ASSERT_UNUSED(oldStructure, oldStructure->indexingType() == newStructure->indexingType());
+ ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
+ ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
+ m_jit.storePtr(MacroAssembler::TrustedImmPtr(newStructure), MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()));
noResult(node);
break;
case GetButterfly: {
SpeculateCellOperand base(this, node->child1());
- GPRTemporary result(this, base);
+ GPRTemporary result(this, Reuse, base);
GPRReg baseGPR = base.gpr();
GPRReg resultGPR = result.gpr();
break;
}
+ case ConstantStoragePointer: {
+ compileConstantStoragePointer(node);
+ break;
+ }
+
+ case GetTypedArrayByteOffset: {
+ compileGetTypedArrayByteOffset(node);
+ break;
+ }
+
case GetByOffset: {
StorageOperand storage(this, node->child1());
- GPRTemporary resultTag(this, storage);
+ GPRTemporary resultTag(this, Reuse, storage);
GPRTemporary resultPayload(this);
GPRReg storageGPR = storage.gpr();
GPRReg resultTagGPR = resultTag.gpr();
GPRReg resultPayloadGPR = resultPayload.gpr();
- StorageAccessData& storageAccessData = m_jit.graph().m_storageAccessData[node->storageAccessDataIndex()];
+ StorageAccessData& storageAccessData = node->storageAccessData();
- m_jit.load32(JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
- m_jit.load32(JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+ m_jit.load32(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+ m_jit.load32(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
jsValueResult(resultTagGPR, resultPayloadGPR, node);
break;
}
+ case GetGetterSetterByOffset: {
+ StorageOperand storage(this, node->child1());
+ GPRTemporary resultPayload(this);
+
+ GPRReg storageGPR = storage.gpr();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+
+ StorageAccessData& storageAccessData = node->storageAccessData();
+
+ m_jit.load32(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+
+ cellResult(resultPayloadGPR, node);
+ break;
+ }
+
+ case GetGetter: {
+ SpeculateCellOperand op1(this, node->child1());
+ GPRTemporary result(this, Reuse, op1);
+
+ GPRReg op1GPR = op1.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfGetter()), resultGPR);
+
+ cellResult(resultGPR, node);
+ break;
+ }
+
+ case GetSetter: {
+ SpeculateCellOperand op1(this, node->child1());
+ GPRTemporary result(this, Reuse, op1);
+
+ GPRReg op1GPR = op1.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfSetter()), resultGPR);
+
+ cellResult(resultGPR, node);
+ break;
+ }
+
case PutByOffset: {
-#if ENABLE(WRITE_BARRIER_PROFILING)
- SpeculateCellOperand base(this, node->child2());
-#endif
StorageOperand storage(this, node->child1());
JSValueOperand value(this, node->child3());
GPRReg storageGPR = storage.gpr();
GPRReg valueTagGPR = value.tagGPR();
GPRReg valuePayloadGPR = value.payloadGPR();
-
-#if ENABLE(WRITE_BARRIER_PROFILING)
- writeBarrier(base.gpr(), valueTagGPR, node->child3(), WriteBarrierForPropertyAccess);
-#endif
- StorageAccessData& storageAccessData = m_jit.graph().m_storageAccessData[node->storageAccessDataIndex()];
+ speculate(node, node->child2());
+
+ StorageAccessData& storageAccessData = node->storageAccessData();
- m_jit.storePtr(valueTagGPR, JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
- m_jit.storePtr(valuePayloadGPR, JITCompiler::Address(storageGPR, storageAccessData.offset * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+ m_jit.storePtr(valueTagGPR, JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+ m_jit.storePtr(valuePayloadGPR, JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
noResult(node);
break;
}
+
+ case PutByIdFlush: {
+ SpeculateCellOperand base(this, node->child1());
+ JSValueOperand value(this, node->child2());
+ GPRTemporary scratch(this);
+
+ GPRReg baseGPR = base.gpr();
+ GPRReg valueTagGPR = value.tagGPR();
+ GPRReg valuePayloadGPR = value.payloadGPR();
+ GPRReg scratchGPR = scratch.gpr();
+ flushRegisters();
+
+ cachedPutById(node->origin.semantic, baseGPR, valueTagGPR, valuePayloadGPR, scratchGPR, node->identifierNumber(), NotDirect, MacroAssembler::Jump(), DontSpill);
+
+ noResult(node);
+ break;
+ }
case PutById: {
SpeculateCellOperand base(this, node->child1());
GPRReg valuePayloadGPR = value.payloadGPR();
GPRReg scratchGPR = scratch.gpr();
- base.use();
- value.use();
-
- cachedPutById(node->codeOrigin, baseGPR, valueTagGPR, valuePayloadGPR, node->child2(), scratchGPR, node->identifierNumber(), NotDirect);
+ cachedPutById(node->origin.semantic, baseGPR, valueTagGPR, valuePayloadGPR, scratchGPR, node->identifierNumber(), NotDirect);
- noResult(node, UseChildrenCalledExplicitly);
+ noResult(node);
break;
}
GPRReg valuePayloadGPR = value.payloadGPR();
GPRReg scratchGPR = scratch.gpr();
- base.use();
- value.use();
-
- cachedPutById(node->codeOrigin, baseGPR, valueTagGPR, valuePayloadGPR, node->child2(), scratchGPR, node->identifierNumber(), Direct);
+ cachedPutById(node->origin.semantic, baseGPR, valueTagGPR, valuePayloadGPR, scratchGPR, node->identifierNumber(), Direct);
- noResult(node, UseChildrenCalledExplicitly);
+ noResult(node);
break;
}
GPRTemporary resultPayload(this);
GPRTemporary resultTag(this);
- m_jit.move(TrustedImmPtr(node->registerPointer()), resultPayload.gpr());
+ m_jit.move(TrustedImmPtr(node->variablePointer()), resultPayload.gpr());
m_jit.load32(JITCompiler::Address(resultPayload.gpr(), OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTag.gpr());
m_jit.load32(JITCompiler::Address(resultPayload.gpr(), OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayload.gpr());
}
case PutGlobalVar: {
- JSValueOperand value(this, node->child1());
- if (Heap::isWriteBarrierEnabled()) {
- GPRTemporary scratch(this);
- GPRReg scratchReg = scratch.gpr();
-
- writeBarrier(m_jit.globalObjectFor(node->codeOrigin), value.tagGPR(), node->child1(), WriteBarrierForVariableAccess, scratchReg);
- }
+ JSValueOperand value(this, node->child2());
// FIXME: if we happen to have a spare register - and _ONLY_ if we happen to have
// a spare register - a good optimization would be to put the register pointer into
// a register and then do a zero offset store followed by a four-offset store (or
// vice-versa depending on endianness).
