Attachment #197914 for bug #113623

View Details Raw Unified Return to Bug 113623

| Differences between



2013-04-12  Filip Pizlo  <fpizlo@apple.com>

        fourthTier: FTL should have OSR exit
        https://bugs.webkit.org/show_bug.cgi?id=113623

        Reviewed by NOBODY (OOPS!).
        
        This implements OSR exit, and hilariously, it actually works. The idea is to have
        LLVM call a no-return function on the off-ramp, passing it everything we know about
        bytecode state that isn't already flushed to the call frame. Our own JIT takes care
        of the rest.
        
        The details are described in FTLOSRExit.h.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/AbstractMacroAssembler.h:
        (Address):
        (JSC::AbstractMacroAssembler::Address::withOffset):
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::offsetOf):
        (LinkBuffer):
        * assembler/MacroAssemblerX86Common.h:
        * assembler/RepatchBuffer.h:
        (JSC::RepatchBuffer::RepatchBuffer):
        (JSC::RepatchBuffer::~RepatchBuffer):
        (RepatchBuffer):
        * bytecode/Operands.h:
        (Operands):
        (JSC):
        (JSC::::dump):
        * dfg/DFGAbstractState.cpp:
        (JSC::DFG::AbstractState::initialize):
        * dfg/DFGGPRInfo.h:
        (DFG):
        (GPRInfo):
        * dfg/DFGMinifiedNode.h:
        (JSC::DFG::belongsInMinifiedGraph):
        * dfg/DFGNodeType.h:
        (JSC::DFG::needsOSRBackwardRewiring):
        (DFG):
        (JSC::DFG::needsOSRForwardRewiring):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::OSRExit):
        (DFG):
        (JSC::DFG::OSRExit::convertToForward):
        * dfg/DFGOSRExit.h:
        (OSRExit):
        * dfg/DFGOSRExitBase.cpp: Added.
        (DFG):
        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
        (JSC::DFG::OSRExitBase::doSearchForForwardConversion):
        * dfg/DFGOSRExitBase.h: Added.
        (DFG):
        (JSC::DFG::OSRExitBase::OSRExitBase):
        (OSRExitBase):
        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
        * dfg/DFGOSRExitCompiler.cpp:
        * dfg/DFGOSRExitCompiler64.cpp:
        (JSC::DFG::OSRExitCompiler::compileExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOSRExitCompilerCommon.h:
        (DFG):
        * dfg/DFGOSRExitPreparation.cpp: Added.
        (DFG):
        (JSC::DFG::prepareCodeOriginForOSRExit):
        * dfg/DFGOSRExitPreparation.h: Added.
        (DFG):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
        * dfg/DFGValueSource.h:
        (JSC::DFG::ValueSource::forSpeculation):
        * dfg/DFGVariableEventStream.cpp:
        (JSC::DFG::VariableEventStream::reconstruct):
        * ftl/FTLAbbreviations.h:
        (JSC::FTL::functionType):
        (FTL):
        (JSC::FTL::typeOf):
        (JSC::FTL::buildCall):
        (JSC::FTL::setTailCall):
        * ftl/FTLCArgumentGetter.cpp: Added.
        (FTL):
        (JSC::FTL::CArgumentGetter::loadNextAndBox):
        * ftl/FTLCArgumentGetter.h: Added.
        (FTL):
        (JSC::FTL::isArgumentRegister):
        (CArgumentGetter):
        (JSC::FTL::CArgumentGetter::CArgumentGetter):
        (JSC::FTL::CArgumentGetter::loadNext8):
        (JSC::FTL::CArgumentGetter::loadNext32):
        (JSC::FTL::CArgumentGetter::loadNext64):
        (JSC::FTL::CArgumentGetter::loadNextPtr):
        (JSC::FTL::CArgumentGetter::loadNextDouble):
        (JSC::FTL::CArgumentGetter::nextAddress):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLExitArgument.cpp: Added.
        (FTL):
        (JSC::FTL::ExitArgument::dump):
        * ftl/FTLExitArgument.h: Added.
        (FTL):
        (ExitArgumentRepresentation):
        (ExitArgument):
        (JSC::FTL::ExitArgument::ExitArgument):
        (JSC::FTL::ExitArgument::operator!):
        (JSC::FTL::ExitArgument::format):
        (JSC::FTL::ExitArgument::argument):
        (JSC::FTL::ExitArgument::withFormat):
        (JSC::FTL::ExitArgument::representation):
        * ftl/FTLExitArgumentForOperand.cpp: Added.
        (FTL):
        (JSC::FTL::ExitArgumentForOperand::dump):
        * ftl/FTLExitArgumentForOperand.h: Added.
        (FTL):
        (ExitArgumentForOperand):
        (JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
        (JSC::FTL::ExitArgumentForOperand::operator!):
        (JSC::FTL::ExitArgumentForOperand::exitArgument):
        (JSC::FTL::ExitArgumentForOperand::operand):
        (JSC::FTL::lesserArgumentIndex):
        * ftl/FTLExitArgumentList.h: Added.
        (FTL):
        * ftl/FTLExitThunkGenerator.cpp: Added.
        (FTL):
        (JSC::FTL::ExitThunkGenerator::ExitThunkGenerator):
        (JSC::FTL::ExitThunkGenerator::~ExitThunkGenerator):
        (JSC::FTL::ExitThunkGenerator::emitThunk):
        * ftl/FTLExitThunkGenerator.h: Added.
        (FTL):
        (ExitThunkGenerator):
        * ftl/FTLExitValue.cpp: Added.
        (FTL):
        (JSC::FTL::ExitValue::dump):
        * ftl/FTLExitValue.h: Added.
        (FTL):
        (ExitValue):
        (JSC::FTL::ExitValue::ExitValue):
        (JSC::FTL::ExitValue::operator!):
        (JSC::FTL::ExitValue::dead):
        (JSC::FTL::ExitValue::inJSStack):
        (JSC::FTL::ExitValue::inJSStackAsInt32):
        (JSC::FTL::ExitValue::inJSStackAsDouble):
        (JSC::FTL::ExitValue::constant):
        (JSC::FTL::ExitValue::exitArgument):
        (JSC::FTL::ExitValue::kind):
        (JSC::FTL::ExitValue::isDead):
        (JSC::FTL::ExitValue::isInJSStackSomehow):
        (JSC::FTL::ExitValue::isConstant):
        (JSC::FTL::ExitValue::isArgument):
        * ftl/FTLFormattedValue.h:
        (FTL):
        (JSC::FTL::noValue):
        (JSC::FTL::int32Value):
        (JSC::FTL::uInt32Value):
        (JSC::FTL::booleanValue):
        (JSC::FTL::jsValueValue):
        (JSC::FTL::doubleValue):
        * ftl/FTLJITCode.cpp:
        (JSC::FTL::JITCode::initializeExitThunks):
        (FTL):
        (JSC::FTL::JITCode::exitThunks):
        * ftl/FTLJITCode.h:
        (JITCode):
        * ftl/FTLLowerDFGToLLVM.cpp:
        (FTL):
        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
        (JSC::FTL::LowerDFGToLLVM::lower):
        (JSC::FTL::LowerDFGToLLVM::transferAndCheckArguments):
        (JSC::FTL::LowerDFGToLLVM::compileBlock):
        (JSC::FTL::LowerDFGToLLVM::compileNode):
        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
        (LowerDFGToLLVM):
        (JSC::FTL::LowerDFGToLLVM::compileMovHint):
        (JSC::FTL::LowerDFGToLLVM::compileZombieHint):
        (JSC::FTL::LowerDFGToLLVM::compileMovHintAndCheck):
        (JSC::FTL::LowerDFGToLLVM::compileAdd):
        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
        (JSC::FTL::LowerDFGToLLVM::speculateBackward):
        (JSC::FTL::LowerDFGToLLVM::speculateForward):
        (JSC::FTL::LowerDFGToLLVM::speculate):
        (JSC::FTL::LowerDFGToLLVM::terminate):
        (JSC::FTL::LowerDFGToLLVM::backwardTypeCheck):
        (JSC::FTL::LowerDFGToLLVM::forwardTypeCheck):
        (JSC::FTL::LowerDFGToLLVM::typeCheck):
        (JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
        (JSC::FTL::LowerDFGToLLVM::lowInt32):
        (JSC::FTL::LowerDFGToLLVM::lowCell):
        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
        (JSC::FTL::LowerDFGToLLVM::speculateObject):
        (JSC::FTL::LowerDFGToLLVM::isLive):
        (JSC::FTL::LowerDFGToLLVM::use):
        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
        (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
        (JSC::FTL::LowerDFGToLLVM::addExitArgument):
        (JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
        (JSC::FTL::LowerDFGToLLVM::observeMovHint):
        * ftl/FTLOSRExit.cpp: Added.
        (FTL):
        (JSC::FTL::OSRExit::OSRExit):
        (JSC::FTL::OSRExit::codeLocationForRepatch):
        (JSC::FTL::OSRExit::convertToForward):
        * ftl/FTLOSRExit.h: Added.
        (FTL):
        (OSRExit):
        * ftl/FTLOSRExitCompilationInfo.h: Added.
        (FTL):
        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
        (OSRExitCompilationInfo):
        * ftl/FTLOSRExitCompiler.cpp: Added.
        (FTL):
        (JSC::FTL::compileStub):
        (JSC::FTL::compileFTLOSRExit):
        * ftl/FTLOSRExitCompiler.h: Added.
        (FTL):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::intToPtr):
        (JSC::FTL::Output::load):
        (JSC::FTL::Output::store):
        (Output):
        (JSC::FTL::Output::call):
        (JSC::FTL::Output::convertToTailCall):
        * ftl/FTLState.h:
        (State):
        * ftl/FTLThunks.cpp: Added.
        (FTL):
        (JSC::FTL::osrExitGenerationThunkGenerator):
        * ftl/FTLThunks.h: Added.
        (JSC):
        (FTL):
        * ftl/FTLValueFormat.cpp: Added.
        (WTF):
        (WTF::printInternal):
        * ftl/FTLValueFormat.h: Added.
        (FTL):
        (WTF):
        * ftl/FTLValueSource.cpp: Added.
        (FTL):
        (JSC::FTL::ValueSource::dump):
        * ftl/FTLValueSource.h: Added.
        (FTL):
        (ValueSource):
        (JSC::FTL::ValueSource::ValueSource):
        (JSC::FTL::ValueSource::kind):
        (JSC::FTL::ValueSource::operator!):
        (JSC::FTL::ValueSource::node):

2013-04-12  Filip Pizlo  <fpizlo@apple.com>

        fourthTier: switch to using MCJIT and disable frame pointer elimination



		0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27A14BE727300ADC64B /* ExecutionHarness.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BD117178E1C00690C7F /* FTLCArgumentGetter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BBB17178E1C00690C7F /* FTLCArgumentGetter.cpp */; };
		0F235BD217178E1C00690C7F /* FTLCArgumentGetter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BBC17178E1C00690C7F /* FTLCArgumentGetter.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BD317178E1C00690C7F /* FTLExitArgument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BBD17178E1C00690C7F /* FTLExitArgument.cpp */; };
		0F235BD417178E1C00690C7F /* FTLExitArgument.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BBE17178E1C00690C7F /* FTLExitArgument.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BD517178E1C00690C7F /* FTLExitArgumentForOperand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */; };
		0F235BD617178E1C00690C7F /* FTLExitArgumentForOperand.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BD717178E1C00690C7F /* FTLExitArgumentList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC117178E1C00690C7F /* FTLExitArgumentList.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BD817178E1C00690C7F /* FTLExitThunkGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC217178E1C00690C7F /* FTLExitThunkGenerator.cpp */; };
		0F235BD917178E1C00690C7F /* FTLExitThunkGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC317178E1C00690C7F /* FTLExitThunkGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BDA17178E1C00690C7F /* FTLExitValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC417178E1C00690C7F /* FTLExitValue.cpp */; };
		0F235BDB17178E1C00690C7F /* FTLExitValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC517178E1C00690C7F /* FTLExitValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BDC17178E1C00690C7F /* FTLOSRExit.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */; };
		0F235BDD17178E1C00690C7F /* FTLOSRExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC717178E1C00690C7F /* FTLOSRExit.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BDE17178E1C00690C7F /* FTLOSRExitCompilationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC817178E1C00690C7F /* FTLOSRExitCompilationInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BDF17178E1C00690C7F /* FTLOSRExitCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC917178E1C00690C7F /* FTLOSRExitCompiler.cpp */; };
		0F235BE017178E1C00690C7F /* FTLOSRExitCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BCA17178E1C00690C7F /* FTLOSRExitCompiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BE117178E1C00690C7F /* FTLThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BCB17178E1C00690C7F /* FTLThunks.cpp */; };
		0F235BE217178E1C00690C7F /* FTLThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BCC17178E1C00690C7F /* FTLThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BE317178E1C00690C7F /* FTLValueFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BCD17178E1C00690C7F /* FTLValueFormat.cpp */; };
		0F235BE417178E1C00690C7F /* FTLValueFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BCE17178E1C00690C7F /* FTLValueFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BE517178E1C00690C7F /* FTLValueSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BCF17178E1C00690C7F /* FTLValueSource.cpp */; };
		0F235BE617178E1C00690C7F /* FTLValueSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BD017178E1C00690C7F /* FTLValueSource.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BEB17178E7300690C7F /* DFGOSRExitBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BE717178E7300690C7F /* DFGOSRExitBase.cpp */; };
		0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BE817178E7300690C7F /* DFGOSRExitBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F235BED17178E7300690C7F /* DFGOSRExitPreparation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */; };
		0F235BEE17178E7300690C7F /* DFGOSRExitPreparation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */; };

