Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (183655 => 183656)
--- trunk/Source/_javascript_Core/ChangeLog 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-05-01 00:06:48 UTC (rev 183656)
@@ -1,5 +1,94 @@
2015-04-30 Filip Pizlo <fpi...@apple.com>
+ Move all of the branchIs<type> helpers from SpeculativeJIT into AssemblyHelpers
+ https://bugs.webkit.org/show_bug.cgi?id=144462
+
+ Reviewed by Geoffrey Garen and Mark Lam.
+
+ At some point we started adding representation-agnostic helpers for doing common type tests.
+ We added some in SpeculativeJIT, and then some in AssemblyHelpers. Prior to this change,
+ they had overlapping powers, though SpeculativeJIT was a bit better.
+
+ This removes SpeculativeJIT's helpers and strengthens AssemblyHelpers' helpers. This is
+ better because now all of these helpers can be used in all of the assembly-based JITs, not
+ just the DFG. It also settles on what I find to be a slightly better naming convention.
+ For example where we previously would have said branchIsString, now we say
+ branchIfString. Similarly, branchNotString becomes branchIfNotString.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+ (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+ (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+ (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+ (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
+ (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
+ (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
+ (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
+ (JSC::DFG::SpeculativeJIT::speculateObject):
+ (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+ (JSC::DFG::SpeculativeJIT::speculateString):
+ (JSC::DFG::SpeculativeJIT::speculateNotStringVar):
+ (JSC::DFG::SpeculativeJIT::speculateNotCell):
+ (JSC::DFG::SpeculativeJIT::speculateOther):
+ (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+ (JSC::DFG::SpeculativeJIT::emitSwitchString):
+ (JSC::DFG::SpeculativeJIT::branchIsObject): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchNotObject): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchIsString): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchNotString): Deleted.
+ * dfg/DFGSpeculativeJIT.h:
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+ (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+ (JSC::DFG::SpeculativeJIT::emitCall):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+ (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+ (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+ (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+ (JSC::DFG::SpeculativeJIT::compile):
+ (JSC::DFG::SpeculativeJIT::branchIsCell): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchNotCell): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchIsOther): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchNotOther): Deleted.
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+ (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+ (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+ (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+ (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+ (JSC::DFG::SpeculativeJIT::compile):
+ (JSC::DFG::SpeculativeJIT::writeBarrier):
+ (JSC::DFG::SpeculativeJIT::branchIsCell): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchNotCell): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchIsOther): Deleted.
+ (JSC::DFG::SpeculativeJIT::branchNotOther): Deleted.
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::branchIfCell):
+ (JSC::AssemblyHelpers::branchIfOther):
+ (JSC::AssemblyHelpers::branchIfNotOther):
+ (JSC::AssemblyHelpers::branchIfObject):
+ (JSC::AssemblyHelpers::branchIfNotObject):
+ (JSC::AssemblyHelpers::branchIfType):
+ (JSC::AssemblyHelpers::branchIfNotType):
+ (JSC::AssemblyHelpers::branchIfString):
+ (JSC::AssemblyHelpers::branchIfNotString):
+ (JSC::AssemblyHelpers::branchIfSymbol):
+ (JSC::AssemblyHelpers::branchIfNotSymbol):
+ (JSC::AssemblyHelpers::branchIfFunction):
+ (JSC::AssemblyHelpers::branchIfNotFunction):
+ (JSC::AssemblyHelpers::branchIfEmpty):
+ (JSC::AssemblyHelpers::branchIsEmpty): Deleted.
+ (JSC::AssemblyHelpers::branchIfCellNotObject): Deleted.
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emitScopedArgumentsGetByVal):
+
+2015-04-30 Filip Pizlo <fpi...@apple.com>
+
js/regress/is-string-fold-tricky.html and js/regress/is-string-fold.html are crashing
https://bugs.webkit.org/show_bug.cgi?id=144463
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (183655 => 183656)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2015-05-01 00:06:48 UTC (rev 183656)
@@ -1182,17 +1182,17 @@
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (m_state.forNode(node->child1()).m_type & ~SpecObject) {
speculationCheck(
- BadType, JSValueSource::unboxedCell(op1GPR), node->child1(), branchNotObject(op1GPR));
+ BadType, JSValueSource::unboxedCell(op1GPR), node->child1(), m_jit.branchIfNotObject(op1GPR));
}
if (m_state.forNode(node->child2()).m_type & ~SpecObject) {
speculationCheck(
- BadType, JSValueSource::unboxedCell(op2GPR), node->child2(), branchNotObject(op2GPR));
+ BadType, JSValueSource::unboxedCell(op2GPR), node->child2(), m_jit.branchIfNotObject(op2GPR));
}
} else {
if (m_state.forNode(node->child1()).m_type & ~SpecObject) {
speculationCheck(
BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
- branchNotObject(op1GPR));
+ m_jit.branchIfNotObject(op1GPR));
}
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
m_jit.branchTest8(
@@ -1203,7 +1203,7 @@
if (m_state.forNode(node->child2()).m_type & ~SpecObject) {
speculationCheck(
BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
- branchNotObject(op2GPR));
+ m_jit.branchIfNotObject(op2GPR));
}
speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
m_jit.branchTest8(
@@ -1897,7 +1897,7 @@
JITCompiler::Jump isNumber = m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);
DFG_TYPE_CHECK(
- JSValueRegs(gpr), node->child1(), ~SpecCell, branchIsCell(JSValueRegs(gpr)));
+ JSValueRegs(gpr), node->child1(), ~SpecCell, m_jit.branchIfCell(JSValueRegs(gpr)));
// It's not a cell: so true turns into 1 and all else turns into 0.
m_jit.compare64(JITCompiler::Equal, gpr, TrustedImm32(ValueTrue), resultGpr);
@@ -1953,7 +1953,7 @@
DFG_TYPE_CHECK(
op1.jsValueRegs(), node->child1(), ~SpecCell,
- branchIsCell(op1.jsValueRegs()));
+ m_jit.branchIfCell(op1.jsValueRegs()));
// It's not a cell: so true turns into 1 and all else turns into 0.
