Title: [281355] trunk/Source/_javascript_Core
Revision
281355
Author
ysuz...@apple.com
Date
2021-08-20 17:54:50 -0700 (Fri, 20 Aug 2021)

Log Message

[JSC] Simplify moveIntsToDouble
https://bugs.webkit.org/show_bug.cgi?id=229351

Reviewed by Saam Barati.

MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed.
This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler.
This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern
IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR
to AccessCase. But after this simplification, this is no longer necessary.

* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::moveIntsToDouble):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::moveIntsToDouble):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileDoubleRep):
(JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileMathIC):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::speculateRealNumber):
(JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::unboxDouble):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitConvertValueToBoolean):
(JSC::AssemblyHelpers::branchIfValue):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::unboxDoubleNonDestructive):
(JSC::AssemblyHelpers::unboxDouble):
* jit/JITAddGenerator.cpp:
(JSC::JITAddGenerator::generateFastPath):
* jit/JITAddGenerator.h:
(JSC::JITAddGenerator::JITAddGenerator):
* jit/JITArithmetic.cpp:
(JSC::JIT::emitRightShiftFastPath):
(JSC::JIT::emitMathICFast):
* jit/JITDivGenerator.cpp:
(JSC::JITDivGenerator::loadOperand):
* jit/JITMulGenerator.cpp:
(JSC::JITMulGenerator::generateInline):
(JSC::JITMulGenerator::generateFastPath):
* jit/JITMulGenerator.h:
(JSC::JITMulGenerator::JITMulGenerator):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitFloatTypedArrayPutByVal):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitGenericContiguousPutByVal):
* jit/JITRightShiftGenerator.cpp:
(JSC::JITRightShiftGenerator::generateFastPath):
* jit/JITRightShiftGenerator.h:
(JSC::JITRightShiftGenerator::JITRightShiftGenerator):
* jit/JITSubGenerator.cpp:
(JSC::JITSubGenerator::generateInline):
(JSC::JITSubGenerator::generateFastPath):
* jit/JITSubGenerator.h:
(JSC::JITSubGenerator::JITSubGenerator):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (281354 => 281355)


--- trunk/Source/_javascript_Core/ChangeLog	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/ChangeLog	2021-08-21 00:54:50 UTC (rev 281355)
@@ -1,5 +1,72 @@
 2021-08-20  Yusuke Suzuki  <ysuz...@apple.com>
 
+        [JSC] Simplify moveIntsToDouble
+        https://bugs.webkit.org/show_bug.cgi?id=229351
+
+        Reviewed by Saam Barati.
+
+        MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed.
+        This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler.
+        This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern
+        IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR
+        to AccessCase. But after this simplification, this is no longer necessary.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::moveIntsToDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::moveIntsToDouble):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+        (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileValueSub):
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        (JSC::DFG::SpeculativeJIT::compileValueNegate):
+        (JSC::DFG::SpeculativeJIT::compileValueMul):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::unboxDouble):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
+        (JSC::AssemblyHelpers::branchIfValue):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
+        (JSC::AssemblyHelpers::unboxDouble):
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitRightShiftFastPath):
+        (JSC::JIT::emitMathICFast):
+        * jit/JITDivGenerator.cpp:
+        (JSC::JITDivGenerator::loadOperand):
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateInline):
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        * jit/JITRightShiftGenerator.cpp:
+        (JSC::JITRightShiftGenerator::generateFastPath):
+        * jit/JITRightShiftGenerator.h:
+        (JSC::JITRightShiftGenerator::JITRightShiftGenerator):
+        * jit/JITSubGenerator.cpp:
+        (JSC::JITSubGenerator::generateInline):
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::JITSubGenerator):
+
+2021-08-20  Yusuke Suzuki  <ysuz...@apple.com>
+
         [JSC] Remove unnecessary moves in Yarr's sub32 / add32 related code
         https://bugs.webkit.org/show_bug.cgi?id=228813
 

Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h (281354 => 281355)


--- trunk/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -1012,9 +1012,8 @@
         m_assembler.vmov(dest1, dest2, src);
     }
     
-    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest)
     {
-        UNUSED_PARAM(scratch);
         m_assembler.vmov(dest, src1, src2);
     }
 

Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerMIPS.h (281354 => 281355)


