Attachment #273143 for bug #155094

View Details Raw Unified Return to Bug 155094

| Differences between



2016-03-06  Filip Pizlo  <fpizlo@apple.com>

        DFG should know how to speculate StringOrOther
        https://bugs.webkit.org/show_bug.cgi?id=155094

        Reviewed by NOBODY (OOPS!).

        Any code that processes the regexp matches array was previously doing a relatively expensive
        Branch(Untyped:). This introduces a new use kind called StringOrOther, which is perfect for
        code that loops over the matches array and branches on the entries being non-empty.

        To do this, I needed to introduce code into the FTL that creates new blocks. We still had that
        awful FTL_NEW_BLOCK idiom since the only way to debug LLVM IR was to ascribe names to basic
        blocks. B3 IR is inherently more debuggable since unlike LLVM, B3 knows how to always respect
        code origin, and it knows how to print the code origin nicely in the dumps. So, rather than
        continue using FTL_NEW_BLOCK(m_out, ("things")), I replaced all of that stuff with
        m_out.newBlock(). It's much nicer that way.

        This is a tiny speed-up on Octane/regexp at best. I was hoping for more. Oh well.

        * bytecode/SpeculatedType.h:
        (JSC::isStringSpeculation):
        (JSC::isStringOrOtherSpeculation):
        (JSC::isSymbolSpeculation):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::shouldSpeculateString):
        (JSC::DFG::Node::shouldSpeculateStringOrOther):
        (JSC::DFG::Node::shouldSpeculateStringObject):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::SafeToExecuteEdge::operator()):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileStringZeroLength):
        (JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther):
        (JSC::DFG::SpeculativeJIT::emitStringBranch):
        (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
        (JSC::DFG::SpeculativeJIT::speculateString):
        (JSC::DFG::SpeculativeJIT::speculateStringOrOther):
        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
        (JSC::DFG::SpeculativeJIT::speculate):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
        (JSC::DFG::SpeculativeJIT::emitBranch):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
        (JSC::DFG::SpeculativeJIT::emitBranch):
        * dfg/DFGUseKind.cpp:
        (WTF::printInternal):
        * dfg/DFGUseKind.h:
        (JSC::DFG::typeFilterFor):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        (JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
        (JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
        (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
        (JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
        (JSC::FTL::DFG::LowerDFGToB3::compileIsString):
        (JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
        (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
        (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
        (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
        (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
        (JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
        (JSC::FTL::DFG::LowerDFGToB3::checkStructure):
        (JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
        (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
        (JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier):
        (JSC::FTL::DFG::LowerDFGToB3::copyBarrier):
        (JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly):
        (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
        (JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
        (JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
        (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd):
        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
        (JSC::FTL::DFG::LowerDFGToB3::boolify):
        (JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
        (JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
        (JSC::FTL::DFG::LowerDFGToB3::switchString):
        (JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
        (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
        (JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
        (JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
        (JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
        (JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
        (JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
        (JSC::FTL::DFG::LowerDFGToB3::speculate):
        (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
        (JSC::FTL::DFG::LowerDFGToB3::speculateObjectOrOther):
        (JSC::FTL::DFG::LowerDFGToB3::speculateString):
        (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
        (JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent):
        (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
        (JSC::FTL::DFG::LowerDFGToB3::speculateRealNumber):
        (JSC::FTL::DFG::LowerDFGToB3::speculateNotStringVar):
        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
        (JSC::FTL::DFG::LowerDFGToB3::callCheck):
        * ftl/FTLOutput.cpp:
        (JSC::FTL::Output::initialize):
        (JSC::FTL::Output::newBlock):
        (JSC::FTL::Output::check):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::setFrequency):
        (JSC::FTL::Output::insertNewBlocksBefore):

2016-03-06  Filip Pizlo  <fpizlo@apple.com>

        RegExpMatchesArray doesn't know how to have a bad time

Lines 149-154 inline bool isStringSpeculation(Speculat Source/JavaScriptCore/bytecode/SpeculatedType.h_sec1
- Source/JavaScriptCore/bytecode/SpeculatedType.h +5 lines
149	return !!value && (value & SpecString) == value;	149	return !!value && (value & SpecString) == value;
150	}	150	}
151		151
		152	inline bool isStringOrOtherSpeculation(SpeculatedType value)
		153	{
		154	return !!value && (value & (SpecString \| SpecOther)) == value;
		155	}
		156
152	inline bool isSymbolSpeculation(SpeculatedType value)	157	inline bool isSymbolSpeculation(SpeculatedType value)
153	{	158	{
154	return value == SpecSymbol;	159	return value == SpecSymbol;

Lines 418-423 private: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +4 lines
418	fixEdge<DoubleRepUse>(node->child1());	418	fixEdge<DoubleRepUse>(node->child1());
419	else if (node->child1()->shouldSpeculateString())	419	else if (node->child1()->shouldSpeculateString())
420	fixEdge<StringUse>(node->child1());	420	fixEdge<StringUse>(node->child1());
		421	else if (node->child1()->shouldSpeculateStringOrOther())
		422	fixEdge<StringOrOtherUse>(node->child1());
421	break;	423	break;
422	}	424	}
423		425
Lines 923-928 private: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp_sec2
923	fixEdge<DoubleRepUse>(node->child1());	925	fixEdge<DoubleRepUse>(node->child1());
924	else if (node->child1()->shouldSpeculateString())	926	else if (node->child1()->shouldSpeculateString())
925	fixEdge<StringUse>(node->child1());	927	fixEdge<StringUse>(node->child1());
		928	else if (node->child1()->shouldSpeculateStringOrOther())
		929	fixEdge<StringOrOtherUse>(node->child1());
926	break;	930	break;
927	}	931	}
928		932

Lines 1957-1962 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec1
- Source/JavaScriptCore/dfg/DFGNode.h +5 lines
1957	return isStringSpeculation(prediction());	1957	return isStringSpeculation(prediction());
1958	}	1958	}
1959		1959
		1960	bool shouldSpeculateStringOrOther()
		1961	{
		1962	return isStringOrOtherSpeculation(prediction());
		1963	}
		1964
1960	bool shouldSpeculateStringObject()	1965	bool shouldSpeculateStringObject()
1961	{	1966	{
1962	return isStringObjectSpeculation(prediction());	1967	return isStringObjectSpeculation(prediction());

Lines 61-66 public: Source/JavaScriptCore/dfg/DFGSafeToExecute.h_sec1
- Source/JavaScriptCore/dfg/DFGSafeToExecute.h +1 lines
61	case ObjectOrOtherUse:	61	case ObjectOrOtherUse:
62	case StringIdentUse:	62	case StringIdentUse:
63	case StringUse:	63	case StringUse:
		64	case StringOrOtherUse:
64	case SymbolUse:	65	case SymbolUse:
65	case StringObjectUse:	66	case StringObjectUse:
66	case StringOrStringObjectUse:	67	case StringOrStringObjectUse:

Lines 1629-1634 void SpeculativeJIT::compileLogicalNot(N Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp +8 lines
1629	case StringUse:	1629	case StringUse:
1630	return compileStringZeroLength(node);	1630	return compileStringZeroLength(node);
1631		1631
		1632	case StringOrOtherUse:
		1633	return compileLogicalNotStringOrOther(node);
		1634
1632	default:	1635	default:
1633	RELEASE_ASSERT_NOT_REACHED();	1636	RELEASE_ASSERT_NOT_REACHED();
1634	break;	1637	break;
Lines 1719-1724 void SpeculativeJIT::emitBranch(Node* no Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec2
1719	return;	1722	return;
1720	}	1723	}
1721		1724
		1725	case StringOrOtherUse: {
		1726	emitStringOrOtherBranch(node->child1(), taken, notTaken);
		1727	return;
		1728	}
		1729
1722	case DoubleRepUse:	1730	case DoubleRepUse:
1723	case Int32Use: {	1731	case Int32Use: {
1724	if (node->child1().useKind() == Int32Use) {	1732	if (node->child1().useKind() == Int32Use) {

