Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (198023 => 198024)
--- trunk/Source/_javascript_Core/ChangeLog 2016-03-11 17:28:46 UTC (rev 198023)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-03-11 17:51:00 UTC (rev 198024)
@@ -1,3 +1,17 @@
+2016-03-11 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r197994.
+ https://bugs.webkit.org/show_bug.cgi?id=155368
+
+ Broke several ARM tests (Requested by msaboff on #webkit).
+
+ Reverted changeset:
+
+ "[JSC] Add register reuse for ArithAdd of an Int32 and
+ constant in DFG"
+ https://bugs.webkit.org/show_bug.cgi?id=155164
+ http://trac.webkit.org/changeset/197994
+
2016-03-11 Yusuke Suzuki <[email protected]>
[ES6] Implement Reflect.set without receiver support
Modified: trunk/Source/_javascript_Core/dfg/DFGOSRExit.h (198023 => 198024)
--- trunk/Source/_javascript_Core/dfg/DFGOSRExit.h 2016-03-11 17:28:46 UTC (rev 198023)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRExit.h 2016-03-11 17:51:00 UTC (rev 198024)
@@ -48,9 +48,8 @@
// This enum describes the types of additional recovery that
// may need be performed should a speculation check fail.
-enum SpeculationRecoveryType : uint8_t {
+enum SpeculationRecoveryType {
SpeculativeAdd,
- SpeculativeAddImmediate,
BooleanSpeculationCheck
};
@@ -61,34 +60,22 @@
class SpeculationRecovery {
public:
SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, GPRReg src)
- : m_src(src)
+ : m_type(type)
, m_dest(dest)
- , m_type(type)
+ , m_src(src)
{
}
- SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, int32_t immediate)
- : m_immediate(immediate)
- , m_dest(dest)
- , m_type(type)
- {
- }
-
SpeculationRecoveryType type() { return m_type; }
GPRReg dest() { return m_dest; }
GPRReg src() { return m_src; }
- int32_t immediate() { return m_immediate; }
private:
- // different recovery types may required different additional information here.
- union {
- GPRReg m_src;
- int32_t m_immediate;
- };
- GPRReg m_dest;
-
// Indicates the type of additional recovery to be performed.
SpeculationRecoveryType m_type;
+ // different recovery types may required different additional information here.
+ GPRReg m_dest;
+ GPRReg m_src;
};
// === OSRExit ===
Modified: trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler32_64.cpp (198023 => 198024)
--- trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler32_64.cpp 2016-03-11 17:28:46 UTC (rev 198023)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler32_64.cpp 2016-03-11 17:51:00 UTC (rev 198024)
@@ -56,10 +56,6 @@
case SpeculativeAdd:
m_jit.sub32(recovery->src(), recovery->dest());
break;
-
- case SpeculativeAddImmediate:
- m_jit.sub32(AssemblyHelpers::Imm32(recovery->immediate()), recovery->dest());
- break;
case BooleanSpeculationCheck:
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler64.cpp (198023 => 198024)
--- trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler64.cpp 2016-03-11 17:28:46 UTC (rev 198023)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler64.cpp 2016-03-11 17:51:00 UTC (rev 198024)
@@ -61,11 +61,6 @@
m_jit.sub32(recovery->src(), recovery->dest());
m_jit.or64(GPRInfo::tagTypeNumberRegister, recovery->dest());
break;
-
- case SpeculativeAddImmediate:
- m_jit.sub32(AssemblyHelpers::Imm32(recovery->immediate()), recovery->dest());
- m_jit.or64(GPRInfo::tagTypeNumberRegister, recovery->dest());
- break;
case BooleanSpeculationCheck:
m_jit.xor64(AssemblyHelpers::TrustedImm32(static_cast<int32_t>(ValueFalse)), recovery->dest());
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (198023 => 198024)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2016-03-11 17:28:46 UTC (rev 198023)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2016-03-11 17:51:00 UTC (rev 198024)
@@ -3256,26 +3256,19 @@
if (node->child2()->isInt32Constant()) {
SpeculateInt32Operand op1(this, node->child1());
- GPRTemporary result(this, Reuse, op1);
-
- GPRReg gpr1 = op1.gpr();
int32_t imm2 = node->child2()->asInt32();
- GPRReg gprResult = result.gpr();
if (!shouldCheckOverflow(node->arithMode())) {
- m_jit.add32(Imm32(imm2), gpr1, gprResult);
- int32Result(gprResult, node);
+ GPRTemporary result(this, Reuse, op1);
+ m_jit.add32(Imm32(imm2), op1.gpr(), result.gpr());
+ int32Result(result.gpr(), node);
return;
}
- MacroAssembler::Jump check = m_jit.branchAdd32(MacroAssembler::Overflow, gpr1, Imm32(imm2), gprResult);
- if (gpr1 == gprResult) {
- speculationCheck(Overflow, JSValueRegs(), 0, check,
- SpeculationRecovery(SpeculativeAddImmediate, gpr1, imm2));
- } else
- speculationCheck(Overflow, JSValueRegs(), 0, check);
+ GPRTemporary result(this);
+ speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchAdd32(MacroAssembler::Overflow, op1.gpr(), Imm32(imm2), result.gpr()));
- int32Result(gprResult, node);
+ int32Result(result.gpr(), node);
return;
}
Deleted: trunk/Source/_javascript_Core/tests/stress/arith-add-with-constant-overflow.js (198023 => 198024)
--- trunk/Source/_javascript_Core/tests/stress/arith-add-with-constant-overflow.js 2016-03-11 17:28:46 UTC (rev 198023)
+++ trunk/Source/_javascript_Core/tests/stress/arith-add-with-constant-overflow.js 2016-03-11 17:51:00 UTC (rev 198024)
@@ -1,21 +0,0 @@
-function opaqueAdd(a)
-{
- return a + 42;
-}
-noInline(opaqueAdd);
-
-// Warm up.
-for (let i = 0; i < 1e4; ++i) {
- let result = opaqueAdd(5);
- if (result !== 47)
- throw "Invalid opaqueAdd(5) at i = " + i;
-}
-
-// Overflow.
-for (let i = 0; i < 1e3; ++i) {
- for (let j = -50; j < 50; ++j) {
- let result = opaqueAdd(2147483647 + j);
- if (result !== 2147483689 + j)
- throw "Invalid opaqueAdd(" + 2147483647 + j + ") at i = " + i + " j = " + j;
- }
-}
