Remove uses of ClassInfo in StrictEq and CompareEq in the DFG
https://bugs.webkit.org/show_bug.cgi?id=93401
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
Another incremental step in removing the dependence on ClassInfo pointers in object headers.
* bytecode/SpeculatedType.h:
(JSC::isCellOrOtherSpeculation):
(JSC):
* dfg/DFGAbstractState.cpp: Updated the CFA to reflect the changes to the backend.
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::shouldSpeculateString): Added this new function since it was conspicuously absent.
(JSC::DFG::Node::shouldSpeculateNonStringCellOrOther): Also add this function for use in the CFA.
* dfg/DFGSpeculativeJIT.cpp: Refactored how we handle CompareEq and CompareStrictEq in the DFG. We now just
check for Strings by comparing the object's Structure to the global Structure for strings. We only
check for MasqueradesAsUndefined if the watchpoint has fired. These changes allow us to remove our
uses of the ClassInfo pointer for compiling these nodes.
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp: Same changes for 32 bit as for 64 bit.
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
LayoutTests:
New test to make sure the DFG watchpoint works correctly for these cases.
* fast/js/document-all-triggers-masquerades-watchpoint-expected.txt: Added.
* fast/js/document-all-triggers-masquerades-watchpoint.html: Added.
* fast/js/script-tests/document-all-triggers-masquerades-watchpoint.js: Added.
(f):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127189 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 29b329e..c768cb1 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -733,45 +733,32 @@
break;
}
- if (Node::shouldSpeculateFinalObject(left, right)) {
- filter = SpecFinalObject;
- checker = isFinalObjectSpeculation;
- } else if (Node::shouldSpeculateArray(left, right)) {
- filter = SpecArray;
- checker = isArraySpeculation;
- } else if (left.shouldSpeculateFinalObject() && right.shouldSpeculateFinalObjectOrOther()) {
- node.setCanExit(
- !isFinalObjectSpeculation(forNode(node.child1()).m_type)
- || !isFinalObjectOrOtherSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecFinalObject);
- forNode(node.child2()).filter(SpecFinalObject | SpecOther);
+ if (left.shouldSpeculateString() || right.shouldSpeculateString()) {
+ node.setCanExit(false);
break;
- } else if (right.shouldSpeculateFinalObject() && left.shouldSpeculateFinalObjectOrOther()) {
- node.setCanExit(
- !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type)
- || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecFinalObject | SpecOther);
- forNode(node.child2()).filter(SpecFinalObject);
+ }
+ if (left.shouldSpeculateNonStringCell() && right.shouldSpeculateNonStringCellOrOther()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter(SpecCell & ~SpecString);
+ forNode(node.child2()).filter((SpecCell & ~SpecString) | SpecOther);
break;
- } else if (left.shouldSpeculateArray() && right.shouldSpeculateArrayOrOther()) {
- node.setCanExit(
- !isArraySpeculation(forNode(node.child1()).m_type)
- || !isArrayOrOtherSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecArray);
- forNode(node.child2()).filter(SpecArray | SpecOther);
- break;
- } else if (right.shouldSpeculateArray() && left.shouldSpeculateArrayOrOther()) {
- node.setCanExit(
- !isArrayOrOtherSpeculation(forNode(node.child1()).m_type)
- || !isArraySpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecArray | SpecOther);
- forNode(node.child2()).filter(SpecArray);
- break;
- } else {
- filter = SpecTop;
- checker = isAnySpeculation;
- clobberWorld(node.codeOrigin, indexInBlock);
}
+ if (left.shouldSpeculateNonStringCellOrOther() && right.shouldSpeculateNonStringCell()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
+ forNode(node.child2()).filter(SpecCell & ~SpecString);