- m_jit.store32(value.tagGPR(), node->registerPointer()->tagPointer());
- m_jit.store32(value.payloadGPR(), node->registerPointer()->payloadPointer());
+ m_jit.store32(value.tagGPR(), node->variablePointer()->tagPointer());
+ m_jit.store32(value.payloadGPR(), node->variablePointer()->payloadPointer());
noResult(node);
break;
}
- case PutGlobalVarCheck: {
- JSValueOperand value(this, node->child1());
-
- WatchpointSet* watchpointSet =
- m_jit.globalObjectFor(node->codeOrigin)->symbolTable()->get(
- identifier(node->identifierNumberForCheck())->impl()).watchpointSet();
- addSlowPathGenerator(
- slowPathCall(
- m_jit.branchTest8(
- JITCompiler::NonZero,
- JITCompiler::AbsoluteAddress(watchpointSet->addressOfIsWatched())),
- this, operationNotifyGlobalVarWrite, NoResult, watchpointSet));
-
- if (Heap::isWriteBarrierEnabled()) {
- GPRTemporary scratch(this);
- GPRReg scratchReg = scratch.gpr();
-
- writeBarrier(m_jit.globalObjectFor(node->codeOrigin), value.tagGPR(), node->child1(), WriteBarrierForVariableAccess, scratchReg);
- }
-
- // FIXME: if we happen to have a spare register - and _ONLY_ if we happen to have
- // a spare register - a good optimization would be to put the register pointer into
- // a register and then do a zero offset store followed by a four-offset store (or
- // vice-versa depending on endianness).
- m_jit.store32(value.tagGPR(), node->registerPointer()->tagPointer());
- m_jit.store32(value.payloadGPR(), node->registerPointer()->payloadPointer());
-
- noResult(node);
+ case NotifyWrite: {
+ compileNotifyWrite(node);
break;
}
-
- case GlobalVarWatchpoint: {
- m_jit.globalObjectFor(node->codeOrigin)->symbolTable()->get(
- identifier(node->identifierNumberForCheck())->impl()).addWatchpoint(
- speculationWatchpoint());
-
-#if DFG_ENABLE(JIT_ASSERT)
- GPRTemporary scratch(this);
- GPRReg scratchGPR = scratch.gpr();
- m_jit.load32(node->registerPointer()->tagPointer(), scratchGPR);
- JITCompiler::Jump notOK = m_jit.branch32(
- JITCompiler::NotEqual, scratchGPR,
- TrustedImm32(node->registerPointer()->get().tag()));
- m_jit.load32(node->registerPointer()->payloadPointer(), scratchGPR);
- JITCompiler::Jump ok = m_jit.branch32(
- JITCompiler::Equal, scratchGPR,
- TrustedImm32(node->registerPointer()->get().payload()));
- notOK.link(&m_jit);
- m_jit.breakpoint();
- ok.link(&m_jit);
-#endif
-
+
+ case VarInjectionWatchpoint: {
noResult(node);
break;
}
GPRTemporary structure(this);
// Speculate that base 'ImplementsDefaultHasInstance'.
- m_jit.loadPtr(MacroAssembler::Address(base.gpr(), JSCell::structureOffset()), structure.gpr());
- speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branchTest8(MacroAssembler::Zero, MacroAssembler::Address(structure.gpr(), Structure::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(ImplementsDefaultHasInstance)));
+ speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branchTest8(
+ MacroAssembler::Zero,
+ MacroAssembler::Address(base.gpr(), JSCell::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(ImplementsDefaultHasInstance)));
noResult(node);
break;
GPRTemporary localGlobalObject(this);
GPRTemporary remoteGlobalObject(this);
- JITCompiler::Jump isCell = m_jit.branch32(JITCompiler::Equal, value.tagGPR(), JITCompiler::TrustedImm32(JSValue::CellTag));
+ JITCompiler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
m_jit.compare32(JITCompiler::Equal, value.tagGPR(), TrustedImm32(JSValue::UndefinedTag), result.gpr());
JITCompiler::Jump done = m_jit.jump();
isCell.link(&m_jit);
JITCompiler::Jump notMasqueradesAsUndefined;
- if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
- m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ if (masqueradesAsUndefinedWatchpointIsStillValid()) {
m_jit.move(TrustedImm32(0), result.gpr());
notMasqueradesAsUndefined = m_jit.jump();
} else {
- m_jit.loadPtr(JITCompiler::Address(value.payloadGPR(), JSCell::structureOffset()), result.gpr());
- JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::NonZero, JITCompiler::Address(result.gpr(), Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+ JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
+ JITCompiler::NonZero,
+ JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()),
+ TrustedImm32(MasqueradesAsUndefined));
m_jit.move(TrustedImm32(0), result.gpr());
notMasqueradesAsUndefined = m_jit.jump();
isMasqueradesAsUndefined.link(&m_jit);
GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
- m_jit.move(TrustedImmPtr(m_jit.globalObjectFor(node->codeOrigin)), localGlobalObjectGPR);
+ m_jit.move(TrustedImmPtr(m_jit.globalObjectFor(node->origin.semantic)), localGlobalObjectGPR);
+ m_jit.loadPtr(JITCompiler::Address(value.payloadGPR(), JSCell::structureIDOffset()), result.gpr());
m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), remoteGlobalObjectGPR);
m_jit.compare32(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, result.gpr());
}
case IsBoolean: {
JSValueOperand value(this, node->child1());
- GPRTemporary result(this, value);
+ GPRTemporary result(this, Reuse, value, TagWord);
m_jit.compare32(JITCompiler::Equal, value.tagGPR(), JITCompiler::TrustedImm32(JSValue::BooleanTag), result.gpr());
booleanResult(result.gpr(), node);
case IsNumber: {
JSValueOperand value(this, node->child1());
- GPRTemporary result(this, value);
+ GPRTemporary result(this, Reuse, value, TagWord);
m_jit.add32(TrustedImm32(1), value.tagGPR(), result.gpr());
m_jit.compare32(JITCompiler::Below, result.gpr(), JITCompiler::TrustedImm32(JSValue::LowestTag + 1), result.gpr());
case IsString: {
JSValueOperand value(this, node->child1());
- GPRTemporary result(this, value);
+ GPRTemporary result(this, Reuse, value, TagWord);
- JITCompiler::Jump isNotCell = m_jit.branch32(JITCompiler::NotEqual, value.tagGPR(), JITCompiler::TrustedImm32(JSValue::CellTag));