Lines 1774-1779 void SpeculativeJIT::compileLogicalNot(N Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp +8 lines
1774	case StringUse:	1774	case StringUse:
1775	return compileStringZeroLength(node);	1775	return compileStringZeroLength(node);
1776		1776
		1777	case StringOrOtherUse:
		1778	return compileLogicalNotStringOrOther(node);
		1779
1777	default:	1780	default:
1778	DFG_CRASH(m_jit.graph(), node, "Bad use kind");	1781	DFG_CRASH(m_jit.graph(), node, "Bad use kind");
1779	break;	1782	break;
Lines 1875-1880 void SpeculativeJIT::emitBranch(Node* no Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp_sec2
1875	return;	1878	return;
1876	}	1879	}
1877		1880
		1881	case StringOrOtherUse: {
		1882	emitStringOrOtherBranch(node->child1(), taken, notTaken);
		1883	return;
		1884	}
		1885
1878	case UntypedUse:	1886	case UntypedUse:
1879	case BooleanUse:	1887	case BooleanUse:
1880	case KnownBooleanUse: {	1888	case KnownBooleanUse: {



    unblessedBooleanResult(eqGPR, node);
}

void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node)
{
    JSValueOperand value(this, node->child1());
    GPRTemporary temp(this);
    JSValueRegs valueRegs = value.jsValueRegs();
    GPRReg tempGPR = temp.gpr();

    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
    GPRReg cellGPR = valueRegs.payloadGPR();
    DFG_TYPE_CHECK(
        valueRegs, node->child1(), (~SpecCell) | SpecString, m_jit.branchIfNotString(cellGPR));
    m_jit.test32(
        JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
        JITCompiler::TrustedImm32(-1), tempGPR);
    JITCompiler::Jump done = m_jit.jump();
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(
        valueRegs, node->child1(), SpecCell | SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR));
    m_jit.move(TrustedImm32(1), tempGPR);
    done.link(&m_jit);

    unblessedBooleanResult(tempGPR, node);
}

void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
{
    SpeculateCellOperand str(this, nodeUse);

    noResult(m_currentNode);
}

void SpeculativeJIT::emitStringOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
{
    JSValueOperand value(this, nodeUse);
    GPRTemporary temp(this);
    JSValueRegs valueRegs = value.jsValueRegs();
    GPRReg tempGPR = temp.gpr();
    
    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
    GPRReg cellGPR = valueRegs.payloadGPR();
    DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCell) | SpecString, m_jit.branchIfNotString(cellGPR));
    branchTest32(
        JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
        JITCompiler::TrustedImm32(-1), notTaken);
    jump(taken, ForceJump);
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(
        valueRegs, nodeUse, SpecCell | SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR));
    jump(notTaken);
    noResult(m_currentNode);
}

void SpeculativeJIT::compileConstantStoragePointer(Node* node)
{
    GPRTemporary storage(this);

        operand.jsValueRegs(), edge, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(gpr));
    MacroAssembler::Jump done = m_jit.jump();
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(
        operand.jsValueRegs(), edge, SpecCell | SpecOther,
        m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
            m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
    }
    done.link(&m_jit);
}


        JSValueSource::unboxedCell(cell), edge, SpecString | ~SpecCell, m_jit.branchIfNotString(cell));
}

void SpeculativeJIT::speculateStringOrOther(Edge edge, JSValueRegs regs, GPRReg scratch)
{
    JITCompiler::Jump notCell = m_jit.branchIfNotCell(regs);
    GPRReg cell = regs.payloadGPR();
    DFG_TYPE_CHECK(regs, edge, (~SpecCell) | SpecString, m_jit.branchIfNotString(cell));
    JITCompiler::Jump done = m_jit.jump();
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(regs, edge, SpecCell | SpecOther, m_jit.branchIfNotOther(regs, scratch));
    done.link(&m_jit);
}

void SpeculativeJIT::speculateStringOrOther(Edge edge)
{
    if (!needsTypeCheck(edge, SpecString | SpecOther))
        return;

    JSValueOperand operand(this, edge, ManualOperandSpeculation);
    GPRTemporary temp(this);
    JSValueRegs regs = operand.jsValueRegs();
    GPRReg tempGPR = temp.gpr();
    speculateStringOrOther(edge, regs, tempGPR);
}

void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)
{
    m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);

    case StringUse:
        speculateString(edge);
        break;
    case StringOrOtherUse:
        speculateStringOrOther(edge);
        break;
    case SymbolUse:
        speculateSymbol(edge);
        break;

Lines 2238-2243 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h +4 lines
2238	void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);	2238	void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
2239	void compileObjectOrOtherLogicalNot(Edge value);	2239	void compileObjectOrOtherLogicalNot(Edge value);
2240	void compileLogicalNot(Node*);	2240	void compileLogicalNot(Node*);
		2241	void compileLogicalNotStringOrOther(Node*);
2241	void compileStringEquality(	2242	void compileStringEquality(
2242	Node*, GPRReg leftGPR, GPRReg rightGPR, GPRReg lengthGPR,	2243	Node*, GPRReg leftGPR, GPRReg rightGPR, GPRReg lengthGPR,
2243	GPRReg leftTempGPR, GPRReg rightTempGPR, GPRReg leftTemp2GPR,	2244	GPRReg leftTempGPR, GPRReg rightTempGPR, GPRReg leftTemp2GPR,
Lines 2257-2262 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec2
2257		2258
2258	void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);	2259	void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
2259	void emitStringBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);	2260	void emitStringBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
		2261	void emitStringOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
2260	void emitBranch(Node*);	2262	void emitBranch(Node*);
2261		2263
2262	struct StringSwitchCase {	2264	struct StringSwitchCase {
Lines 2573-2578 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec3
2573	void speculateStringIdent(Edge edge, GPRReg string);	2575	void speculateStringIdent(Edge edge, GPRReg string);
2574	void speculateStringIdent(Edge);	2576	void speculateStringIdent(Edge);
2575	void speculateString(Edge);	2577	void speculateString(Edge);
		2578	void speculateStringOrOther(Edge, JSValueRegs, GPRReg scratch);
		2579	void speculateStringOrOther(Edge);
2576	void speculateNotStringVar(Edge);	2580	void speculateNotStringVar(Edge);
2577	template<typename StructureLocationType>	2581	template<typename StructureLocationType>
2578	void speculateStringObjectForStructure(Edge, StructureLocationType);	2582	void speculateStringObjectForStructure(Edge, StructureLocationType);

Lines 103-108 void printInternal(PrintStream& out, Use Source/JavaScriptCore/dfg/DFGUseKind.cpp_sec1
- Source/JavaScriptCore/dfg/DFGUseKind.cpp +3 lines
103	case StringUse:	103	case StringUse:
104	out.print("String");	104	out.print("String");
105	return;	105	return;
		106	case StringOrOtherUse:
		107	out.print("StringOrOther");
		108	return;
106	case KnownStringUse:	109	case KnownStringUse:
107	out.print("KnownString");	110	out.print("KnownString");
108	return;	111	return;