JITCompiler::Jump isBoolean = m_jit.branch32(JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::BooleanTag));
@@ -2543,7 +2543,7 @@
void SpeculativeJIT::compileInstanceOfForObject(Node*, GPRReg valueReg, GPRReg prototypeReg, GPRReg scratchReg, GPRReg scratch2Reg)
{
// Check that prototype is an object.
- speculationCheck(BadType, JSValueRegs(), 0, m_jit.branchIfCellNotObject(prototypeReg));
+ speculationCheck(BadType, JSValueRegs(), 0, m_jit.branchIfNotObject(prototypeReg));
// Initialize scratchReg with the value being checked.
m_jit.move(valueReg, scratchReg);
@@ -2554,7 +2554,7 @@
m_jit.loadPtr(MacroAssembler::Address(scratchReg, Structure::prototypeOffset() + CellPayloadOffset), scratchReg);
MacroAssembler::Jump isInstance = m_jit.branchPtr(MacroAssembler::Equal, scratchReg, prototypeReg);
#if USE(JSVALUE64)
- branchIsCell(JSValueRegs(scratchReg)).linkTo(loop, &m_jit);
+ m_jit.branchIfCell(JSValueRegs(scratchReg)).linkTo(loop, &m_jit);
#else
m_jit.branchTestPtr(MacroAssembler::NonZero, scratchReg).linkTo(loop, &m_jit);
#endif
@@ -2593,7 +2593,7 @@
GPRReg scratchReg = scratch.gpr();
GPRReg scratch2Reg = scratch2.gpr();
- MacroAssembler::Jump isCell = branchIsCell(value.jsValueRegs());
+ MacroAssembler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
GPRReg valueReg = value.jsValueRegs().payloadGPR();
moveFalseTo(scratchReg);
@@ -3958,14 +3958,14 @@
JITCompiler::JumpList fastTrue;
JITCompiler::JumpList fastFalse;
- fastFalse.append(branchNotCell(rightRegs));
+ fastFalse.append(m_jit.branchIfNotCell(rightRegs));
// It's safe to branch around the type check below, since proving that the values are
// equal does indeed prove that the right value is a string.
fastTrue.append(m_jit.branchPtr(
MacroAssembler::Equal, leftGPR, rightRegs.payloadGPR()));
- fastFalse.append(branchNotString(rightRegs.payloadGPR()));
+ fastFalse.append(m_jit.branchIfNotString(rightRegs.payloadGPR()));
compileStringEquality(
node, leftGPR, rightRegs.payloadGPR(), lengthGPR, leftTempGPR, rightTempGPR, leftTemp2GPR,
@@ -4012,8 +4012,8 @@
moveFalseTo(rightTempGPR);
JITCompiler::JumpList notString;
- notString.append(branchNotCell(rightRegs));
- notString.append(branchNotString(rightRegs.payloadGPR()));
+ notString.append(m_jit.branchIfNotCell(rightRegs));
+ notString.append(m_jit.branchIfNotString(rightRegs.payloadGPR()));
speculateStringIdentAndLoadStorage(notStringVarEdge, rightRegs.payloadGPR(), rightTempGPR);
@@ -4234,7 +4234,7 @@
baseReg, scratch2Reg, MacroAssembler::TimesEight,
ScopedArguments::overflowStorageOffset()),
resultRegs);
- speculationCheck(ExoticObjectMode, JSValueSource(), nullptr, m_jit.branchIsEmpty(resultRegs));
+ speculationCheck(ExoticObjectMode, JSValueSource(), nullptr, m_jit.branchIfEmpty(resultRegs));
done.link(&m_jit);
@@ -4965,7 +4965,7 @@
flushRegisters();
JITCompiler::Jump done;
if (node->child1()->prediction() & SpecString) {
- JITCompiler::Jump needCall = branchNotString(op1GPR);
+ JITCompiler::Jump needCall = m_jit.branchIfNotString(op1GPR);
m_jit.move(op1GPR, resultGPR);
done = m_jit.jump();
needCall.link(&m_jit);
@@ -5194,7 +5194,7 @@
SpeculateCellOperand operand(this, edge);
GPRReg gpr = operand.gpr();
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(gpr), edge, SpecObject, branchNotObject(gpr));
+ JSValueSource::unboxedCell(gpr), edge, SpecObject, m_jit.branchIfNotObject(gpr));
}
void SpeculativeJIT::speculateFunction(Edge edge)
@@ -5223,16 +5223,16 @@
JSValueOperand operand(this, edge, ManualOperandSpeculation);
GPRTemporary temp(this);
GPRReg tempGPR = temp.gpr();
- MacroAssembler::Jump notCell = branchNotCell(operand.jsValueRegs());
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(operand.jsValueRegs());
GPRReg gpr = operand.jsValueRegs().payloadGPR();
DFG_TYPE_CHECK(
- operand.jsValueRegs(), edge, (~SpecCell) | SpecObject, branchNotObject(gpr));
+ operand.jsValueRegs(), edge, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(gpr));
MacroAssembler::Jump done = m_jit.jump();
notCell.link(&m_jit);
if (needsTypeCheck(edge, SpecCell | SpecOther)) {
typeCheck(
operand.jsValueRegs(), edge, SpecCell | SpecOther,
- branchNotOther(operand.jsValueRegs(), tempGPR));
+ m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
}
done.link(&m_jit);
}
@@ -5240,7 +5240,7 @@
void SpeculativeJIT::speculateString(Edge edge, GPRReg cell)
{
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(cell), edge, SpecString | ~SpecCell, branchNotString(cell));
+ JSValueSource::unboxedCell(cell), edge, SpecString | ~SpecCell, m_jit.branchIfNotString(cell));
}
void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)
@@ -5342,10 +5342,10 @@
GPRTemporary temp(this);
GPRReg tempGPR = temp.gpr();
- JITCompiler::Jump notCell = branchNotCell(operand.jsValueRegs());
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(operand.jsValueRegs());
