Bug 58705 – DFG JIT Add support for flow control (branch, jump).

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Gavin Barraclough]

Add support for control flow by breaking the CodeBlock up into multiple basic blocks, generating code for each basic block in turn through the speculative JIT & then the non-speculativ JIT.

[Gavin Barraclough]

Created attachment 89866 [details]
The patch

[WebKit Review Bot]

Attachment 89866 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1

Source/JavaScriptCore/ChangeLog:3:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
Source/JavaScriptCore/dfg/DFGGraph.h:33:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 2 in 10 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Geoffrey Garen]

Comment on attachment 89866 [details]
The patch

View in context: https://bugs.webkit.org/attachment.cgi?id=89866&action=review

r=me

> Source/JavaScriptCore/dfg/DFGGraph.h:56
> +    unsigned bytecodeOffset;

Can we call this bytecodeBegin?

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:622
> +        // Integers
> +        addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsNumber(0)))), notTaken);
> +        MacroAssembler::Jump isNonZeroInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, valueReg, JITCompiler::tagTypeNumberRegister);
> +
> +        // Booleans
> +        addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false)))), notTaken);

So slow! :(

[Gavin Barraclough]

Fixed in r84045