		0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeSpecializationKind.h; sourceTree = "<group>"; };
		0F21C27A14BE727300ADC64B /* ExecutionHarness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionHarness.h; sourceTree = "<group>"; };
		0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeConventions.h; sourceTree = "<group>"; };
		0F235BBB17178E1C00690C7F /* FTLCArgumentGetter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLCArgumentGetter.cpp; path = ftl/FTLCArgumentGetter.cpp; sourceTree = "<group>"; };
		0F235BBC17178E1C00690C7F /* FTLCArgumentGetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLCArgumentGetter.h; path = ftl/FTLCArgumentGetter.h; sourceTree = "<group>"; };
		0F235BBD17178E1C00690C7F /* FTLExitArgument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitArgument.cpp; path = ftl/FTLExitArgument.cpp; sourceTree = "<group>"; };
		0F235BBE17178E1C00690C7F /* FTLExitArgument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitArgument.h; path = ftl/FTLExitArgument.h; sourceTree = "<group>"; };
		0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitArgumentForOperand.cpp; path = ftl/FTLExitArgumentForOperand.cpp; sourceTree = "<group>"; };
		0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitArgumentForOperand.h; path = ftl/FTLExitArgumentForOperand.h; sourceTree = "<group>"; };
		0F235BC117178E1C00690C7F /* FTLExitArgumentList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitArgumentList.h; path = ftl/FTLExitArgumentList.h; sourceTree = "<group>"; };
		0F235BC217178E1C00690C7F /* FTLExitThunkGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitThunkGenerator.cpp; path = ftl/FTLExitThunkGenerator.cpp; sourceTree = "<group>"; };
		0F235BC317178E1C00690C7F /* FTLExitThunkGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitThunkGenerator.h; path = ftl/FTLExitThunkGenerator.h; sourceTree = "<group>"; };
		0F235BC417178E1C00690C7F /* FTLExitValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitValue.cpp; path = ftl/FTLExitValue.cpp; sourceTree = "<group>"; };
		0F235BC517178E1C00690C7F /* FTLExitValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitValue.h; path = ftl/FTLExitValue.h; sourceTree = "<group>"; };
		0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOSRExit.cpp; path = ftl/FTLOSRExit.cpp; sourceTree = "<group>"; };
		0F235BC717178E1C00690C7F /* FTLOSRExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSRExit.h; path = ftl/FTLOSRExit.h; sourceTree = "<group>"; };
		0F235BC817178E1C00690C7F /* FTLOSRExitCompilationInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSRExitCompilationInfo.h; path = ftl/FTLOSRExitCompilationInfo.h; sourceTree = "<group>"; };
		0F235BC917178E1C00690C7F /* FTLOSRExitCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOSRExitCompiler.cpp; path = ftl/FTLOSRExitCompiler.cpp; sourceTree = "<group>"; };
		0F235BCA17178E1C00690C7F /* FTLOSRExitCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSRExitCompiler.h; path = ftl/FTLOSRExitCompiler.h; sourceTree = "<group>"; };
		0F235BCB17178E1C00690C7F /* FTLThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLThunks.cpp; path = ftl/FTLThunks.cpp; sourceTree = "<group>"; };
		0F235BCC17178E1C00690C7F /* FTLThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLThunks.h; path = ftl/FTLThunks.h; sourceTree = "<group>"; };
		0F235BCD17178E1C00690C7F /* FTLValueFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLValueFormat.cpp; path = ftl/FTLValueFormat.cpp; sourceTree = "<group>"; };
		0F235BCE17178E1C00690C7F /* FTLValueFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLValueFormat.h; path = ftl/FTLValueFormat.h; sourceTree = "<group>"; };
		0F235BCF17178E1C00690C7F /* FTLValueSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLValueSource.cpp; path = ftl/FTLValueSource.cpp; sourceTree = "<group>"; };
		0F235BD017178E1C00690C7F /* FTLValueSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLValueSource.h; path = ftl/FTLValueSource.h; sourceTree = "<group>"; };
		0F235BE717178E7300690C7F /* DFGOSRExitBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitBase.cpp; path = dfg/DFGOSRExitBase.cpp; sourceTree = "<group>"; };
		0F235BE817178E7300690C7F /* DFGOSRExitBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitBase.h; path = dfg/DFGOSRExitBase.h; sourceTree = "<group>"; };
		0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitPreparation.cpp; path = dfg/DFGOSRExitPreparation.cpp; sourceTree = "<group>"; };
		0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitPreparation.h; path = dfg/DFGOSRExitPreparation.h; sourceTree = "<group>"; };
		0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakReferenceHarvester.h; sourceTree = "<group>"; };
		0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCallArrayAllocatorSlowPathGenerator.h; path = dfg/DFGCallArrayAllocatorSlowPathGenerator.h; sourceTree = "<group>"; };
		0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFixupPhase.cpp; path = dfg/DFGFixupPhase.cpp; sourceTree = "<group>"; };

		0FEA09FC1705137F00BB722C /* ftl */ = {
			isa = PBXGroup;
			children = (
				0FEA09FD170513DB00BB722C /* FTLAbbreviations.h */,
				0FEA0A171708B00700BB722C /* FTLAbstractHeap.cpp */,
				0FEA0A181708B00700BB722C /* FTLAbstractHeap.h */,
				0FEA0A191708B00700BB722C /* FTLAbstractHeapRepository.cpp */,
				0FEA0A1A1708B00700BB722C /* FTLAbstractHeapRepository.h */,
				0FEA09FD170513DB00BB722C /* FTLAbbreviations.h */,
				0FEA09FE170513DB00BB722C /* FTLCapabilities.cpp */,
				0FEA09FF170513DB00BB722C /* FTLCapabilities.h */,
				0F235BBB17178E1C00690C7F /* FTLCArgumentGetter.cpp */,
				0F235BBC17178E1C00690C7F /* FTLCArgumentGetter.h */,
				0FEA0A251709623B00BB722C /* FTLCommonValues.cpp */,
				0FEA0A211709606900BB722C /* FTLCommonValues.h */,
				0FEA0A00170513DB00BB722C /* FTLCompile.cpp */,
				0FEA0A01170513DB00BB722C /* FTLCompile.h */,
				0F235BBD17178E1C00690C7F /* FTLExitArgument.cpp */,
				0F235BBE17178E1C00690C7F /* FTLExitArgument.h */,
				0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */,
				0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */,
				0F235BC117178E1C00690C7F /* FTLExitArgumentList.h */,
				0F235BC217178E1C00690C7F /* FTLExitThunkGenerator.cpp */,
				0F235BC317178E1C00690C7F /* FTLExitThunkGenerator.h */,
				0F235BC417178E1C00690C7F /* FTLExitValue.cpp */,
				0F235BC517178E1C00690C7F /* FTLExitValue.h */,
				0FEA0A2B170B661900BB722C /* FTLFormattedValue.h */,
				0FEA0A261709623B00BB722C /* FTLIntrinsicRepository.cpp */,
				0FEA0A221709606900BB722C /* FTLIntrinsicRepository.h */,

				0FEA0A131706363600BB722C /* FTLLLVMHeaders.h */,
				0FEA0A04170513DB00BB722C /* FTLLowerDFGToLLVM.cpp */,
				0FEA0A05170513DB00BB722C /* FTLLowerDFGToLLVM.h */,
				0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */,
				0F235BC717178E1C00690C7F /* FTLOSRExit.h */,
				0F235BC817178E1C00690C7F /* FTLOSRExitCompilationInfo.h */,
				0F235BC917178E1C00690C7F /* FTLOSRExitCompiler.cpp */,
				0F235BCA17178E1C00690C7F /* FTLOSRExitCompiler.h */,
				0FEA0A291709629600BB722C /* FTLOutput.cpp */,
				0FEA0A06170513DB00BB722C /* FTLOutput.h */,
				0FEA0A151706BB9000BB722C /* FTLState.cpp */,
				0FEA0A07170513DB00BB722C /* FTLState.h */,
				0F235BCB17178E1C00690C7F /* FTLThunks.cpp */,
				0F235BCC17178E1C00690C7F /* FTLThunks.h */,
				0FEA0A1B1708B00700BB722C /* FTLTypedPointer.h */,
				0F235BCD17178E1C00690C7F /* FTLValueFormat.cpp */,
				0F235BCE17178E1C00690C7F /* FTLValueFormat.h */,
				0F235BCF17178E1C00690C7F /* FTLValueSource.cpp */,
				0F235BD017178E1C00690C7F /* FTLValueSource.h */,
			);
			name = ftl;
			sourceTree = "<group>";

				0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */,
				0FC0978E146A6F6300CF2442 /* DFGOSRExit.cpp */,
				0FC097681468A6EF00CF2442 /* DFGOSRExit.h */,
				0F235BE717178E7300690C7F /* DFGOSRExitBase.cpp */,
				0F235BE817178E7300690C7F /* DFGOSRExitBase.h */,
				65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */,
				0FC0978F146A6F6300CF2442 /* DFGOSRExitCompiler.cpp */,
				0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */,

				0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */,
				0FEFC9A71681A3B000567F53 /* DFGOSRExitJumpPlaceholder.cpp */,
				0FEFC9A81681A3B000567F53 /* DFGOSRExitJumpPlaceholder.h */,
				0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */,
				0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */,
				0FFFC94F14EF909500C72532 /* DFGPhase.cpp */,
				0FFFC95014EF909500C72532 /* DFGPhase.h */,
				0FBE0F6D16C1DB010082C5E8 /* DFGPredictionInjectionPhase.cpp */,

				0F620174143FCD330068B77C /* DFGVariableAccessData.h in Headers */,
				0FDDBFB61666EEDA00C55FEF /* DFGVariableAccessDataDump.h in Headers */,
				0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */,
				0F235BD217178E1C00690C7F /* FTLCArgumentGetter.h in Headers */,
				0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */,
				0FEA0A241709606900BB722C /* FTLIntrinsicRepository.h in Headers */,
				0FEA0A32170D40BF00BB722C /* DFGCommonData.h in Headers */,

				BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */,
				0F766D3015A8DCE2008F363E /* GCAwareJITStubRoutine.h in Headers */,
				C2239D1B16262BDD005AC5FD /* GCThread.h in Headers */,
				0F235BE217178E1C00690C7F /* FTLThunks.h in Headers */,
				C21122E215DD9AB300790E3A /* GCThreadSharedData.h in Headers */,
				0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,
				142E3134134FF0A600AFADB5 /* Handle.h in Headers */,

				BC18C4140E16F5CD00B34460 /* JavaScriptCore.h in Headers */,
				BC18C4150E16F5CD00B34460 /* JavaScriptCorePrefix.h in Headers */,
				1429D9300ED22D7000B89619 /* JIT.h in Headers */,
				0F235BD417178E1C00690C7F /* FTLExitArgument.h in Headers */,
				86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */,
				0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */,
				0FAF7EFE165BA91F000C8455 /* JITDisassembler.h in Headers */,

				A76F54A313B28AAB00EF2BCE /* JITWriteBarrier.h in Headers */,
				BC18C4160E16F5CD00B34460 /* JSActivation.h in Headers */,
				840480131021A1D9008E7F01 /* JSAPIValueWrapper.h in Headers */,
				0F235BE417178E1C00690C7F /* FTLValueFormat.h in Headers */,
				BC18C4170E16F5CD00B34460 /* JSArray.h in Headers */,
				BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */,
				140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */,

				C2CF39C216E15A8100DD69BE /* JSAPIWrapperObject.h in Headers */,
				A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */,
				1442566215EDE98D0066A49B /* JSWithScope.h in Headers */,
				0F235BD617178E1C00690C7F /* FTLExitArgumentForOperand.h in Headers */,
				86E3C619167BABEE006D760A /* JSWrapperMap.h in Headers */,
				BC18C42E0E16F5CD00B34460 /* JSWrapperObject.h in Headers */,
				0F766D3515AE253B008F363E /* JumpReplacementWatchpoint.h in Headers */,
				0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */,
				BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */,
				A72FFD64139985A800E5365A /* KeywordLookup.h in Headers */,
				969A072A0ED1CE6900F1F681 /* Label.h in Headers */,

				86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */,
				86D3B2C610156BDE002865E7 /* MacroAssemblerARM.h in Headers */,
				86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */,
				0F235BDE17178E1C00690C7F /* FTLOSRExitCompilationInfo.h in Headers */,
				0F34B14C16D43E0D001CDA5A /* PolymorphicAccessStructureList.h in Headers */,
				863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */,
				86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */,

				BC18C4450E16F5CD00B34460 /* ObjectConstructor.h in Headers */,
				BC18C4460E16F5CD00B34460 /* ObjectPrototype.h in Headers */,
				E124A8F70E555775003091F1 /* OpaqueJSString.h in Headers */,
				0F235BD917178E1C00690C7F /* FTLExitThunkGenerator.h in Headers */,
				969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
				0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */,
				0F235BD717178E1C00690C7F /* FTLExitArgumentList.h in Headers */,
				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
				0FE228ED1436AB2700196C48 /* Options.h in Headers */,
				BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,

				0FF729C0166AD360000F5BA3 /* ProfilerOriginStack.h in Headers */,
				0FB1058C1675483300F8AB6E /* ProfilerOSRExit.h in Headers */,
				0FB1058E1675483A00F8AB6E /* ProfilerOSRExitSite.h in Headers */,
				0F235BE617178E1C00690C7F /* FTLValueSource.h in Headers */,
				0F13912C16771C3D009CCB07 /* ProfilerProfiledBytecodes.h in Headers */,
				A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */,
				BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */,

				1474C33B16AA2D950062F01D /* PrototypeMap.h in Headers */,
				0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */,
				0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */,
				0F235BDB17178E1C00690C7F /* FTLExitValue.h in Headers */,
				0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */,
				147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
				0FF60AC216740F8300029779 /* ReduceWhitespace.h in Headers */,

				C2160FE715F7E95E00942DFC /* SlotVisitorInlines.h in Headers */,
				933040040E6A749400786E6A /* SmallStrings.h in Headers */,
				BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */,
				0F235BE017178E1C00690C7F /* FTLOSRExitCompiler.h in Headers */,
				BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */,
				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,

				0FBE0F7716C1DB120082C5E8 /* DFGUnificationPhase.h in Headers */,
				0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,
				0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */,
				0F235BDD17178E1C00690C7F /* FTLOSRExit.h in Headers */,
				0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */,
				0FFB921816D02EB20055A5DB /* DFGAllocator.h in Headers */,
				0FFB921A16D02EC50055A5DB /* DFGBasicBlockInlines.h in Headers */,
				0FFB921B16D02F010055A5DB /* DFGNodeAllocator.h in Headers */,
				0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */,
				0F235BEE17178E7300690C7F /* DFGOSRExitPreparation.h in Headers */,
				0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers */,
				0FFB921E16D02F470055A5DB /* DFGVariadicFunction.h in Headers */,
				0FFB921F16D033050055A5DB /* (null) in Headers */,

				0F620179143FCD480068B77C /* DFGAbstractState.cpp in Sources */,
				0F16015D156198C900C2587C /* DFGArgumentsSimplificationPhase.cpp in Sources */,
				0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
				0F235BD517178E1C00690C7F /* FTLExitArgumentForOperand.cpp in Sources */,
				0FC0976E1468AB5100CF2442 /* DFGAssemblyHelpers.cpp in Sources */,
				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
				0F235BD817178E1C00690C7F /* FTLExitThunkGenerator.cpp in Sources */,
				0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */,
				0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */,
				0F3B3A271544C995003ED0FF /* DFGCFGSimplificationPhase.cpp in Sources */,
				0F235BD117178E1C00690C7F /* FTLCArgumentGetter.cpp in Sources */,
				0F2C557014738F3500121E4F /* DFGCodeBlocks.cpp in Sources */,
				0FF0F19D16B72A08005DF95B /* DFGCommon.cpp in Sources */,
				0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */,

				0FBC0AE71496C7C400D4FBDD /* DFGExitProfile.cpp in Sources */,
				C2CF39C116E15A8100DD69BE /* JSAPIWrapperObject.cpp in Sources */,
				0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */,
				0F235BDA17178E1C00690C7F /* FTLExitValue.cpp in Sources */,
				86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
				0FEA0A271709623B00BB722C /* FTLCommonValues.cpp in Sources */,
				86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */,
				0FF0F19916B729F6005DF95B /* DFGLongLivedState.cpp in Sources */,
				0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */,
				0FF0F19C16B72A03005DF95B /* DFGNode.cpp in Sources */,
				0F235BED17178E7300690C7F /* DFGOSRExitPreparation.cpp in Sources */,
				0FA581BA150E952C00B9A2D9 /* DFGNodeFlags.cpp in Sources */,
				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
				0FD82E56141DAF0800179C94 /* DFGOSREntry.cpp in Sources */,

				1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */,
				86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */,
				A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */,
				0F235BEB17178E7300690C7F /* DFGOSRExitBase.cpp in Sources */,
				86CC85A30EE79B7400288682 /* JITCall.cpp in Sources */,
				146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */,
				0F8F94441667635400D61971 /* JITCode.cpp in Sources */,

