Remove uses of ClassInfo in StrictEq and CompareEq in the DFG
https://bugs.webkit.org/show_bug.cgi?id=93401
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
Another incremental step in removing the dependence on ClassInfo pointers in object headers.
* bytecode/SpeculatedType.h:
(JSC::isCellOrOtherSpeculation):
(JSC):
* dfg/DFGAbstractState.cpp: Updated the CFA to reflect the changes to the backend.
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::shouldSpeculateString): Added this new function since it was conspicuously absent.
(JSC::DFG::Node::shouldSpeculateNonStringCellOrOther): Also add this function for use in the CFA.
* dfg/DFGSpeculativeJIT.cpp: Refactored how we handle CompareEq and CompareStrictEq in the DFG. We now just
check for Strings by comparing the object's Structure to the global Structure for strings. We only
check for MasqueradesAsUndefined if the watchpoint has fired. These changes allow us to remove our
uses of the ClassInfo pointer for compiling these nodes.
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp: Same changes for 32 bit as for 64 bit.
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
LayoutTests:
New test to make sure the DFG watchpoint works correctly for these cases.
* fast/js/document-all-triggers-masquerades-watchpoint-expected.txt: Added.
* fast/js/document-all-triggers-masquerades-watchpoint.html: Added.
* fast/js/script-tests/document-all-triggers-masquerades-watchpoint.js: Added.
(f):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127189 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 29b329e..c768cb1 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -733,45 +733,32 @@
break;
}
- if (Node::shouldSpeculateFinalObject(left, right)) {
- filter = SpecFinalObject;
- checker = isFinalObjectSpeculation;
- } else if (Node::shouldSpeculateArray(left, right)) {
- filter = SpecArray;
- checker = isArraySpeculation;
- } else if (left.shouldSpeculateFinalObject() && right.shouldSpeculateFinalObjectOrOther()) {
- node.setCanExit(
- !isFinalObjectSpeculation(forNode(node.child1()).m_type)
- || !isFinalObjectOrOtherSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecFinalObject);
- forNode(node.child2()).filter(SpecFinalObject | SpecOther);
+ if (left.shouldSpeculateString() || right.shouldSpeculateString()) {
+ node.setCanExit(false);
break;
- } else if (right.shouldSpeculateFinalObject() && left.shouldSpeculateFinalObjectOrOther()) {
- node.setCanExit(
- !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type)
- || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecFinalObject | SpecOther);
- forNode(node.child2()).filter(SpecFinalObject);
+ }
+ if (left.shouldSpeculateNonStringCell() && right.shouldSpeculateNonStringCellOrOther()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter(SpecCell & ~SpecString);
+ forNode(node.child2()).filter((SpecCell & ~SpecString) | SpecOther);
break;
- } else if (left.shouldSpeculateArray() && right.shouldSpeculateArrayOrOther()) {
- node.setCanExit(
- !isArraySpeculation(forNode(node.child1()).m_type)
- || !isArrayOrOtherSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecArray);
- forNode(node.child2()).filter(SpecArray | SpecOther);
- break;
- } else if (right.shouldSpeculateArray() && left.shouldSpeculateArrayOrOther()) {
- node.setCanExit(
- !isArrayOrOtherSpeculation(forNode(node.child1()).m_type)
- || !isArraySpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecArray | SpecOther);
- forNode(node.child2()).filter(SpecArray);
- break;
- } else {
- filter = SpecTop;
- checker = isAnySpeculation;
- clobberWorld(node.codeOrigin, indexInBlock);
}
+ if (left.shouldSpeculateNonStringCellOrOther() && right.shouldSpeculateNonStringCell()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
+ forNode(node.child2()).filter(SpecCell & ~SpecString);
+ break;
+ }
+ if (left.shouldSpeculateNonStringCell() && right.shouldSpeculateNonStringCell()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter(SpecCell & ~SpecString);
+ forNode(node.child2()).filter(SpecCell & ~SpecString);
+ break;
+ }
+
+ filter = SpecTop;
+ checker = isAnySpeculation;
+ clobberWorld(node.codeOrigin, indexInBlock);
} else {
filter = SpecTop;
checker = isAnySpeculation;
@@ -819,22 +806,16 @@
speculateNumberBinary(node);
break;
}
- if (Node::shouldSpeculateFinalObject(
- m_graph[node.child1()], m_graph[node.child2()])) {
- node.setCanExit(
- !isFinalObjectSpeculation(forNode(node.child1()).m_type)
- || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecFinalObject);
- forNode(node.child2()).filter(SpecFinalObject);
+ Node& leftNode = m_graph[node.child1()];
+ Node& rightNode = m_graph[node.child2()];
+ if (leftNode.shouldSpeculateString() || rightNode.shouldSpeculateString()) {
+ node.setCanExit(false);
break;
}
- if (Node::shouldSpeculateArray(
- m_graph[node.child1()], m_graph[node.child2()])) {
- node.setCanExit(
- !isArraySpeculation(forNode(node.child1()).m_type)
- || !isArraySpeculation(forNode(node.child2()).m_type));
- forNode(node.child1()).filter(SpecArray);
- forNode(node.child2()).filter(SpecArray);
+ if (leftNode.shouldSpeculateNonStringCell() && rightNode.shouldSpeculateNonStringCell()) {
+ node.setCanExit(true);
+ forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
+ forNode(node.child2()).filter((SpecCell & ~SpecString) | SpecOther);
break;
}
node.setCanExit(false);