Lines 59-64 enum UseKind { Source/JavaScriptCore/dfg/DFGUseKind.h_sec1
- Source/JavaScriptCore/dfg/DFGUseKind.h +3 lines
59	ObjectOrOtherUse,	59	ObjectOrOtherUse,
60	StringIdentUse,	60	StringIdentUse,
61	StringUse,	61	StringUse,
		62	StringOrOtherUse,
62	KnownStringUse,	63	KnownStringUse,
63	KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects).	64	KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects).
64	SymbolUse,	65	SymbolUse,
Lines 127-132 inline SpeculatedType typeFilterFor(UseK Source/JavaScriptCore/dfg/DFGUseKind.h_sec2
127	case StringUse:	128	case StringUse:
128	case KnownStringUse:	129	case KnownStringUse:
129	return SpecString;	130	return SpecString;
		131	case StringOrOtherUse:
		132	return SpecString \| SpecOther;
130	case KnownPrimitiveUse:	133	case KnownPrimitiveUse:
131	return SpecHeapTop & ~SpecObject;	134	return SpecHeapTop & ~SpecObject;
132	case SymbolUse:	135	case SymbolUse:

Lines 463-468 CapabilityLevel canCompile(Graph& graph) Source/JavaScriptCore/ftl/FTLCapabilities.cpp_sec1
- Source/JavaScriptCore/ftl/FTLCapabilities.cpp +1 lines
463	case FunctionUse:	463	case FunctionUse:
464	case ObjectOrOtherUse:	464	case ObjectOrOtherUse:
465	case StringUse:	465	case StringUse:
		466	case StringOrOtherUse:
466	case KnownStringUse:	467	case KnownStringUse:
467	case KnownPrimitiveUse:	468	case KnownPrimitiveUse:
468	case StringObjectUse:	469	case StringObjectUse:



        // We use prologue frequency for all of the initialization code.
        m_out.setFrequency(1);
        
        m_prologue = m_out.newBlock();
        LBasicBlock stackOverflow = m_out.newBlock();
        m_handleExceptions = m_out.newBlock();
        
        LBasicBlock checkArguments = m_out.newBlock();

        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
            m_highBlock = m_graph.block(blockIndex);
            if (!m_highBlock)
                continue;
            m_out.setFrequency(m_highBlock->executionCount);
            m_blocks.add(m_highBlock, m_out.newBlock());
        }

        // Back to prologue frequency for any bocks that get sneakily created in the initialization code.

            
            LValue doubleValue = unboxDouble(value);
            
            LBasicBlock intCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock fastResult = m_out.anchor(doubleValue);
            m_out.branch(

            
            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);

            LBasicBlock intCase = m_out.newBlock();
            LBasicBlock doubleTesting = m_out.newBlock();
            LBasicBlock doubleCase = m_out.newBlock();
            LBasicBlock nonDoubleCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                isNotInt32(value, provenType(m_node->child1())),

            m_out.jump(continuation);

            if (shouldConvertNonNumber) {
                LBasicBlock undefinedCase = m_out.newBlock();
                LBasicBlock testNullCase = m_out.newBlock();
                LBasicBlock nullCase = m_out.newBlock();
                LBasicBlock testBooleanTrueCase = m_out.newBlock();
                LBasicBlock convertBooleanTrueCase = m_out.newBlock();
                LBasicBlock convertBooleanFalseCase = m_out.newBlock();

                m_out.appendTo(nonDoubleCase, undefinedCase);
                LValue valueIsUndefined = m_out.equal(value, m_out.constInt64(ValueUndefined));

                return;
            }
            
            LBasicBlock booleanCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock notBooleanResult = m_out.anchor(value);
            m_out.branch(

    {
        LValue value = lowJSValue(m_node->child1());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(
            isCell(value, provenType(m_node->child1())), usually(isCellCase), rarely(slowCase));

            }
            
            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock slowCase = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();
                
                m_out.branch(
                    m_out.notZero32(result), usually(continuation), rarely(slowCase));

            blessSpeculation(result, Overflow, noValue(), nullptr, m_origin);

            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock slowCase = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();
                
                m_out.branch(
                    m_out.notZero64(result), usually(continuation), rarely(slowCase));

            LValue denominator = lowInt32(m_node->child2());

            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock zeroNumerator = m_out.newBlock();
                LBasicBlock numeratorContinuation = m_out.newBlock();

                m_out.branch(
                    m_out.isZero32(numerator),

            }
            
            if (shouldCheckOverflow(m_node->arithMode())) {
                LBasicBlock unsafeDenominator = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();

                LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
                m_out.branch(


            LValue remainder;
            if (shouldCheckOverflow(m_node->arithMode())) {
                LBasicBlock unsafeDenominator = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();

                LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
                m_out.branch(

                remainder = m_out.chillMod(numerator, denominator);

            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock negativeNumerator = m_out.newBlock();
                LBasicBlock numeratorContinuation = m_out.newBlock();

                m_out.branch(
                    m_out.lessThan(numerator, m_out.int32Zero),

            LValue left = lowDouble(m_node->child1());
            LValue right = lowDouble(m_node->child2());
            
            LBasicBlock notLessThan = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            Vector<ValueFromBlock, 2> results;
            

            LValue base = lowDouble(m_node->child1());
            LValue exponent = lowDouble(m_node->child2());

            LBasicBlock integerExponentIsSmallBlock = m_out.newBlock();
            LBasicBlock integerExponentPowBlock = m_out.newBlock();
            LBasicBlock doubleExponentPowBlockEntry = m_out.newBlock();
            LBasicBlock nanExceptionExponentIsInfinity = m_out.newBlock();
            LBasicBlock nanExceptionBaseIsOne = m_out.newBlock();
            LBasicBlock powBlock = m_out.newBlock();
            LBasicBlock nanExceptionResultIsNaN = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            LValue integerExponent = m_out.doubleToInt(exponent);
            LValue integerExponentConvertedToDouble = m_out.intToDouble(integerExponent);

            LValue value = lowDouble(m_node->child1());
            result = m_out.doubleFloor(m_out.doubleAdd(value, m_out.constDouble(0.5)));
        } else {
            LBasicBlock realPartIsMoreThanHalf = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            LValue value = lowDouble(m_node->child1());
            LValue integerValue = m_out.doubleCeil(value);

        case CellOrOtherUse: {
            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);

            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(
                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));

        LValue cell = lowCell(m_node->child1());
        LValue property = !!m_node->child2() ? lowInt32(m_node->child2()) : 0;
        
        LBasicBlock unexpectedStructure = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
        

            // https://bugs.webkit.org/show_bug.cgi?id=127830
            LValue value = lowJSValue(m_node->child1());
            
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));

        LValue cell = lowCell(m_node->child1());
        
        if (m_node->arrayMode().type() == Array::String) {
            LBasicBlock slowPath = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            LValue fastResultValue = m_out.loadPtr(cell, m_heaps.JSString_value);
            ValueFromBlock fastResult = m_out.anchor(fastResultValue);

    {
        LValue basePtr = lowCell(m_node->child1());    

        LBasicBlock simpleCase = m_out.newBlock();
        LBasicBlock wastefulCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue mode = m_out.load32(basePtr, m_heaps.JSArrayBufferView_mode);
        m_out.branch(

            
            LValue base = lowCell(m_node->child1());
            
            LBasicBlock fastCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(

            
            LValue base = lowCell(m_node->child1());
            
            LBasicBlock inBounds = m_out.newBlock();
            LBasicBlock boxPath = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(

            LValue table = m_out.loadPtr(base, m_heaps.ScopedArguments_table);
            LValue namedLength = m_out.load32(table, m_heaps.ScopedArgumentsTable_length);
            
            LBasicBlock namedCase = m_out.newBlock();
            LBasicBlock overflowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(index, namedLength), unsure(overflowCase), unsure(namedCase));

        case Array::Int32:
        case Array::Double:
        case Array::Contiguous: {
            LBasicBlock continuation = m_out.newBlock();
            LBasicBlock outerLastNext = m_out.appendTo(m_out.m_block, continuation);
            
            switch (m_node->arrayMode().type()) {

                        if (isClamped(type)) {
                            ASSERT(elementSize(type) == 1);
                            
                            LBasicBlock atLeastZero = m_out.newBlock();
                            LBasicBlock continuation = m_out.newBlock();
                            