--- trunk/Source/_javascript_Core/assembler/MacroAssemblerMIPS.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerMIPS.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -2072,9 +2072,8 @@
         m_assembler.vmov(dest1, dest2, src);
     }
 
-    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest)
     {
-        UNUSED_PARAM(scratch);
         m_assembler.vmov(dest, src1, src2);
     }
 

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -2856,7 +2856,6 @@
                 GPRReg tagGPR = op1.tagGPR();
                 FPRTemporary tempFpr(this);
                 FPRReg fpr = tempFpr.fpr();
-                FPRTemporary scratch(this);
 
                 JITCompiler::Jump isInteger = m_jit.branchIfInt32(tagGPR);
 
@@ -2885,7 +2884,7 @@
                     isNumber.link(&m_jit);
                 }
 
-                unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());
+                unboxDouble(tagGPR, payloadGPR, fpr);
 
                 silentSpillAllRegisters(resultGpr);
                 callOperation(operationToInt32, resultGpr, fpr);
@@ -2989,9 +2988,7 @@
         GPRReg tempGPR = temp.gpr();
         m_jit.unboxDoubleWithoutAssertions(op1Regs.gpr(), tempGPR, resultFPR);
 #else
-        FPRTemporary temp(this);
-        FPRReg tempFPR = temp.fpr();
-        unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR, tempFPR);
+        unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR);
 #endif
         
         JITCompiler::Jump done = m_jit.branchIfNotNaN(resultFPR);
@@ -3068,11 +3065,8 @@
         m_jit.convertInt32ToDouble(op1GPR, resultFPR);
         done.link(&m_jit);
 #else // USE(JSVALUE64) -> this is the 32_64 case
-        FPRTemporary temp(this);
-    
         GPRReg op1TagGPR = op1.tagGPR();
         GPRReg op1PayloadGPR = op1.payloadGPR();
-        FPRReg tempFPR = temp.fpr();
         FPRReg resultFPR = result.fpr();
         JITCompiler::JumpList done;
     
@@ -3109,7 +3103,7 @@
                 m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));
         }
 
-        unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR, tempFPR);
+        unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR);
         done.append(m_jit.jump());
     
         isInteger.link(&m_jit);
@@ -4622,14 +4616,11 @@
     JSValueRegs resultRegs = JSValueRegs(result.gpr());
     GPRTemporary scratch(this);
     GPRReg scratchGPR = scratch.gpr();
-    FPRReg scratchFPR = InvalidFPRReg;
 #else
     GPRTemporary resultTag(this);
     GPRTemporary resultPayload(this);
     JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
     GPRReg scratchGPR = resultTag.gpr();
-    FPRTemporary fprScratch(this);
-    FPRReg scratchFPR = fprScratch.fpr();
 #endif
 
     SnippetOperand leftOperand;
@@ -4653,8 +4644,7 @@
         rightRegs = right->jsValueRegs();
     }
 
-    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
-        leftFPR, scratchGPR, scratchFPR, shiftType);
+    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, scratchGPR, shiftType);
     gen.generateFastPath(m_jit);
 
     ASSERT(gen.didEmitFastPath());
@@ -4859,14 +4849,6 @@
         return;
     }
 
-#if USE(JSVALUE64)
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = false;
-#else
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = true;
-#endif
-
     CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -4874,7 +4856,7 @@
     auto repatchingFunction = operationValueAddOptimize;
     auto nonRepatchingFunction = operationValueAdd;
     
-    compileMathIC(node, addIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
+    compileMathIC(node, addIC, repatchingFunction, nonRepatchingFunction);
 }
 
 void SpeculativeJIT::compileValueSub(Node* node)
@@ -4951,14 +4933,6 @@
         return;
     }
 
-#if USE(JSVALUE64)
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = false;
-#else
-    bool needsScratchGPRReg = true;
-    bool needsScratchFPRReg = true;
-#endif
-
     CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -4966,11 +4940,11 @@
     auto repatchingFunction = operationValueSubOptimize;
     auto nonRepatchingFunction = operationValueSub;
 
-    compileMathIC(node, subIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
+    compileMathIC(node, subIC, repatchingFunction, nonRepatchingFunction);
 }
 
 template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
-void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathIC, bool needsScratchGPRReg, bool needsScratchFPRReg, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
+void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathIC, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
 {
     Edge& leftChild = node->child1();
     Edge& rightChild = node->child2();
@@ -4987,20 +4961,10 @@
     FPRReg rightFPR = rightNumber.fpr();
 