+ break;
+ }
+ if (left.shouldSpeculateNonStringCell() && right.shouldSpeculateNonStringCell()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter(SpecCell & ~SpecString);
+ forNode(node.child2()).filter(SpecCell & ~SpecString);
+ break;
+ }
+
+ filter = SpecTop;
+ checker = isAnySpeculation;
+ clobberWorld(node.codeOrigin, indexInBlock);
} else {
filter = SpecTop;
checker = isAnySpeculation;
@@ -819,22 +806,16 @@
speculateNumberBinary(node);
break;
}
- if (Node::shouldSpeculateFinalObject(
- m_graph[node.child1()], m_graph[node.child2()])) {
- node.setCanExit(
- !isFinalObjectSpeculation(forNode(node.child1()).m_type)
- || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecFinalObject);
- forNode(node.child2()).filter(SpecFinalObject);
+ Node& leftNode = m_graph[node.child1()];
+ Node& rightNode = m_graph[node.child2()];
+ if (leftNode.shouldSpeculateString() || rightNode.shouldSpeculateString()) {
+ node.setCanExit(false);
break;
}
- if (Node::shouldSpeculateArray(
- m_graph[node.child1()], m_graph[node.child2()])) {
- node.setCanExit(
- !isArraySpeculation(forNode(node.child1()).m_type)
- || !isArraySpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecArray);
- forNode(node.child2()).filter(SpecArray);
+ if (leftNode.shouldSpeculateNonStringCell() && rightNode.shouldSpeculateNonStringCell()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
+ forNode(node.child2()).filter((SpecCell & ~SpecString) | SpecOther);
break;
}
node.setCanExit(false);
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 946a5f79..fb31f93 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -916,12 +916,27 @@
{
return isBooleanSpeculation(prediction());
}
-
+
+ bool shouldSpeculateString()
+ {
+ return isStringSpeculation(prediction());
+ }
+
bool shouldSpeculateFinalObject()
{
return isFinalObjectSpeculation(prediction());
}
+ bool shouldSpeculateNonStringCell()
+ {
+ return isNonStringCellSpeculation(prediction());
+ }
+
+ bool shouldSpeculateNonStringCellOrOther()
+ {
+ return isNonStringCellOrOtherSpeculation(prediction());
+ }
+
bool shouldSpeculateFinalObjectOrOther()
{
return isFinalObjectOrOtherSpeculation(prediction());
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index b22c5bc..c9c07da 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -1072,7 +1072,7 @@
jump(notTaken);
}
-void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchNodeIndex, const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchNodeIndex)
{
Node& branchNode = at(branchNodeIndex);
BlockIndex taken = branchNode.takenBlockIndex();
@@ -1093,11 +1093,47 @@
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
- if (!speculatedTypeChecker(m_state.forNode(node.child1()).m_type))
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
- if (!speculatedTypeChecker(m_state.forNode(node.child2()).m_type))
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-
+ if (m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+ m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+ }
+
branchPtr(condition, op1GPR, op2GPR, taken);
jump(notTaken);
}
@@ -1151,37 +1187,17 @@
else if (Node::shouldSpeculateNumber(at(node.child1()), at(node.child2())))
compilePeepHoleDoubleBranch(node, branchNodeIndex, doubleCondition);
else if (node.op() == CompareEq) {
- if (Node::shouldSpeculateFinalObject(
- at(node.child1()), at(node.child2()))) {
- compilePeepHoleObjectEquality(
- node, branchNodeIndex, &JSFinalObject::s_info,
- isFinalObjectSpeculation);
- } else if (Node::shouldSpeculateArray(
- at(node.child1()), at(node.child2()))) {
- compilePeepHoleObjectEquality(
- node, branchNodeIndex, &JSArray::s_info,
- isArraySpeculation);
- } else if (at(node.child1()).shouldSpeculateFinalObject()
- && at(node.child2()).shouldSpeculateFinalObjectOrOther()) {
- compilePeepHoleObjectToObjectOrOtherEquality(
- node.child1(), node.child2(), branchNodeIndex,
- &JSFinalObject::s_info, isFinalObjectSpeculation);
- } else if (at(node.child1()).shouldSpeculateFinalObjectOrOther()
- && at(node.child2()).shouldSpeculateFinalObject()) {
- compilePeepHoleObjectToObjectOrOtherEquality(
- node.child2(), node.child1(), branchNodeIndex,
- &JSFinalObject::s_info, isFinalObjectSpeculation);
- } else if (at(node.child1()).shouldSpeculateArray()
- && at(node.child2()).shouldSpeculateArrayOrOther()) {
- compilePeepHoleObjectToObjectOrOtherEquality(
- node.child1(), node.child2(), branchNodeIndex,
- &JSArray::s_info, isArraySpeculation);
- } else if (at(node.child1()).shouldSpeculateArrayOrOther()
- && at(node.child2()).shouldSpeculateArray()) {
- compilePeepHoleObjectToObjectOrOtherEquality(
- node.child2(), node.child1(), branchNodeIndex,
- &JSArray::s_info, isArraySpeculation);
- } else {
+ if (at(node.child1()).shouldSpeculateString() || at(node.child2()).shouldSpeculateString()) {
+ nonSpeculativePeepholeBranch(node, branchNodeIndex, condition, operation);
+ return true;
+ }
+ if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCellOrOther())
+ compilePeepHoleObjectToObjectOrOtherEquality(node.child1(), node.child2(), branchNodeIndex);
+ else if (at(node.child1()).shouldSpeculateNonStringCellOrOther() && at(node.child2()).shouldSpeculateNonStringCell())
+ compilePeepHoleObjectToObjectOrOtherEquality(node.child2(), node.child1(), branchNodeIndex);
+ else if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCell())
+ compilePeepHoleObjectEquality(node, branchNodeIndex);
+ else {
nonSpeculativePeepholeBranch(node, branchNodeIndex, condition, operation);
return true;
}
@@ -2799,45 +2815,23 @@
}
if (node.op() == CompareEq) {
- if (Node::shouldSpeculateFinalObject(at(node.child1()), at(node.child2()))) {
- compileObjectEquality(node, &JSFinalObject::s_info, isFinalObjectSpeculation);
+ if (at(node.child1()).shouldSpeculateString() || at(node.child2()).shouldSpeculateString()) {
+ nonSpeculativeNonPeepholeCompare(node, condition, operation);
return false;
}
- if (Node::shouldSpeculateArray(at(node.child1()), at(node.child2()))) {
- compileObjectEquality(node, &JSArray::s_info, isArraySpeculation);
+ if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCellOrOther()) {
+ compileObjectToObjectOrOtherEquality(node.child1(), node.child2());
return false;
}
- if (at(node.child1()).shouldSpeculateFinalObject()
- && at(node.child2()).shouldSpeculateFinalObjectOrOther()) {
- compileObjectToObjectOrOtherEquality(
- node.child1(), node.child2(), &JSFinalObject::s_info,
- isFinalObjectSpeculation);
+ if (at(node.child1()).shouldSpeculateNonStringCellOrOther() && at(node.child2()).shouldSpeculateNonStringCell()) {
+ compileObjectToObjectOrOtherEquality(node.child2(), node.child1());
return false;
}
-
- if (at(node.child1()).shouldSpeculateFinalObjectOrOther()
- && at(node.child2()).shouldSpeculateFinalObject()) {
- compileObjectToObjectOrOtherEquality(
- node.child2(), node.child1(), &JSFinalObject::s_info,
- isFinalObjectSpeculation);
- return false;
- }
-
- if (at(node.child1()).shouldSpeculateArray()
- && at(node.child2()).shouldSpeculateArrayOrOther()) {
- compileObjectToObjectOrOtherEquality(
- node.child1(), node.child2(), &JSArray::s_info,
- isArraySpeculation);
- return false;
- }
-
- if (at(node.child1()).shouldSpeculateArrayOrOther()
- && at(node.child2()).shouldSpeculateArray()) {
- compileObjectToObjectOrOtherEquality(
- node.child2(), node.child1(), &JSArray::s_info,
- isArraySpeculation);
+
+ if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCell()) {
+ compileObjectEquality(node);
return false;
}
}
@@ -2970,36 +2964,20 @@
return false;
}
- // 4) If the operands are predicted final object or array, then do a final object
- // or array comparison.