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
- m_jit.loadPtr(JITCompiler::Address(value.payloadGPR(), JSCell::structureOffset()), result.gpr());
- m_jit.compare8(JITCompiler::Equal, JITCompiler::Address(result.gpr(), Structure::typeInfoTypeOffset()), TrustedImm32(StringType), result.gpr());
+ m_jit.compare8(JITCompiler::Equal,
+ JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
+ TrustedImm32(StringType),
+ result.gpr());
JITCompiler::Jump done = m_jit.jump();
isNotCell.link(&m_jit);
case IsObject: {
JSValueOperand value(this, node->child1());
- GPRReg valueTagGPR = value.tagGPR();
- GPRReg valuePayloadGPR = value.payloadGPR();
- GPRResult result(this);
- GPRReg resultGPR = result.gpr();
- flushRegisters();
- callOperation(operationIsObject, resultGPR, valueTagGPR, valuePayloadGPR);
+ GPRTemporary result(this, Reuse, value, TagWord);
+
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
+
+ m_jit.compare8(JITCompiler::AboveOrEqual,
+ JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
+ TrustedImm32(ObjectType),
+ result.gpr());
+ JITCompiler::Jump done = m_jit.jump();
+
+ isNotCell.link(&m_jit);
+ m_jit.move(TrustedImm32(0), result.gpr());
+
+ done.link(&m_jit);
booleanResult(result.gpr(), node);
break;
}
+ case IsObjectOrNull: {
+ compileIsObjectOrNull(node);
+ break;
+ }
+
case IsFunction: {
- JSValueOperand value(this, node->child1());
- GPRReg valueTagGPR = value.tagGPR();
- GPRReg valuePayloadGPR = value.payloadGPR();
- GPRResult result(this);
- GPRReg resultGPR = result.gpr();
- flushRegisters();
- callOperation(operationIsFunction, resultGPR, valueTagGPR, valuePayloadGPR);
- booleanResult(result.gpr(), node);
+ compileIsFunction(node);
break;
}
case TypeOf: {
- JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
- GPRReg tagGPR = value.tagGPR();
- GPRReg payloadGPR = value.payloadGPR();
- GPRTemporary temp(this);
- GPRReg tempGPR = temp.gpr();
- GPRResult result(this);
- GPRReg resultGPR = result.gpr();
- JITCompiler::JumpList doneJumps;
-
- flushRegisters();
-
- ASSERT(node->child1().useKind() == UntypedUse || node->child1().useKind() == CellUse || node->child1().useKind() == StringUse);
-
- JITCompiler::Jump isNotCell = m_jit.branch32(JITCompiler::NotEqual, tagGPR, JITCompiler::TrustedImm32(JSValue::CellTag));
- if (node->child1().useKind() != UntypedUse)
- DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecCell, isNotCell);
-
- if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {
- m_jit.loadPtr(JITCompiler::Address(payloadGPR, JSCell::structureOffset()), tempGPR);
- JITCompiler::Jump notString = m_jit.branch8(JITCompiler::NotEqual, JITCompiler::Address(tempGPR, Structure::typeInfoTypeOffset()), TrustedImm32(StringType));
- if (node->child1().useKind() == StringUse)
- DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecString, notString);
- m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.stringString()), resultGPR);
- doneJumps.append(m_jit.jump());
- if (node->child1().useKind() != StringUse) {
- notString.link(&m_jit);
- callOperation(operationTypeOf, resultGPR, payloadGPR);
- doneJumps.append(m_jit.jump());
- }
- } else {
- callOperation(operationTypeOf, resultGPR, payloadGPR);
- doneJumps.append(m_jit.jump());
- }
-
- if (node->child1().useKind() == UntypedUse) {
- isNotCell.link(&m_jit);
-
- m_jit.add32(TrustedImm32(1), tagGPR, tempGPR);
- JITCompiler::Jump notNumber = m_jit.branch32(JITCompiler::AboveOrEqual, tempGPR, JITCompiler::TrustedImm32(JSValue::LowestTag + 1));
- m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.numberString()), resultGPR);
- doneJumps.append(m_jit.jump());
- notNumber.link(&m_jit);
-
- JITCompiler::Jump notUndefined = m_jit.branch32(JITCompiler::NotEqual, tagGPR, TrustedImm32(JSValue::UndefinedTag));
- m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.undefinedString()), resultGPR);
- doneJumps.append(m_jit.jump());
- notUndefined.link(&m_jit);
-
- JITCompiler::Jump notNull = m_jit.branch32(JITCompiler::NotEqual, tagGPR, TrustedImm32(JSValue::NullTag));
- m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.objectString()), resultGPR);
- doneJumps.append(m_jit.jump());
- notNull.link(&m_jit);
-
- // Only boolean left
- m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.booleanString()), resultGPR);
- }
- doneJumps.link(&m_jit);
- cellResult(resultGPR, node);
+ compileTypeOf(node);
break;
}
- case Phi:
case Flush:
break;
- case Breakpoint:
-#if ENABLE(DEBUG_WITH_BREAKPOINT)
- m_jit.breakpoint();
-#else
- RELEASE_ASSERT_NOT_REACHED();
-#endif
- break;
-
case Call:
case Construct:
+ case CallVarargs:
+ case CallForwardVarargs:
+ case ConstructVarargs:
+ case ConstructForwardVarargs:
emitCall(node);
break;
- case Resolve: {
- flushRegisters();
- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
- ResolveOperationData& data = m_jit.graph().m_resolveOperationsData[node->resolveOperationsDataIndex()];
- callOperation(operationResolve, resultTag.gpr(), resultPayload.gpr(), identifier(data.identifierNumber), data.resolveOperations);
- jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
- break;
- }
-
- case ResolveBase: {
- flushRegisters();
- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
- ResolveOperationData& data = m_jit.graph().m_resolveOperationsData[node->resolveOperationsDataIndex()];
- callOperation(operationResolveBase, resultTag.gpr(), resultPayload.gpr(), identifier(data.identifierNumber), data.resolveOperations, data.putToBaseOperation);
- jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
- break;
- }
-
- case ResolveBaseStrictPut: {
- flushRegisters();
- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
- ResolveOperationData& data = m_jit.graph().m_resolveOperationsData[node->resolveOperationsDataIndex()];
- callOperation(operationResolveBaseStrictPut, resultTag.gpr(), resultPayload.gpr(), identifier(data.identifierNumber), data.resolveOperations, data.putToBaseOperation);
- jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
- break;
- }
-
- case ResolveGlobal: {
- GPRTemporary globalObject(this);
- GPRTemporary resolveInfo(this);
- GPRTemporary resultTag(this);
- GPRTemporary resultPayload(this);
-
- GPRReg globalObjectGPR = globalObject.gpr();
- GPRReg resolveInfoGPR = resolveInfo.gpr();
- GPRReg resultTagGPR = resultTag.gpr();
- GPRReg resultPayloadGPR = resultPayload.gpr();
-
- ResolveGlobalData& data = m_jit.graph().m_resolveGlobalData[node->resolveGlobalDataIndex()];
- ResolveOperation* resolveOperationAddress = &(data.resolveOperations->data()[data.resolvePropertyIndex]);
-
- // Check Structure of global object
- m_jit.move(JITCompiler::TrustedImmPtr(m_jit.globalObjectFor(node->codeOrigin)), globalObjectGPR);
- m_jit.move(JITCompiler::TrustedImmPtr(resolveOperationAddress), resolveInfoGPR);
- m_jit.loadPtr(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(ResolveOperation, m_structure)), resultPayloadGPR);
-
- JITCompiler::Jump structuresNotMatch = m_jit.branchPtr(JITCompiler::NotEqual, resultPayloadGPR, JITCompiler::Address(globalObjectGPR, JSCell::structureOffset()));
-
- // Fast case
- m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::butterflyOffset()), resultPayloadGPR);
- m_jit.load32(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(ResolveOperation, m_offset)), resolveInfoGPR);
-#if DFG_ENABLE(JIT_ASSERT)
- JITCompiler::Jump isOutOfLine = m_jit.branch32(JITCompiler::GreaterThanOrEqual, resolveInfoGPR, TrustedImm32(firstOutOfLineOffset));
- m_jit.breakpoint();
- isOutOfLine.link(&m_jit);
-#endif
- m_jit.neg32(resolveInfoGPR);
- m_jit.signExtend32ToPtr(resolveInfoGPR, resolveInfoGPR);
- m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) + (firstOutOfLineOffset - 2) * static_cast<ptrdiff_t>(sizeof(JSValue))), resultTagGPR);
- m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) + (firstOutOfLineOffset - 2) * static_cast<ptrdiff_t>(sizeof(JSValue))), resultPayloadGPR);
-
- addSlowPathGenerator(
- slowPathCall(
- structuresNotMatch, this, operationResolveGlobal,
- JSValueRegs(resultTagGPR, resultPayloadGPR), resolveInfoGPR, globalObjectGPR,
- &m_jit.codeBlock()->identifier(data.identifierNumber)));
-
- jsValueResult(resultTagGPR, resultPayloadGPR, node);
- break;
- }
-
- case CreateActivation: {
- JSValueOperand value(this, node->child1());
- GPRTemporary result(this, value, false);
-
- GPRReg valueTagGPR = value.tagGPR();
- GPRReg valuePayloadGPR = value.payloadGPR();
- GPRReg resultGPR = result.gpr();
-
- m_jit.move(valuePayloadGPR, resultGPR);
-
- JITCompiler::Jump notCreated = m_jit.branch32(JITCompiler::Equal, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
+ case LoadVarargs: {
+ LoadVarargsData* data = node->loadVarargsData();
- addSlowPathGenerator(
- slowPathCall(notCreated, this, operationCreateActivation, resultGPR));
+ GPRReg argumentsTagGPR;
+ GPRReg argumentsPayloadGPR;
+ {
+ JSValueOperand arguments(this, node->child1());
+ argumentsTagGPR = arguments.tagGPR();
+ argumentsPayloadGPR = arguments.payloadGPR();
+ flushRegisters();
+ }
- cellResult(resultGPR, node);
- break;
- }
+ callOperation(operationSizeOfVarargs, GPRInfo::returnValueGPR, argumentsTagGPR, argumentsPayloadGPR, data->offset);
- case CreateArguments: {
- JSValueOperand value(this, node->child1());
- GPRTemporary result(this, value, false);
+ lock(GPRInfo::returnValueGPR);
+ {
+ JSValueOperand arguments(this, node->child1());
+ argumentsTagGPR = arguments.tagGPR();
+ argumentsPayloadGPR = arguments.payloadGPR();
+ flushRegisters();
+ }
+ unlock(GPRInfo::returnValueGPR);
- GPRReg valueTagGPR = value.tagGPR();
- GPRReg valuePayloadGPR = value.payloadGPR();
- GPRReg resultGPR = result.gpr();
+ // FIXME: There is a chance that we will call an effectful length property twice. This is safe
+ // from the standpoint of the VM's integrity, but it's subtly wrong from a spec compliance
+ // standpoint. The best solution would be one where we can exit *into* the op_call_varargs right
+ // past the sizing.
+ // https://bugs.webkit.org/show_bug.cgi?id=141448
+
+ GPRReg argCountIncludingThisGPR =
+ JITCompiler::selectScratchGPR(GPRInfo::returnValueGPR, argumentsTagGPR, argumentsPayloadGPR);
- m_jit.move(valuePayloadGPR, resultGPR);
+ m_jit.add32(TrustedImm32(1), GPRInfo::returnValueGPR, argCountIncludingThisGPR);
+ speculationCheck(
+ VarargsOverflow, JSValueSource(), Edge(), m_jit.branch32(
+ MacroAssembler::Above,
+ argCountIncludingThisGPR,
+ TrustedImm32(data->limit)));
- JITCompiler::Jump notCreated = m_jit.branch32(JITCompiler::Equal, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
+ m_jit.store32(argCountIncludingThisGPR, JITCompiler::payloadFor(data->machineCount));
- if (node->codeOrigin.inlineCallFrame) {
- addSlowPathGenerator(
- slowPathCall(
- notCreated, this, operationCreateInlinedArguments, resultGPR,
- node->codeOrigin.inlineCallFrame));
- } else {
- addSlowPathGenerator(
- slowPathCall(notCreated, this, operationCreateArguments, resultGPR));
- }
+ callOperation(operationLoadVarargs, data->machineStart.offset(), argumentsTagGPR, argumentsPayloadGPR, data->offset, GPRInfo::returnValueGPR, data->mandatoryMinimum);
- cellResult(resultGPR, node);
+ noResult(node);
break;
}
- case TearOffActivation: {
- JSValueOperand activationValue(this, node->child1());
- GPRTemporary scratch(this);
-
- GPRReg activationValueTagGPR = activationValue.tagGPR();
- GPRReg activationValuePayloadGPR = activationValue.payloadGPR();
- GPRReg scratchGPR = scratch.gpr();
-
- JITCompiler::Jump notCreated = m_jit.branch32(JITCompiler::Equal, activationValueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