GPRReg cell = operand.jsValueRegs().payloadGPR();
- JITCompiler::Jump notString = branchNotString(cell);
+ JITCompiler::Jump notString = m_jit.branchIfNotString(cell);
speculateStringIdentAndLoadStorage(edge, cell, tempGPR);
@@ -5359,7 +5359,7 @@
return;
JSValueOperand operand(this, edge, ManualOperandSpeculation);
- typeCheck(operand.jsValueRegs(), edge, ~SpecCell, branchIsCell(operand.jsValueRegs()));
+ typeCheck(operand.jsValueRegs(), edge, ~SpecCell, m_jit.branchIfCell(operand.jsValueRegs()));
}
void SpeculativeJIT::speculateOther(Edge edge)
@@ -5372,7 +5372,7 @@
GPRReg tempGPR = temp.gpr();
typeCheck(
operand.jsValueRegs(), edge, SpecOther,
- branchNotOther(operand.jsValueRegs(), tempGPR));
+ m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
}
void SpeculativeJIT::speculateMisc(Edge edge, JSValueRegs regs)
@@ -5619,9 +5619,9 @@
op1.use();
- addBranch(branchNotCell(op1Regs), data->fallThrough.block);
+ addBranch(m_jit.branchIfNotCell(op1Regs), data->fallThrough.block);
- addBranch(branchNotString(op1Regs.payloadGPR()), data->fallThrough.block);
+ addBranch(m_jit.branchIfNotString(op1Regs.payloadGPR()), data->fallThrough.block);
emitSwitchCharStringJump(data, op1Regs.payloadGPR(), tempGPR);
noResult(node, UseChildrenCalledExplicitly);
@@ -5892,9 +5892,9 @@
op1.use();
- addBranch(branchNotCell(op1Regs), data->fallThrough.block);
+ addBranch(m_jit.branchIfNotCell(op1Regs), data->fallThrough.block);
- addBranch(branchNotString(op1Regs.payloadGPR()), data->fallThrough.block);
+ addBranch(m_jit.branchIfNotString(op1Regs.payloadGPR()), data->fallThrough.block);
emitSwitchStringOnString(data, op1Regs.payloadGPR());
noResult(node, UseChildrenCalledExplicitly);
@@ -5944,38 +5944,6 @@
}
}
-JITCompiler::Jump SpeculativeJIT::branchIsObject(GPRReg cellGPR)
-{
- return m_jit.branch8(
- MacroAssembler::AboveOrEqual,
- MacroAssembler::Address(cellGPR, JSCell::typeInfoTypeOffset()),
- MacroAssembler::TrustedImm32(ObjectType));
-}
-
-JITCompiler::Jump SpeculativeJIT::branchNotObject(GPRReg cellGPR)
-{
- return m_jit.branch8(
- MacroAssembler::Below,
- MacroAssembler::Address(cellGPR, JSCell::typeInfoTypeOffset()),
- MacroAssembler::TrustedImm32(ObjectType));
-}
-
-JITCompiler::Jump SpeculativeJIT::branchIsString(GPRReg cellGPR)
-{
- return m_jit.branchStructurePtr(
- MacroAssembler::Equal,
- MacroAssembler::Address(cellGPR, JSCell::structureIDOffset()),
- m_jit.vm()->stringStructure.get());
-}
-
-JITCompiler::Jump SpeculativeJIT::branchNotString(GPRReg cellGPR)
-{
- return m_jit.branchStructurePtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(cellGPR, JSCell::structureIDOffset()),
- m_jit.vm()->stringStructure.get());
-}
-
#if ENABLE(GGC)
void SpeculativeJIT::compileStoreBarrier(Node* node)
{
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (183655 => 183656)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2015-05-01 00:06:48 UTC (rev 183656)
@@ -2215,15 +2215,6 @@
void compileNotifyWrite(Node*);
bool compileRegExpExec(Node*);
- JITCompiler::Jump branchIsCell(JSValueRegs);
- JITCompiler::Jump branchNotCell(JSValueRegs);
- JITCompiler::Jump branchIsOther(JSValueRegs, GPRReg tempGPR);
- JITCompiler::Jump branchNotOther(JSValueRegs, GPRReg tempGPR);
- JITCompiler::Jump branchIsObject(GPRReg cellGPR);
- JITCompiler::Jump branchNotObject(GPRReg cellGPR);
- JITCompiler::Jump branchIsString(GPRReg cellGPR);
- JITCompiler::Jump branchNotString(GPRReg cellGPR);
-
void moveTrueTo(GPRReg);
void moveFalseTo(GPRReg);
void blessBoolean(GPRReg);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (183655 => 183656)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2015-05-01 00:06:48 UTC (rev 183656)
@@ -246,7 +246,7 @@
JITCompiler::Jump notMasqueradesAsUndefined;
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(arg.jsValueRegs());
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
m_jit.move(invert ? TrustedImm32(1) : TrustedImm32(0), resultPayloadGPR);
notMasqueradesAsUndefined = m_jit.jump();
@@ -255,7 +255,7 @@
GPRTemporary remoteGlobalObject(this);
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(arg.jsValueRegs());
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
JITCompiler::NonZero,
@@ -314,7 +314,7 @@
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(arg.jsValueRegs());
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
jump(invert ? taken : notTaken, ForceJump);
} else {
@@ -322,7 +322,7 @@
GPRTemporary remoteGlobalObject(this);
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(arg.jsValueRegs());
+ notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
branchTest8(JITCompiler::Zero,
JITCompiler::Address(argPayloadGPR, JSCell::typeInfoFlagsOffset()),
@@ -799,7 +799,7 @@
CallLinkInfo* info = m_jit.codeBlock()->addCallLinkInfo();
