FTL B3 should do the ArithSub binary snippet
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 4 Jan 2016 20:49:33 +0000 (20:49 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 4 Jan 2016 20:49:33 +0000 (20:49 +0000)
commit76c447f032f5ed55058e447e10a9a3b079edfe2c
tree81a62d38daa3d83b1551a96760f2022538eeef99
parentf2e0ffe90b895b209dd6ee261089e6e28ec83e84
FTL B3 should do the ArithSub binary snippet
https://bugs.webkit.org/show_bug.cgi?id=152705

Reviewed by Saam Barati.

This implements the ArithSub binary snippet generator in FTL B3.

While doing this, I discovered that the DFG type inference logic for ArithSub contains a
classic mistake: it causes the snippets to kick in when the type set does not contain numbers
rather than kicking in when the type set contains non-numbers. So, the original test that I
wrote for this doesn't work right (it runs to completion but OSR exits ad infinitum). I wrote
a second test that is simpler, and that one shows that the binary snippets "work". That's
sort of a joke though, since the only way to trigger binary snippets is to never pass numbers
and the only way to actually cause a binary snippet to do meaninful work is to pass numbers.
I filed a bug about this mess: https://bugs.webkit.org/show_bug.cgi?id=152708.

* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileUntypedBinaryOp):
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
(JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
(JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
(JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
(JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
(JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
* tests/stress/object-sub.js: Added.
(foo):
(things.valueOf):
* tests/stress/untyped-sub.js: Added.
(foo):
(valueOf):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194548 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
Source/JavaScriptCore/tests/stress/object-sub.js [new file with mode: 0644]
Source/JavaScriptCore/tests/stress/untyped-sub.js [new file with mode: 0644]