-
- SharedSymbolTable* symbolTable = m_jit.symbolTableFor(node->codeOrigin);
- int registersOffset = JSActivation::registersOffset(symbolTable);
-
- int captureEnd = symbolTable->captureEnd();
- for (int i = symbolTable->captureStart(); i < captureEnd; ++i) {
- m_jit.loadPtr(
- JITCompiler::Address(
- GPRInfo::callFrameRegister, i * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)),
- scratchGPR);
- m_jit.storePtr(
- scratchGPR, JITCompiler::Address(
- activationValuePayloadGPR, registersOffset + i * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
- m_jit.loadPtr(
- JITCompiler::Address(
- GPRInfo::callFrameRegister, i * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)),
- scratchGPR);
- m_jit.storePtr(
- scratchGPR, JITCompiler::Address(
- activationValuePayloadGPR, registersOffset + i * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
- }
- m_jit.addPtr(TrustedImm32(registersOffset), activationValuePayloadGPR, scratchGPR);
- m_jit.storePtr(scratchGPR, JITCompiler::Address(activationValuePayloadGPR, JSActivation::offsetOfRegisters()));
-
- notCreated.link(&m_jit);
- noResult(node);
+ case ForwardVarargs: {
+ compileForwardVarargs(node);
break;
}
- case TearOffArguments: {
- JSValueOperand unmodifiedArgumentsValue(this, node->child1());
- JSValueOperand activationValue(this, node->child2());
- GPRReg unmodifiedArgumentsValuePayloadGPR = unmodifiedArgumentsValue.payloadGPR();
- GPRReg activationValuePayloadGPR = activationValue.payloadGPR();
+ case CreateActivation: {
+ compileCreateActivation(node);
+ break;
+ }
- JITCompiler::Jump created = m_jit.branchTest32(
- JITCompiler::NonZero, unmodifiedArgumentsValuePayloadGPR);
+ case CreateDirectArguments: {
+ compileCreateDirectArguments(node);
+ break;
+ }
- if (node->codeOrigin.inlineCallFrame) {
- addSlowPathGenerator(
- slowPathCall(
- created, this, operationTearOffInlinedArguments, NoResult,
- unmodifiedArgumentsValuePayloadGPR, activationValuePayloadGPR, node->codeOrigin.inlineCallFrame));
- } else {
- addSlowPathGenerator(
- slowPathCall(
- created, this, operationTearOffArguments, NoResult,
- unmodifiedArgumentsValuePayloadGPR, activationValuePayloadGPR));
- }
+ case GetFromArguments: {
+ compileGetFromArguments(node);
+ break;
+ }
- noResult(node);
+ case PutToArguments: {
+ compilePutToArguments(node);
break;
}
- case CheckArgumentsNotCreated: {
- ASSERT(!isEmptySpeculation(
- m_state.variables().operand(
- m_jit.graph().argumentsRegisterFor(node->codeOrigin)).m_type));
- speculationCheck(
- Uncountable, JSValueRegs(), 0,
- m_jit.branch32(
- JITCompiler::NotEqual,
- JITCompiler::tagFor(m_jit.argumentsRegisterFor(node->codeOrigin)),
- TrustedImm32(JSValue::EmptyValueTag)));
- noResult(node);
+ case CreateScopedArguments: {
+ compileCreateScopedArguments(node);
break;
}
- case GetMyArgumentsLength: {
- GPRTemporary result(this);
- GPRReg resultGPR = result.gpr();
+ case CreateClonedArguments: {
+ compileCreateClonedArguments(node);
+ break;
+ }
- if (!isEmptySpeculation(
- m_state.variables().operand(
- m_jit.graph().argumentsRegisterFor(node->codeOrigin)).m_type)) {
- speculationCheck(
- ArgumentsEscaped, JSValueRegs(), 0,
- m_jit.branch32(
- JITCompiler::NotEqual,
- JITCompiler::tagFor(m_jit.argumentsRegisterFor(node->codeOrigin)),
- TrustedImm32(JSValue::EmptyValueTag)));
- }
+ case NewFunction:
+ compileNewFunction(node);
+ break;
- ASSERT(!node->codeOrigin.inlineCallFrame);
- m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), resultGPR);
- m_jit.sub32(TrustedImm32(1), resultGPR);
- integerResult(resultGPR, node);
+ case In:
+ compileIn(node);
+ break;
+
+ case StoreBarrier: {
+ compileStoreBarrier(node);
break;
}
-
- case GetMyArgumentsLengthSafe: {
+
+ case GetEnumerableLength: {
+ SpeculateCellOperand enumerator(this, node->child1());
+ GPRFlushedCallResult result(this);
+ GPRReg resultGPR = result.gpr();
+
+ m_jit.load32(MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::indexedLengthOffset()), resultGPR);
+ int32Result(resultGPR, node);
+ break;
+ }
+ case HasGenericProperty: {
+ JSValueOperand base(this, node->child1());
+ SpeculateCellOperand property(this, node->child2());
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
+ GPRReg basePayloadGPR = base.payloadGPR();
+ GPRReg baseTagGPR = base.tagGPR();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg resultTagGPR = resultTag.gpr();
+
+ flushRegisters();
+ callOperation(operationHasGenericProperty, resultTagGPR, resultPayloadGPR, baseTagGPR, basePayloadGPR, property.gpr());
+ booleanResult(resultPayloadGPR, node);
+ break;
+ }
+ case HasStructureProperty: {
+ JSValueOperand base(this, node->child1());
+ SpeculateCellOperand property(this, node->child2());
+ SpeculateCellOperand enumerator(this, node->child3());
GPRTemporary resultPayload(this);
GPRTemporary resultTag(this);
+
+ GPRReg baseTagGPR = base.tagGPR();
+ GPRReg basePayloadGPR = base.payloadGPR();
+ GPRReg propertyGPR = property.gpr();
GPRReg resultPayloadGPR = resultPayload.gpr();
GPRReg resultTagGPR = resultTag.gpr();
-
- JITCompiler::Jump created = m_jit.branch32(
- JITCompiler::NotEqual,
- JITCompiler::tagFor(m_jit.argumentsRegisterFor(node->codeOrigin)),
- TrustedImm32(JSValue::EmptyValueTag));
-
- if (node->codeOrigin.inlineCallFrame) {
- m_jit.move(
- Imm32(node->codeOrigin.inlineCallFrame->arguments.size() - 1),
- resultPayloadGPR);
- } else {
- m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), resultPayloadGPR);
- m_jit.sub32(TrustedImm32(1), resultPayloadGPR);
- }
- m_jit.move(TrustedImm32(JSValue::Int32Tag), resultTagGPR);
-
- // FIXME: the slow path generator should perform a forward speculation that the
- // result is an integer. For now we postpone the speculation by having this return
- // a JSValue.