- slowPath.append(branchNotCell(callee.jsValueRegs()));
+ slowPath.append(m_jit.branchIfNotCell(callee.jsValueRegs()));
slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));
JITCompiler::Call fastCall = m_jit.nearCall();
@@ -1025,7 +1025,7 @@
if (type & ~SpecCell) {
speculationCheck(
BadType, JSValueRegs(tagGPR, payloadGPR), edge,
- branchNotCell(info.jsValueRegs()));
+ m_jit.branchIfNotCell(info.jsValueRegs()));
}
m_gprs.unlock(tagGPR);
m_gprs.release(tagGPR);
@@ -1150,12 +1150,12 @@
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, branchNotObject(op2GPR));
+ JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
} else {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1163,7 +1163,7 @@
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, branchNotObject(op2GPR));
+ JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1200,10 +1200,10 @@
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
} else {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1214,15 +1214,15 @@
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
- MacroAssembler::Jump rightNotCell = branchNotCell(op2.jsValueRegs());
+ MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(op2.jsValueRegs());
// We know that within this branch, rightChild must be a cell.
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, branchNotObject(op2PayloadGPR));
+ JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2PayloadGPR));
} else {
DFG_TYPE_CHECK(
- JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, branchNotObject(op2PayloadGPR));
+ JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2PayloadGPR));
speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1279,10 +1279,10 @@
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
} else {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1292,17 +1292,17 @@
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
- MacroAssembler::Jump rightNotCell = branchNotCell(op2.jsValueRegs());
+ MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(op2.jsValueRegs());
// We know that within this branch, rightChild must be a cell.
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
- branchNotObject(op2PayloadGPR));
+ m_jit.branchIfNotObject(op2PayloadGPR));
} else {
DFG_TYPE_CHECK(
JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
- branchNotObject(op2PayloadGPR));
+ m_jit.branchIfNotObject(op2PayloadGPR));
speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1382,15 +1382,15 @@
structureGPR = structure.gpr();
}
- MacroAssembler::Jump notCell = branchNotCell(value.jsValueRegs());
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(value.jsValueRegs());
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- branchNotObject(valuePayloadGPR));
+ m_jit.branchIfNotObject(valuePayloadGPR));
} else {
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- branchNotObject(valuePayloadGPR));
+ m_jit.branchIfNotObject(valuePayloadGPR));
MacroAssembler::Jump isNotMasqueradesAsUndefined =
m_jit.branchTest8(
@@ -1504,15 +1504,15 @@
GPRReg valuePayloadGPR = value.payloadGPR();
GPRReg scratchGPR = scratch.gpr();
- MacroAssembler::Jump notCell = branchNotCell(value.jsValueRegs());
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(value.jsValueRegs());
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- branchNotObject(valuePayloadGPR));
+ m_jit.branchIfNotObject(valuePayloadGPR));
} else {
DFG_TYPE_CHECK(
JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
- branchNotObject(valuePayloadGPR));
+ m_jit.branchIfNotObject(valuePayloadGPR));
JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(
JITCompiler::Zero,
@@ -3074,8 +3074,8 @@
m_jit.move(op1TagGPR, resultTagGPR);
m_jit.move(op1PayloadGPR, resultPayloadGPR);
} else {
- MacroAssembler::Jump alreadyPrimitive = branchNotCell(op1.jsValueRegs());
- MacroAssembler::Jump notPrimitive = branchIsObject(op1PayloadGPR);
+ MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(op1.jsValueRegs());
+ MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(op1PayloadGPR);
alreadyPrimitive.link(&m_jit);
m_jit.move(op1TagGPR, resultTagGPR);
@@ -3105,8 +3105,8 @@
JITCompiler::Jump done;
if (node->child1()->prediction() & SpecString) {
- JITCompiler::Jump slowPath1 = branchNotCell(op1.jsValueRegs());
- JITCompiler::Jump slowPath2 = branchNotString(op1PayloadGPR);
+ JITCompiler::Jump slowPath1 = m_jit.branchIfNotCell(op1.jsValueRegs());
+ JITCompiler::Jump slowPath2 = m_jit.branchIfNotString(op1PayloadGPR);
m_jit.move(op1PayloadGPR, resultGPR);
done = m_jit.jump();
slowPath1.link(&m_jit);
@@ -3473,7 +3473,7 @@
GPRReg tempTagGPR = tempTag.gpr();
MacroAssembler::JumpList slowCases;
- slowCases.append(branchNotCell(thisValue.jsValueRegs()));
+ slowCases.append(m_jit.branchIfNotCell(thisValue.jsValueRegs()));
slowCases.append(m_jit.branch8(