				140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */,
				147F39D0107EC37600427A48 /* JSArray.cpp in Sources */,
				1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */,
				0F235BE517178E1C00690C7F /* FTLValueSource.cpp in Sources */,
				86FA9E91142BBB2E001773B7 /* JSBoundFunction.cpp in Sources */,
				1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */,
				1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */,

				147F39D4107EC37600427A48 /* JSObject.cpp in Sources */,
				1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */,
				A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */,
				0F235BDF17178E1C00690C7F /* FTLOSRExitCompiler.cpp in Sources */,
				95F6E6950E5B5F970091E860 /* JSProfilerPrivate.cpp in Sources */,
				A727FF6B0DA3092200E548D7 /* JSPropertyNameIterator.cpp in Sources */,
				862553D116136DA9009F17D0 /* JSProxy.cpp in Sources */,

				0F9FC8C314E1B5FE00D52AE0 /* PolymorphicPutByIdList.cpp in Sources */,
				95742F650DD11F5A000917FB /* Profile.cpp in Sources */,
				95CD45760E1C4FDD0085358E /* ProfileGenerator.cpp in Sources */,
				0F235BE317178E1C00690C7F /* FTLValueFormat.cpp in Sources */,
				95AB83560DA43C3000BC83F3 /* ProfileNode.cpp in Sources */,
				0FF729AD166AD35C000F5BA3 /* ProfilerBytecode.cpp in Sources */,
				0FF729AE166AD35C000F5BA3 /* ProfilerBytecodes.cpp in Sources */,
				0F235BDC17178E1C00690C7F /* FTLOSRExit.cpp in Sources */,
				0F13912916771C33009CCB07 /* ProfilerBytecodeSequence.cpp in Sources */,
				0FF729AF166AD35C000F5BA3 /* ProfilerCompilation.cpp in Sources */,
				0F235BE117178E1C00690C7F /* FTLThunks.cpp in Sources */,
				0FF729B0166AD35C000F5BA3 /* ProfilerCompilationKind.cpp in Sources */,
				0FEA0A33170D40BF00BB722C /* DFGJITCode.cpp in Sources */,
				0FF729B1166AD35C000F5BA3 /* ProfilerCompiledBytecode.cpp in Sources */,

				A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */,
				8642C510151C06A90046D4EF /* RegExpCachedResult.cpp in Sources */,
				14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */,
				0F235BD317178E1C00690C7F /* FTLExitArgument.cpp in Sources */,
				8642C512151C083D0046D4EF /* RegExpMatchesArray.cpp in Sources */,
				14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */,
				14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */,

Lines 88-93 public: Source/JavaScriptCore/assembler/AbstractMacroAssembler.h_sec1
- Source/JavaScriptCore/assembler/AbstractMacroAssembler.h +5 lines
88	, offset(offset)	88	, offset(offset)
89	{	89	{
90	}	90	}
		91
		92	Address withOffset(int32_t additionalOffset)
		93	{
		94	return Address(base, offset + additionalOffset);
		95	}
91		96
92	RegisterID base;	97	RegisterID base;
93	int32_t offset;	98	int32_t offset;

Lines 199-204 public: Source/JavaScriptCore/assembler/LinkBuffer.h_sec1
- Source/JavaScriptCore/assembler/LinkBuffer.h +5 lines
199	return applyOffset(label.m_label).m_offset;	199	return applyOffset(label.m_label).m_offset;
200	}	200	}
201		201
		202	unsigned offsetOf(PatchableJump jump)
		203	{
		204	return applyOffset(jump.m_jump.m_label).m_offset;
		205	}
		206
202	// Upon completion of all patching 'FINALIZE_CODE()' should be called once to	207	// Upon completion of all patching 'FINALIZE_CODE()' should be called once to
203	// complete generation of the code. Alternatively, call	208	// complete generation of the code. Alternatively, call
204	// finalizeCodeWithoutDisassembly() directly if you have your own way of	209	// finalizeCodeWithoutDisassembly() directly if you have your own way of

Lines 93-98 public: Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h_sec1
- Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h +1 lines
93	DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);	93	DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);
94		94
95	static const RegisterID stackPointerRegister = X86Registers::esp;	95	static const RegisterID stackPointerRegister = X86Registers::esp;
		96	static const RegisterID framePointerRegister = X86Registers::ebp;
96		97
97	#if ENABLE(JIT_CONSTANT_BLINDING)	98	#if ENABLE(JIT_CONSTANT_BLINDING)
98	static bool shouldBlindForSpecificArch(uint32_t value) { return value >= 0x00ffffff; }	99	static bool shouldBlindForSpecificArch(uint32_t value) { return value >= 0x00ffffff; }



public:
    RepatchBuffer(CodeBlock* codeBlock)
    {
#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
        RefPtr<JITCode> code = codeBlock->getJITCode();
        m_start = code->start();
        m_size = code->size();

        ExecutableAllocator::makeWritable(m_start, m_size);
#else
        UNUSED_PARAM(codeBlock);
#endif
    }

    ~RepatchBuffer()
    {
#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
        ExecutableAllocator::makeExecutable(m_start, m_size);
#endif
    }

    void relink(CodeLocationJump jump, CodeLocationLabel destination)

    }

private:
#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
    void* m_start;
    size_t m_size;
#endif
};

} // namespace JSC

Lines 217-222 public: Source/JavaScriptCore/bytecode/Operands.h_sec1
- Source/JavaScriptCore/bytecode/Operands.h +8 lines
217	m_locals[i] = Traits::defaultValue();	217	m_locals[i] = Traits::defaultValue();
218	}	218	}
219		219
		220	void dump(PrintStream& out) const;
		221
220	private:	222	private:
221	Vector<T, 8> m_arguments;	223	Vector<T, 8> m_arguments;
222	Vector<T, 16> m_locals;	224	Vector<T, 16> m_locals;
Lines 240-245 void dumpOperands(const Operands<T, Trai Source/JavaScriptCore/bytecode/Operands.h_sec2
240	}	242	}
241	}	243	}
242		244
		245	template<typename T, typename Traits>
		246	inline void Operands<T, Traits>::dump(PrintStream& out) const
		247	{
		248	dumpOperands(*this, out);
		249	}
		250
243	} // namespace JSC	251	} // namespace JSC
244		252
245	#endif // Operands_h	253	#endif // Operands_h



            continue;
        }
        
        SpeculatedType prediction =
            node->variableAccessData()->argumentAwarePrediction();
        if (isInt32Speculation(prediction))
            root->valuesAtHead.argument(i).set(SpecInt32);
        else if (isBooleanSpeculation(prediction))



namespace JSC { namespace DFG {

typedef MacroAssembler::RegisterID GPRReg;
#define InvalidGPRReg ((::JSC::DFG::GPRReg)-1)

#if USE(JSVALUE64)
class JSValueRegs {

        static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3, argumentGPR4, argumentGPR5 };
        return registerForIndex[index];
    }
    
    static unsigned toIndex(GPRReg reg)
    {
        ASSERT(reg != InvalidGPRReg);

Lines 51-56 inline bool belongsInMinifiedGraph(NodeT Source/JavaScriptCore/dfg/DFGMinifiedNode.h_sec1
- Source/JavaScriptCore/dfg/DFGMinifiedNode.h +1 lines
51	case PhantomArguments:	51	case PhantomArguments:
52	return true;	52	return true;
53	default:	53	default:
		54	ASSERT(!needsOSRBackwardRewiring(type) && !needsOSRForwardRewiring(type));
54	return false;	55	return false;
55	}	56	}
56	}	57	}



    }
}

inline bool needsOSRBackwardRewiring(NodeType op)
{
    return op == UInt32ToNumber;
}

inline bool needsOSRForwardRewiring(NodeType op)
{
    switch (op) {
    case Int32ToDouble:
    case ForwardInt32ToDouble:
    case ValueToInt32:
    case UInt32ToNumber:
    case DoubleAsInt32:
        return true;
    default:
        return false;
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)



namespace JSC { namespace DFG {

OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, SpeculativeJIT* jit, unsigned streamIndex, unsigned recoveryIndex)
    : OSRExitBase(kind, jit->m_codeOriginForOSR)
    , m_jsValueSource(jsValueSource)
    , m_valueProfile(valueProfile)
    , m_patchableCodeOffset(0)
    , m_codeOrigin(jit->m_codeOriginForOSR)
    , m_codeOriginForExitProfile(m_codeOrigin)
    , m_recoveryIndex(recoveryIndex)
    , m_watchpointIndex(std::numeric_limits<unsigned>::max())
    , m_kind(kind)
    , m_count(0)
    , m_streamIndex(streamIndex)
    , m_lastSetOperand(jit->m_lastSetOperand)
{

    m_patchableCodeOffset = linkBuffer.offsetOf(label);
}

bool OSRExit::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
{
    if (static_cast<double>(m_count) / dfgCodeBlock->osrExitCounter() <= Options::osrExitProminenceForFrequentExitSite())
        return false;
    
    FrequentExitSite exitSite;
    
    if (m_kind == ArgumentsEscaped) {
        // Count this one globally. It doesn't matter where in the code block the arguments excaped;
        // the fact that they did is not associated with any particular instruction.
        exitSite = FrequentExitSite(m_kind);
    } else
        exitSite = FrequentExitSite(m_codeOriginForExitProfile.bytecodeIndex, m_kind);
    
    return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOriginForExitProfile, profiledCodeBlock)->addFrequentExitSite(exitSite);
}

void OSRExit::convertToForward(BasicBlock* block, Node* currentNode, unsigned nodeIndex, const ValueRecovery& valueRecovery)
{
    Node* node;
    Node* lastMovHint;
    if (!doSearchForForwardConversion(block, currentNode, nodeIndex, !!valueRecovery, node, lastMovHint))
        return;

        Node* setLocal = block->at(nodeIndex - 1);
        ASSERT_UNUSED(setLocal, setLocal->containsMovHint());
        ASSERT_UNUSED(setLocal, setLocal->codeOrigin == currentNode->codeOrigin);
    }
    
    // Find the first node for the next bytecode instruction. Also track the last mov hint
    // on this node.
    unsigned indexInBlock = nodeIndex + 1;
    Node* node = 0;
    Node* lastMovHint = 0;
    for (;;) {
        if (indexInBlock == block->size()) {
            // This is an inline return. Give up and do a backwards speculation. This is safe
            // because an inline return has its own bytecode index and it's always safe to
            // reexecute that bytecode.
            ASSERT(node->op() == Jump);
            return;
        }
        node = block->at(indexInBlock);
        if (node->containsMovHint() && node->child1() == currentNode)
            lastMovHint = node;
        if (node->codeOrigin != currentNode->codeOrigin)
            break;
        indexInBlock++;
    }
    
    ASSERT(node->codeOrigin != currentNode->codeOrigin);
    
    m_codeOrigin = node->codeOrigin;
    
    if (!valueRecovery)



/*
 * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions

#include "DFGCommon.h"
#include "DFGExitProfile.h"
#include "DFGGPRInfo.h"
#include "DFGOSRExitBase.h"
#include "DFGValueRecoveryOverride.h"
#include "MacroAssembler.h"
#include "MethodOfGettingAValueProfile.h"

//
// This structure describes how to exit the speculative path by
// going into baseline code.
struct OSRExit : public OSRExitBase {
    OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = UINT_MAX);
    
    MacroAssemblerCodeRef m_code;

    MethodOfGettingAValueProfile m_valueProfile;

    unsigned m_patchableCodeOffset;
    CodeOrigin m_codeOrigin;
    CodeOrigin m_codeOriginForExitProfile;
    
    unsigned m_recoveryIndex;
    unsigned m_watchpointIndex;
    
    ExitKind m_kind;
    uint32_t m_count;
    
    bool considerAddingAsFrequentExitSite(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
    {
        if (!m_count || !exitKindIsCountable(m_kind))
            return false;
        return considerAddingAsFrequentExitSiteSlow(dfgCodeBlock, profiledCodeBlock);
    }

    void setPatchableCodeOffset(MacroAssembler::PatchableJump);
    MacroAssembler::Jump getPatchableCodeOffsetAsJump() const;
    CodeLocationJump codeLocationForRepatch(CodeBlock*) const;

    int m_lastSetOperand;
    
    RefPtr<ValueRecoveryOverride> m_valueRecoveryOverride;

private:
    bool considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock);
};

struct SpeculationFailureDebugInfo {



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGOSRExitBase.h"

#if ENABLE(DFG_JIT)

#include "CodeBlock.h"
#include "DFGBasicBlock.h"
#include "DFGNode.h"
#include "Operations.h"

namespace JSC { namespace DFG {

bool OSRExitBase::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
{
    if (static_cast<double>(m_count) / dfgCodeBlock->osrExitCounter() <= Options::osrExitProminenceForFrequentExitSite())
        return false;
    
    FrequentExitSite exitSite;
    
    if (m_kind == ArgumentsEscaped) {
        // Count this one globally. It doesn't matter where in the code block the arguments excaped;
        // the fact that they did is not associated with any particular instruction.
        exitSite = FrequentExitSite(m_kind);
    } else
        exitSite = FrequentExitSite(m_codeOriginForExitProfile.bytecodeIndex, m_kind);
    
    return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOriginForExitProfile, profiledCodeBlock)->addFrequentExitSite(exitSite);
}

bool OSRExitBase::doSearchForForwardConversion(
    BasicBlock* block, Node* currentNode, unsigned nodeIndex, bool hasValueRecovery,
    Node*& node, Node*& lastMovHint)
{
    // Check that either the current node is a SetLocal, or the preceding node was a
    // SetLocal with the same code origin, or that we've provided a valueRecovery.
    if (!ASSERT_DISABLED
        && !hasValueRecovery
        && !currentNode->containsMovHint()) {
        Node* setLocal = block->at(nodeIndex - 1);
        ASSERT_UNUSED(setLocal, setLocal->containsMovHint());
        ASSERT_UNUSED(setLocal, setLocal->codeOrigin == currentNode->codeOrigin);
    }
    
    // Find the first node for the next bytecode instruction. Also track the last mov hint
    // on this node.
    unsigned indexInBlock = nodeIndex + 1;
    node = 0;
    lastMovHint = 0;
    for (;;) {
        if (indexInBlock == block->size()) {
            // This is an inline return. Give up and do a backwards speculation. This is safe
            // because an inline return has its own bytecode index and it's always safe to
            // reexecute that bytecode.
            ASSERT(node->op() == Jump);
            return false;
        }
        node = block->at(indexInBlock);
        if (node->containsMovHint() && node->child1() == currentNode)
            lastMovHint = node;
        if (node->codeOrigin != currentNode->codeOrigin)
            break;
        indexInBlock++;
    }
    
    ASSERT(node->codeOrigin != currentNode->codeOrigin);
    return true;
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGOSRExitBase_h
#define DFGOSRExitBase_h

#include <wtf/Platform.h>

#if ENABLE(DFG_JIT)

#include "CodeOrigin.h"
#include "DFGExitProfile.h"

namespace JSC { namespace DFG {

struct BasicBlock;
struct Node;

// Provides for the OSR exit profiling functionality that is common between the DFG
// and the FTL.

struct OSRExitBase {
    OSRExitBase(ExitKind kind, CodeOrigin origin)
        : m_kind(kind)
        , m_count(0)
        , m_codeOrigin(origin)
        , m_codeOriginForExitProfile(origin)
    {
    }
    
    ExitKind m_kind;
    uint32_t m_count;
    
