DFG OSR exit for UInt32ToNumber should roll forward, not roll backward
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 14 Dec 2011 01:46:36 +0000 (01:46 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 14 Dec 2011 01:46:36 +0000 (01:46 +0000)
commit5e98bff6c78ddead925ed37e59e47e9686e9f409
tree2b567042d78ae259c1fb9d32fe44de97efbb6f12
parent5364c2a49f434058a0e55d57421f46ee2e490682
DFG OSR exit for UInt32ToNumber should roll forward, not roll backward
https://bugs.webkit.org/show_bug.cgi?id=74463

Source/JavaScriptCore:

Reviewed by Gavin Barraclough.

Implements roll-forward OSR exit for UInt32ToNumber, which requires ValueRecoveries knowing
how to execute the slow path of UInt32ToNumber.

* bytecode/CodeBlock.h:
(JSC::CodeBlock::lastOSRExit):
* bytecode/CodeOrigin.h:
(JSC::CodeOrigin::operator!=):
* bytecode/ValueRecovery.h:
(JSC::ValueRecovery::uint32InGPR):
(JSC::ValueRecovery::gpr):
(JSC::ValueRecovery::dump):
* dfg/DFGAssemblyHelpers.cpp:
* dfg/DFGAssemblyHelpers.h:
* dfg/DFGOSRExit.h:
(JSC::DFG::OSRExit::valueRecoveryForOperand):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Gavin Barraclough.

* fast/js/dfg-uint32-to-number-expected.txt: Added.
* fast/js/dfg-uint32-to-number.html: Added.
* fast/js/script-tests/dfg-uint32-to-number.js: Added.
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@102723 268f45cc-cd09-0410-ab3c-d52691b4dbfc
17 files changed:
LayoutTests/ChangeLog
LayoutTests/fast/js/dfg-uint32-to-number-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-uint32-to-number.html [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-uint32-to-number.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/CodeBlock.h
Source/JavaScriptCore/bytecode/CodeOrigin.h
Source/JavaScriptCore/bytecode/ValueRecovery.h
Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp
Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
Source/JavaScriptCore/dfg/DFGOSRExit.h
Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp