Update FTL to support UntypedUse operands for op_sub.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 28 Oct 2015 18:36:02 +0000 (18:36 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 28 Oct 2015 18:36:02 +0000 (18:36 +0000)
commit95a6681938b4275ce1d9e21ba4ee620bdca1bcdf
treeedf96c3d7b64c720591165f25245d6045a250f4c
parentf5744debacd1bfa1423fc77dc6dbac092e3fe7ef
Update FTL to support UntypedUse operands for op_sub.
https://bugs.webkit.org/show_bug.cgi?id=150562

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

* assembler/MacroAssemblerARM64.h:
- make the dataTempRegister and memoryTempRegister public so that we can
  move input registers out of them if needed.

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
- We can now compile ArithSub.

* ftl/FTLCompile.cpp:
- Added BinaryArithGenerationContext to shuffle registers into a state that is
  expected by the baseline snippet generator.  This includes:
  1. Making sure that the input and output registers are not in the tag or
     scratch registers.
  2. Loading the tag registers with expected values.
  3. Restoring the registers to their original value on return.
- Added code to implement the ArithSub inline cache.

* ftl/FTLInlineCacheDescriptor.h:
(JSC::FTL::ArithSubDescriptor::ArithSubDescriptor):
(JSC::FTL::ArithSubDescriptor::leftType):
(JSC::FTL::ArithSubDescriptor::rightType):

* ftl/FTLInlineCacheSize.cpp:
(JSC::FTL::sizeOfArithSub):
* ftl/FTLInlineCacheSize.h:

* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
- Added handling for UnusedType for the ArithSub case.

* ftl/FTLState.h:
* jit/GPRInfo.h:
(JSC::GPRInfo::reservedRegisters):

* jit/JITSubGenerator.h:
(JSC::JITSubGenerator::generateFastPath):
- When the result is in the same as one of the input registers, we'll end up
  corrupting the input in fast path even if we determine that we need to go to
  the slow path.  We now move the input into the scratch register and operate
  on that instead and only move the result into the result register only after
  the fast path has succeeded.

* tests/stress/op_sub.js:
(o1.valueOf):
(runTest):
- Added some debugging tools: flags for verbose logging, and eager abort on fail.

LayoutTests:

* js/regress/ftl-sub-expected.txt: Added.
* js/regress/ftl-sub.html: Added.
* js/regress/script-tests/ftl-sub.js: Added.
(o1.valueOf):
(o2.valueOf):
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191683 268f45cc-cd09-0410-ab3c-d52691b4dbfc
16 files changed:
LayoutTests/ChangeLog
LayoutTests/js/regress/ftl-object-sub-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/ftl-object-sub.html [new file with mode: 0644]
LayoutTests/js/regress/script-tests/ftl-object-sub.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLCompile.cpp
Source/JavaScriptCore/ftl/FTLInlineCacheDescriptor.h
Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp
Source/JavaScriptCore/ftl/FTLInlineCacheSize.h
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
Source/JavaScriptCore/ftl/FTLState.h
Source/JavaScriptCore/jit/GPRInfo.h
Source/JavaScriptCore/jit/JITSubGenerator.h
Source/JavaScriptCore/tests/stress/op_sub.js