    CodeOrigin m_codeOrigin;
    CodeOrigin m_codeOriginForExitProfile;

    bool considerAddingAsFrequentExitSite(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
    {
        if (!m_count || !exitKindIsCountable(m_kind))
            return false;
        return considerAddingAsFrequentExitSiteSlow(dfgCodeBlock, profiledCodeBlock);
    }
    
    // Returns true if the forward conversion is really needed.
    bool doSearchForForwardConversion(
        BasicBlock*, Node* currentNode, unsigned nodeIndex, bool hasValueRecovery,
        Node*& nextBCNode, Node*& lastMovHint);

private:
    bool considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock);
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGOSRExitBase_h


Lines 653-659 void OSRExitCompiler::compileExit(const Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp -1 / +1 lines
653	// 16) Load the result of the last bytecode operation into regT0.	653	// 16) Load the result of the last bytecode operation into regT0.
654		654
655	if (exit.m_lastSetOperand != std::numeric_limits<int>::max())	655	if (exit.m_lastSetOperand != std::numeric_limits<int>::max())
656	m_jit.load64(AssemblyHelpers::addressFor((VirtualRegister)exit.m_lastSetOperand), GPRInfo::cachedResultRegister);	656	m_jit.load64(AssemblyHelpers::addressFor(exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
657		657
658	// 17) And finish.	658	// 17) And finish.
659		659



#include "CallFrame.h"
#include "DFGCommon.h"
#include "DFGJITCode.h"
#include "DFGOSRExitPreparation.h"
#include "LinkBuffer.h"
#include "Operations.h"
#include "RepatchBuffer.h"

    uint32_t exitIndex = globalData->osrExitIndex;
    OSRExit& exit = codeBlock->getJITCode()->dfg()->osrExit[exitIndex];
    
    prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
    // we may opt to inline a code block even before it had ever been compiled by the
    // JIT, but our OSR exit infrastructure currently only works if the target of the
    // OSR exit is JIT code. This could be changed since there is nothing particularly
    // hard about doing an OSR exit into the interpreter, but for now this seems to make
    // sense in that if we're OSR exiting from inlined code of a DFG code block, then
    // probably it's a good sign that the thing we're exiting into is hot. Even more
    // interestingly, since the code was inlined, it may never otherwise get JIT
    // compiled since the act of inlining it may ensure that it otherwise never runs.
    for (CodeOrigin codeOrigin = exit.m_codeOrigin; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->caller) {
        static_cast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())
            ->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)
            ->jitCompile(exec);
    }
    
    // Compute the value recoveries.
    Operands<ValueRecovery> operands;




namespace JSC { namespace DFG {

void handleExitCounts(CCallHelpers& jit, const OSRExitBase& exit)
{
    jit.add32(AssemblyHelpers::TrustedImm32(1), AssemblyHelpers::AbsoluteAddress(&exit.m_count));
    

    doneAdjusting.link(&jit);
}

void reifyInlinedCallFrames(CCallHelpers& jit, const OSRExitBase& exit)
{
#if USE(JSVALUE64)
    ASSERT(jit.baselineCodeBlock()->getJITType() == JITCode::BaselineJIT);

#endif // USE(JSVALUE64) // ending the #else part, so directly above is the 32-bit part
}

void adjustAndJumpToTarget(CCallHelpers& jit, const OSRExitBase& exit)
{
    if (exit.m_codeOrigin.inlineCallFrame)
        jit.addPtr(AssemblyHelpers::TrustedImm32(exit.m_codeOrigin.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);




namespace JSC { namespace DFG {

void handleExitCounts(CCallHelpers&, const OSRExitBase&);
void reifyInlinedCallFrames(CCallHelpers&, const OSRExitBase&);
void adjustAndJumpToTarget(CCallHelpers&, const OSRExitBase&);

} } // namespace JSC::DFG




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGOSRExitPreparation.h"

#if ENABLE(DFG_JIT)

#include "CodeBlock.h"
#include "Executable.h"
#include "Operations.h"

namespace JSC { namespace DFG {

void prepareCodeOriginForOSRExit(ExecState* exec, CodeOrigin codeOrigin)
{
    for (; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->caller) {
        static_cast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())
            ->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)
            ->jitCompile(exec);
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGOSRExitPreparation_h
#define DFGOSRExitPreparation_h

#if ENABLE(DFG_JIT)

#include "CallFrame.h"
#include "CodeOrigin.h"

namespace JSC { namespace DFG {

// Make sure all code on our inline stack is JIT compiled. This is necessary since
// we may opt to inline a code block even before it had ever been compiled by the
// JIT, but our OSR exit infrastructure currently only works if the target of the
// OSR exit is JIT code. This could be changed since there is nothing particularly
// hard about doing an OSR exit into the interpreter, but for now this seems to make
// sense in that if we're OSR exiting from inlined code of a DFG code block, then
// probably it's a good sign that the thing we're exiting into is hot. Even more
// interestingly, since the code was inlined, it may never otherwise get JIT
// compiled since the act of inlining it may ensure that it otherwise never runs.
void prepareCodeOriginForOSRExit(ExecState*, CodeOrigin);

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGOSRExitPreparation_h



Lines 1777-1783 void SpeculativeJIT::checkArgumentTypes( Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp -1 / +1 lines
1777	continue;	1777	continue;
1778		1778
1779	VirtualRegister virtualRegister = variableAccessData->local();	1779	VirtualRegister virtualRegister = variableAccessData->local();
1780	SpeculatedType predictedType = variableAccessData->prediction();	1780	SpeculatedType predictedType = variableAccessData->argumentAwarePrediction();
1781		1781
1782	JSValueSource valueSource = JSValueSource(JITCompiler::addressFor(virtualRegister));	1782	JSValueSource valueSource = JSValueSource(JITCompiler::addressFor(virtualRegister));
1783		1783

Lines 131-137 public: Source/JavaScriptCore/dfg/DFGValueSource.h_sec1
- Source/JavaScriptCore/dfg/DFGValueSource.h -1 / +1 lines
131	{	131	{
132	if (isInt32Speculation(prediction))	132	if (isInt32Speculation(prediction))
133	return ValueSource(Int32InJSStack);	133	return ValueSource(Int32InJSStack);
134	if (isArraySpeculation(prediction) \|\| isCellSpeculation(prediction))	134	if (isCellSpeculation(prediction))
135	return ValueSource(CellInJSStack);	135	return ValueSource(CellInJSStack);
136	if (isBooleanSpeculation(prediction))	136	if (isBooleanSpeculation(prediction))
137	return ValueSource(BooleanInJSStack);	137	return ValueSource(BooleanInJSStack);



            
            bool found = false;
            
            if (node && needsOSRBackwardRewiring(node->op())) {
                MinifiedID id = node->child1();
                if (tryToSetConstantRecovery(valueRecoveries[i], codeBlock, graph.at(id)))
                    continue;

                        doubleAsInt32ID = id;
                        break;
                    default:
                        ASSERT(!needsOSRForwardRewiring(node->op()));
                        break;
                    }
                }

Lines 80-88 static inline LType structType(LType ele Source/JavaScriptCore/ftl/FTLAbbreviations.h_sec1
- Source/JavaScriptCore/ftl/FTLAbbreviations.h -4 / +18 lines
80	}	80	}
81		81
82	enum Variadicity { NotVariadic, Variadic };	82	enum Variadicity { NotVariadic, Variadic };
83	static inline LType functionType(LType returnType, LType* paramTypes, unsigned paramCount, Variadicity variadicity)	83	static inline LType functionType(LType returnType, const LType* paramTypes, unsigned paramCount, Variadicity variadicity)
84	{	84	{
85	return LLVMFunctionType(returnType, paramTypes, paramCount, variadicity == Variadic);	85	return LLVMFunctionType(returnType, const_cast<LType*>(paramTypes), paramCount, variadicity == Variadic);
		86	}
		87	template<typename VectorType>
		88	inline LType functionType(LType returnType, const VectorType& vector, Variadicity variadicity = NotVariadic)
		89	{
		90	return functionType(returnType, vector.begin(), vector.size(), variadicity);
86	}	91	}
87	static inline LType functionType(LType returnType, Variadicity variadicity = NotVariadic)	92	static inline LType functionType(LType returnType, Variadicity variadicity = NotVariadic)
88	{	93	{
Lines 98-103 static inline LType functionType(LType r Source/JavaScriptCore/ftl/FTLAbbreviations.h_sec2
98	return functionType(returnType, paramTypes, 2, variadicity);	103	return functionType(returnType, paramTypes, 2, variadicity);
99	}	104	}
100		105
		106	static inline LType typeOf(LValue value) { return LLVMTypeOf(value); }
		107
101	static inline unsigned mdKindID(const char* string) { return LLVMGetMDKindID(string, strlen(string)); }	108	static inline unsigned mdKindID(const char* string) { return LLVMGetMDKindID(string, strlen(string)); }
102	static inline LValue mdString(const char* string, unsigned length) { return LLVMMDString(string, length); }	109	static inline LValue mdString(const char* string, unsigned length) { return LLVMMDString(string, length); }
103	static inline LValue mdString(const char* string) { return mdString(string, strlen(string)); }	110	static inline LValue mdString(const char* string) { return mdString(string, strlen(string)); }
Lines 151-159 static inline LValue buildIntCast(LBuild Source/JavaScriptCore/ftl/FTLAbbreviations.h_sec3
151	static inline LValue buildIntToPtr(LBuilder builder, LValue value, LType type) { return LLVMBuildIntToPtr(builder, value, type, ""); }	158	static inline LValue buildIntToPtr(LBuilder builder, LValue value, LType type) { return LLVMBuildIntToPtr(builder, value, type, ""); }
152	static inline LValue buildPtrToInt(LBuilder builder, LValue value, LType type) { return LLVMBuildPtrToInt(builder, value, type, ""); }	159	static inline LValue buildPtrToInt(LBuilder builder, LValue value, LType type) { return LLVMBuildPtrToInt(builder, value, type, ""); }
153	static inline LValue buildICmp(LBuilder builder, LIntPredicate cond, LValue left, LValue right) { return LLVMBuildICmp(builder, cond, left, right, ""); }	160	static inline LValue buildICmp(LBuilder builder, LIntPredicate cond, LValue left, LValue right) { return LLVMBuildICmp(builder, cond, left, right, ""); }
154	static inline LValue buildCall(LBuilder builder, LValue function, LValue* args, unsigned numArgs)	161	static inline LValue buildCall(LBuilder builder, LValue function, const LValue* args, unsigned numArgs)
		162	{
		163	return LLVMBuildCall(builder, function, const_cast<LValue*>(args), numArgs, "");
		164	}
		165	template<typename VectorType>
		166	inline LValue buildCall(LBuilder builder, LValue function, const VectorType& vector)
155	{	167	{
156	return LLVMBuildCall(builder, function, args, numArgs, "");	168	return buildCall(builder, function, vector.begin(), vector.size());
157	}	169	}
158	static inline LValue buildCall(LBuilder builder, LValue function)	170	static inline LValue buildCall(LBuilder builder, LValue function)
159	{	171	{
Lines 168-173 static inline LValue buildCall(LBuilder Source/JavaScriptCore/ftl/FTLAbbreviations.h_sec4
168	LValue args[] = { arg1, arg2 };	180	LValue args[] = { arg1, arg2 };
169	return buildCall(builder, function, args, 2);	181	return buildCall(builder, function, args, 2);
170	}	182	}
		183	enum TailCallMode { IsNotTailCall, IsTailCall };
		184	static inline void setTailCall(LValue call, TailCallMode mode) { LLVMSetTailCall(call, mode == IsTailCall); }
171	static inline LValue buildExtractValue(LBuilder builder, LValue aggVal, unsigned index) { return LLVMBuildExtractValue(builder, aggVal, index, ""); }	185	static inline LValue buildExtractValue(LBuilder builder, LValue aggVal, unsigned index) { return LLVMBuildExtractValue(builder, aggVal, index, ""); }
172	static inline LValue buildSelect(LBuilder builder, LValue condition, LValue taken, LValue notTaken) { return LLVMBuildSelect(builder, condition, taken, notTaken, ""); }	186	static inline LValue buildSelect(LBuilder builder, LValue condition, LValue taken, LValue notTaken) { return LLVMBuildSelect(builder, condition, taken, notTaken, ""); }
173	static inline LValue buildBr(LBuilder builder, LBasicBlock destination) { return LLVMBuildBr(builder, destination); }	187	static inline LValue buildBr(LBuilder builder, LBasicBlock destination) { return LLVMBuildBr(builder, destination); }



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLCArgumentGetter.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

using namespace DFG;

void CArgumentGetter::loadNextAndBox(ValueFormat format, GPRReg destination, GPRReg scratch)
{
    if (scratch == InvalidGPRReg) {
        if (destination == GPRInfo::nonArgGPR0)
            scratch = GPRInfo::nonArgGPR1;
        else
            scratch = GPRInfo::nonArgGPR0;
    }
    
    switch (format) {
    case ValueFormatInt32: {
        loadNext32(destination);
        m_jit.or64(GPRInfo::tagTypeNumberRegister, destination);
        break;
    }
            
    case ValueFormatUInt32: {
        loadNext32(destination);
        MacroAssembler::Jump isInt = m_jit.branch32(
            MacroAssembler::GreaterThanOrEqual,
            destination, MacroAssembler::TrustedImm32(0));
            
        m_jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch);
        m_jit.convertInt32ToDouble(destination, FPRInfo::fpRegT0);
        m_jit.boxDouble(FPRInfo::fpRegT0, destination);
        m_jit.move64ToDouble(scratch, FPRInfo::fpRegT0);
            
        MacroAssembler::Jump done = m_jit.jump();
            
        isInt.link(&m_jit);
        m_jit.or64(GPRInfo::tagTypeNumberRegister, destination);
            
        done.link(&m_jit);
        break;
    }
            
    case ValueFormatBoolean: {
        loadNext8(destination);
        m_jit.or32(MacroAssembler::TrustedImm32(ValueFalse), destination);
        break;
    }
            
    case ValueFormatJSValue: {
        loadNext64(destination);
        break;
    }
            
    case ValueFormatDouble: {
        m_jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch);
        loadNextDouble(FPRInfo::fpRegT0);
        m_jit.boxDouble(FPRInfo::fpRegT0, destination);
        m_jit.move64ToDouble(scratch, FPRInfo::fpRegT0);
        break;
    }
            
    default:
        RELEASE_ASSERT_NOT_REACHED();
        break;
    }
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLCArgumentGetter_h
#define FTLCArgumentGetter_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "DFGAssemblyHelpers.h"
#include "FTLValueFormat.h"

namespace JSC { namespace FTL {

// This currently only understands how to get arguments on X86-64 cdecl. This is also
// not particularly efficient. It will generate some redundant moves.