MacroAssembler::NotEqual,
MacroAssembler::Address(thisValuePayloadGPR, JSCell::typeInfoTypeOffset()),
@@ -3637,7 +3637,7 @@
base.use();
- JITCompiler::Jump notCell = branchNotCell(base.jsValueRegs());
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(base.jsValueRegs());
cachedGetById(node->origin.semantic, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell);
@@ -3693,7 +3693,7 @@
flushRegisters();
- JITCompiler::Jump notCell = branchNotCell(base.jsValueRegs());
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(base.jsValueRegs());
cachedGetById(node->origin.semantic, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell, DontSpill);
@@ -4014,7 +4014,7 @@
GPRTemporary localGlobalObject(this);
GPRTemporary remoteGlobalObject(this);
- JITCompiler::Jump isCell = branchIsCell(value.jsValueRegs());
+ JITCompiler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
m_jit.compare32(JITCompiler::Equal, value.tagGPR(), TrustedImm32(JSValue::UndefinedTag), result.gpr());
JITCompiler::Jump done = m_jit.jump();
@@ -4070,7 +4070,7 @@
JSValueOperand value(this, node->child1());
GPRTemporary result(this, Reuse, value, TagWord);
- JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
m_jit.compare8(JITCompiler::Equal,
JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
@@ -4090,7 +4090,7 @@
JSValueOperand value(this, node->child1());
GPRTemporary result(this, Reuse, value, TagWord);
- JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
m_jit.compare8(JITCompiler::AboveOrEqual,
JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
@@ -4143,12 +4143,12 @@
ASSERT(node->child1().useKind() == UntypedUse || node->child1().useKind() == CellUse || node->child1().useKind() == StringUse);
- JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
if (node->child1().useKind() != UntypedUse)
DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecCell, isNotCell);
if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {
- JITCompiler::Jump notString = branchNotString(payloadGPR);
+ JITCompiler::Jump notString = m_jit.branchIfNotString(payloadGPR);
if (node->child1().useKind() == StringUse)
DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecString, notString);
m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.stringString()), resultGPR);
@@ -4570,7 +4570,7 @@
m_jit.store32(value.payloadGPR(), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
// Store the structureID of the cell if valueGPR is a cell, otherwise, store 0 on the log entry.
- MacroAssembler::Jump isNotCell = branchNotCell(value.jsValueRegs());
+ MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
m_jit.load32(MacroAssembler::Address(value.payloadGPR(), JSCell::structureIDOffset()), scratch3GPR);
m_jit.store32(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
MacroAssembler::Jump skipIsCell = m_jit.jump();
@@ -4713,32 +4713,6 @@
}
#endif // ENABLE(GGC)
-JITCompiler::Jump SpeculativeJIT::branchIsCell(JSValueRegs regs)
-{
- return m_jit.branch32(MacroAssembler::Equal, regs.tagGPR(), TrustedImm32(JSValue::CellTag));
-}
-
-JITCompiler::Jump SpeculativeJIT::branchNotCell(JSValueRegs regs)
-{
- return m_jit.branch32(MacroAssembler::NotEqual, regs.tagGPR(), TrustedImm32(JSValue::CellTag));
-}
-
-JITCompiler::Jump SpeculativeJIT::branchIsOther(JSValueRegs regs, GPRReg tempGPR)
-{
- m_jit.or32(TrustedImm32(1), regs.tagGPR(), tempGPR);
- return m_jit.branch32(
- MacroAssembler::Equal, tempGPR,
- MacroAssembler::TrustedImm32(JSValue::NullTag));
-}
-
-JITCompiler::Jump SpeculativeJIT::branchNotOther(JSValueRegs regs, GPRReg tempGPR)
-{
- m_jit.or32(TrustedImm32(1), regs.tagGPR(), tempGPR);
- return m_jit.branch32(
- MacroAssembler::NotEqual, tempGPR,
- MacroAssembler::TrustedImm32(JSValue::NullTag));
-}
-
void SpeculativeJIT::moveTrueTo(GPRReg gpr)
{
m_jit.move(TrustedImm32(1), gpr);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (183655 => 183656)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2015-05-01 00:06:48 UTC (rev 183656)
@@ -204,7 +204,7 @@
JITCompiler::Jump notMasqueradesAsUndefined;
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(JSValueRegs(argGPR));
+ notCell = m_jit.branchIfNotCell(JSValueRegs(argGPR));
m_jit.move(invert ? TrustedImm32(1) : TrustedImm32(0), resultGPR);
notMasqueradesAsUndefined = m_jit.jump();
@@ -214,7 +214,7 @@
GPRTemporary scratch(this);
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(JSValueRegs(argGPR));
+ notCell = m_jit.branchIfNotCell(JSValueRegs(argGPR));
JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
JITCompiler::NonZero,
@@ -273,7 +273,7 @@
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(JSValueRegs(argGPR));
+ notCell = m_jit.branchIfNotCell(JSValueRegs(argGPR));
jump(invert ? taken : notTaken, ForceJump);
} else {
@@ -282,7 +282,7 @@
GPRTemporary scratch(this);
if (!isKnownCell(operand.node()))
- notCell = branchNotCell(JSValueRegs(argGPR));
+ notCell = m_jit.branchIfNotCell(JSValueRegs(argGPR));
branchTest8(JITCompiler::Zero,
JITCompiler::Address(argGPR, JSCell::typeInfoFlagsOffset()),
@@ -1119,7 +1119,7 @@
info.fillJSValue(*m_stream, gpr, DataFormatJS);
if (type & ~SpecCell)
- speculationCheck(BadType, JSValueRegs(gpr), edge, branchNotCell(JSValueRegs(gpr)));
+ speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchIfNotCell(JSValueRegs(gpr)));
info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
return gpr;
}
@@ -1129,7 +1129,7 @@
GPRReg gpr = info.gpr();
m_gprs.lock(gpr);
if (!ASSERT_DISABLED) {
- MacroAssembler::Jump checkCell = branchIsCell(JSValueRegs(gpr));
+ MacroAssembler::Jump checkCell = m_jit.branchIfCell(JSValueRegs(gpr));
m_jit.abortWithReason(DFGIsNotCell);
checkCell.link(&m_jit);
}
@@ -1140,7 +1140,7 @@
GPRReg gpr = info.gpr();
m_gprs.lock(gpr);
if (type & ~SpecCell)
- speculationCheck(BadType, JSValueRegs(gpr), edge, branchNotCell(JSValueRegs(gpr)));
+ speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchIfNotCell(JSValueRegs(gpr)));
info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
return gpr;
}
@@ -1265,12 +1265,12 @@
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, branchNotObject(op2GPR));
+ JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
} else {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1278,7 +1278,7 @@
MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, branchNotObject(op2GPR));
+ JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1311,10 +1311,10 @@
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
} else {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1324,15 +1324,15 @@
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
- MacroAssembler::Jump rightNotCell = branchNotCell(JSValueRegs(op2GPR));
+ MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(JSValueRegs(op2GPR));
// We know that within this branch, rightChild must be a cell.
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, branchNotObject(op2GPR));
+ JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
} else {
DFG_TYPE_CHECK(
- JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, branchNotObject(op2GPR));
+ JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1389,10 +1389,10 @@
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
} else {
DFG_TYPE_CHECK(
- JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, branchNotObject(op1GPR));
+ JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1402,15 +1402,15 @@
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
- MacroAssembler::Jump rightNotCell = branchNotCell(JSValueRegs(op2GPR));
+ MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(JSValueRegs(op2GPR));
// We know that within this branch, rightChild must be a cell.
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, branchNotObject(op2GPR));
+ JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
} else {
DFG_TYPE_CHECK(
- JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, branchNotObject(op2GPR));
+ JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
m_jit.branchTest8(
MacroAssembler::NonZero,
@@ -1529,13 +1529,13 @@
scratchGPR = scratch.gpr();
}
- MacroAssembler::Jump notCell = branchNotCell(JSValueRegs(valueGPR));
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
if (masqueradesAsUndefinedWatchpointValid) {
DFG_TYPE_CHECK(
- JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, branchNotObject(valueGPR));
+ JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
} else {
DFG_TYPE_CHECK(
- JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, branchNotObject(valueGPR));
+ JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
MacroAssembler::Jump isNotMasqueradesAsUndefined =
m_jit.branchTest8(
@@ -1673,13 +1673,13 @@
structureGPR = structure.gpr();
}
- MacroAssembler::Jump notCell = branchNotCell(JSValueRegs(valueGPR));
+ MacroAssembler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
if (masqueradesAsUndefinedWatchpointIsStillValid()) {
DFG_TYPE_CHECK(
- JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, branchNotObject(valueGPR));
+ JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
} else {
DFG_TYPE_CHECK(
- JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, branchNotObject(valueGPR));
+ JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(
JITCompiler::Zero,
@@ -3167,8 +3167,8 @@
op1.use();
- MacroAssembler::Jump alreadyPrimitive = branchNotCell(JSValueRegs(op1GPR));
- MacroAssembler::Jump notPrimitive = branchIsObject(op1GPR);
+ MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(JSValueRegs(op1GPR));
+ MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(op1GPR);
alreadyPrimitive.link(&m_jit);
m_jit.move(op1GPR, resultGPR);