-
- addSlowPathGenerator(
- slowPathCall(
- created, this, operationGetArgumentsLength,
- JSValueRegs(resultTagGPR, resultPayloadGPR),
- m_jit.argumentsRegisterFor(node->codeOrigin)));
-
- jsValueResult(resultTagGPR, resultPayloadGPR, node);
+
+ m_jit.load32(MacroAssembler::Address(basePayloadGPR, JSCell::structureIDOffset()), resultTagGPR);
+ MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual,
+ resultTagGPR,
+ MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::cachedStructureIDOffset()));
+
+ moveTrueTo(resultPayloadGPR);
+ MacroAssembler::Jump done = m_jit.jump();
+
+ done.link(&m_jit);
+
+ addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty, resultTagGPR, resultPayloadGPR, baseTagGPR, basePayloadGPR, propertyGPR));
+ booleanResult(resultPayloadGPR, node);
break;
}
-
- case GetMyArgumentByVal: {
- SpeculateStrictInt32Operand index(this, node->child1());
+ case HasIndexedProperty: {
+ SpeculateCellOperand base(this, node->child1());
+ SpeculateInt32Operand index(this, node->child2());
GPRTemporary resultPayload(this);
GPRTemporary resultTag(this);
+
+ GPRReg baseGPR = base.gpr();
GPRReg indexGPR = index.gpr();
GPRReg resultPayloadGPR = resultPayload.gpr();
GPRReg resultTagGPR = resultTag.gpr();
-
- if (!isEmptySpeculation(
- m_state.variables().operand(
- m_jit.graph().argumentsRegisterFor(node->codeOrigin)).m_type)) {
- speculationCheck(
- ArgumentsEscaped, JSValueRegs(), 0,
- m_jit.branch32(
- JITCompiler::NotEqual,
- JITCompiler::tagFor(m_jit.argumentsRegisterFor(node->codeOrigin)),
- TrustedImm32(JSValue::EmptyValueTag)));
- }
-
- m_jit.add32(TrustedImm32(1), indexGPR, resultPayloadGPR);
+
+ MacroAssembler::JumpList slowCases;
+ ArrayMode mode = node->arrayMode();
+ switch (mode.type()) {
+ case Array::Int32:
+ case Array::Contiguous: {
+ ASSERT(!!node->child3());
+ StorageOperand storage(this, node->child3());
+ GPRTemporary scratch(this);
- if (node->codeOrigin.inlineCallFrame) {
- speculationCheck(
- Uncountable, JSValueRegs(), 0,
- m_jit.branch32(
- JITCompiler::AboveOrEqual,
- resultPayloadGPR,
- Imm32(node->codeOrigin.inlineCallFrame->arguments.size())));
- } else {
- speculationCheck(
- Uncountable, JSValueRegs(), 0,
- m_jit.branch32(
- JITCompiler::AboveOrEqual,
- resultPayloadGPR,
- JITCompiler::payloadFor(JSStack::ArgumentCount)));
+ GPRReg storageGPR = storage.gpr();
+ GPRReg scratchGPR = scratch.gpr();
+
+ slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength())));
+ m_jit.load32(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), scratchGPR);
+ slowCases.append(m_jit.branch32(MacroAssembler::Equal, scratchGPR, TrustedImm32(JSValue::EmptyValueTag)));
+ break;
}
-
- JITCompiler::JumpList slowArgument;
- JITCompiler::JumpList slowArgumentOutOfBounds;
- if (const SlowArgument* slowArguments = m_jit.symbolTableFor(node->codeOrigin)->slowArguments()) {
- slowArgumentOutOfBounds.append(
- m_jit.branch32(
- JITCompiler::AboveOrEqual, indexGPR,
- Imm32(m_jit.symbolTableFor(node->codeOrigin)->parameterCount())));
+ case Array::Double: {
+ ASSERT(!!node->child3());
+ StorageOperand storage(this, node->child3());
+ FPRTemporary scratch(this);
+ FPRReg scratchFPR = scratch.fpr();
+ GPRReg storageGPR = storage.gpr();
- COMPILE_ASSERT(sizeof(SlowArgument) == 8, SlowArgument_size_is_eight_bytes);
- m_jit.move(ImmPtr(slowArguments), resultPayloadGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- resultPayloadGPR, indexGPR, JITCompiler::TimesEight,
- OBJECT_OFFSETOF(SlowArgument, index)),
- resultPayloadGPR);
+ slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength())));
+ m_jit.loadDouble(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight), scratchFPR);
+ slowCases.append(m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, scratchFPR, scratchFPR));
+ break;
+ }
+ case Array::ArrayStorage: {
+ ASSERT(!!node->child3());
+ StorageOperand storage(this, node->child3());
+ GPRTemporary scratch(this);
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfLocals(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)),
- resultTagGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfLocals(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)),
- resultPayloadGPR);
- slowArgument.append(m_jit.jump());
+ GPRReg storageGPR = storage.gpr();
+ GPRReg scratchGPR = scratch.gpr();
+
+ slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset())));
+ m_jit.load32(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), scratchGPR);
+ slowCases.append(m_jit.branch32(MacroAssembler::Equal, scratchGPR, TrustedImm32(JSValue::EmptyValueTag)));
+ break;
}
- slowArgumentOutOfBounds.link(&m_jit);
-
- m_jit.neg32(resultPayloadGPR);
-
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfArgumentsIncludingThis(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)),
- resultTagGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfArgumentsIncludingThis(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)),
- resultPayloadGPR);
-
- slowArgument.link(&m_jit);
- jsValueResult(resultTagGPR, resultPayloadGPR, node);
+ default: {
+ slowCases.append(m_jit.jump());
+ break;
+ }
+ }
+
+ moveTrueTo(resultPayloadGPR);
+ MacroAssembler::Jump done = m_jit.jump();
+
+ addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, resultTagGPR, resultPayloadGPR, baseGPR, indexGPR));
+
+ done.link(&m_jit);
+ booleanResult(resultPayloadGPR, node);
break;
}
- case GetMyArgumentByValSafe: {
- SpeculateStrictInt32Operand index(this, node->child1());
+ case GetDirectPname: {
+ Edge& baseEdge = m_jit.graph().varArgChild(node, 0);
+ Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+
+ SpeculateCellOperand base(this, baseEdge);
+ SpeculateCellOperand property(this, propertyEdge);
+ GPRReg baseGPR = base.gpr();
+ GPRReg propertyGPR = property.gpr();
+
+#if CPU(X86)
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
+ GPRTemporary scratch(this);
+
+ GPRReg resultTagGPR = resultTag.gpr();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg scratchGPR = scratch.gpr();
+
+ // Not enough registers on X86 for this code, so always use the slow path.
+ flushRegisters();
+ m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), scratchGPR);
+ callOperation(operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, scratchGPR, propertyGPR);
+#else
GPRTemporary resultPayload(this);
GPRTemporary resultTag(this);
- GPRReg indexGPR = index.gpr();
- GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRTemporary scratch(this);
+
GPRReg resultTagGPR = resultTag.gpr();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg scratchGPR = scratch.gpr();
+
+ Edge& indexEdge = m_jit.graph().varArgChild(node, 2);
+ Edge& enumeratorEdge = m_jit.graph().varArgChild(node, 3);
+
+ SpeculateInt32Operand index(this, indexEdge);
+ SpeculateCellOperand enumerator(this, enumeratorEdge);
+
+ GPRReg indexGPR = index.gpr();
+ GPRReg enumeratorGPR = enumerator.gpr();
+
+ // Check the structure
+ m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), scratchGPR);
+ MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual,
+ scratchGPR, MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset()));
- JITCompiler::JumpList slowPath;
- slowPath.append(
- m_jit.branch32(
- JITCompiler::NotEqual,
- JITCompiler::tagFor(m_jit.argumentsRegisterFor(node->codeOrigin)),
- TrustedImm32(JSValue::EmptyValueTag)));
-
- m_jit.add32(TrustedImm32(1), indexGPR, resultPayloadGPR);
- if (node->codeOrigin.inlineCallFrame) {
- slowPath.append(
- m_jit.branch32(
- JITCompiler::AboveOrEqual,
- resultPayloadGPR,
- Imm32(node->codeOrigin.inlineCallFrame->arguments.size())));
- } else {
- slowPath.append(
- m_jit.branch32(
- JITCompiler::AboveOrEqual,
- resultPayloadGPR,
- JITCompiler::payloadFor(JSStack::ArgumentCount)));
- }
-
- JITCompiler::JumpList slowArgument;
- JITCompiler::JumpList slowArgumentOutOfBounds;
- if (const SlowArgument* slowArguments = m_jit.symbolTableFor(node->codeOrigin)->slowArguments()) {
- slowArgumentOutOfBounds.append(
- m_jit.branch32(
- JITCompiler::AboveOrEqual, indexGPR,
- Imm32(m_jit.symbolTableFor(node->codeOrigin)->parameterCount())));
+ // Compute the offset
+ // If index is less than the enumerator's cached inline storage, then it's an inline access
+ MacroAssembler::Jump outOfLineAccess = m_jit.branch32(MacroAssembler::AboveOrEqual,
+ indexGPR, MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()));
- COMPILE_ASSERT(sizeof(SlowArgument) == 8, SlowArgument_size_is_eight_bytes);
- m_jit.move(ImmPtr(slowArguments), resultPayloadGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- resultPayloadGPR, indexGPR, JITCompiler::TimesEight,
- OBJECT_OFFSETOF(SlowArgument, index)),
- resultPayloadGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfLocals(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)),
- resultTagGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfLocals(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)),
- resultPayloadGPR);
- slowArgument.append(m_jit.jump());
- }
- slowArgumentOutOfBounds.link(&m_jit);
-
- m_jit.neg32(resultPayloadGPR);
-
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfArgumentsIncludingThis(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)),
- resultTagGPR);
- m_jit.load32(
- JITCompiler::BaseIndex(
- GPRInfo::callFrameRegister, resultPayloadGPR, JITCompiler::TimesEight,
- m_jit.offsetOfArgumentsIncludingThis(node->codeOrigin) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)),
- resultPayloadGPR);
-
- if (node->codeOrigin.inlineCallFrame) {
- addSlowPathGenerator(
- slowPathCall(
- slowPath, this, operationGetInlinedArgumentByVal,
- JSValueRegs(resultTagGPR, resultPayloadGPR),
- m_jit.argumentsRegisterFor(node->codeOrigin),
- node->codeOrigin.inlineCallFrame, indexGPR));
- } else {
- addSlowPathGenerator(
- slowPathCall(
- slowPath, this, operationGetArgumentByVal,
- JSValueRegs(resultTagGPR, resultPayloadGPR),
- m_jit.argumentsRegisterFor(node->codeOrigin), indexGPR));
- }
+ m_jit.move(indexGPR, scratchGPR);
+ m_jit.signExtend32ToPtr(scratchGPR, scratchGPR);
+ m_jit.load32(MacroAssembler::BaseIndex(baseGPR, scratchGPR, MacroAssembler::TimesEight, JSObject::offsetOfInlineStorage() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
+ m_jit.load32(MacroAssembler::BaseIndex(baseGPR, scratchGPR, MacroAssembler::TimesEight, JSObject::offsetOfInlineStorage() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
+
+ MacroAssembler::Jump done = m_jit.jump();
- slowArgument.link(&m_jit);
+ // Otherwise it's out of line
+ outOfLineAccess.link(&m_jit);
+ m_jit.move(indexGPR, scratchGPR);
+ m_jit.sub32(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), scratchGPR);
+ m_jit.neg32(scratchGPR);
+ m_jit.signExtend32ToPtr(scratchGPR, scratchGPR);
+ // We use resultPayloadGPR as a temporary here. We have to make sure clobber it after getting the
+ // value out of indexGPR and enumeratorGPR because resultPayloadGPR could reuse either of those registers.
+ m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultPayloadGPR);
+ int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
+ m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
+ m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
+
+ done.link(&m_jit);
+
+ addSlowPathGenerator(slowPathCall(wrongStructure, this, operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, propertyGPR));
+#endif
+
jsValueResult(resultTagGPR, resultPayloadGPR, node);
break;
}
-
- case NewFunctionNoCheck:
- compileNewFunctionNoCheck(node);
+ case GetPropertyEnumerator: {
+ SpeculateCellOperand base(this, node->child1());
+ GPRFlushedCallResult result(this);
+ GPRReg resultGPR = result.gpr();
+
+ flushRegisters();
+ callOperation(operationGetPropertyEnumerator, resultGPR, base.gpr());
+ cellResult(resultGPR, node);
break;
-
- case NewFunction: {
- JSValueOperand value(this, node->child1());
- GPRTemporary resultTag(this, value);
- GPRTemporary resultPayload(this, value, false);
-
- GPRReg valueTagGPR = value.tagGPR();
- GPRReg valuePayloadGPR = value.payloadGPR();
+ }
+ case GetEnumeratorStructurePname:
+ case GetEnumeratorGenericPname: {
+ SpeculateCellOperand enumerator(this, node->child1());
+ SpeculateInt32Operand index(this, node->child2());
+ GPRTemporary scratch(this);
+ GPRTemporary resultPayload(this);
+ GPRTemporary resultTag(this);
+
+ GPRReg enumeratorGPR = enumerator.gpr();
+ GPRReg indexGPR = index.gpr();
+ GPRReg scratchGPR = scratch.gpr();
GPRReg resultTagGPR = resultTag.gpr();
GPRReg resultPayloadGPR = resultPayload.gpr();
-
- m_jit.move(valuePayloadGPR, resultPayloadGPR);
- m_jit.move(valueTagGPR, resultTagGPR);
-
- JITCompiler::Jump notCreated = m_jit.branch32(JITCompiler::Equal, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
-
- addSlowPathGenerator(
- slowPathCall(
- notCreated, this, operationNewFunction, JSValueRegs(resultTagGPR, resultPayloadGPR),
- m_jit.codeBlock()->functionDecl(node->functionDeclIndex())));
-
+
+ MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, indexGPR,
+ MacroAssembler::Address(enumeratorGPR, (op == GetEnumeratorStructurePname)
+ ? JSPropertyNameEnumerator::endStructurePropertyIndexOffset()
+ : JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
+
+ m_jit.move(MacroAssembler::TrustedImm32(JSValue::NullTag), resultTagGPR);
+ m_jit.move(MacroAssembler::TrustedImm32(0), resultPayloadGPR);
+
+ MacroAssembler::Jump done = m_jit.jump();
+ inBounds.link(&m_jit);
+
+ m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratchGPR);
+ m_jit.loadPtr(MacroAssembler::BaseIndex(scratchGPR, indexGPR, MacroAssembler::ScalePtr), resultPayloadGPR);
+ m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), resultTagGPR);
+
+ done.link(&m_jit);
jsValueResult(resultTagGPR, resultPayloadGPR, node);
break;
}
-
- case NewFunctionExpression:
- compileNewFunctionExpression(node);
+ case ToIndexString: {
+ SpeculateInt32Operand index(this, node->child1());
+ GPRFlushedCallResult result(this);
+ GPRReg resultGPR = result.gpr();
+
+ flushRegisters();
+ callOperation(operationToIndexString, resultGPR, index.gpr());
+ cellResult(resultGPR, node);
break;
+ }
+ case ProfileType: {
+ JSValueOperand value(this, node->child1());
+ GPRTemporary scratch1(this);
+ GPRTemporary scratch2(this);
+ GPRTemporary scratch3(this);
+
+ GPRReg scratch1GPR = scratch1.gpr();
+ GPRReg scratch2GPR = scratch2.gpr();
+ GPRReg scratch3GPR = scratch3.gpr();
+
+ // Load the TypeProfilerLog into Scratch2.