template<typename RegisterKind>
bool isArgumentRegister(typename RegisterKind::RegisterType reg)
{
    for (unsigned i = 0; i < RegisterKind::numberOfArgumentRegisters; ++i) {
        if (RegisterKind::toArgumentRegister(i) == reg)
            return true;
    }
    return false;
}

class CArgumentGetter {
public:
    // Peek offset is the number of things on the stack below the first argument.
    // It will be 1 if you haven't pushed or popped after the call; i.e. the only
    // thing is the return address.
    CArgumentGetter(DFG::AssemblyHelpers& jit, int peekOffset = 1)
        : m_jit(jit)
        , m_peekOffset(peekOffset)
        , m_gprArgumentIndex(0)
        , m_fprArgumentIndex(0)
        , m_stackArgumentIndex(0)
    {
    }
    
    void loadNext8(DFG::GPRReg destination)
    {
        ASSERT(!isArgumentRegister<DFG::GPRInfo>(destination));
        if (m_gprArgumentIndex < DFG::GPRInfo::numberOfArgumentRegisters) {
            m_jit.move(DFG::GPRInfo::toArgumentRegister(m_gprArgumentIndex++), destination);
            return;
        }
        
        m_jit.load8(nextAddress(), destination);
    }
    
    void loadNext32(DFG::GPRReg destination)
    {
        ASSERT(!isArgumentRegister<DFG::GPRInfo>(destination));
        if (m_gprArgumentIndex < DFG::GPRInfo::numberOfArgumentRegisters) {
            m_jit.move(DFG::GPRInfo::toArgumentRegister(m_gprArgumentIndex++), destination);
            return;
        }
        
        m_jit.load32(nextAddress(), destination);
    }
    
    void loadNext64(DFG::GPRReg destination)
    {
        ASSERT(!isArgumentRegister<DFG::GPRInfo>(destination));
        if (m_gprArgumentIndex < DFG::GPRInfo::numberOfArgumentRegisters) {
            m_jit.move(DFG::GPRInfo::toArgumentRegister(m_gprArgumentIndex++), destination);
            return;
        }
        
        m_jit.load64(nextAddress(), destination);
    }
    
    void loadNextPtr(DFG::GPRReg destination)
    {
        loadNext64(destination);
    }
    
    void loadNextDouble(DFG::FPRReg destination)
    {
        ASSERT(
            !isArgumentRegister<DFG::FPRInfo>(destination)
            || destination == DFG::FPRInfo::argumentFPR0);
        
        if (m_fprArgumentIndex < DFG::FPRInfo::numberOfArgumentRegisters) {
            m_jit.moveDouble(DFG::FPRInfo::toArgumentRegister(m_fprArgumentIndex++), destination);
            return;
        }
        
        m_jit.loadDouble(nextAddress(), destination);
    }
    
    void loadNextAndBox(
        ValueFormat format, DFG::GPRReg destination, DFG::GPRReg scratch = InvalidGPRReg);

private:
    MacroAssembler::Address nextAddress()
    {
        return MacroAssembler::Address(
            MacroAssembler::stackPointerRegister,
            (m_peekOffset + m_stackArgumentIndex++) * sizeof(void*));
    }
            
    DFG::AssemblyHelpers& m_jit;
    unsigned m_peekOffset;
    unsigned m_gprArgumentIndex;
    unsigned m_fprArgumentIndex;
    unsigned m_stackArgumentIndex;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLCArgumentGetter_h




    // FIXME: This is a total kludge - LLVM should just use our calling convention.
    // https://bugs.webkit.org/show_bug.cgi?id=113621
    CCallHelpers jit(&state.graph.m_globalData, state.graph.m_codeBlock);
    
    compileEntry(jit);
    
    // This part is only necessary for functions. We currently only compile functions.
        
    CCallHelpers::Label fromArityCheck = jit.label();



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitArgument.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

void ExitArgument::dump(PrintStream& out) const
{
    out.print("arg", argument(), " as ", format());
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitArgument_h
#define FTLExitArgument_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "FTLValueFormat.h"
#include <wtf/PrintStream.h>

namespace JSC { namespace FTL {

struct ExitArgumentRepresentation {
    ValueFormat format;
    unsigned argument;
};

class ExitArgument {
public:
    ExitArgument()
    {
        m_representation.format = InvalidValueFormat;
    }
    
    ExitArgument(ValueFormat format, unsigned argument)
    {
        m_representation.format = format;
        m_representation.argument = argument;
    }
    
    explicit ExitArgument(ExitArgumentRepresentation representation)
    {
        m_representation = representation;
    }
    
    bool operator!() const { return m_representation.format == InvalidValueFormat; }
    
    ValueFormat format() const
    {
        ASSERT(*this);
        return m_representation.format;
    }
    
    unsigned argument() const
    {
        ASSERT(*this);
        return m_representation.argument;
    }
    
    ExitArgument withFormat(ValueFormat format)
    {
        return ExitArgument(format, argument());
    }
    
    ExitArgumentRepresentation representation() const { return m_representation; }
    
    void dump(PrintStream&) const;
    
private:
    ExitArgumentRepresentation m_representation;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitArgument_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitArgumentForOperand.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

void ExitArgumentForOperand::dump(PrintStream& out) const
{
    out.print(m_exitArgument, " for r", m_operand);
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitArgumentForOperand_h
#define FTLExitArgumentForOperand_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "FTLExitArgument.h"

namespace JSC { namespace FTL {

class ExitArgumentForOperand {
public:
    ExitArgumentForOperand()
        : m_operand(-1)
    {
    }
    
    ExitArgumentForOperand(ExitArgument exitArgument, int operand)
        : m_exitArgument(exitArgument)
        , m_operand(operand)
    {
    }
    
    bool operator!() const { return !m_exitArgument; }
    
    const ExitArgument& exitArgument() const { return m_exitArgument; }
    int operand() const { return m_operand; }
    
    void dump(PrintStream&) const;
    
private:
    ExitArgument m_exitArgument;
    int m_operand;
};

inline bool lesserArgumentIndex(
    const ExitArgumentForOperand& a, const ExitArgumentForOperand& b)
{
    return a.exitArgument().argument() < b.exitArgument().argument();
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitArgumentForOperand_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitArgumentList_h
#define FTLExitArgumentList_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "FTLAbbreviations.h"
#include <wtf/Vector.h>

namespace JSC { namespace FTL {

typedef Vector<LValue, 16> ExitArgumentList;

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitArgumentList_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitThunkGenerator.h"

#if ENABLE(FTL_JIT)

#include "FTLOSRExitCompilationInfo.h"
#include "FTLState.h"

namespace JSC { namespace FTL {

using namespace JSC::DFG;

ExitThunkGenerator::ExitThunkGenerator(State& state)
    : CCallHelpers(&state.graph.m_globalData, state.graph.m_codeBlock)
    , m_state(state)
{
}

ExitThunkGenerator::~ExitThunkGenerator()
{
}

void ExitThunkGenerator::emitThunk(unsigned index)
{
    OSRExitCompilationInfo& info = m_state.osrExit[index];
    
    info.m_thunkLabel = label();
    move(TrustedImm32(index), GPRInfo::nonArgGPR0);
    info.m_thunkJump = patchableJump();
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitThunkGenerator_h
#define FTLExitThunkGenerator_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "DFGCCallHelpers.h"

namespace JSC { namespace FTL {

class State;
struct OSRExitCompilationInfo;

class ExitThunkGenerator : public DFG::CCallHelpers {
public:
    ExitThunkGenerator(State& state);
    ~ExitThunkGenerator();
    
    void emitThunk(unsigned index);

private:
    State& m_state;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitThunkGenerator_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitValue.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

void ExitValue::dump(PrintStream& out) const
{
    switch (kind()) {
    case InvalidExitValue:
        out.print("Invalid");
        return;
    case ExitValueDead:
        out.print("Dead");
        return;
    case ExitValueArgument:
        out.print("Argument(", exitArgument(), ")");
        return;
    case ExitValueConstant:
        out.print("Constant(", constant(), ")");
        return;
    case ExitValueInJSStack:
        out.print("InJSStack");
        return;
    case ExitValueInJSStackAsInt32:
        out.print("InJSStackAsInt32");
        return;
    case ExitValueInJSStackAsDouble:
        out.print("InJSStackAsDouble");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitValue_h
#define FTLExitValue_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "FTLExitArgument.h"
#include "JSCJSValue.h"
#include <wtf/PrintStream.h>

namespace JSC { namespace FTL {

// This is like ValueRecovery, but respects the way that the FTL does OSR
// exit: the live non-constant non-flushed values are passed as arguments
// to a noreturn tail call. ExitValue is hence mostly responsible for
// telling us the mapping between operands in bytecode and the arguments to
// the call.

enum ExitValueKind {
    InvalidExitValue,
    ExitValueDead,
    ExitValueArgument,
    ExitValueConstant,
    ExitValueInJSStack,
    ExitValueInJSStackAsInt32,
    ExitValueInJSStackAsDouble
};

class ExitValue {
public:
    ExitValue()
        : m_kind(InvalidExitValue)
    {
    }
    
    bool operator!() const { return m_kind == InvalidExitValue; }
    
    static ExitValue dead()
    {
        ExitValue result;
        result.m_kind = ExitValueDead;
        return result;
    }
    
    static ExitValue inJSStack()
    {
        ExitValue result;
        result.m_kind = ExitValueInJSStack;
        return result;
    }
    
    static ExitValue inJSStackAsInt32()
    {
        ExitValue result;
        result.m_kind = ExitValueInJSStackAsInt32;
        return result;
    }
    
    static ExitValue inJSStackAsDouble()
    {
        ExitValue result;
        result.m_kind = ExitValueInJSStackAsDouble;
        return result;
    }
    
    static ExitValue constant(JSValue value)
    {
        ExitValue result;
        result.m_kind = ExitValueConstant;
        result.u.constant = JSValue::encode(value);
        return result;
    }
    
    static ExitValue exitArgument(const ExitArgument& argument)
    {
        ExitValue result;
        result.m_kind = ExitValueArgument;
        result.u.argument = argument.representation();
        return result;
    }
    
    ExitValueKind kind() const { return m_kind; }
    
    bool isDead() const { return kind() == ExitValueDead; }
    bool isInJSStackSomehow() const
    {
        switch (kind()) {
        case ExitValueInJSStack:
        case ExitValueInJSStackAsInt32:
        case ExitValueInJSStackAsDouble:
            return true;
        default:
            return false;
        }
    }
    bool isConstant() const { return kind() == ExitValueConstant; }
    bool isArgument() const { return kind() == ExitValueArgument; }
    
    ExitArgument exitArgument() const
    {
        ASSERT(isArgument());
        return ExitArgument(u.argument);
    }
    
    JSValue constant() const
    {
        ASSERT(isConstant());
        return JSValue::decode(u.constant);
    }
    
    void dump(PrintStream&) const;
    
private:
    ExitValueKind m_kind;
    union {
        ExitArgumentRepresentation argument;
        EncodedJSValue constant;
    } u;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitValue_h



#if ENABLE(FTL_JIT)

#include "FTLAbbreviations.h"
#include "FTLValueFormat.h"

namespace JSC { namespace FTL {


// use this in situations where there is no good way to say what node the value came
// from.

// Note that this is awkwardly similar to DataFormat in other parts of JSC, except that
// unlike DataFormat and like ValueRecovery, it distinguishes between UInt32 and Int32.

enum ValueFormat {
    InvalidValueFormat,
    ValueFormatInt32,
    ValueFormatUInt32,
    ValueFormatBoolean,
    ValueFormatJSValue,
    ValueFormatDouble
};

class FormattedValue {
public:
    FormattedValue()

    LValue m_value;
};

static inline FormattedValue noValue() { return FormattedValue(); }
static inline FormattedValue int32Value(LValue value) { return FormattedValue(ValueFormatInt32, value); }
static inline FormattedValue uInt32Value(LValue value) { return FormattedValue(ValueFormatUInt32, value); }
static inline FormattedValue booleanValue(LValue value) { return FormattedValue(ValueFormatBoolean, value); }
static inline FormattedValue jsValueValue(LValue value) { return FormattedValue(ValueFormatJSValue, value); }
static inline FormattedValue doubleValue(LValue value) { return FormattedValue(ValueFormatDouble, value); }

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

Lines 42-47 JITCode::~JITCode() Source/JavaScriptCore/ftl/FTLJITCode.cpp_sec1
- Source/JavaScriptCore/ftl/FTLJITCode.cpp +10 lines
42	LLVMDisposeExecutionEngine(m_engine);	42	LLVMDisposeExecutionEngine(m_engine);
43	}	43	}
44		44
		45	void JITCode::initializeExitThunks(CodeRef exitThunks)
		46	{
		47	m_exitThunks = exitThunks;
		48	}
		49
45	void JITCode::initializeCode(LLVMExecutionEngineRef engine, CodeRef entrypoint)	50	void JITCode::initializeCode(LLVMExecutionEngineRef engine, CodeRef entrypoint)
46	{	51	{
47	m_engine = engine;	52	m_engine = engine;
Lines 97-102 bool JITCode::contains(void*) Source/JavaScriptCore/ftl/FTLJITCode.cpp_sec2
97	return false;	102	return false;
98	}	103	}
99		104
		105	JITCode::CodePtr JITCode::exitThunks()
		106	{
		107	return m_exitThunks.code();
		108	}
		109
100	JITCode* JITCode::ftl()	110	JITCode* JITCode::ftl()
101	{	111	{
102	return this;	112	return this;

Lines 32-37 Source/JavaScriptCore/ftl/FTLJITCode.h_sec1
- Source/JavaScriptCore/ftl/FTLJITCode.h +6 lines
32		32
33	#include "DFGCommonData.h"	33	#include "DFGCommonData.h"
34	#include "FTLLLVMHeaders.h"	34	#include "FTLLLVMHeaders.h"
		35	#include "FTLOSRExit.h"
35	#include "JITCode.h"	36	#include "JITCode.h"
36		37
37	namespace JSC { namespace FTL {	38	namespace JSC { namespace FTL {
Lines 48-59 public: Source/JavaScriptCore/ftl/FTLJITCode.h_sec2
48	size_t size();	49	size_t size();
49	bool contains(void*);	50	bool contains(void*);
50		51
		52	void initializeExitThunks(CodeRef);
51	void initializeCode(LLVMExecutionEngineRef, CodeRef entrypoint);	53	void initializeCode(LLVMExecutionEngineRef, CodeRef entrypoint);
52		54
		55	CodePtr exitThunks();
		56
53	JITCode* ftl();	57	JITCode* ftl();
54	DFG::CommonData* dfgCommon();	58	DFG::CommonData* dfgCommon();
55		59
56	DFG::CommonData common;	60	DFG::CommonData common;
		61	SegmentedVector<OSRExit, 8> osrExit;
57		62
58	private:	63	private:
59	// FIXME: LLVM should use our own JIT memory allocator, and we shouldn't have to	64	// FIXME: LLVM should use our own JIT memory allocator, and we shouldn't have to
Lines 61-66 private: Source/JavaScriptCore/ftl/FTLJITCode.h_sec3
61	// https://bugs.webkit.org/show_bug.cgi?id=113619	66	// https://bugs.webkit.org/show_bug.cgi?id=113619
62	LLVMExecutionEngineRef m_engine;	67	LLVMExecutionEngineRef m_engine;
63	CodeRef m_entrypoint;	68	CodeRef m_entrypoint;
		69	CodeRef m_exitThunks;
64	};	70	};
65		71
66	} } // namespace JSC::FTL	72	} } // namespace JSC::FTL

Lines 28-37 Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec1
- Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp -81 / +511 lines
28		28
29	#if ENABLE(FTL_JIT)	29	#if ENABLE(FTL_JIT)
30		30
		31	#include "CodeBlockWithJITType.h"
31	#include "DFGAbstractState.h"	32	#include "DFGAbstractState.h"
32	#include "FTLAbstractHeapRepository.h"	33	#include "FTLAbstractHeapRepository.h"
		34	#include "FTLExitThunkGenerator.h"
33	#include "FTLFormattedValue.h"	35	#include "FTLFormattedValue.h"
34	#include "FTLOutput.h"	36	#include "FTLOutput.h"
		37	#include "FTLThunks.h"
		38	#include "FTLValueSource.h"
		39	#include "LinkBuffer.h"
35	#include "Operations.h"	40	#include "Operations.h"
36		41
37	namespace JSC { namespace FTL {	42	namespace JSC { namespace FTL {
Lines 41-47 using namespace DFG; Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec2
41	// Using this instead of typeCheck() helps to reduce the load on LLVM, by creating	46	// Using this instead of typeCheck() helps to reduce the load on LLVM, by creating
42	// significantly less dead code.	47	// significantly less dead code.
43	#define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) do { \	48	#define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) do { \
44	LValue _ftc_lowValue = (lowValue); \	49	FormattedValue _ftc_lowValue = (lowValue); \
45	Edge _ftc_highValue = (highValue); \	50	Edge _ftc_highValue = (highValue); \
46	SpeculatedType _ftc_typesPassedThrough = (typesPassedThrough); \	51	SpeculatedType _ftc_typesPassedThrough = (typesPassedThrough); \
47	if (!m_state.needsTypeCheck(_ftc_highValue, _ftc_typesPassedThrough)) \	52	if (!m_state.needsTypeCheck(_ftc_highValue, _ftc_typesPassedThrough)) \
Lines 57-62 public: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec3
57	, m_localsBoolean(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)	62	, m_localsBoolean(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)
58	, m_locals32(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)	63	, m_locals32(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)
59	, m_locals64(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)	64	, m_locals64(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)
		65	, m_valueSources(OperandsLike, state.graph.m_blocks[0]->variablesAtHead)
		66	, m_lastSetOperand(std::numeric_limits<int>::max())
		67	, m_exitThunkGenerator(state)
60	, m_state(state.graph)	68	, m_state(state.graph)
61	{	69	{
62	}	70	}
Lines 80-93 public: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec4
80	m_locals64[index] = buildAlloca(m_out.m_builder, m_out.int64);	88	m_locals64[index] = buildAlloca(m_out.m_builder, m_out.int64);
81	}	89	}
82		90
		91	m_initialization = appendBasicBlock(m_ftlState.function);
		92	m_argumentChecks = appendBasicBlock(m_ftlState.function);
		93
83	m_callFrame = m_out.param(0);	94	m_callFrame = m_out.param(0);
84	m_tagTypeNumber = m_out.constInt64(TagTypeNumber);	95	m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
85	m_tagMask = m_out.constInt64(TagMask);	96	m_tagMask = m_out.constInt64(TagMask);
86		97
87	m_abortFunction = constIntToPtr(
88	m_out.constIntPtr(abort),
89	pointerType(functionType(m_out.voidType)));
90
91	for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {	98	for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
92	m_highBlock = m_graph.m_blocks[blockIndex].get();	99	m_highBlock = m_graph.m_blocks[blockIndex].get();
93	if (!m_highBlock)	100	if (!m_highBlock)
Lines 97-104 public: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec5
97	}	104	}
98		105
99	closeOverFlushedLocalOps();	106	closeOverFlushedLocalOps();
100		107
101	m_out.appendTo(m_prologue, m_blocks.get(m_graph.m_blocks[0].get()));	108	m_out.appendTo(m_argumentChecks, m_blocks.get(m_graph.m_blocks[0].get()));
102		109
103	transferAndCheckArguments();	110	transferAndCheckArguments();
104		111
Lines 106-111 public: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec6
106		113
107	for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex)	114	for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex)
108	compileBlock(blockIndex);	115	compileBlock(blockIndex);
		116
		117	// And now complete the initialization block.
		118	linkOSRExitsAndCompleteInitializationBlocks();
109		119
110	if (verboseCompilationEnabled())	120	if (verboseCompilationEnabled())
111	m_ftlState.dumpState("after lowering");	121	m_ftlState.dumpState("after lowering");
Lines 151-158 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec7
151		161
152	void transferAndCheckArguments()	162	void transferAndCheckArguments()
153	{	163	{
154	// FIXME: Set up the OSR story here.	164	// While checking arguments, everything is in the stack.
155	// https://bugs.webkit.org/show_bug.cgi?id=113623	165	for (unsigned i = m_valueSources.size(); i--;)
		166	m_valueSources[i] = ValueSource(ValueInJSStack);
156		167
157	for (int i = 0; i < m_graph.m_codeBlock->numParameters(); ++i) {	168	for (int i = 0; i < m_graph.m_codeBlock->numParameters(); ++i) {
158	Node* node = m_graph.m_arguments[i];	169	Node* node = m_graph.m_arguments[i];
Lines 170-190 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec8
170	if (variable->shouldUnboxIfPossible()) {	181	if (variable->shouldUnboxIfPossible()) {
171	RELEASE_ASSERT(!variable->shouldUseDoubleFormat());	182	RELEASE_ASSERT(!variable->shouldUseDoubleFormat());
172		183
173	SpeculatedType prediction = variable->prediction();	184	SpeculatedType prediction = variable->argumentAwarePrediction();
174		185
175	if (isInt32Speculation(prediction)) {	186	if (isInt32Speculation(prediction)) {
176	speculateBackward(BadType, jsValue, node, isNotInt32(jsValue));	187	speculateBackward(BadType, jsValueValue(jsValue), node, isNotInt32(jsValue));
177	m_out.set(unboxInt32(jsValue), m_locals32.operand(variable->local()));	188	m_out.set(unboxInt32(jsValue), m_locals32.operand(variable->local()));
178	continue;	189	continue;
179	}	190	}
180		191
181	if (isCellSpeculation(prediction)) {	192	if (isCellSpeculation(prediction)) {
182	speculateBackward(BadType, jsValue, node, isNotCell(jsValue));	193	speculateBackward(BadType, jsValueValue(jsValue), node, isNotCell(jsValue));
183	m_out.set(jsValue, m_locals64.operand(variable->local()));	194	m_out.set(jsValue, m_locals64.operand(variable->local()));
184	continue;	195	continue;
185	}	196	}
186	if (isBooleanSpeculation(prediction)) {	197	if (isBooleanSpeculation(prediction)) {
187	speculateBackward(BadType, jsValue, node, isNotBoolean(jsValue));	198	speculateBackward(BadType, jsValueValue(jsValue), node, isNotBoolean(jsValue));
188	m_out.set(unboxBoolean(jsValue), m_localsBoolean.operand(variable->local()));	199	m_out.set(unboxBoolean(jsValue), m_localsBoolean.operand(variable->local()));
189	continue;	200	continue;
190	}	201	}
Lines 216-234 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec9
216	// make IR dumps easier to read.	227	// make IR dumps easier to read.
217	m_out.appendTo(lowBlock, m_nextLowBlock);	228	m_out.appendTo(lowBlock, m_nextLowBlock);
218		229
219	// FIXME: We should track the OSR situation here.	230	initializeOSRExitStateForBlock();
220	// https://bugs.webkit.org/show_bug.cgi?id=113623
221		231
222	m_int32Values.clear();	232	m_int32Values.clear();
223	m_jsValueValues.clear();	233	m_jsValueValues.clear();
224	m_booleanValues.clear();	234	m_booleanValues.clear();
225	m_storageValues.clear();	235	m_storageValues.clear();
		236	m_timeToLive.clear();
226		237
227	m_state.reset();	238	m_state.reset();
228	m_state.beginBasicBlock(m_highBlock);	239	m_state.beginBasicBlock(m_highBlock);
229		240
230	for (unsigned nodeIndex = 0; nodeIndex < m_highBlock->size(); ++nodeIndex)	241	for (m_nodeIndex = 0; m_nodeIndex < m_highBlock->size(); ++m_nodeIndex)
231	compileNode(nodeIndex);	242	compileNode(m_nodeIndex);
232	}	243	}
233		244
234	void compileNode(unsigned nodeIndex)	245	void compileNode(unsigned nodeIndex)
Lines 240-248 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec10
240		251
241	bool shouldExecuteEffects = m_state.startExecuting(m_node);	252	bool shouldExecuteEffects = m_state.startExecuting(m_node);
242		253
243	if (!m_node->shouldGenerate())
244	return; // FIXME: Implement OSR magic here. https://bugs.webkit.org/show_bug.cgi?id=113623
245
246	m_direction = (m_node->flags() & NodeExitsForward) ? ForwardSpeculation : BackwardSpeculation;	254	m_direction = (m_node->flags() & NodeExitsForward) ? ForwardSpeculation : BackwardSpeculation;
247		255
248	switch (m_node->op()) {	256	switch (m_node->op()) {
Lines 258-263 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec11
258	case SetLocal:	266	case SetLocal:
259	compileSetLocal();	267	compileSetLocal();
260	break;	268	break;
		269	case MovHint:
		270	compileMovHint();
		271	break;
		272	case ZombieHint:
		273	compileZombieHint();
		274	break;
261	case MovHintAndCheck:	275	case MovHintAndCheck:
262	compileMovHintAndCheck();	276	compileMovHintAndCheck();
263	break;	277	break;
Lines 352-357 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec12
352	break;	366	break;
353	}	367	}
354		368
		369	if (m_node->shouldGenerate())
		370	DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, use);
		371
		372	if (m_node->hasResult())
		373	m_timeToLive.add(m_node, m_node->adjustedRefCount());
		374
355	if (shouldExecuteEffects)	375	if (shouldExecuteEffects)
356	m_state.executeEffects(nodeIndex);	376	m_state.executeEffects(nodeIndex);
357	}	377	}
Lines 368-375 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec13
368		388
369	void compileGetLocal()	389	void compileGetLocal()
370	{	390	{
		391	// GetLocal is one of the few nodes that may be left behind, with !shouldGenerate().
		392	if (!m_node->shouldGenerate())
		393	return;
		394
371	VariableAccessData* variable = m_node->variableAccessData();	395	VariableAccessData* variable = m_node->variableAccessData();
372	SpeculatedType prediction = variable->prediction();	396	SpeculatedType prediction = variable->argumentAwarePrediction();
373	AbstractValue& value = m_state.variables().operand(variable->local());	397	AbstractValue& value = m_state.variables().operand(variable->local());
374		398
375	if (prediction == SpecNone) {	399	if (prediction == SpecNone) {
Lines 420-432 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec14
420		444
421	void compileSetLocal()	445	void compileSetLocal()
422	{	446	{
		447	observeMovHint(m_node);
		448
423	VariableAccessData* variable = m_node->variableAccessData();	449	VariableAccessData* variable = m_node->variableAccessData();
424	SpeculatedType prediction = variable->prediction();	450	SpeculatedType prediction = variable->argumentAwarePrediction();
425	bool needsFlushing = m_flushedLocalOps.contains(m_node);	451	bool needsFlushing = m_flushedLocalOps.contains(m_node);
426		452
427	// FIXME: Handle the MovHint for OSR.
428	// https://bugs.webkit.org/show_bug.cgi?id=113623
429
430	if (variable->shouldUnboxIfPossible()) {	453	if (variable->shouldUnboxIfPossible()) {
431	if (variable->shouldUseDoubleFormat()) {	454	if (variable->shouldUseDoubleFormat()) {
432	// FIXME: implement doubles in FTL.	455	// FIXME: implement doubles in FTL.
Lines 438-458 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec15
438	if (isInt32Speculation(prediction)) {	461	if (isInt32Speculation(prediction)) {
439	LValue value = lowInt32(m_node->child1());	462	LValue value = lowInt32(m_node->child1());
440	m_out.set(value, m_locals32.operand(variable->local()));	463	m_out.set(value, m_locals32.operand(variable->local()));
441	if (needsFlushing)	464	if (needsFlushing) {
442	m_out.store32(value, payloadFor(variable->local()));	465	m_out.store32(value, payloadFor(variable->local()));
		466	m_valueSources.operand(variable->local()) = ValueSource(Int32InJSStack);
		467	}
443	return;	468	return;
444	}	469	}
445	if (isCellSpeculation(prediction)) {	470	if (isCellSpeculation(prediction)) {
446	LValue value = lowCell(m_node->child1());	471	LValue value = lowCell(m_node->child1());
447	m_out.set(value, m_locals64.operand(variable->local()));	472	m_out.set(value, m_locals64.operand(variable->local()));
448	if (needsFlushing)	473	if (needsFlushing) {
449	m_out.store64(value, addressFor(variable->local()));	474	m_out.store64(value, addressFor(variable->local()));
		475	m_valueSources.operand(variable->local()) = ValueSource(ValueInJSStack);
		476	}
450	return;	477	return;
451	}	478	}
452	if (isBooleanSpeculation(prediction)) {	479	if (isBooleanSpeculation(prediction)) {
453	m_out.set(lowBoolean(m_node->child1()), m_localsBoolean.operand(variable->local()));	480	m_out.set(lowBoolean(m_node->child1()), m_localsBoolean.operand(variable->local()));
454	if (needsFlushing)	481	if (needsFlushing) {
455	m_out.store64(lowJSValue(m_node->child1()), addressFor(variable->local()));	482	m_out.store64(lowJSValue(m_node->child1()), addressFor(variable->local()));
		483	m_valueSources.operand(variable->local()) = ValueSource(ValueInJSStack);
		484	}
456	return;	485	return;
457	}	486	}
458	}	487	}
Lines 460-477 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec16
460	LValue value = lowJSValue(m_node->child1());	489	LValue value = lowJSValue(m_node->child1());
461	if (variable->isCaptured()) {	490	if (variable->isCaptured()) {
462	m_out.store64(value, addressFor(variable->local()));	491	m_out.store64(value, addressFor(variable->local()));
		492	m_valueSources.operand(variable->local()) = ValueSource(ValueInJSStack);
463	return;	493	return;
464	}	494	}
465		495
466	m_out.set(value, m_locals64.operand(variable->local()));	496	m_out.set(value, m_locals64.operand(variable->local()));
467	if (needsFlushing)	497	if (needsFlushing) {
468	m_out.store64(value, addressFor(variable->local()));	498	m_out.store64(value, addressFor(variable->local()));
		499	m_valueSources.operand(variable->local()) = ValueSource(ValueInJSStack);
		500	}
		501	}
		502
		503	void compileMovHint()
		504	{
		505	observeMovHint(m_node);
		506	}
		507
		508	void compileZombieHint()
		509	{
		510	VariableAccessData* data = m_node->variableAccessData();
		511	m_lastSetOperand = data->local();
		512	m_valueSources.operand(data->local()) = ValueSource(SourceIsDead);
469	}	513	}
470		514
471	void compileMovHintAndCheck()	515	void compileMovHintAndCheck()
472	{	516	{
473	// FIXME: Handle the MovHint for OSR.	517	observeMovHint(m_node);
474	// https://bugs.webkit.org/show_bug.cgi?id=113623
475	speculate(m_node->child1());	518	speculate(m_node->child1());
476	}	519	}
477		520
Lines 500-506 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec17
500	}	543	}
501		544
502	LValue result = m_out.addWithOverflow32(left, right);	545	LValue result = m_out.addWithOverflow32(left, right);
503	speculate(Overflow, 0, 0, m_out.extractValue(result, 1));	546	speculate(Overflow, noValue(), 0, m_out.extractValue(result, 1));
504	m_int32Values.add(m_node, m_out.extractValue(result, 0));	547	m_int32Values.add(m_node, m_out.extractValue(result, 0));
505	break;	548	break;
506	}	549	}
Lines 524-530 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec18
524	}	567	}
525		568
526	LValue result = m_out.subWithOverflow32(left, right);	569	LValue result = m_out.subWithOverflow32(left, right);
527	speculate(Overflow, 0, 0, m_out.extractValue(result, 1));	570	speculate(Overflow, noValue(), 0, m_out.extractValue(result, 1));
528	m_int32Values.add(m_node, m_out.extractValue(result, 0));	571	m_int32Values.add(m_node, m_out.extractValue(result, 0));
529	break;	572	break;
530	}	573	}
Lines 547-553 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec19
547	result = m_out.mul(left, right);	590	result = m_out.mul(left, right);
548	else {	591	else {
549	LValue overflowResult = m_out.mulWithOverflow32(left, right);	592	LValue overflowResult = m_out.mulWithOverflow32(left, right);
550	speculate(Overflow, 0, 0, m_out.extractValue(overflowResult, 1));	593	speculate(Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
551	result = m_out.extractValue(overflowResult, 0);	594	result = m_out.extractValue(overflowResult, 0);
552	}	595	}
553		596
Lines 556-563 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec20
556	LBasicBlock continuation = m_out.newBlock();	599	LBasicBlock continuation = m_out.newBlock();
557		600
558	LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);	601	LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);
559	speculate(NegativeZero, 0, 0, m_out.lessThan(left, m_out.int32Zero));	602	speculate(NegativeZero, noValue(), 0, m_out.lessThan(left, m_out.int32Zero));
560	speculate(NegativeZero, 0, 0, m_out.lessThan(right, m_out.int32Zero));	603	speculate(NegativeZero, noValue(), 0, m_out.lessThan(right, m_out.int32Zero));
561	m_out.jump(continuation);	604	m_out.jump(continuation);
562	m_out.appendTo(continuation, lastNext);	605	m_out.appendTo(continuation, lastNext);
563	}	606	}
Lines 585-591 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec21
585	// We don't have a negate-with-overflow intrinsic. Hopefully this	628	// We don't have a negate-with-overflow intrinsic. Hopefully this
586	// does the trick, though.	629	// does the trick, though.
587	LValue overflowResult = m_out.subWithOverflow32(m_out.int32Zero, value);	630	LValue overflowResult = m_out.subWithOverflow32(m_out.int32Zero, value);
588	speculate(Overflow, 0, 0, m_out.extractValue(overflowResult, 1));	631	speculate(Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
589	result = m_out.extractValue(overflowResult, 0);	632	result = m_out.extractValue(overflowResult, 0);
590	}	633	}
591		634
Lines 656-662 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec22
656		699
657	LValue value = lowInt32(m_node->child1());	700	LValue value = lowInt32(m_node->child1());
658	speculateForward(	701	speculateForward(
659	Overflow, 0, 0, m_out.lessThan(value, m_out.int32Zero),	702	Overflow, noValue(), 0, m_out.lessThan(value, m_out.int32Zero),
660	FormattedValue(ValueFormatUInt32, value));	703	FormattedValue(ValueFormatUInt32, value));
661	m_int32Values.add(m_node, value);	704	m_int32Values.add(m_node, value);
662	}	705	}
Lines 675-681 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec23
675		718
676	if (m_node->structureSet().size() == 1) {	719	if (m_node->structureSet().size() == 1) {
677	speculate(	720	speculate(
678	exitKind, cell, 0,	721	exitKind, jsValueValue(cell), 0,
679	m_out.notEqual(structure, weakPointer(m_node->structureSet()[0])));	722	m_out.notEqual(structure, weakPointer(m_node->structureSet()[0])));
680	return;	723	return;
681	}	724	}
Lines 692-698 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec24
692	}	735	}
693		736
694	speculate(	737	speculate(
695	exitKind, cell, 0,	738	exitKind, jsValueValue(cell), 0,
696	m_out.notEqual(structure, weakPointer(m_node->structureSet().last())));	739	m_out.notEqual(structure, weakPointer(m_node->structureSet().last())));
697		740
698	m_out.appendTo(continuation, lastNext);	741	m_out.appendTo(continuation, lastNext);
Lines 755-761 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec25
755	case Array::Contiguous: {	798	case Array::Contiguous: {
756	if (m_node->arrayMode().isInBounds()) {	799	if (m_node->arrayMode().isInBounds()) {
757	speculate(	800	speculate(
758	OutOfBounds, 0, 0,	801	OutOfBounds, noValue(), 0,
759	m_out.aboveOrEqual(	802	m_out.aboveOrEqual(
760	index, m_out.load32(storage, m_heaps.Butterfly_publicLength)));	803	index, m_out.load32(storage, m_heaps.Butterfly_publicLength)));
761		804
Lines 764-770 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec26
764	m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties,	807	m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties,
765	storage, m_out.zeroExt(index, m_out.intPtr),	808	storage, m_out.zeroExt(index, m_out.intPtr),
766	m_state.forNode(m_node->child2()).m_value));	809	m_state.forNode(m_node->child2()).m_value));
767	speculate(LoadFromHole, 0, 0, m_out.isZero64(result));	810	speculate(LoadFromHole, noValue(), 0, m_out.isZero64(result));
768	m_jsValueValues.add(m_node, result);	811	m_jsValueValues.add(m_node, result);
769	break;	812	break;
770	}	813	}
Lines 865-924 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec27