@@ -3193,8 +3193,8 @@
JITCompiler::Jump done;
if (node->child1()->prediction() & SpecString) {
- JITCompiler::Jump slowPath1 = branchNotCell(JSValueRegs(op1GPR));
- JITCompiler::Jump slowPath2 = branchNotString(op1GPR);
+ JITCompiler::Jump slowPath1 = m_jit.branchIfNotCell(JSValueRegs(op1GPR));
+ JITCompiler::Jump slowPath2 = m_jit.branchIfNotString(op1GPR);
m_jit.move(op1GPR, resultGPR);
done = m_jit.jump();
slowPath1.link(&m_jit);
@@ -3553,7 +3553,7 @@
GPRReg tempGPR = temp.gpr();
MacroAssembler::JumpList slowCases;
- slowCases.append(branchNotCell(JSValueRegs(thisValueGPR)));
+ slowCases.append(m_jit.branchIfNotCell(JSValueRegs(thisValueGPR)));
slowCases.append(m_jit.branch8(
MacroAssembler::NotEqual,
MacroAssembler::Address(thisValueGPR, JSCell::typeInfoTypeOffset()),
@@ -3703,7 +3703,7 @@
base.use();
- JITCompiler::Jump notCell = branchNotCell(JSValueRegs(baseGPR));
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(baseGPR));
cachedGetById(node->origin.semantic, baseGPR, resultGPR, node->identifierNumber(), notCell);
@@ -3753,7 +3753,7 @@
base.use();
flushRegisters();
- JITCompiler::Jump notCell = branchNotCell(JSValueRegs(baseGPR));
+ JITCompiler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(baseGPR));
cachedGetById(node->origin.semantic, baseGPR, resultGPR, node->identifierNumber(), notCell, DontSpill);
@@ -4049,7 +4049,7 @@
GPRTemporary remoteGlobalObject(this);
GPRTemporary scratch(this);
- JITCompiler::Jump isCell = branchIsCell(value.jsValueRegs());
+ JITCompiler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
m_jit.compare64(JITCompiler::Equal, value.gpr(), TrustedImm32(ValueUndefined), result.gpr());
JITCompiler::Jump done = m_jit.jump();
@@ -4109,7 +4109,7 @@
JSValueOperand value(this, node->child1());
GPRTemporary result(this, Reuse, value);
- JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
m_jit.compare8(JITCompiler::Equal,
JITCompiler::Address(value.gpr(), JSCell::typeInfoTypeOffset()),
@@ -4130,7 +4130,7 @@
JSValueOperand value(this, node->child1());
GPRTemporary result(this, Reuse, value);
- JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
m_jit.compare8(JITCompiler::AboveOrEqual,
JITCompiler::Address(value.gpr(), JSCell::typeInfoTypeOffset()),
@@ -4182,12 +4182,12 @@
ASSERT(node->child1().useKind() == UntypedUse || node->child1().useKind() == CellUse || node->child1().useKind() == StringUse);
- JITCompiler::Jump isNotCell = branchNotCell(JSValueRegs(valueGPR));
+ JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
if (node->child1().useKind() != UntypedUse)
DFG_TYPE_CHECK(JSValueSource(valueGPR), node->child1(), SpecCell, isNotCell);
if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {
- JITCompiler::Jump notString = branchNotString(valueGPR);
+ JITCompiler::Jump notString = m_jit.branchIfNotString(valueGPR);
if (node->child1().useKind() == StringUse)
DFG_TYPE_CHECK(JSValueSource(valueGPR), node->child1(), SpecString, notString);
m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.stringString()), resultGPR);
@@ -4628,8 +4628,8 @@
else if (cachedTypeLocation->m_lastSeenType == TypeNumber)
jumpToEnd.append(m_jit.branchTest64(MacroAssembler::NonZero, valueGPR, GPRInfo::tagTypeNumberRegister));
else if (cachedTypeLocation->m_lastSeenType == TypeString) {
- MacroAssembler::Jump isNotCell = branchNotCell(JSValueRegs(valueGPR));
- jumpToEnd.append(branchIsString(valueGPR));
+ MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
+ jumpToEnd.append(m_jit.branchIfString(valueGPR));
isNotCell.link(&m_jit);
}
@@ -4644,7 +4644,7 @@
m_jit.store64(valueGPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset()));
// Store the structureID of the cell if valueGPR is a cell, otherwise, store 0 on the log entry.
- MacroAssembler::Jump isNotCell = branchNotCell(JSValueRegs(valueGPR));
+ MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
m_jit.load32(MacroAssembler::Address(valueGPR, JSCell::structureIDOffset()), scratch3GPR);
m_jit.store32(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
MacroAssembler::Jump skipIsCell = m_jit.jump();
@@ -4779,7 +4779,7 @@
{
JITCompiler::Jump isNotCell;
if (!isKnownCell(valueUse.node()))
- isNotCell = branchNotCell(JSValueRegs(valueGPR));
+ isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
JITCompiler::Jump ownerIsRememberedOrInEden = m_jit.jumpIfIsRememberedOrInEden(ownerGPR);
storeToWriteBarrierBuffer(ownerGPR, scratch1, scratch2);
@@ -4793,7 +4793,7 @@
{
JITCompiler::Jump isNotCell;
if (!isKnownCell(valueUse.node()))
- isNotCell = branchNotCell(JSValueRegs(valueGPR));
+ isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
JITCompiler::Jump ownerIsRememberedOrInEden = m_jit.jumpIfIsRememberedOrInEden(owner);
storeToWriteBarrierBuffer(owner, scratch1, scratch2);
@@ -4804,34 +4804,6 @@
}
#endif // ENABLE(GGC)
-JITCompiler::Jump SpeculativeJIT::branchIsCell(JSValueRegs regs)
-{
- return m_jit.branchTest64(MacroAssembler::Zero, regs.gpr(), GPRInfo::tagMaskRegister);
-}
-
-JITCompiler::Jump SpeculativeJIT::branchNotCell(JSValueRegs regs)
-{
- return m_jit.branchTest64(MacroAssembler::NonZero, regs.gpr(), GPRInfo::tagMaskRegister);
-}
-
-JITCompiler::Jump SpeculativeJIT::branchIsOther(JSValueRegs regs, GPRReg tempGPR)
-{
- m_jit.move(regs.gpr(), tempGPR);
- m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), tempGPR);
- return m_jit.branch64(
- MacroAssembler::Equal, tempGPR,
- MacroAssembler::TrustedImm64(ValueNull));
-}
-
-JITCompiler::Jump SpeculativeJIT::branchNotOther(JSValueRegs regs, GPRReg tempGPR)
-{
- m_jit.move(regs.gpr(), tempGPR);
- m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), tempGPR);
- return m_jit.branch64(
- MacroAssembler::NotEqual, tempGPR,
- MacroAssembler::TrustedImm64(ValueNull));
-}
-
void SpeculativeJIT::moveTrueTo(GPRReg gpr)
{
m_jit.move(TrustedImm32(ValueTrue), gpr);
Modified: trunk/Source/_javascript_Core/jit/AssemblyHelpers.h (183655 => 183656)
--- trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/jit/AssemblyHelpers.h 2015-05-01 00:06:48 UTC (rev 183656)
@@ -385,9 +385,79 @@
#endif
}
- Jump branchIsEmpty(JSValueRegs regs)
+ Jump branchIfCell(GPRReg reg)
{
#if USE(JSVALUE64)
+ return branchTest64(MacroAssembler::Zero, reg, GPRInfo::tagMaskRegister);
+#else
+ return branch32(MacroAssembler::Equal, reg, TrustedImm32(JSValue::CellTag));
+#endif
+ }
+ Jump branchIfCell(JSValueRegs regs)
+ {
+#if USE(JSVALUE64)
+ return branchIfCell(regs.gpr());
+#else
+ return branchIfCell(regs.tagGPR());
+#endif
+ }
+
+ Jump branchIfOther(JSValueRegs regs, GPRReg tempGPR)
+ {
+#if USE(JSVALUE64)
+ move(regs.gpr(), tempGPR);
+ and64(TrustedImm32(~TagBitUndefined), tempGPR);
+ return branch64(Equal, tempGPR, TrustedImm64(ValueNull));
+#else
+ or32(TrustedImm32(1), regs.tagGPR(), tempGPR);
+ return branch32(Equal, tempGPR, TrustedImm32(JSValue::NullTag));
+#endif
+ }
+
+ Jump branchIfNotOther(JSValueRegs regs, GPRReg tempGPR)
+ {
+#if USE(JSVALUE64)
+ move(regs.gpr(), tempGPR);
+ and64(TrustedImm32(~TagBitUndefined), tempGPR);
+ return branch64(NotEqual, tempGPR, TrustedImm64(ValueNull));
+#else
+ or32(TrustedImm32(1), regs.tagGPR(), tempGPR);
+ return branch32(NotEqual, tempGPR, TrustedImm32(JSValue::NullTag));
+#endif
+ }
+
+ Jump branchIfObject(GPRReg cellGPR)
+ {
+ return branch8(
+ AboveOrEqual, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+ }
+
+ Jump branchIfNotObject(GPRReg cellGPR)
+ {
+ return branch8(
+ Below, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+ }
+
+ Jump branchIfType(GPRReg cellGPR, JSType type)
+ {
+ return branch8(Equal, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(type));
+ }
+
+ Jump branchIfNotType(GPRReg cellGPR, JSType type)
+ {
+ return branch8(NotEqual, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(type));
+ }
+
+ Jump branchIfString(GPRReg cellGPR) { return branchIfType(cellGPR, StringType); }
+ Jump branchIfNotString(GPRReg cellGPR) { return branchIfNotType(cellGPR, StringType); }
+ Jump branchIfSymbol(GPRReg cellGPR) { return branchIfType(cellGPR, SymbolType); }
+ Jump branchIfNotSymbol(GPRReg cellGPR) { return branchIfNotType(cellGPR, SymbolType); }
+ Jump branchIfFunction(GPRReg cellGPR) { return branchIfType(cellGPR, JSFunctionType); }
+ Jump branchIfNotFunction(GPRReg cellGPR) { return branchIfNotType(cellGPR, JSFunctionType); }
+
+ Jump branchIfEmpty(JSValueRegs regs)
+ {
+#if USE(JSVALUE64)
return branchTest64(Zero, regs.gpr());
#else
return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
@@ -475,11 +545,6 @@
return calleeFrameSlot(0).withOffset(CallFrame::callerFrameOffset());
}
- Jump branchIfCellNotObject(GPRReg cellReg)
- {
- return branch8(Below, Address(cellReg, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
- }
-
static GPRReg selectScratchGPR(GPRReg preserve1 = InvalidGPRReg, GPRReg preserve2 = InvalidGPRReg, GPRReg preserve3 = InvalidGPRReg, GPRReg preserve4 = InvalidGPRReg, GPRReg preserve5 = InvalidGPRReg)
{
if (preserve1 != GPRInfo::regT0 && preserve2 != GPRInfo::regT0 && preserve3 != GPRInfo::regT0 && preserve4 != GPRInfo::regT0 && preserve5 != GPRInfo::regT0)
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (183655 => 183656)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2015-04-30 23:44:49 UTC (rev 183655)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2015-05-01 00:06:48 UTC (rev 183656)
@@ -1130,7 +1130,7 @@
sub32(property, scratch2);
neg32(scratch2);
loadValue(BaseIndex(base, scratch2, TimesEight, ScopedArguments::overflowStorageOffset()), result);
- slowCases.append(branchIsEmpty(result));
+ slowCases.append(branchIfEmpty(result));
done.link(this);
return slowCases;