     GPRReg scratchGPR = InvalidGPRReg;
-    FPRReg scratchFPR = InvalidFPRReg;
 
-    std::optional<FPRTemporary> fprScratch;
-    if (needsScratchFPRReg) {
-        fprScratch.emplace(this);
-        scratchFPR = fprScratch->fpr();
-    }
-
 #if USE(JSVALUE64)
-    std::optional<GPRTemporary> gprScratch;
-    if (needsScratchGPRReg) {
-        gprScratch.emplace(this);
-        scratchGPR = gprScratch->gpr();
-    }
+    GPRTemporary gprScratch(this);
+    scratchGPR = gprScratch.gpr();
     GPRTemporary result(this);
     JSValueRegs resultRegs = JSValueRegs(result.gpr());
 #else
@@ -5007,8 +4971,7 @@
     GPRTemporary resultTag(this);
     GPRTemporary resultPayload(this);
     JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
-    if (needsScratchGPRReg)
-        scratchGPR = resultRegs.tagGPR();
+    scratchGPR = resultRegs.tagGPR();
 #endif
 
     SnippetOperand leftOperand(m_state.forNode(leftChild).resultType());
@@ -5038,7 +5001,7 @@
 #endif
 
     Box<MathICGenerationState> addICGenerationState = Box<MathICGenerationState>::create();
-    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, rightFPR, scratchGPR, scratchFPR);
+    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, rightFPR, scratchGPR);
 
     bool shouldEmitProfiling = false;
     bool generatedInline = mathIC->generateInline(m_jit, *addICGenerationState, shouldEmitProfiling);
@@ -5558,8 +5521,7 @@
     JITNegIC* negIC = m_jit.codeBlock()->addJITNegIC(arithProfile);
     auto repatchingFunction = operationArithNegateOptimize;
     auto nonRepatchingFunction = operationArithNegate;
-    bool needsScratchGPRReg = true;
-    compileMathIC(node, negIC, needsScratchGPRReg, repatchingFunction, nonRepatchingFunction);
+    compileMathIC(node, negIC, repatchingFunction, nonRepatchingFunction);
 }
 
 void SpeculativeJIT::compileArithNegate(Node* node)
@@ -5642,14 +5604,10 @@
 }
 
 template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
-void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC, bool needsScratchGPRReg, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
+void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
 {
-    GPRReg scratchGPR = InvalidGPRReg;
-    std::optional<GPRTemporary> gprScratch;
-    if (needsScratchGPRReg) {
-        gprScratch.emplace(this);
-        scratchGPR = gprScratch->gpr();
-    }
+    GPRTemporary gprScratch(this);
+    GPRReg scratchGPR = gprScratch.gpr();
     JSValueOperand childOperand(this, node->child1());
     JSValueRegs childRegs = childOperand.jsValueRegs();
 #if USE(JSVALUE64)
@@ -5801,13 +5759,6 @@
         return;
     }
 
-    bool needsScratchGPRReg = true;
-#if USE(JSVALUE64)
-    bool needsScratchFPRReg = false;
-#else
-    bool needsScratchFPRReg = true;
-#endif
-
     CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -5815,7 +5766,7 @@
     auto repatchingFunction = operationValueMulOptimize;
     auto nonRepatchingFunction = operationValueMul;
 
-    compileMathIC(node, mulIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
+    compileMathIC(node, mulIC, repatchingFunction, nonRepatchingFunction);
 }
 
 void SpeculativeJIT::compileArithMul(Node* node)
@@ -11263,9 +11214,7 @@
     GPRReg tempGPR = temp.gpr();
     m_jit.unboxDoubleWithoutAssertions(op1Regs.gpr(), tempGPR, resultFPR);
 #else
-    FPRTemporary temp(this);
-    FPRReg tempFPR = temp.fpr();
-    unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR, tempFPR);
+    unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR);
 #endif
     