865	}	908	}
866	}	909	}
867		910
868	void speculateBackward(ExitKind, LValue, Node*, LValue failCondition)	911	void speculateBackward(
		912	ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition)
869	{	913	{
870	LBasicBlock failCase = m_out.newBlock();	914	appendOSRExit(
871	LBasicBlock continuation = m_out.newBlock();	915	kind, lowValue, highValue, failCondition, BackwardSpeculation, FormattedValue());
872
873	m_out.branch(failCondition, failCase, continuation);
874	LBasicBlock lastNext = m_out.appendTo(failCase, continuation);
875	// FIXME: Implement OSR exit.
876	// https://bugs.webkit.org/show_bug.cgi?id=113623
877	m_out.call(m_abortFunction);
878	m_out.unreachable();
879	m_out.appendTo(continuation, lastNext);
880	}	916	}
881		917
882	void speculateForward(ExitKind kind, LValue lowValue, Node* highValue, LValue failCondition, const FormattedValue&)	918	void speculateForward(
		919	ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition,
		920	const FormattedValue& recovery)
883	{	921	{
884	speculateBackward(kind, lowValue, highValue, failCondition);	922	appendOSRExit(
885	// FIXME: Implement rewiring of OSR exit to forward.	923	kind, lowValue, highValue, failCondition, ForwardSpeculation, recovery);
886	// https://bugs.webkit.org/show_bug.cgi?id=113623
887	}	924	}
888		925
889	void speculate(ExitKind kind, LValue lowValue, Node* highValue, LValue failCondition)	926	void speculate(
		927	ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition)
890	{	928	{
891	speculateBackward(kind, lowValue, highValue, failCondition);	929	appendOSRExit(
892	// FIXME: Implement rewiring the OSR exit to forward, if m_direction == ForwardDirection.	930	kind, lowValue, highValue, failCondition, m_direction, FormattedValue());
893	// https://bugs.webkit.org/show_bug.cgi?id=113623
894	}	931	}
895		932
896	void terminate(ExitKind kind)	933	void terminate(ExitKind kind)
897	{	934	{
898	speculate(kind, 0, 0, m_out.booleanTrue);	935	speculate(kind, noValue(), 0, m_out.booleanTrue);
899	}	936	}
900		937
901	void backwardTypeCheck(LValue lowValue, Edge highValue, SpeculatedType typesPassedThrough, LValue failCondition)	938	void backwardTypeCheck(
		939	FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
		940	LValue failCondition)
902	{	941	{
903	if (!m_state.needsTypeCheck(highValue, typesPassedThrough))	942	appendTypeCheck(
904	return;	943	lowValue, highValue, typesPassedThrough, failCondition, BackwardSpeculation,
905	ASSERT(mayHaveTypeCheck(highValue.useKind()));	944	FormattedValue());
906	speculateBackward(BadType, lowValue, highValue.node(), failCondition);
907	m_state.forNode(highValue).filter(typesPassedThrough);
908	}	945	}
909		946
910	void forwardTypeCheck(LValue lowValue, Edge highValue, SpeculatedType typesPassedThrough, LValue failCondition)	947	void forwardTypeCheck(
		948	FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
		949	LValue failCondition)
911	{	950	{
912	backwardTypeCheck(lowValue, highValue, typesPassedThrough, failCondition);	951	appendTypeCheck(
913	// FIXME: Implement rewiring of OSR exit to forward.	952	lowValue, highValue, typesPassedThrough, failCondition, ForwardSpeculation,
914	// https://bugs.webkit.org/show_bug.cgi?id=113623	953	FormattedValue());
915	}	954	}
916		955
917	void typeCheck(LValue lowValue, Edge highValue, SpeculatedType typesPassedThrough, LValue failCondition)	956	void typeCheck(
		957	FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
		958	LValue failCondition)
918	{	959	{
919	backwardTypeCheck(lowValue, highValue, typesPassedThrough, failCondition);	960	appendTypeCheck(
920	// FIXME: Implement rewiring of OSR exit to forward, if m_direction == ForwardDirection.	961	lowValue, highValue, typesPassedThrough, failCondition, m_direction,
921	// https://bugs.webkit.org/show_bug.cgi?id=113623	962	FormattedValue());
		963	}
		964
		965	void appendTypeCheck(
		966	FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
		967	LValue failCondition, SpeculationDirection direction, FormattedValue recovery)
		968	{
		969	if (!m_state.needsTypeCheck(highValue, typesPassedThrough))
		970	return;
		971	ASSERT(mayHaveTypeCheck(highValue.useKind()));
		972	appendOSRExit(BadType, lowValue, highValue.node(), failCondition, direction, recovery);
		973	m_state.forNode(highValue).filter(typesPassedThrough);
922	}	974	}
923		975
924	LValue lowInt32(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)	976	LValue lowInt32(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
Lines 929-935 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec28
929	return result;	981	return result;
930		982
931	if (LValue boxedResult = m_jsValueValues.get(edge.node())) {	983	if (LValue boxedResult = m_jsValueValues.get(edge.node())) {
932	FTL_TYPE_CHECK(boxedResult, edge, SpecInt32, isNotInt32(boxedResult));	984	FTL_TYPE_CHECK(
		985	jsValueValue(boxedResult), edge, SpecInt32, isNotInt32(boxedResult));
933	LValue result = unboxInt32(boxedResult);	986	LValue result = unboxInt32(boxedResult);
934	m_int32Values.add(edge.node(), result);	987	m_int32Values.add(edge.node(), result);
935	return result;	988	return result;
Lines 945-951 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec29
945	ASSERT_UNUSED(mode, mode == ManualOperandSpeculation \|\| isCell(edge.useKind()));	998	ASSERT_UNUSED(mode, mode == ManualOperandSpeculation \|\| isCell(edge.useKind()));
946		999
947	if (LValue uncheckedResult = m_jsValueValues.get(edge.node())) {	1000	if (LValue uncheckedResult = m_jsValueValues.get(edge.node())) {
948	FTL_TYPE_CHECK(uncheckedResult, edge, SpecCell, isNotCell(uncheckedResult));	1001	FTL_TYPE_CHECK(
		1002	jsValueValue(uncheckedResult), edge, SpecCell, isNotCell(uncheckedResult));
949	return uncheckedResult;	1003	return uncheckedResult;
950	}	1004	}
951		1005
Lines 971-977 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec30
971	return result;	1025	return result;
972		1026
973	if (LValue unboxedResult = m_jsValueValues.get(edge.node())) {	1027	if (LValue unboxedResult = m_jsValueValues.get(edge.node())) {
974	FTL_TYPE_CHECK(unboxedResult, edge, SpecBoolean, isNotBoolean(unboxedResult));	1028	FTL_TYPE_CHECK(
		1029	jsValueValue(unboxedResult), edge, SpecBoolean, isNotBoolean(unboxedResult));
975	LValue result = unboxBoolean(unboxedResult);	1030	LValue result = unboxBoolean(unboxedResult);
976	m_booleanValues.add(edge.node(), result);	1031	m_booleanValues.add(edge.node(), result);
977	return result;	1032	return result;
Lines 1094-1100 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec31
1094	void speculateObject(Edge edge, LValue cell)	1149	void speculateObject(Edge edge, LValue cell)
1095	{	1150	{
1096	FTL_TYPE_CHECK(	1151	FTL_TYPE_CHECK(
1097	cell, edge, SpecObject,	1152	jsValueValue(cell), edge, SpecObject,
1098	m_out.equal(	1153	m_out.equal(
1099	m_out.loadPtr(cell, m_heaps.JSCell_structure),	1154	m_out.loadPtr(cell, m_heaps.JSCell_structure),
1100	m_out.constIntPtr(globalData().stringStructure.get())));	1155	m_out.constIntPtr(globalData().stringStructure.get())));
Lines 1105-1110 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec32
1105	speculateObject(edge, lowCell(edge));	1160	speculateObject(edge, lowCell(edge));
1106	}	1161	}
1107		1162
		1163	bool isLive(Node* node)
		1164	{
		1165	HashMap<Node*, unsigned>::iterator iter = m_timeToLive.find(node);
		1166	ASSERT(iter != m_timeToLive.end());
		1167	return !!iter->value;
		1168	}
		1169
		1170	void use(Edge edge)
		1171	{
		1172	if (!edge->hasResult()) {
		1173	ASSERT(edge->hasVariableAccessData());
		1174	return;
		1175	}
		1176
		1177	HashMap<Node*, unsigned>::iterator iter = m_timeToLive.find(edge.node());
		1178	ASSERT(iter != m_timeToLive.end());
		1179	ASSERT(iter->value);
		1180	iter->value--;
		1181	}
		1182
		1183	// Wrapper used only for DFG_NODE_DO_TO_CHILDREN
		1184	void use(Node*, Edge edge)
		1185	{
		1186	use(edge);
		1187	}
		1188
		1189	void initializeOSRExitStateForBlock()
		1190	{
		1191	for (unsigned i = m_valueSources.size(); i--;) {
		1192	Node* node = m_highBlock->variablesAtHead[i];
		1193	if (!node) {
		1194	m_valueSources[i] = ValueSource(SourceIsDead);
		1195	continue;
		1196	}
		1197
		1198	VariableAccessData* variable = node->variableAccessData();
		1199	SpeculatedType prediction = variable->argumentAwarePrediction();
		1200
		1201	if (variable->isArgumentsAlias()) {
		1202	m_valueSources[i] = ValueSource(ArgumentsSource);
		1203	continue;
		1204	}
		1205
		1206	if (!node->shouldGenerate()) {
		1207	m_valueSources[i] = ValueSource(SourceIsDead);
		1208	continue;
		1209	}
		1210
		1211	if (m_flushedLocalOps.contains(node)) {
		1212	// This value will have been flushed to the JSStack in some form or
		1213	// another.
		1214
		1215	if (variable->shouldUnboxIfPossible()) {
		1216	if (variable->shouldUseDoubleFormat()) {
		1217	m_valueSources[i] = ValueSource(DoubleInJSStack);
		1218	continue;
		1219	}
		1220
		1221	if (isInt32Speculation(prediction)) {
		1222	m_valueSources[i] = ValueSource(Int32InJSStack);
		1223	continue;
		1224	}
		1225	}
		1226
1227	m_valueSources[i] = ValueSource(ValueInJSStack);
1228	continue;
1229	}
1230
1231	if (variable->shouldUnboxIfPossible()) {
1232	if (variable->shouldUseDoubleFormat()) {
1233	m_valueSources[i] = ValueSource(ValueInLocals);
1234	continue;
1235	}
1236
1237	if (isInt32Speculation(prediction)) {
1238	m_valueSources[i] = ValueSource(Int32InLocals);
1239	continue;
1240	}
1241
1242	if (isBooleanSpeculation(prediction)) {
1243	m_valueSources[i] = ValueSource(BooleanInLocals);
1244	continue;
1245	}
1246	}
1247
1248	m_valueSources[i] = ValueSource(ValueInLocals);
1249	}
1250	}
1251
1252	void appendOSRExit(
1253	ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition,
1254	SpeculationDirection direction, FormattedValue recovery)
1255	{
1256	dataLog(" OSR exit with value sources: ", m_valueSources, "\n");
1257
1258	ASSERT(m_ftlState.jitCode->osrExit.size() == m_ftlState.osrExit.size());
1259	unsigned index = m_ftlState.osrExit.size();
1260
1261	m_ftlState.jitCode->osrExit.append(
1262	OSRExit(
1263	kind, lowValue.format(), m_graph.methodOfGettingAValueProfileFor(highValue),
1264	m_node->codeOrigin, m_lastSetOperand, m_valueSources.numberOfArguments(),
1265	m_valueSources.numberOfLocals()));
1266	m_ftlState.osrExit.append(OSRExitCompilationInfo());
1267
1268	OSRExit& exit = m_ftlState.jitCode->osrExit.last();
1269	OSRExitCompilationInfo& info = m_ftlState.osrExit.last();
1270
1271	LBasicBlock failCase = m_out.newBlock();
1272	LBasicBlock continuation = m_out.newBlock();
1273
1274	m_out.branch(failCondition, failCase, continuation);
1275
1276	m_out.appendTo(m_prologue);
1277	info.m_thunkAddress = buildAlloca(m_out.m_builder, m_out.intPtr);
1278
1279	LBasicBlock lastNext = m_out.appendTo(failCase, continuation);
1280
1281	ExitArgumentList arguments;
1282	arguments.append(m_callFrame);
1283	if (!!lowValue)
1284	arguments.append(lowValue.value());
1285
1286	for (unsigned i = 0; i < exit.m_values.size(); ++i) {
1287	ValueSource source = m_valueSources[i];
1288
1289	switch (source.kind()) {
1290	case ValueInJSStack:
1291	exit.m_values[i] = ExitValue::inJSStack();
1292	break;
1293	case Int32InJSStack:
1294	exit.m_values[i] = ExitValue::inJSStackAsInt32();
1295	break;
1296	case DoubleInJSStack:
1297	exit.m_values[i] = ExitValue::inJSStackAsDouble();
1298	break;
1299	case ValueInLocals:
1300	addExitArgument(
1301	exit, arguments, i, ValueFormatJSValue, m_out.get(m_locals64[i]));
1302	break;
1303	case Int32InLocals:
1304	addExitArgument(
1305	exit, arguments, i, ValueFormatInt32, m_out.get(m_locals32[i]));
1306	break;
1307	case BooleanInLocals:
1308	addExitArgument(
1309	exit, arguments, i, ValueFormatBoolean, m_out.get(m_localsBoolean[i]));
1310	break;
1311	case DoubleInLocals:
1312	// FIXME: implement doubles in FTL.
1313	// https://bugs.webkit.org/show_bug.cgi?id=113624
1314	RELEASE_ASSERT_NOT_REACHED();
1315	break;
1316	case ArgumentsSource:
1317	// FIXME: implement PhantomArguments.
1318	// https://bugs.webkit.org/show_bug.cgi?id=113986
1319	RELEASE_ASSERT_NOT_REACHED();
1320	break;
1321	case SourceIsDead:
1322	exit.m_values[i] = ExitValue::dead();
1323	break;
1324	case HaveNode:
1325	addExitArgumentForNode(exit, arguments, i, source.node());
1326	break;
1327	default:
1328	RELEASE_ASSERT_NOT_REACHED();
1329	break;
1330	}
1331	}
1332
1333	dataLog(" Exit values: ", exit.m_values, "\n");
1334
1335	if (direction == ForwardSpeculation)
1336	exit.convertToForward(m_highBlock, m_node, m_nodeIndex, recovery, arguments);
1337
1338	// So, the really lame thing here is that we have to build an LLVM function type.
1339	// Booo.
1340	Vector<LType, 16> argumentTypes;
1341	for (unsigned i = 0; i < arguments.size(); ++i)
1342	argumentTypes.append(typeOf(arguments[i]));
1343
1344	m_out.call(
1345	m_out.intToPtr(
1346	m_out.get(info.m_thunkAddress),
1347	pointerType(functionType(m_out.voidType, argumentTypes))),
1348	arguments);
1349	m_out.unreachable();
1350
1351	m_out.appendTo(continuation, lastNext);
1352
1353	m_exitThunkGenerator.emitThunk(index);
1354	}
1355
1356	void addExitArgumentForNode(
1357	OSRExit& exit, ExitArgumentList& arguments, unsigned index, Node* node)
1358	{
1359	ASSERT(node->shouldGenerate());
1360	ASSERT(node->hasResult());
1361
1362	if (tryToSetConstantExitArgument(exit, index, node))
1363	return;
1364
1365	if (!isLive(node)) {
1366	bool found = false;
1367
1368	if (needsOSRBackwardRewiring(node->op())) {
1369	node = node->child1().node();
1370	if (tryToSetConstantExitArgument(exit, index, node))
1371	return;
1372	if (isLive(node))
1373	found = true;
1374	}
1375
1376	if (!found) {
1377	Node* int32ToDouble = 0;
1378	Node* valueToInt32 = 0;
1379	Node* uint32ToNumber = 0;
1380	Node* doubleAsInt32 = 0;
1381
1382	HashMap<Node*, unsigned>::iterator iter = m_timeToLive.begin();
1383	HashMap<Node*, unsigned>::iterator end = m_timeToLive.end();
1384	for (; iter != end; ++iter) {
1385	if (!iter->value)
1386	continue;
1387	Node* candidate = iter->key;
1388	if (!candidate->child1())
1389	continue;
1390	if (candidate->child1() != node)
1391	continue;
1392	switch (candidate->op()) {
1393	case Int32ToDouble:
1394	case ForwardInt32ToDouble:
1395	int32ToDouble = candidate;
1396	break;
1397	case ValueToInt32:
1398	valueToInt32 = candidate;
1399	break;
1400	case UInt32ToNumber:
1401	uint32ToNumber = candidate;
1402	break;
1403	case DoubleAsInt32:
1404	uint32ToNumber = candidate;
1405	break;
1406	default:
1407	ASSERT(!needsOSRForwardRewiring(candidate->op()));
1408	break;
1409	}
1410	}
1411
1412	if (doubleAsInt32)
1413	node = doubleAsInt32;
1414	else if (int32ToDouble)
1415	node = int32ToDouble;
1416	else if (valueToInt32)
1417	node = valueToInt32;
1418	else if (uint32ToNumber)
1419	node = uint32ToNumber;
1420
1421	if (isLive(node))
1422	found = true;
1423	}
1424
1425	if (!found) {
1426	exit.m_values[index] = ExitValue::dead();
1427	return;
1428	}
1429	}
1430
1431	ASSERT(isLive(node));
1432
1433	if (LValue result = m_int32Values.get(node)) {
1434	addExitArgument(exit, arguments, index, ValueFormatInt32, result);
1435	return;
1436	}
1437
1438	if (LValue result = m_booleanValues.get(node)) {
1439	addExitArgument(exit, arguments, index, ValueFormatBoolean, result);
1440	return;
1441	}
1442
1443	if (LValue result = m_jsValueValues.get(node)) {
1444	addExitArgument(exit, arguments, index, ValueFormatJSValue, result);
1445	return;
1446	}
1447
1448	// FIXME: Implement doubles in the FTL.
1449	// https://bugs.webkit.org/show_bug.cgi?id=113624
1450	RELEASE_ASSERT_NOT_REACHED();
1451	}
1452
1453	bool tryToSetConstantExitArgument(OSRExit& exit, unsigned index, Node* node)
1454	{
1455	if (!node)
1456	return false;
1457
1458	switch (node->op()) {
1459	case JSConstant:
1460	case WeakJSConstant:
1461	exit.m_values[index] = ExitValue::constant(m_graph.valueOfJSConstant(node));
1462	return true;
1463	case PhantomArguments:
1464	// FIXME: implement PhantomArguments.
1465	// https://bugs.webkit.org/show_bug.cgi?id=113986
1466	RELEASE_ASSERT_NOT_REACHED();
1467	return true;
1468	default:
1469	return false;
1470	}
1471	}
1472
1473	void addExitArgument(
1474	OSRExit& exit, ExitArgumentList& arguments, unsigned index, ValueFormat format,
1475	LValue value)
1476	{
1477	exit.m_values[index] = ExitValue::exitArgument(ExitArgument(format, arguments.size()));
1478	arguments.append(value);
1479	}
1480
1481	void linkOSRExitsAndCompleteInitializationBlocks()
1482	{
1483	MacroAssemblerCodeRef osrExitThunk =
1484	globalData().getCTIStub(osrExitGenerationThunkGenerator);
1485	CodeLocationLabel target = CodeLocationLabel(osrExitThunk.code());
1486
1487	m_out.appendTo(m_prologue);
1488	m_out.jump(m_initialization);
1489
1490	m_out.appendTo(m_initialization);
1491
1492	LinkBuffer linkBuffer(
1493	globalData(), &m_exitThunkGenerator, m_ftlState.graph.m_codeBlock,
1494	JITCompilationMustSucceed);
1495
1496	ASSERT(m_ftlState.osrExit.size() == m_ftlState.jitCode->osrExit.size());
1497
1498	for (unsigned i = 0; i < m_ftlState.osrExit.size(); ++i) {
1499	OSRExitCompilationInfo& info = m_ftlState.osrExit[i];
1500	OSRExit& exit = m_ftlState.jitCode->osrExit[i];
1501
1502	linkBuffer.link(info.m_thunkJump, target);
1503
1504	m_out.set(
1505	m_out.constIntPtr(
1506	linkBuffer.locationOf(info.m_thunkLabel).executableAddress()),
1507	info.m_thunkAddress);
1508
1509	exit.m_patchableCodeOffset = linkBuffer.offsetOf(info.m_thunkJump);
1510	}
1511
1512	m_ftlState.jitCode->initializeExitThunks(
1513	FINALIZE_DFG_CODE(
1514	linkBuffer,
1515	("FTL exit thunks for %s", toCString(CodeBlockWithJITType(m_ftlState.graph.m_codeBlock,JITCode::FTLJIT)).data())));
1516
1517	m_out.jump(m_argumentChecks);
1518	}
1519
1520	void observeMovHint(Node* node)
1521	{
1522	ASSERT(node->containsMovHint());
1523	ASSERT(node->op() != ZombieHint);
1524
1525	int operand = node->local();
1526
1527	m_lastSetOperand = operand;
1528	m_valueSources.operand(operand) = ValueSource(node->child1().node());
1529	}
1530
1108	void addWeakReference(JSCell* target)	1531	void addWeakReference(JSCell* target)
1109	{	1532	{
1110	m_ftlState.jitCode->common.weakReferences.append(	1533	m_ftlState.jitCode->common.weakReferences.append(
Lines 1151-1162 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec33
1151	Output m_out;	1574	Output m_out;
1152		1575
1153	LBasicBlock m_prologue;	1576	LBasicBlock m_prologue;
		1577	LBasicBlock m_initialization;
		1578	LBasicBlock m_argumentChecks;
1154	HashMap<BasicBlock*, LBasicBlock> m_blocks;	1579	HashMap<BasicBlock*, LBasicBlock> m_blocks;
1155		1580
1156	LValue m_callFrame;	1581	LValue m_callFrame;
1157	LValue m_tagTypeNumber;	1582	LValue m_tagTypeNumber;
1158	LValue m_tagMask;	1583	LValue m_tagMask;
1159	LValue m_abortFunction;
1160		1584
1161	HashSet<Node*> m_flushedLocalOps;	1585	HashSet<Node*> m_flushedLocalOps;
1162	Vector<Node*> m_flushedLocalOpWorklist;	1586	Vector<Node*> m_flushedLocalOpWorklist;
Lines 1165-1179 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec34
1165	HashMap<Node*, LValue> m_jsValueValues;	1589	HashMap<Node*, LValue> m_jsValueValues;
1166	HashMap<Node*, LValue> m_booleanValues;	1590	HashMap<Node*, LValue> m_booleanValues;
1167	HashMap<Node*, LValue> m_storageValues;	1591	HashMap<Node*, LValue> m_storageValues;
		1592	HashMap<Node*, unsigned> m_timeToLive;
1168		1593
1169	Operands<LValue> m_localsBoolean;	1594	Operands<LValue> m_localsBoolean;
1170	Operands<LValue> m_locals32;	1595	Operands<LValue> m_locals32;
1171	Operands<LValue> m_locals64;	1596	Operands<LValue> m_locals64;
1172		1597
		1598	Operands<ValueSource> m_valueSources;
		1599	int m_lastSetOperand;
		1600	ExitThunkGenerator m_exitThunkGenerator;
		1601
1173	AbstractState m_state;	1602	AbstractState m_state;
1174	BasicBlock* m_highBlock;	1603	BasicBlock* m_highBlock;
1175	BasicBlock* m_nextHighBlock;	1604	BasicBlock* m_nextHighBlock;
1176	LBasicBlock m_nextLowBlock;	1605	LBasicBlock m_nextLowBlock;
		1606	unsigned m_nodeIndex;
1177	Node* m_node;	1607	Node* m_node;
1178	SpeculationDirection m_direction;	1608	SpeculationDirection m_direction;
1179	};	1609	};