-
- if (Node::shouldSpeculateFinalObject(at(node.child1()), at(node.child2()))) {
+ if (at(node.child1()).shouldSpeculateString() || at(node.child2()).shouldSpeculateString())
+ return nonSpeculativeStrictEq(node);
+ if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCell()) {
unsigned branchIndexInBlock = detectPeepHoleBranch();
if (branchIndexInBlock != UINT_MAX) {
NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
- compilePeepHoleObjectEquality(node, branchNodeIndex, &JSFinalObject::s_info, isFinalObjectSpeculation);
+ compilePeepHoleObjectEquality(node, branchNodeIndex);
use(node.child1());
use(node.child2());
m_indexInBlock = branchIndexInBlock;
m_compileIndex = branchNodeIndex;
return true;
}
- compileObjectEquality(node, &JSFinalObject::s_info, isFinalObjectSpeculation);
- return false;
- }
-
- if (Node::shouldSpeculateArray(at(node.child1()), at(node.child2()))) {
- unsigned branchIndexInBlock = detectPeepHoleBranch();
- if (branchIndexInBlock != UINT_MAX) {
- NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
- compilePeepHoleObjectEquality(node, branchNodeIndex, &JSArray::s_info, isArraySpeculation);
- use(node.child1());
- use(node.child2());
- m_indexInBlock = branchIndexInBlock;
- m_compileIndex = branchNodeIndex;
- return true;
- }
- compileObjectEquality(node, &JSArray::s_info, isArraySpeculation);
+ compileObjectEquality(node);
return false;
}
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 92a3bb9..4f6a14a 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -2054,12 +2054,10 @@
bool compilePeepHoleBranch(Node&, MacroAssembler::RelationalCondition, MacroAssembler::DoubleCondition, S_DFGOperation_EJJ);
void compilePeepHoleIntegerBranch(Node&, NodeIndex branchNodeIndex, JITCompiler::RelationalCondition);
void compilePeepHoleDoubleBranch(Node&, NodeIndex branchNodeIndex, JITCompiler::DoubleCondition);
- void compilePeepHoleObjectEquality(Node&, NodeIndex branchNodeIndex, const ClassInfo*, SpeculatedTypeChecker);
- void compilePeepHoleObjectToObjectOrOtherEquality(
- Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex, const ClassInfo*, SpeculatedTypeChecker);
- void compileObjectEquality(Node&, const ClassInfo*, SpeculatedTypeChecker);
- void compileObjectToObjectOrOtherEquality(
- Edge leftChild, Edge rightChild, const ClassInfo*, SpeculatedTypeChecker);
+ void compilePeepHoleObjectEquality(Node&, NodeIndex branchNodeIndex);
+ void compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex);
+ void compileObjectEquality(Node&);
+ void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
void compileValueAdd(Node&);
void compileObjectOrOtherLogicalNot(Edge value, const ClassInfo*, bool needSpeculationCheck);
void compileLogicalNot(Node&);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 23623e1..c80d824 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -1489,17 +1489,53 @@
return notNumber;
}
-void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectEquality(Node& node)
{
SpeculateCellOperand op1(this, node.child1());
SpeculateCellOperand op2(this, node.child2());
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
- if (!speculatedTypeChecker(m_state.forNode(node.child1()).m_type))
- speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
- if (!speculatedTypeChecker(m_state.forNode(node.child2()).m_type))
- speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+ if (m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+ m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+ }
GPRTemporary resultPayload(this, op2);
GPRReg resultPayloadGPR = resultPayload.gpr();
@@ -1514,10 +1550,9 @@
booleanResult(resultPayloadGPR, m_compileIndex);
}
-void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
- Edge leftChild, Edge rightChild,
- const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
{
+ Node& leftNode = m_jit.graph()[leftChild.index()];
SpeculateCellOperand op1(this, leftChild);
JSValueOperand op2(this, rightChild);
GPRTemporary result(this);
@@ -1527,31 +1562,59 @@
GPRReg op2PayloadGPR = op2.payloadGPR();
GPRReg resultGPR = result.gpr();
- if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
- speculationCheck(
- BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+ if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
+
// It seems that most of the time when programs do a == b where b may be either null/undefined
// or an object, b is usually an object. Balance the branches to make that case fast.
MacroAssembler::Jump rightNotCell =
m_jit.branch32(MacroAssembler::NotEqual, op2TagGPR, TrustedImm32(JSValue::CellTag));
- // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
- // proof, when filtered on cell, demonstrates that we have an object of the desired type
- // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
- // speculation.
- if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
- speculationCheck(
- BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+ // We know that within this branch, rightChild must be a cell.