                            Vector<ValueFromBlock, 2> intValues;
                            intValues.append(m_out.anchor(m_out.int32Zero));

                        if (isClamped(type)) {
                            ASSERT(elementSize(type) == 1);
                            
                            LBasicBlock atLeastZero = m_out.newBlock();
                            LBasicBlock withinRange = m_out.newBlock();
                            LBasicBlock continuation = m_out.newBlock();
                            
                            Vector<ValueFromBlock, 3> intValues;
                            intValues.append(m_out.anchor(m_out.int32Zero));

                if (m_node->arrayMode().isInBounds() || m_node->op() == PutByValAlias)
                    m_out.store(valueToStore, pointer, storeType);
                else {
                    LBasicBlock isInBounds = m_out.newBlock();
                    LBasicBlock continuation = m_out.newBlock();
                    
                    m_out.branch(
                        m_out.aboveOrEqual(index, lowInt32(child5)),


            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
            
            LBasicBlock fastPath = m_out.newBlock();
            LBasicBlock slowPath = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(

        case Array::Contiguous: {
            IndexedAbstractHeap& heap = m_heaps.forArrayType(m_node->arrayMode().type());
            
            LBasicBlock fastCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
            

            return;
        }
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

            isGeneratorFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->generatorFunctionStructure() :
            m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        
        unsigned minCapacity = m_graph.baselineCodeBlockFor(m_node->origin.semantic)->numParameters() - 1;
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        } else {
            LValue stackBase = getArgumentsStart();
            
            LBasicBlock loop = m_out.newBlock();
            LBasicBlock end = m_out.newBlock();

            ValueFromBlock originalLength;
            if (minCapacity) {


    void compileCopyRest()
    {            
        LBasicBlock doCopyRest = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue arrayLength = lowInt32(m_node->child2());



    void compileGetRestLength()
    {
        LBasicBlock nonZeroLength = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        ValueFromBlock zeroLengthResult = m_out.anchor(m_out.constInt32(0));


                || hasDouble(structure->indexingType())
                || hasContiguous(structure->indexingType()));

            LBasicBlock fastCase = m_out.newBlock();
            LBasicBlock largeCase = m_out.newBlock();
            LBasicBlock failCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(publicLength, m_out.constInt32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)),

            m_out.store32(vectorLength, butterfly, m_heaps.Butterfly_vectorLength);
            
            if (hasDouble(m_node->indexingType())) {
                LBasicBlock initLoop = m_out.newBlock();
                LBasicBlock initDone = m_out.newBlock();
                
                ValueFromBlock originalIndex = m_out.anchor(vectorLength);
                ValueFromBlock originalPointer = m_out.anchor(butterfly);


            LValue size = lowInt32(m_node->child1());

            LBasicBlock smallEnoughCase = m_out.newBlock();
            LBasicBlock nonZeroCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(
                m_out.above(size, m_out.constInt32(JSArrayBufferView::fastSizeLimit)),

            LValue cell = lowCell(m_node->child1());
            LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
            
            LBasicBlock notString = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock simpleResult = m_out.anchor(cell);
            m_out.branch(

            else
                value = lowJSValue(m_node->child1());
            
            LBasicBlock isCell = m_out.newBlock();
            LBasicBlock notString = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            LValue isCellPredicate;
            if (m_node->child1().useKind() == CellUse)

    {
        LValue value = lowJSValue(m_node->child1());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock isObjectCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock, 3> results;
        

            numKids = 2;
        }
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        LValue index = lowInt32(m_node->child2());
        LValue storage = lowStorage(m_node->child3());
            
        LBasicBlock fastPath = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
            
        m_out.branch(
            m_out.aboveOrEqual(

            
        LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
            
        LBasicBlock is8Bit = m_out.newBlock();
        LBasicBlock is16Bit = m_out.newBlock();
        LBasicBlock bitsContinuation = m_out.newBlock();
        LBasicBlock bigCharacter = m_out.newBlock();
            
        m_out.branch(
            m_out.testIsZero32(

                m_graph.watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
                m_graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
                
                LBasicBlock negativeIndex = m_out.newBlock();
                    
                results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
                m_out.branch(

    
    void compileStringCharCodeAt()
    {
        LBasicBlock is8Bit = m_out.newBlock();
        LBasicBlock is16Bit = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue base = lowCell(m_node->child1());
        LValue index = lowInt32(m_node->child2());


        LValue value = lowInt32(childEdge);
        
        LBasicBlock smallIntCase = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(
            m_out.aboveOrEqual(value, m_out.constInt32(0xff)),

        
        Vector<LBasicBlock, 2> blocks(data.cases.size());
        for (unsigned i = data.cases.size(); i--;)
            blocks[i] = m_out.newBlock();
        LBasicBlock exit = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<SwitchCase, 2> cases;
        StructureSet baseSet;

        
        Vector<LBasicBlock, 2> blocks(data.variants.size());
        for (unsigned i = data.variants.size(); i--;)
            blocks[i] = m_out.newBlock();
        LBasicBlock exit = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<SwitchCase, 2> cases;
        StructureSet baseSet;

    {
        WatchpointSet* set = m_node->watchpointSet();
        
        LBasicBlock isNotInvalidated = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue state = m_out.load8ZeroExt32(m_out.absolute(set->addressOfState()));
        m_out.branch(

            LValue left = lowCell(m_node->child1());
            LValue right = lowCell(m_node->child2());

            LBasicBlock notTriviallyEqualCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            speculateString(m_node->child1(), left);


            LValue left = lowStringIdent(leftEdge);
            LValue rightValue = lowJSValue(rightEdge, ManualOperandSpeculation);
            
            LBasicBlock isCellCase = m_out.newBlock();
            LBasicBlock isStringCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
            m_out.branch(

        LValue sourceStart = getArgumentsStart(inlineCallFrame);
        LValue targetStart = addressFor(data->machineStart).value();

        LBasicBlock undefinedLoop = m_out.newBlock();
        LBasicBlock mainLoopEntry = m_out.newBlock();
        LBasicBlock mainLoop = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue lengthAsPtr = m_out.zeroExtPtr(length);
        LValue loopBoundValue = m_out.constIntPtr(data->mandatoryMinimum);

        switch (data->kind) {
        case SwitchImm: {
            Vector<ValueFromBlock, 2> intValues;
            LBasicBlock switchOnInts = m_out.newBlock();
            
            LBasicBlock lastNext = m_out.appendTo(m_out.m_block, switchOnInts);
            

            }
                
            case UntypedUse: {
                LBasicBlock isInt = m_out.newBlock();
                LBasicBlock isNotInt = m_out.newBlock();
                LBasicBlock isDouble = m_out.newBlock();
                
                LValue boxedValue = lowJSValue(m_node->child1());
                m_out.branch(isNotInt32(boxedValue), unsure(isNotInt), unsure(isInt));

            case UntypedUse: {
                LValue unboxedValue = lowJSValue(m_node->child1());
                
                LBasicBlock isCellCase = m_out.newBlock();
                LBasicBlock isStringCase = m_out.newBlock();
                
                m_out.branch(
                    isNotCell(unboxedValue, provenType(m_node->child1())),

                break;
            }
            
            LBasicBlock lengthIs1 = m_out.newBlock();
            LBasicBlock needResolution = m_out.newBlock();
            LBasicBlock resolved = m_out.newBlock();
            LBasicBlock is8Bit = m_out.newBlock();
            LBasicBlock is16Bit = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.notEqual(

            case UntypedUse: {
                LValue value = lowJSValue(m_node->child1());
                