     JITCompiler::Jump done = m_jit.branchIfNotNaN(resultFPR);
@@ -13298,7 +13247,7 @@
 #if USE(JSVALUE64)
     m_jit.unboxDoubleWithoutAssertions(keyRegs.gpr(), scratchGPR, doubleValueFPR);
 #else
-    unboxDouble(keyRegs.tagGPR(), keyRegs.payloadGPR(), doubleValueFPR, tempFPR);
+    unboxDouble(keyRegs.tagGPR(), keyRegs.payloadGPR(), doubleValueFPR);
 #endif
     auto notNaN = m_jit.branchIfNotNaN(doubleValueFPR);
     m_jit.moveTrustedValue(jsNaN(), resultRegs);

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (281354 => 281355)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -480,9 +480,9 @@
     {
         m_jit.boxDouble(fpr, tagGPR, payloadGPR);
     }
-    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr, FPRReg scratchFPR)
+    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr)
     {
-        m_jit.unboxDouble(tagGPR, payloadGPR, fpr, scratchFPR);
+        m_jit.unboxDouble(tagGPR, payloadGPR, fpr);
     }
 #endif
     void boxDouble(FPRReg fpr, JSValueRegs regs)
@@ -1395,9 +1395,9 @@
     void compileShiftOp(Node*);
 
     template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
-    void compileMathIC(Node*, JITBinaryMathIC<Generator>*, bool needsScratchGPRReg, bool needsScratchFPRReg, RepatchingFunction, NonRepatchingFunction);
+    void compileMathIC(Node*, JITBinaryMathIC<Generator>*, RepatchingFunction, NonRepatchingFunction);
     template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
-    void compileMathIC(Node*, JITUnaryMathIC<Generator>*, bool needsScratchGPRReg, RepatchingFunction, NonRepatchingFunction);
+    void compileMathIC(Node*, JITUnaryMathIC<Generator>*, RepatchingFunction, NonRepatchingFunction);
 
     void compileArithDoubleUnaryOp(Node*, double (*doubleFunction)(double), double (*operation)(JSGlobalObject*, EncodedJSValue));
     void compileValueAdd(Node*);

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -2503,7 +2503,7 @@
                 JITBinaryMathIC<Generator>* mathIC = jit.codeBlock()->addMathIC<Generator>(arithProfile);
                 mathIC->m_generator = Generator(leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
                     JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()), params.fpScratch(0),
-                    params.fpScratch(1), params.gpScratch(0), InvalidFPRReg);
+                    params.fpScratch(1), params.gpScratch(0));
 
                 bool shouldEmitProfiling = false;
                 bool generatedInline = mathIC->generateInline(jit, *mathICGenerationState, shouldEmitProfiling);
@@ -16012,7 +16012,7 @@
                 auto generator = Box<JITRightShiftGenerator>::create(
                     leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
                     JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()),
-                    params.fpScratch(0), params.gpScratch(0), InvalidFPRReg, shiftType);
+                    params.fpScratch(0), params.gpScratch(0), shiftType);
 
                 generator->generateFastPath(jit);
                 generator->endJumpList().link(&jit);

Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -819,7 +819,7 @@
 #if USE(JSVALUE64)
     unboxDouble(value.gpr(), result, valueAsFPR);
 #else
-    unboxDouble(value, valueAsFPR, tempFPR);
+    unboxDouble(value, valueAsFPR);
 #endif
     move(invert ? TrustedImm32(1) : TrustedImm32(0), result);
     done.append(branchDoubleZeroOrNaN(valueAsFPR, tempFPR));
@@ -920,7 +920,7 @@
 #if USE(JSVALUE64)
     unboxDouble(value.gpr(), scratch, valueAsFPR);
 #else
-    unboxDouble(value, valueAsFPR, tempFPR);
+    unboxDouble(value, valueAsFPR);
 #endif
     if (invert) {
         truthy.append(branchDoubleZeroOrNaN(valueAsFPR, tempFPR));

Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.h (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -1304,7 +1304,7 @@
         boxDouble(fpr, regs.gpr(), mode);
     }
 
