Modified: trunk/Source/_javascript_Core/ChangeLog (225951 => 225952)
--- trunk/Source/_javascript_Core/ChangeLog 2017-12-15 01:39:29 UTC (rev 225951)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-12-15 01:45:28 UTC (rev 225952)
@@ -1,3 +1,17 @@
+2017-12-14 Yusuke Suzuki <utatane....@gmail.com>
+
+ [DFG] Reduce register pressure of WeakMapGet to be used for 32bit
+ https://bugs.webkit.org/show_bug.cgi?id=180804
+
+ Reviewed by Saam Barati.
+
+ This fixes 32bit failures of JSC by reducing register pressure of WeakMapGet.
+
+ * dfg/DFGRegisterBank.h:
+ (JSC::DFG::RegisterBank::lockedCount const):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileWeakMapGet):
+
2017-12-14 Keith Miller <keith_mil...@apple.com>
Unreviewed, forgot to add { }
Modified: trunk/Source/_javascript_Core/dfg/DFGRegisterBank.h (225951 => 225952)
--- trunk/Source/_javascript_Core/dfg/DFGRegisterBank.h 2017-12-15 01:39:29 UTC (rev 225951)
+++ trunk/Source/_javascript_Core/dfg/DFGRegisterBank.h 2017-12-15 01:45:28 UTC (rev 225952)
@@ -139,6 +139,16 @@
return allocateInternal(currentLowest, spillMe);
}
+ uint32_t lockedCount() const
+ {
+ uint32_t count = 0;
+ for (uint32_t i = 0 ; i < NUM_REGS; ++i) {
+ if (m_data[i].lockCount)
+ ++count;
+ }
+ return count;
+ }
+
// Allocates the given register, even if this will force a spill.
VirtualRegister allocateSpecific(RegID reg)
{
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (225951 => 225952)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-12-15 01:39:29 UTC (rev 225951)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-12-15 01:45:28 UTC (rev 225952)
@@ -10983,41 +10983,52 @@
void SpeculativeJIT::compileWeakMapGet(Node* node)
{
- SpeculateCellOperand weakMap(this, node->child1());
- SpeculateCellOperand key(this, node->child2());
- SpeculateInt32Operand hash(this, node->child3());
- JSValueRegsTemporary result(this);
-
GPRTemporary mask(this);
- GPRTemporary index(this);
GPRTemporary buffer(this);
- GPRTemporary bucket(this);
+ JSValueRegsTemporary result(this);
- GPRReg weakMapGPR = weakMap.gpr();
- GPRReg keyGPR = key.gpr();
- GPRReg hashGPR = hash.gpr();
-
GPRReg maskGPR = mask.gpr();
- GPRReg indexGPR = index.gpr();
GPRReg bufferGPR = buffer.gpr();
- GPRReg bucketGPR = bucket.gpr();
JSValueRegs resultRegs = result.regs();
- if (node->child1().useKind() == WeakMapObjectUse)
- speculateWeakMapObject(node->child1(), weakMapGPR);
- else
- speculateWeakSetObject(node->child1(), weakMapGPR);
+ GPRTemporary index;
+ GPRReg indexGPR { InvalidGPRReg };
+ {
+ SpeculateInt32Operand hash(this, node->child3());
+ GPRReg hashGPR = hash.gpr();
+ index = GPRTemporary(this, Reuse, hash);
+ indexGPR = index.gpr();
+ m_jit.move(hashGPR, indexGPR);
+ }
+
+ {
+ SpeculateCellOperand weakMap(this, node->child1());
+ GPRReg weakMapGPR = weakMap.gpr();
+ if (node->child1().useKind() == WeakMapObjectUse)
+ speculateWeakMapObject(node->child1(), weakMapGPR);
+ else
+ speculateWeakSetObject(node->child1(), weakMapGPR);
+
+ ASSERT(WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfCapacity() == WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::offsetOfCapacity());
+ ASSERT(WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfBuffer() == WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::offsetOfBuffer());
+ m_jit.load32(MacroAssembler::Address(weakMapGPR, WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfCapacity()), maskGPR);
+ m_jit.loadPtr(MacroAssembler::Address(weakMapGPR, WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfBuffer()), bufferGPR);
+ }
+
+ SpeculateCellOperand key(this, node->child2());
+ GPRReg keyGPR = key.gpr();
speculateObject(node->child2(), keyGPR);
- ASSERT(WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfCapacity() == WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::offsetOfCapacity());
- ASSERT(WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfBuffer() == WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::offsetOfBuffer());
- m_jit.load32(MacroAssembler::Address(weakMapGPR, WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfCapacity()), maskGPR);
- m_jit.loadPtr(MacroAssembler::Address(weakMapGPR, WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::offsetOfBuffer()), bufferGPR);
+#if USE(JSVALUE32_64)
+ GPRReg bucketGPR = resultRegs.tagGPR();
+#else
+ GPRTemporary bucket(this);
+ GPRReg bucketGPR = bucket.gpr();
+#endif
+
m_jit.sub32(TrustedImm32(1), maskGPR);
- m_jit.move(hashGPR, indexGPR);
MacroAssembler::Label loop = m_jit.label();
-
m_jit.and32(maskGPR, indexGPR);
if (node->child1().useKind() == WeakSetObjectUse) {
static_assert(sizeof(WeakMapBucket<WeakMapBucketDataKey>) == sizeof(void*), "");