                LBasicBlock isCellBlock = m_out.newBlock();
                LBasicBlock isStringBlock = m_out.newBlock();
                
                m_out.branch(
                    isCell(value, provenType(m_node->child1())),

                
            case UntypedUse: {
                LValue value = lowJSValue(m_node->child1());
                LBasicBlock cellCase = m_out.newBlock();
                m_out.branch(
                    isCell(value, provenType(m_node->child1())),
                    unsure(cellCase), unsure(lowBlock(data->fallThrough.block)));

    {
        LValue value = lowJSValue(m_node->child1());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
        m_out.branch(

    {
        LValue value = lowJSValue(m_node->child1());

        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
        m_out.branch(

        Edge child = m_node->child1();
        LValue value = lowJSValue(child);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock notFunctionCase = m_out.newBlock();
        LBasicBlock objectCase = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock notCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
        

        Edge child = m_node->child1();
        LValue value = lowJSValue(child);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock notFunctionCase = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
        m_out.branch(

        Edge child = m_node->child1();
        LValue value = lowJSValue(child);
        
        LBasicBlock continuation = m_out.newBlock();
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
        
        Vector<ValueFromBlock> results;

        LValue constructor = lowCell(m_node->child1());
        LValue hasInstance = lowJSValue(m_node->child2());

        LBasicBlock defaultHasInstance = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        // Unlike in the DFG, we don't worry about cleaning this code up for the case where we have proven the hasInstanceValue is a constant as B3 should fix it for us.


        
        LValue prototype = lowCell(m_node->child2());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock loop = m_out.newBlock();
        LBasicBlock notYetInstance = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue condition;
        if (m_node->child1().useKind() == UntypedUse)

            IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
                m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties;

            LBasicBlock checkHole = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            if (!m_node->arrayMode().isInBounds()) {
                m_out.branch(

            
            IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
            
            LBasicBlock checkHole = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            if (!m_node->arrayMode().isInBounds()) {
                m_out.branch(

        LValue property = lowString(m_node->child2());
        LValue enumerator = lowCell(m_node->child3());

        LBasicBlock correctStructure = m_out.newBlock();
        LBasicBlock wrongStructure = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.notEqual(
            m_out.load32(base, m_heaps.JSCell_structureID),

        LValue index = lowInt32(m_graph.varArgChild(m_node, 2));
        LValue enumerator = lowCell(m_graph.varArgChild(m_node, 3));

        LBasicBlock checkOffset = m_out.newBlock();
        LBasicBlock inlineLoad = m_out.newBlock();
        LBasicBlock outOfLineLoad = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.notEqual(
            m_out.load32(base, m_heaps.JSCell_structureID),

        LValue enumerator = lowCell(m_node->child1());
        LValue index = lowInt32(m_node->child2());

        LBasicBlock inBounds = m_out.newBlock();
        LBasicBlock outOfBounds = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endStructurePropertyIndex)),
            usually(inBounds), rarely(outOfBounds));

        LValue enumerator = lowCell(m_node->child1());
        LValue index = lowInt32(m_node->child2());

        LBasicBlock inBounds = m_out.newBlock();
        LBasicBlock outOfBounds = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endGenericPropertyIndex)),
            usually(inBounds), rarely(outOfBounds));

        
        Vector<LBasicBlock, 1> blocks(set.size());
        for (unsigned i = set.size(); i--;)
            blocks[i] = m_out.newBlock();
        LBasicBlock dummyDefault = m_out.newBlock();
        LBasicBlock outerContinuation = m_out.newBlock();
        
        Vector<SwitchCase, 1> cases(set.size());
        for (unsigned i = set.size(); i--;)

                size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
                MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
                
                LBasicBlock slowPath = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();
                
                LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
                

        ASSERT(table == m_graph.varArgChild(m_node, 0)->castConstant<SymbolTable*>());
        Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure();

        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);



    void compileCheckWatchdogTimer()
    {
        LBasicBlock timerDidFire = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue state = m_out.load8ZeroExt32(m_out.absolute(vm().watchdog()->timerDidFireAddress()));
        m_out.branch(m_out.isZero32(state),

            return;
        }
        
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
        for (unsigned i = 0; i < set.size() - 1; ++i) {
            LBasicBlock nextStructure = m_out.newBlock();
            m_out.branch(
                m_out.equal(structureDiscriminant, weakStructureDiscriminant(set[i])),
                unsure(continuation), unsure(nextStructure));

    
    LValue numberOrNotCellToInt32(Edge edge, LValue value)
    {
        LBasicBlock intCase = m_out.newBlock();
        LBasicBlock notIntCase = m_out.newBlock();
        LBasicBlock doubleCase = 0;
        LBasicBlock notNumberCase = 0;
        if (edge.useKind() == NotCellUse) {
            doubleCase = m_out.newBlock();
            notNumberCase = m_out.newBlock();
        }
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock> results;
        

            return;

        case InferredType::ObjectWithStructureOrOther: {
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));


            return;

        case InferredType::ObjectOrOther: {
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));


    
    LValue allocatePropertyStorageWithSizeImpl(size_t sizeInValues)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        return copyBarrier(
            fastResultValue,
            [&] () -> LValue {
                LBasicBlock slowPath = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();

                ValueFromBlock fastResult = m_out.anchor(fastResultValue);
                m_out.branch(isFastTypedArray(object), rarely(slowPath), usually(continuation));

    template<typename Functor>
    LValue copyBarrier(LValue pointer, const Functor& functor)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        ValueFromBlock fastResult = m_out.anchor(pointer);
        m_out.branch(isInToSpace(pointer), usually(continuation), rarely(slowPath));

    {
        LValue fastResultValue = m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector);

        LBasicBlock possiblyFromSpace = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        ValueFromBlock fastResult = m_out.anchor(fastResultValue);


        
        speculateTruthyObject(rightChild, rightCell, SpecObject);
        
        LBasicBlock leftCellCase = m_out.newBlock();
        LBasicBlock leftNotCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(
            isCell(leftValue, provenType(leftChild)),

        LValue left = lowJSValue(m_node->child1());
        LValue right = lowJSValue(m_node->child2());
        
        LBasicBlock leftIsInt = m_out.newBlock();
        LBasicBlock fastPath = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isNotInt32(left), rarely(slowPath), usually(leftIsInt));
        


    LValue stringsEqual(LValue leftJSString, LValue rightJSString)
    {
        LBasicBlock notTriviallyUnequalCase = m_out.newBlock();
        LBasicBlock notEmptyCase = m_out.newBlock();
        LBasicBlock leftReadyCase = m_out.newBlock();
        LBasicBlock rightReadyCase = m_out.newBlock();
        LBasicBlock left8BitCase = m_out.newBlock();
        LBasicBlock right8BitCase = m_out.newBlock();
        LBasicBlock loop = m_out.newBlock();
        LBasicBlock bytesEqual = m_out.newBlock();
        LBasicBlock trueCase = m_out.newBlock();
        LBasicBlock falseCase = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue length = m_out.load32(leftJSString, m_heaps.JSString_length);



    LValue allocateCell(LValue allocator, LBasicBlock slowPath)
    {
        LBasicBlock success = m_out.newBlock();
    
        LValue result;
        LValue condition;


        LValue subspace = m_out.constIntPtr(&vm().heap.subspaceForObjectOfType<ClassType>());
        
        LBasicBlock smallCaseBlock = m_out.newBlock();
        LBasicBlock largeOrOversizeCaseBlock = m_out.newBlock();
        LBasicBlock largeCaseBlock = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue uproundedSize = m_out.add(size, m_out.constInt32(MarkedSpace::preciseStep - 1));
        LValue isSmall = m_out.below(uproundedSize, m_out.constInt32(MarkedSpace::preciseCutoff));

    {
        CopiedAllocator& allocator = vm().heap.storageAllocator();
        
        LBasicBlock success = m_out.newBlock();
        
        LValue remaining = m_out.loadPtr(m_out.absolute(&allocator.m_currentRemaining));
        LValue newRemaining = m_out.sub(remaining, size);

        size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
        MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