-    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg resultGPR, FPRReg)
+    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg resultGPR)
     {
         unboxDouble(regs.payloadGPR(), resultGPR, destFPR);
     }
@@ -1355,9 +1355,9 @@
     {
         moveDoubleToInts(fpr, payloadGPR, tagGPR);
     }
-    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr, FPRReg scratchFPR)
+    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr)
     {
-        moveIntsToDouble(payloadGPR, tagGPR, fpr, scratchFPR);
+        moveIntsToDouble(payloadGPR, tagGPR, fpr);
     }
     
     void boxDouble(FPRReg fpr, JSValueRegs regs)
@@ -1364,14 +1364,14 @@
     {
         boxDouble(fpr, regs.tagGPR(), regs.payloadGPR());
     }
-    void unboxDouble(JSValueRegs regs, FPRReg fpr, FPRReg scratchFPR)
+    void unboxDouble(JSValueRegs regs, FPRReg fpr)
     {
-        unboxDouble(regs.tagGPR(), regs.payloadGPR(), fpr, scratchFPR);
+        unboxDouble(regs.tagGPR(), regs.payloadGPR(), fpr);
     }
 
-    void unboxDoubleNonDestructive(const JSValueRegs regs, FPRReg destFPR, GPRReg, FPRReg scratchFPR)
+    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg)
     {
-        unboxDouble(regs, destFPR, scratchFPR);
+        unboxDouble(regs, destFPR);
     }
 #endif
     

Modified: trunk/Source/_javascript_Core/jit/JITAddGenerator.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITAddGenerator.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITAddGenerator.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -80,7 +80,6 @@
 #if USE(JSVALUE32_64)
     ASSERT(m_scratchGPR != m_left.tagGPR());
     ASSERT(m_scratchGPR != m_right.tagGPR());
-    ASSERT(m_scratchFPR != InvalidFPRReg);
 #endif
 
     ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
@@ -114,7 +113,7 @@
         if (!varOpr.definitelyIsNumber())
             slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
 
-        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR);
 
         jit.move(CCallHelpers::Imm32(constOpr.asConstInt32()), m_scratchGPR);
         jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
@@ -151,7 +150,7 @@
         if (!m_rightOperand.definitelyIsNumber())
             slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
 
-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
         CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
 
         jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
@@ -164,7 +163,7 @@
         jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
 
         rightIsDouble.link(&jit);
-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
 
         rightWasInteger.link(&jit);
 

Modified: trunk/Source/_javascript_Core/jit/JITAddGenerator.h (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITAddGenerator.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITAddGenerator.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -41,7 +41,7 @@
 
     JITAddGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
         JSValueRegs result, JSValueRegs left, JSValueRegs right,
-        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR)
         : m_leftOperand(leftOperand)
         , m_rightOperand(rightOperand)
         , m_result(result)
@@ -50,7 +50,6 @@
         , m_leftFPR(leftFPR)
         , m_rightFPR(rightFPR)
         , m_scratchGPR(scratchGPR)
-        , m_scratchFPR(scratchFPR)
     {
         ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
     }
@@ -70,7 +69,6 @@
     FPRReg m_leftFPR;
     FPRReg m_rightFPR;
     GPRReg m_scratchGPR;
-    FPRReg m_scratchFPR;
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/jit/JITArithmetic.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITArithmetic.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITArithmetic.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -854,13 +854,11 @@
     JSValueRegs rightRegs = JSValueRegs(regT1);
     JSValueRegs resultRegs = leftRegs;
     GPRReg scratchGPR = regT2;
-    FPRReg scratchFPR = InvalidFPRReg;
 #else
     JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
     JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
     JSValueRegs resultRegs = leftRegs;
     GPRReg scratchGPR = regT4;
-    FPRReg scratchFPR = fpRegT2;
 #endif
 
     SnippetOperand leftOperand;
@@ -878,8 +876,7 @@
     if (!rightOperand.isConst())
         emitGetVirtualRegister(op2, rightRegs);
 
-    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
-        fpRegT0, scratchGPR, scratchFPR, snippetShiftType);
+    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, scratchGPR, snippetShiftType);
 
     gen.generateFastPath(*this);
 
@@ -979,13 +976,11 @@
     JSValueRegs rightRegs = JSValueRegs(regT2);
     JSValueRegs resultRegs = JSValueRegs(regT0);
     GPRReg scratchGPR = regT3;
-    FPRReg scratchFPR = fpRegT2;
 #else
     JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
     JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
     JSValueRegs resultRegs = leftRegs;
     GPRReg scratchGPR = regT4;
-    FPRReg scratchFPR = fpRegT2;
 #endif
 