+ if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op2PayloadGPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// At this point we know that we can perform a straight-forward equality comparison on pointer
@@ -1585,9 +1648,7 @@
booleanResult(resultGPR, m_compileIndex);
}
-void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
- Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex,
- const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex)
{
Node& branchNode = at(branchNodeIndex);
BlockIndex taken = branchNode.takenBlockIndex();
@@ -1602,13 +1663,28 @@
GPRReg op2PayloadGPR = op2.payloadGPR();
GPRReg resultGPR = result.gpr();
- if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
- speculationCheck(
- BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+ if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// It seems that most of the time when programs do a == b where b may be either null/undefined
@@ -1616,17 +1692,29 @@
MacroAssembler::Jump rightNotCell =
m_jit.branch32(MacroAssembler::NotEqual, op2TagGPR, TrustedImm32(JSValue::CellTag));
- // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
- // proof, when filtered on cell, demonstrates that we have an object of the desired type
- // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
- // speculation.
- if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
- speculationCheck(
- BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+ // We know that within this branch, rightChild must be a cell.
+ if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op2PayloadGPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// At this point we know that we can perform a straight-forward equality comparison on pointer
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 88b9a47..1f08600 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -1538,7 +1538,7 @@
return notNumber;
}
-void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectEquality(Node& node)
{
SpeculateCellOperand op1(this, node.child1());
SpeculateCellOperand op2(this, node.child2());
@@ -1547,11 +1547,47 @@
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
GPRReg resultGPR = result.gpr();
-
- if (!speculatedTypeChecker(m_state.forNode(node.child1()).m_type))
- speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
- if (!speculatedTypeChecker(m_state.forNode(node.child2()).m_type))
- speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+
+ if (m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+ m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+ }
MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR);
m_jit.move(TrustedImm32(ValueTrue), resultGPR);
@@ -1563,10 +1599,9 @@
jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);
}
-void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
- Edge leftChild, Edge rightChild,
- const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
{
+ Node& leftNode = m_jit.graph()[leftChild.index()];
SpeculateCellOperand op1(this, leftChild);
JSValueOperand op2(this, rightChild);
GPRTemporary result(this);
@@ -1574,14 +1609,29 @@
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
GPRReg resultGPR = result.gpr();
-
- if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
- speculationCheck(
- BadType, JSValueRegs(op1GPR), leftChild.index(),
+
+ if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// It seems that most of the time when programs do a == b where b may be either null/undefined
@@ -1589,17 +1639,29 @@
MacroAssembler::Jump rightNotCell =
m_jit.branchTestPtr(MacroAssembler::NonZero, op2GPR, GPRInfo::tagMaskRegister);
- // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
- // proof, when filtered on cell, demonstrates that we have an object of the desired type
- // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
- // speculation.
- if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
- speculationCheck(
- BadType, JSValueRegs(op2GPR), rightChild.index(),
+ // We know that within this branch, rightChild must be a cell.
+ if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// At this point we know that we can perform a straight-forward equality comparison on pointer
@@ -1633,9 +1695,7 @@
jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);
}
-void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
- Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex,
- const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex)
{
Node& branchNode = at(branchNodeIndex);
BlockIndex taken = branchNode.takenBlockIndex();
@@ -1649,13 +1709,28 @@
GPRReg op2GPR = op2.gpr();
GPRReg resultGPR = result.gpr();
- if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
- speculationCheck(
- BadType, JSValueRegs(op1GPR), leftChild.index(),
+ if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op1GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// It seems that most of the time when programs do a == b where b may be either null/undefined
@@ -1663,17 +1738,29 @@
MacroAssembler::Jump rightNotCell =
m_jit.branchTestPtr(MacroAssembler::NonZero, op2GPR, GPRInfo::tagMaskRegister);
- // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
- // proof, when filtered on cell, demonstrates that we have an object of the desired type
- // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
- // speculation.
- if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
- speculationCheck(
- BadType, JSValueRegs(op2GPR), rightChild.index(),
+ // We know that within this branch, rightChild must be a cell.
+ if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+ m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+ speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(),
m_jit.branchPtr(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()),
- MacroAssembler::TrustedImmPtr(classInfo)));
+ MacroAssembler::Equal,
+ MacroAssembler::Address(op2GPR, JSCell::structureOffset()),
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ } else {
+ GPRTemporary structure(this);
+ GPRReg structureGPR = structure.gpr();
+
+ m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+ speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(),
+ m_jit.branchPtr(
+ MacroAssembler::Equal,
+ structureGPR,
+ MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+ speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(),
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
}
// At this point we know that we can perform a straight-forward equality comparison on pointer