    
    ArrayValues allocateJSArray(Structure* structure, unsigned numElements)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

            LValue length = m_out.load32NonNegative(stringValue, m_heaps.JSString_length);
            return m_out.notEqual(length, m_out.int32Zero);
        }
        case StringOrOtherUse: {
            LValue value = lowJSValue(edge, ManualOperandSpeculation);

            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
            
            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
            
            FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCell) | SpecString, isNotString(value));
            LValue length = m_out.load32NonNegative(value, m_heaps.JSString_length);
            ValueFromBlock cellResult = m_out.anchor(m_out.notEqual(length, m_out.int32Zero));
            m_out.jump(continuation);
            
            m_out.appendTo(notCellCase, continuation);
            
            FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
            m_out.jump(continuation);
            m_out.appendTo(continuation, lastNext);

            return m_out.phi(Int32, cellResult, notCellResult);
        }
        case UntypedUse: {
            LValue value = lowJSValue(edge);
            

            //     result = value == jsTrue
            // }
            
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock stringCase = m_out.newBlock();
            LBasicBlock notStringCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock int32Case = m_out.newBlock();
            LBasicBlock notInt32Case = m_out.newBlock();
            LBasicBlock doubleCase = m_out.newBlock();
            LBasicBlock notDoubleCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            Vector<ValueFromBlock> results;
            

            if (masqueradesAsUndefinedWatchpointIsStillValid())
                isTruthyObject = m_out.booleanTrue;
            else {
                LBasicBlock masqueradesCase = m_out.newBlock();
                
                results.append(m_out.anchor(m_out.booleanTrue));
                

        
        LValue value = lowJSValue(edge, operandMode);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock primitiveCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
        

            m_out.jump(continuation);
        } else {
            LBasicBlock masqueradesCase =
                m_out.newBlock();
                
            results.append(m_out.anchor(m_out.booleanFalse));
            

            index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength));
        if (!m_node->arrayMode().isInBounds()) {
            LBasicBlock notInBoundsCase =
                m_out.newBlock();
            LBasicBlock performStore =
                m_out.newBlock();
                
            m_out.branch(isNotInBounds, unsure(notInBoundsCase), unsure(performStore));
                

                speculate(OutOfBounds, noValue(), 0, isOutOfBounds);
            else {
                LBasicBlock outOfBoundsCase =
                    m_out.newBlock();
                LBasicBlock holeCase =
                    m_out.newBlock();
                    
                m_out.branch(isOutOfBounds, rarely(outOfBoundsCase), usually(holeCase));
                    

        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
        LValue length = m_out.load32(string, m_heaps.JSString_length);
        
        LBasicBlock hasImplBlock = m_out.newBlock();
        LBasicBlock is8BitBlock = m_out.newBlock();
        LBasicBlock slowBlock = m_out.newBlock();
        
        m_out.branch(m_out.isNull(stringImpl), unsure(slowBlock), unsure(hasImplBlock));
        

        characterCases.append(currentCase);
        
        Vector<LBasicBlock> characterBlocks;
        for (unsigned i = characterCases.size(); i--;)
            characterBlocks.append(m_out.newBlock());
        
        Vector<SwitchCase> switchCases;
        for (unsigned i = 0; i < characterCases.size(); ++i) {

    // contination and set it as the nextBlock (m_out.insertNewBlocksBefore(continuation)) before
    // calling this. For example:
    //
    // LBasicBlock continuation = m_out.newBlock();
    // LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
    // buildTypeOf(
    //     child, value,

        //     return undefined
        // }
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock objectCase = m_out.newBlock();
        LBasicBlock functionCase = m_out.newBlock();
        LBasicBlock notFunctionCase = m_out.newBlock();
        LBasicBlock reallyObjectCase = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock unreachable = m_out.newBlock();
        LBasicBlock notObjectCase = m_out.newBlock();
        LBasicBlock stringCase = m_out.newBlock();
        LBasicBlock symbolCase = m_out.newBlock();
        LBasicBlock notCellCase = m_out.newBlock();
        LBasicBlock numberCase = m_out.newBlock();
        LBasicBlock notNumberCase = m_out.newBlock();
        LBasicBlock notNullCase = m_out.newBlock();
        LBasicBlock booleanCase = m_out.newBlock();
        LBasicBlock undefinedCase = m_out.newBlock();
        
        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
        

    
    LValue doubleToInt32(LValue doubleValue, double low, double high, bool isSigned = true)
    {
        LBasicBlock greatEnough = m_out.newBlock();
        LBasicBlock withinRange = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock, 2> results;
        

    
    LValue sensibleDoubleToInt32(LValue doubleValue)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue fastResultValue = m_out.doubleToInt(doubleValue);
        ValueFromBlock fastResult = m_out.anchor(fastResultValue);

    
    LValue strictInt52ToJSValue(LValue value)
    {
        LBasicBlock isInt32 = m_out.newBlock();
        LBasicBlock isDouble = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock, 2> results;
            

    
    LValue jsValueToStrictInt52(Edge edge, LValue boxedValue)
    {
        LBasicBlock intCase = m_out.newBlock();
        LBasicBlock doubleCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
            
        LValue isNotInt32;
        if (!m_interpreter.needsTypeCheck(edge, SpecInt32))

        speculate(Overflow, FormattedValue(DataFormatDouble, value), m_node, valueNotConvertibleToInteger);

        if (shouldCheckNegativeZero) {
            LBasicBlock valueIsZero = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            m_out.branch(m_out.isZero32(integerValue), unsure(valueIsZero), unsure(continuation));

            LBasicBlock lastNext = m_out.appendTo(valueIsZero, continuation);

        case StringUse:
            speculateString(edge);
            break;
        case StringOrOtherUse:
            speculateStringOrOther(edge);
            break;
        case StringIdentUse:
            speculateStringIdent(edge);
            break;

    {
        LValue value = lowJSValue(edge, ManualOperandSpeculation);

        LBasicBlock isNotCell = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(isCell(value, provenType(edge)), unsure(continuation), unsure(isNotCell));


        
        LValue value = lowJSValue(edge, ManualOperandSpeculation);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock primitiveCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
        

        speculateString(edge, lowCell(edge));
    }
    
    void speculateStringOrOther(Edge edge, LValue value)
    {
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock notCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));

        LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);

        FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCell) | SpecString, isNotString(value));

        m_out.jump(continuation);
        m_out.appendTo(notCellCase, continuation);

        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));

        m_out.jump(continuation);
        m_out.appendTo(continuation, lastNext);
    }
    
    void speculateStringOrOther(Edge edge)
    {
        speculateStringOrOther(edge, lowJSValue(edge, ManualOperandSpeculation));
    }
    
    void speculateStringIdent(Edge edge, LValue string, LValue stringImpl)
    {
        if (!m_interpreter.needsTypeCheck(edge, SpecStringIdent | ~SpecString))

        if (!m_interpreter.needsTypeCheck(edge, SpecString | SpecStringObject))
            return;
        
        LBasicBlock notString = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue structureID = m_out.load32(lowCell(edge), m_heaps.JSCell_structureID);
        m_out.branch(

        LValue value = lowJSValue(edge, ManualOperandSpeculation);
        LValue doubleValue = unboxDouble(value);
        
        LBasicBlock intCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(
            m_out.doubleEqual(doubleValue, doubleValue),

        
        LValue value = lowJSValue(edge, ManualOperandSpeculation);
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock isStringCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isCell(value, provenType(edge)), unsure(isCellCase), unsure(continuation));
        


    void emitStoreBarrier(LValue base)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(
            m_out.notZero32(loadCellState(base)), usually(continuation), rarely(slowPath));

            return;
        }

        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(
            hadException, rarely(m_handleExceptions), usually(continuation));



    m_heaps = &heaps;
}

LBasicBlock Output::newBlock()
{
    LBasicBlock result = m_proc.addBlock(m_frequency);



void Output::check(LValue condition, WeightedTarget taken, Weight notTakenWeight)
{
    LBasicBlock continuation = newBlock();
    branch(condition, taken, WeightedTarget(continuation, notTakenWeight));
    appendTo(continuation);
}



        m_frequency = value;
    }

    LBasicBlock newBlock();

    LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)
    {

#pragma GCC diagnostic pop
#endif // COMPILER(GCC_OR_CLANG)

#define FTL_NEW_BLOCK(output, nameArguments) \
    (LIKELY(!verboseCompilationEnabled()) \
    ? (output).newBlock() \
    : (output).newBlock((toCString nameArguments).data()))

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

Return to Bug 155094

Lines 5117-5122 void SpeculativeJIT::compileStringZeroLe Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp -5 / +74 lines
5117	unblessedBooleanResult(eqGPR, node);	5117	unblessedBooleanResult(eqGPR, node);
5118	}	5118	}
5119		5119
		5120	void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node)
		5121	{
		5122	JSValueOperand value(this, node->child1());
		5123	GPRTemporary temp(this);
		5124	JSValueRegs valueRegs = value.jsValueRegs();
		5125	GPRReg tempGPR = temp.gpr();
		5126
		5127	JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
		5128	GPRReg cellGPR = valueRegs.payloadGPR();
		5129	DFG_TYPE_CHECK(
		5130	valueRegs, node->child1(), (~SpecCell) \| SpecString, m_jit.branchIfNotString(cellGPR));
		5131	m_jit.test32(
		5132	JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
		5133	JITCompiler::TrustedImm32(-1), tempGPR);
		5134	JITCompiler::Jump done = m_jit.jump();
		5135	notCell.link(&m_jit);
		5136	DFG_TYPE_CHECK(
		5137	valueRegs, node->child1(), SpecCell \| SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR));
		5138	m_jit.move(TrustedImm32(1), tempGPR);
		5139	done.link(&m_jit);
		5140
		5141	unblessedBooleanResult(tempGPR, node);
		5142	}
		5143
5120	void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)	5144	void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
5121	{	5145	{
5122	SpeculateCellOperand str(this, nodeUse);	5146	SpeculateCellOperand str(this, nodeUse);
Lines 5126-5131 void SpeculativeJIT::emitStringBranch(Ed Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec2
5126	noResult(m_currentNode);	5150	noResult(m_currentNode);
5127	}	5151	}
5128		5152
		5153	void SpeculativeJIT::emitStringOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
		5154	{
		5155	JSValueOperand value(this, nodeUse);
		5156	GPRTemporary temp(this);
		5157	JSValueRegs valueRegs = value.jsValueRegs();
		5158	GPRReg tempGPR = temp.gpr();
		5159
		5160	JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
		5161	GPRReg cellGPR = valueRegs.payloadGPR();
		5162	DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCell) \| SpecString, m_jit.branchIfNotString(cellGPR));
		5163	branchTest32(
		5164	JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
		5165	JITCompiler::TrustedImm32(-1), notTaken);
		5166	jump(taken, ForceJump);
		5167	notCell.link(&m_jit);
		5168	DFG_TYPE_CHECK(
		5169	valueRegs, nodeUse, SpecCell \| SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR));
		5170	jump(notTaken);
		5171	noResult(m_currentNode);
		5172	}
		5173
5129	void SpeculativeJIT::compileConstantStoragePointer(Node* node)	5174	void SpeculativeJIT::compileConstantStoragePointer(Node* node)
5130	{	5175	{
5131	GPRTemporary storage(this);	5176	GPRTemporary storage(this);
Lines 6661-6671 void SpeculativeJIT::speculateObjectOrOt Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec3
6661	operand.jsValueRegs(), edge, (~SpecCell) \| SpecObject, m_jit.branchIfNotObject(gpr));	6706	operand.jsValueRegs(), edge, (~SpecCell) \| SpecObject, m_jit.branchIfNotObject(gpr));
6662	MacroAssembler::Jump done = m_jit.jump();	6707	MacroAssembler::Jump done = m_jit.jump();
6663	notCell.link(&m_jit);	6708	notCell.link(&m_jit);
6664	if (needsTypeCheck(edge, SpecCell \| SpecOther)) {	6709	DFG_TYPE_CHECK(
6665	typeCheck(	6710	operand.jsValueRegs(), edge, SpecCell \| SpecOther,
6666	operand.jsValueRegs(), edge, SpecCell \| SpecOther,	6711	m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
6667	m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
6668	}
6669	done.link(&m_jit);	6712	done.link(&m_jit);
6670	}	6713	}
6671		6714
Lines 6675-6680 void SpeculativeJIT::speculateString(Edg Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec4
6675	JSValueSource::unboxedCell(cell), edge, SpecString \| ~SpecCell, m_jit.branchIfNotString(cell));	6718	JSValueSource::unboxedCell(cell), edge, SpecString \| ~SpecCell, m_jit.branchIfNotString(cell));
6676	}	6719	}
6677		6720
		6721	void SpeculativeJIT::speculateStringOrOther(Edge edge, JSValueRegs regs, GPRReg scratch)
		6722	{
		6723	JITCompiler::Jump notCell = m_jit.branchIfNotCell(regs);
		6724	GPRReg cell = regs.payloadGPR();
		6725	DFG_TYPE_CHECK(regs, edge, (~SpecCell) \| SpecString, m_jit.branchIfNotString(cell));
		6726	JITCompiler::Jump done = m_jit.jump();
		6727	notCell.link(&m_jit);
		6728	DFG_TYPE_CHECK(regs, edge, SpecCell \| SpecOther, m_jit.branchIfNotOther(regs, scratch));
		6729	done.link(&m_jit);
		6730	}
		6731
		6732	void SpeculativeJIT::speculateStringOrOther(Edge edge)
		6733	{
		6734	if (!needsTypeCheck(edge, SpecString \| SpecOther))
		6735	return;
		6736
		6737	JSValueOperand operand(this, edge, ManualOperandSpeculation);
		6738	GPRTemporary temp(this);
		6739	JSValueRegs regs = operand.jsValueRegs();
		6740	GPRReg tempGPR = temp.gpr();
		6741	speculateStringOrOther(edge, regs, tempGPR);
		6742	}
		6743
6678	void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)	6744	void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)
6679	{	6745	{
6680	m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);	6746	m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);
Lines 6922-6927 void SpeculativeJIT::speculate(Node*, Ed Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec5
6922	case StringUse:	6988	case StringUse:
6923	speculateString(edge);	6989	speculateString(edge);
6924	break;	6990	break;
		6991	case StringOrOtherUse:
		6992	speculateStringOrOther(edge);
		6993	break;
6925	case SymbolUse:	6994	case SymbolUse:
6926	speculateSymbol(edge);	6995	speculateSymbol(edge);
6927	break;	6996	break;

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +155 lines
		1	2016-03-06 Filip Pizlo <fpizlo@apple.com>
		2
		3	DFG should know how to speculate StringOrOther
		4	https://bugs.webkit.org/show_bug.cgi?id=155094
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Any code that processes the regexp matches array was previously doing a relatively expensive
		9	Branch(Untyped:). This introduces a new use kind called StringOrOther, which is perfect for
		10	code that loops over the matches array and branches on the entries being non-empty.
		11
		12	To do this, I needed to introduce code into the FTL that creates new blocks. We still had that
		13	awful FTL_NEW_BLOCK idiom since the only way to debug LLVM IR was to ascribe names to basic
		14	blocks. B3 IR is inherently more debuggable since unlike LLVM, B3 knows how to always respect
		15	code origin, and it knows how to print the code origin nicely in the dumps. So, rather than
		16	continue using FTL_NEW_BLOCK(m_out, ("things")), I replaced all of that stuff with
		17	m_out.newBlock(). It's much nicer that way.
		18
		19	This is a tiny speed-up on Octane/regexp at best. I was hoping for more. Oh well.
		20
		21	* bytecode/SpeculatedType.h:
		22	(JSC::isStringSpeculation):
		23	(JSC::isStringOrOtherSpeculation):
		24	(JSC::isSymbolSpeculation):
		25	* dfg/DFGFixupPhase.cpp:
		26	(JSC::DFG::FixupPhase::fixupNode):
		27	* dfg/DFGNode.h:
		28	(JSC::DFG::Node::shouldSpeculateString):
		29	(JSC::DFG::Node::shouldSpeculateStringOrOther):
		30	(JSC::DFG::Node::shouldSpeculateStringObject):
		31	* dfg/DFGSafeToExecute.h:
		32	(JSC::DFG::SafeToExecuteEdge::operator()):
		33	* dfg/DFGSpeculativeJIT.cpp:
		34	(JSC::DFG::SpeculativeJIT::compileStringZeroLength):
		35	(JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther):
		36	(JSC::DFG::SpeculativeJIT::emitStringBranch):
		37	(JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):
		38	(JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
		39	(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
		40	(JSC::DFG::SpeculativeJIT::speculateString):
		41	(JSC::DFG::SpeculativeJIT::speculateStringOrOther):
		42	(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
		43	(JSC::DFG::SpeculativeJIT::speculate):
		44	* dfg/DFGSpeculativeJIT.h:
		45	* dfg/DFGSpeculativeJIT32_64.cpp:
		46	(JSC::DFG::SpeculativeJIT::compileLogicalNot):
		47	(JSC::DFG::SpeculativeJIT::emitBranch):
		48	* dfg/DFGSpeculativeJIT64.cpp:
		49	(JSC::DFG::SpeculativeJIT::compileLogicalNot):
		50	(JSC::DFG::SpeculativeJIT::emitBranch):
		51	* dfg/DFGUseKind.cpp:
		52	(WTF::printInternal):
		53	* dfg/DFGUseKind.h:
		54	(JSC::DFG::typeFilterFor):
		55	* ftl/FTLCapabilities.cpp:
		56	(JSC::FTL::canCompile):
		57	* ftl/FTLLowerDFGToB3.cpp:
		58	(JSC::FTL::DFG::LowerDFGToB3::lower):
		59	(JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
		60	(JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
		61	(JSC::FTL::DFG::LowerDFGToB3::compileToThis):
		62	(JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
		63	(JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
		64	(JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
65	(JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
66	(JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
67	(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
68	(JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
69	(JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
70	(JSC::FTL::DFG::LowerDFGToB3::compileGetById):
71	(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
72	(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
73	(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
74	(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
75	(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
76	(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
77	(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
78	(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
79	(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
80	(JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
81	(JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
82	(JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
83	(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
84	(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
85	(JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
86	(JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
87	(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
88	(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
89	(JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
90	(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
91	(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
92	(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
93	(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
94	(JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
95	(JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
96	(JSC::FTL::DFG::LowerDFGToB3::compileIsString):
97	(JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
98	(JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
99	(JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
100	(JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
101	(JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
102	(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
103	(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
104	(JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
105	(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
106	(JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
107	(JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
108	(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
109	(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
110	(JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
111	(JSC::FTL::DFG::LowerDFGToB3::checkStructure):
112	(JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
113	(JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
114	(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
115	(JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier):
116	(JSC::FTL::DFG::LowerDFGToB3::copyBarrier):
117	(JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly):
118	(JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
119	(JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
120	(JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
121	(JSC::FTL::DFG::LowerDFGToB3::allocateCell):
122	(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
123	(JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd):
124	(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
125	(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
126	(JSC::FTL::DFG::LowerDFGToB3::boolify):
127	(JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
128	(JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
129	(JSC::FTL::DFG::LowerDFGToB3::switchString):
130	(JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
131	(JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
132	(JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
133	(JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
134	(JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
135	(JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
136	(JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
137	(JSC::FTL::DFG::LowerDFGToB3::speculate):
138	(JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
139	(JSC::FTL::DFG::LowerDFGToB3::speculateObjectOrOther):
140	(JSC::FTL::DFG::LowerDFGToB3::speculateString):
141	(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
142	(JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent):
143	(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
144	(JSC::FTL::DFG::LowerDFGToB3::speculateRealNumber):
145	(JSC::FTL::DFG::LowerDFGToB3::speculateNotStringVar):
146	(JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
147	(JSC::FTL::DFG::LowerDFGToB3::callCheck):
148	* ftl/FTLOutput.cpp:
149	(JSC::FTL::Output::initialize):
150	(JSC::FTL::Output::newBlock):
151	(JSC::FTL::Output::check):
152	* ftl/FTLOutput.h:
153	(JSC::FTL::Output::setFrequency):
154	(JSC::FTL::Output::insertNewBlocksBefore):
155
1	2016-03-06 Filip Pizlo <fpizlo@apple.com>	156	2016-03-06 Filip Pizlo <fpizlo@apple.com>
2		157
3	RegExpMatchesArray doesn't know how to have a bad time	158	RegExpMatchesArray doesn't know how to have a bad time

Lines 49-55 void Output::initialize(AbstractHeapRepo Source/JavaScriptCore/ftl/FTLOutput.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOutput.cpp -2 / +2 lines
49	m_heaps = &heaps;	49	m_heaps = &heaps;
50	}	50	}
51		51
52	LBasicBlock Output::newBlock(const char*)	52	LBasicBlock Output::newBlock()
53	{	53	{
54	LBasicBlock result = m_proc.addBlock(m_frequency);	54	LBasicBlock result = m_proc.addBlock(m_frequency);
55		55
Lines 232-238 void Output::branch(LValue condition, LB Source/JavaScriptCore/ftl/FTLOutput.cpp_sec2
232		232
233	void Output::check(LValue condition, WeightedTarget taken, Weight notTakenWeight)	233	void Output::check(LValue condition, WeightedTarget taken, Weight notTakenWeight)
234	{	234	{
235	LBasicBlock continuation = FTL_NEW_BLOCK(*this, ("Output::check continuation"));	235	LBasicBlock continuation = newBlock();
236	branch(condition, taken, WeightedTarget(continuation, notTakenWeight));	236	branch(condition, taken, WeightedTarget(continuation, notTakenWeight));
237	appendTo(continuation);	237	appendTo(continuation);
238	}	238	}

Lines 82-88 public: Source/JavaScriptCore/ftl/FTLOutput.h_sec1
- Source/JavaScriptCore/ftl/FTLOutput.h -6 / +1 lines
82	m_frequency = value;	82	m_frequency = value;
83	}	83	}
84		84
85	LBasicBlock newBlock(const char* name = "");	85	LBasicBlock newBlock();
86		86
87	LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)	87	LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)
88	{	88	{
Lines 524-534 inline LValue Output::fround(LValue doub Source/JavaScriptCore/ftl/FTLOutput.h_sec2
524	#pragma GCC diagnostic pop	524	#pragma GCC diagnostic pop
525	#endif // COMPILER(GCC_OR_CLANG)	525	#endif // COMPILER(GCC_OR_CLANG)
526		526
527	#define FTL_NEW_BLOCK(output, nameArguments) \
528	(LIKELY(!verboseCompilationEnabled()) \
529	? (output).newBlock() \
530	: (output).newBlock((toCString nameArguments).data()))
531
532	} } // namespace JSC::FTL	527	} } // namespace JSC::FTL
533		528
534	#endif // ENABLE(FTL_JIT)	529	#endif // ENABLE(FTL_JIT)