+ TypeProfilerLog* cachedTypeProfilerLog = m_jit.vm()->typeProfilerLog();
+ m_jit.move(TrustedImmPtr(cachedTypeProfilerLog), scratch2GPR);
+
+ // Load the next LogEntry into Scratch1.
+ m_jit.loadPtr(MacroAssembler::Address(scratch2GPR, TypeProfilerLog::currentLogEntryOffset()), scratch1GPR);
+
+ // Store the JSValue onto the log entry.
+ m_jit.store32(value.tagGPR(), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+ m_jit.store32(value.payloadGPR(), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+
+ // Store the structureID of the cell if valueGPR is a cell, otherwise, store 0 on the log entry.
+ MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
+ m_jit.load32(MacroAssembler::Address(value.payloadGPR(), JSCell::structureIDOffset()), scratch3GPR);
+ m_jit.store32(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
+ MacroAssembler::Jump skipIsCell = m_jit.jump();
+ isNotCell.link(&m_jit);
+ m_jit.store32(TrustedImm32(0), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
+ skipIsCell.link(&m_jit);
+
+ // Store the typeLocation on the log entry.
+ TypeLocation* cachedTypeLocation = node->typeLocation();
+ m_jit.move(TrustedImmPtr(cachedTypeLocation), scratch3GPR);
+ m_jit.storePtr(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::locationOffset()));
+
+ // Increment the current log entry.
+ m_jit.addPtr(TrustedImm32(sizeof(TypeProfilerLog::LogEntry)), scratch1GPR);
+ m_jit.storePtr(scratch1GPR, MacroAssembler::Address(scratch2GPR, TypeProfilerLog::currentLogEntryOffset()));
+ MacroAssembler::Jump clearLog = m_jit.branchPtr(MacroAssembler::Equal, scratch1GPR, TrustedImmPtr(cachedTypeProfilerLog->logEndPtr()));
+ addSlowPathGenerator(
+ slowPathCall(clearLog, this, operationProcessTypeProfilerLogDFG, NoResult));
- case GarbageValue:
- // We should never get to the point of code emission for a GarbageValue
- CRASH();
+ noResult(node);
break;
+ }
+ case ProfileControlFlow: {
+ BasicBlockLocation* basicBlockLocation = node->basicBlockLocation();
+ if (!basicBlockLocation->hasExecuted()) {
+ GPRTemporary scratch1(this);
+ basicBlockLocation->emitExecuteCode(m_jit, scratch1.gpr());
+ }
+ noResult(node);
+ break;
+ }
case ForceOSRExit: {
terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
break;
}
+ case InvalidationPoint:
+ emitInvalidationPoint(node);
+ break;
+
case CheckWatchdogTimer:
+ ASSERT(m_jit.vm()->watchdog);
speculationCheck(
WatchdogTimerFired, JSValueRegs(), 0,
m_jit.branchTest8(
JITCompiler::NonZero,
- JITCompiler::AbsoluteAddress(m_jit.vm()->watchdog.timerDidFireAddress())));
+ JITCompiler::AbsoluteAddress(m_jit.vm()->watchdog->timerDidFireAddress())));
break;
case CountExecution:
break;
case Phantom:
+ case Check:
DFG_NODE_DO_TO_CHILDREN(m_jit.graph(), node, speculate);
noResult(node);
break;
+ case Breakpoint:
+ case ProfileWillCall:
+ case ProfileDidCall:
case PhantomLocal:
+ case LoopHint:
// This is a no-op.
noResult(node);
break;
-
+
+
case Unreachable:
RELEASE_ASSERT_NOT_REACHED();
break;
- case Nop:
case LastNodeType:
- RELEASE_ASSERT_NOT_REACHED();
+ case Phi:
+ case Upsilon:
+ case ExtractOSREntryLocal:
+ case CheckTierUpInLoop:
+ case CheckTierUpAtReturn:
+ case CheckTierUpAndOSREnter:
+ case CheckTierUpWithNestedTriggerAndOSREnter:
+ case Int52Rep:
+ case FiatInt52:
+ case Int52Constant:
+ case CheckInBounds:
+ case ArithIMul:
+ case MultiGetByOffset:
+ case MultiPutByOffset:
+ case NativeCall:
+ case NativeConstruct:
+ case CheckBadCell:
+ case BottomValue:
+ case PhantomNewObject:
+ case PhantomNewFunction:
+ case PhantomCreateActivation:
+ case PutHint:
+ case CheckStructureImmediate:
+ case MaterializeNewObject:
+ case MaterializeCreateActivation:
+ case PutStack:
+ case KillStack:
+ case GetStack:
+ case GetMyArgumentByVal:
+ DFG_CRASH(m_jit.graph(), node, "unexpected node in DFG backend");
break;
}
-#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
- m_jit.clearRegisterAllocationOffsets();
-#endif
-
if (!m_compileOkay)
return;
use(node);
}
+#if ENABLE(GGC)
+void SpeculativeJIT::writeBarrier(GPRReg ownerGPR, GPRReg valueTagGPR, Edge valueUse, GPRReg scratch1, GPRReg scratch2)
+{
+ JITCompiler::Jump isNotCell;
+ if (!isKnownCell(valueUse.node()))
+ isNotCell = m_jit.branch32(JITCompiler::NotEqual, valueTagGPR, JITCompiler::TrustedImm32(JSValue::CellTag));
+
+ JITCompiler::Jump ownerIsRememberedOrInEden = m_jit.jumpIfIsRememberedOrInEden(ownerGPR);
+ storeToWriteBarrierBuffer(ownerGPR, scratch1, scratch2);
+ ownerIsRememberedOrInEden.link(&m_jit);
+
+ if (!isKnownCell(valueUse.node()))
+ isNotCell.link(&m_jit);
+}
+#endif // ENABLE(GGC)
+
+void SpeculativeJIT::moveTrueTo(GPRReg gpr)
+{
+ m_jit.move(TrustedImm32(1), gpr);
+}
+
+void SpeculativeJIT::moveFalseTo(GPRReg gpr)
+{
+ m_jit.move(TrustedImm32(0), gpr);
+}
+
+void SpeculativeJIT::blessBoolean(GPRReg)
+{
+}
+
#endif
} } // namespace JSC::DFG
projects / apple / javascriptcore.git / blobdiff