2016-01-04  Filip Pizlo  <fpizlo@apple.com>

        FTL B3 should do the ArithSub binary snippet

        https://bugs.webkit.org/show_bug.cgi?id=152705

        Reviewed by NOBODY (OOPS!).

        This implements the ArithSub binary snippet generator in FTL B3.

        While doing this, I discovered that the DFG type inference logic for ArithSub contains a

        classic mistake: it causes the snippets to kick in when the type set does not contain numbers

        rather than kicking in when the type set contains non-numbers. So, the original test that I

        wrote for this doesn't work right (it runs to completion but OSR exits ad infinitum). I wrote

        a second test that is simpler, and that one shows that the binary snippets "work". That's

        sort of a joke though, since the only way to trigger binary snippets is to never pass numbers

        and the only way to actually cause a binary snippet to do meaninful work is to pass numbers.

        I filed a bug about this mess: https://bugs.webkit.org/show_bug.cgi?id=152708.

        * ftl/FTLLowerDFGToLLVM.cpp:

        (JSC::FTL::DFG::LowerDFGToLLVM::compileUntypedBinaryOp):

        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):

        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):

        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):

        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):

        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):

        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):

        * tests/stress/object-sub.js: Added.

        (foo):

        (things.valueOf):

        * tests/stress/untyped-sub.js: Added.

        (foo):

        (valueOf):

#include "JITSubGenerator.h"

#endif // FTL_USES_B3

#if FTL_USES_B3

    enum ScratchFPRUsage {

        DontNeedScratchFPR,

        NeedScratchFPR

    };

    template<typename BinaryArithOpGenerator, ScratchFPRUsage scratchFPRUsage = DontNeedScratchFPR>

    void emitBinarySnippet(J_JITOperation_EJJ slowPathFunction)

    {

        Node* node = m_node;

        // FIXME: Make this do exceptions.

        // https://bugs.webkit.org/show_bug.cgi?id=151686

        LValue left = lowJSValue(node->child1());

        LValue right = lowJSValue(node->child2());

        SnippetOperand leftOperand(m_state.forNode(node->child1()).resultType());

        SnippetOperand rightOperand(m_state.forNode(node->child2()).resultType());

        PatchpointValue* patchpoint = m_out.patchpoint(Int64);

        patchpoint->append(left, ValueRep::SomeRegister);

        patchpoint->append(right, ValueRep::SomeRegister);

        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));

        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));

        patchpoint->numGPScratchRegisters = 1;

        patchpoint->numFPScratchRegisters = 2;

        if (scratchFPRUsage == NeedScratchFPR)

            patchpoint->numFPScratchRegisters++;

        patchpoint->clobber(RegisterSet::macroScratchRegisters());

        State* state = &m_ftlState;

        patchpoint->setGenerator(

            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {

                AllowMacroScratchRegisterUsage allowScratch(jit);

                auto generator = Box<BinaryArithOpGenerator>::create(

                    leftOperand, rightOperand, JSValueRegs(params[0].gpr()),

                    JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()),

                    params.fpScratch(0), params.fpScratch(1), params.gpScratch(0),

                    scratchFPRUsage == NeedScratchFPR ? params.fpScratch(2) : InvalidFPRReg);

                generator->generateFastPath(jit);

                generator->endJumpList().link(&jit);

                CCallHelpers::Label done = jit.label();

                params.addLatePath(

                    [=] (CCallHelpers& jit) {

                        AllowMacroScratchRegisterUsage allowScratch(jit);

                        // FIXME: Make this do something.

                        CCallHelpers::JumpList exceptions;

                        generator->slowPathJumpList().link(&jit);

                        callOperation(

                            *state, params.unavailableRegisters(), jit, node->origin.semantic,

                            &exceptions, slowPathFunction, params[0].gpr(), params[1].gpr(),

                            params[2].gpr());

                        jit.jump().linkTo(done, &jit);

                    });

            });

        setJSValue(patchpoint);

    }

#endif // FTL_USES_B3

function foo(a, b) {

    return a - b;

}

noInline(foo);

var things = [{valueOf: function() { return 4; }}];

var results = [3];

for (var i = 0; i < 100000; ++i) {

    var result = foo(things[i % things.length], 1);

    var expected = results[i % results.length];

    if (result != expected)

        throw "Error: bad result for i = " + i + ": " + result;

}

function foo(a, b) {

    return a - b;

}

noInline(foo);

var things = [1, 2.5, "3", {valueOf: function() { return 4; }}];

var results = [0, 1.5, 2, 3];

for (var i = 0; i < 100000; ++i) {

    var result = foo(things[i % things.length], 1);

    var expected = results[i % results.length];

    if (result != expected)

        throw "Error: bad result for i = " + i + ": " + result;

}