     SnippetOperand leftOperand(bytecode.m_operandTypes.first());
@@ -998,7 +993,7 @@
 
     RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
 
-    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, fpRegT1, scratchGPR, scratchFPR);
+    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, fpRegT1, scratchGPR);
     
     ASSERT(!(Generator::isLeftOperandValidConstant(leftOperand) && Generator::isRightOperandValidConstant(rightOperand)));
     

Modified: trunk/Source/_javascript_Core/jit/JITDivGenerator.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITDivGenerator.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITDivGenerator.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -55,7 +55,7 @@
         jit.convertInt32ToDouble(oprRegs.payloadGPR(), destFPR);
         CCallHelpers::Jump oprIsLoaded = jit.jump();
         notInt32.link(&jit);
-        jit.unboxDoubleNonDestructive(oprRegs, destFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(oprRegs, destFPR, m_scratchGPR);
         oprIsLoaded.link(&jit);
     }
 }

Modified: trunk/Source/_javascript_Core/jit/JITMulGenerator.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITMulGenerator.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITMulGenerator.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -58,8 +58,8 @@
             state.slowPathJumps.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
         state.slowPathJumps.append(jit.branchIfInt32(m_left));
         state.slowPathJumps.append(jit.branchIfInt32(m_right));
-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
         jit.mulDouble(m_rightFPR, m_leftFPR);
         jit.boxDouble(m_leftFPR, m_result);
 
@@ -99,7 +99,6 @@
 #else
     ASSERT(m_scratchGPR != m_left.tagGPR());
     ASSERT(m_scratchGPR != m_right.tagGPR());
-    ASSERT(m_scratchFPR != InvalidFPRReg);
 #endif
 
     ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
@@ -134,7 +133,7 @@
         if (!varOpr.definitelyIsNumber())
             slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
 
-        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR);
 
         jit.move(CCallHelpers::Imm32(constOpr.asConstInt32()), m_scratchGPR);
         jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
@@ -169,7 +168,7 @@
         if (!m_rightOperand.definitelyIsNumber())
             slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
 
-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
         CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
 
         jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
@@ -182,7 +181,7 @@
         jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
 
         rightIsDouble.link(&jit);
-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
 
         rightWasInteger.link(&jit);
 

Modified: trunk/Source/_javascript_Core/jit/JITMulGenerator.h (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITMulGenerator.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITMulGenerator.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -42,7 +42,7 @@
 
     JITMulGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
         JSValueRegs result, JSValueRegs left, JSValueRegs right,
-        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR)
         : m_leftOperand(leftOperand)
         , m_rightOperand(rightOperand)
         , m_result(result)
@@ -51,7 +51,6 @@
         , m_leftFPR(leftFPR)
         , m_rightFPR(rightFPR)
         , m_scratchGPR(scratchGPR)
-        , m_scratchFPR(scratchFPR)
     {
         ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
     }
@@ -71,7 +70,6 @@
     FPRReg m_leftFPR;
     FPRReg m_rightFPR;
     GPRReg m_scratchGPR;
-    FPRReg m_scratchFPR;
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -3600,7 +3600,7 @@
     Jump ready = jump();
     doubleCase.link(this);
     slowCases.append(branch32(Above, lateScratch, TrustedImm32(JSValue::LowestTag)));
-    moveIntsToDouble(earlyScratch, lateScratch, fpRegT0, fpRegT1);
+    moveIntsToDouble(earlyScratch, lateScratch, fpRegT0);
     ready.link(this);
 #endif
     

Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -545,7 +545,7 @@
         convertInt32ToDouble(regT0, fpRegT0);
         Jump ready = jump();
         notInt.link(this);
-        moveIntsToDouble(regT0, regT1, fpRegT0, fpRegT1);
+        moveIntsToDouble(regT0, regT1, fpRegT0);
         slowCases.append(branchIfNaN(fpRegT0));
         ready.link(this);
         storeDouble(fpRegT0, BaseIndex(regT3, regT2, TimesEight));

Modified: trunk/Source/_javascript_Core/jit/JITRightShiftGenerator.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITRightShiftGenerator.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITRightShiftGenerator.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -38,7 +38,6 @@
 #if USE(JSVALUE32_64)
     ASSERT(m_scratchGPR != m_left.tagGPR());
     ASSERT(m_scratchGPR != m_right.tagGPR());
-    ASSERT(m_scratchFPR != InvalidFPRReg);
 #endif
 
     ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
@@ -69,7 +68,7 @@
 
             m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
 
-            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
 #if CPU(ARM64)
             if (MacroAssemblerARM64::supportsDoubleToInt32ConversionUsingJavaScriptSemantics())
                 jit.convertDoubleToInt32UsingJavaScriptSemantics(m_leftFPR, m_scratchGPR);
@@ -128,7 +127,7 @@
             leftNotInt.link(&jit);
 
             m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
-            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
 #if CPU(ARM64)
             if (MacroAssemblerARM64::supportsDoubleToInt32ConversionUsingJavaScriptSemantics())
                 jit.convertDoubleToInt32UsingJavaScriptSemantics(m_leftFPR, m_scratchGPR);

Modified: trunk/Source/_javascript_Core/jit/JITRightShiftGenerator.h (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITRightShiftGenerator.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITRightShiftGenerator.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -40,11 +40,10 @@
 
     JITRightShiftGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
         JSValueRegs result, JSValueRegs left, JSValueRegs right,
-        FPRReg leftFPR, GPRReg scratchGPR, FPRReg scratchFPR, ShiftType type = SignedShift)
+        FPRReg leftFPR, GPRReg scratchGPR, ShiftType type = SignedShift)
         : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, scratchGPR)
         , m_shiftType(type)
         , m_leftFPR(leftFPR)
-        , m_scratchFPR(scratchFPR)
     { }
 
     void generateFastPath(CCallHelpers&);
@@ -52,7 +51,6 @@
 private:
     ShiftType m_shiftType;
     FPRReg m_leftFPR;
-    FPRReg m_scratchFPR;
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/jit/JITSubGenerator.cpp (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITSubGenerator.cpp	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITSubGenerator.cpp	2021-08-21 00:54:50 UTC (rev 281355)
@@ -56,8 +56,8 @@
             state.slowPathJumps.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
         state.slowPathJumps.append(jit.branchIfInt32(m_left));
         state.slowPathJumps.append(jit.branchIfInt32(m_right));
-        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
-        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
         jit.subDouble(m_rightFPR, m_leftFPR);
         jit.boxDouble(m_leftFPR, m_result);
 
@@ -86,7 +86,6 @@
 #if USE(JSVALUE32_64)
     ASSERT(m_scratchGPR != m_left.tagGPR());
     ASSERT(m_scratchGPR != m_right.tagGPR());
-    ASSERT(m_scratchFPR != InvalidFPRReg);
 #endif
 
     CCallHelpers::Jump leftNotInt = jit.branchIfNotInt32(m_left);
@@ -111,7 +110,7 @@
     if (!m_rightOperand.definitelyIsNumber())
         slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
 
-    jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+    jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR);
     CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
 
     jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
@@ -124,7 +123,7 @@
     jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
 
     rightIsDouble.link(&jit);
-    jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+    jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR);
 
     rightWasInteger.link(&jit);
 

Modified: trunk/Source/_javascript_Core/jit/JITSubGenerator.h (281354 => 281355)


--- trunk/Source/_javascript_Core/jit/JITSubGenerator.h	2021-08-21 00:35:46 UTC (rev 281354)
+++ trunk/Source/_javascript_Core/jit/JITSubGenerator.h	2021-08-21 00:54:50 UTC (rev 281355)
@@ -41,7 +41,7 @@
 
     JITSubGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
         JSValueRegs result, JSValueRegs left, JSValueRegs right,
-        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR)
         : m_leftOperand(leftOperand)
         , m_rightOperand(rightOperand)
         , m_result(result)
@@ -50,7 +50,6 @@
         , m_leftFPR(leftFPR)
         , m_rightFPR(rightFPR)
         , m_scratchGPR(scratchGPR)
-        , m_scratchFPR(scratchFPR)
     { }
 
     JITMathICInlineResult generateInline(CCallHelpers&, MathICGenerationState&, const BinaryArithProfile*);
@@ -68,7 +67,6 @@
     FPRReg m_leftFPR;
     FPRReg m_rightFPR;
     GPRReg m_scratchGPR;
-    FPRReg m_scratchFPR;
 };
 
 } // namespace JSC
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to