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLOSRExit.h"

#if ENABLE(FTL_JIT)

#include "CodeBlock.h"
#include "DFGBasicBlock.h"
#include "DFGNode.h"
#include "FTLExitArgument.h"
#include "FTLExitArgumentList.h"
#include "FTLJITCode.h"
#include "Operations.h"

namespace JSC { namespace FTL {

using namespace DFG;

OSRExit::OSRExit(
    ExitKind exitKind, ValueFormat profileValueFormat,
    MethodOfGettingAValueProfile valueProfile, CodeOrigin codeOrigin,
    int lastSetOperand, unsigned numberOfArguments, unsigned numberOfLocals)
    : OSRExitBase(exitKind, codeOrigin)
    , m_profileValueFormat(profileValueFormat)
    , m_valueProfile(valueProfile)
    , m_patchableCodeOffset(0)
    , m_lastSetOperand(lastSetOperand)
    , m_values(numberOfArguments, numberOfLocals)
{
}

CodeLocationJump OSRExit::codeLocationForRepatch(CodeBlock* ftlCodeBlock) const
{
    return CodeLocationJump(
        reinterpret_cast<char*>(
            ftlCodeBlock->getJITCode()->ftl()->exitThunks().dataLocation()) +
        m_patchableCodeOffset);
}

void OSRExit::convertToForward(
    BasicBlock* block, Node* currentNode, unsigned nodeIndex,
    const FormattedValue &value, ExitArgumentList& arguments)
{
    Node* node;
    Node* lastMovHint;
    if (!doSearchForForwardConversion(block, currentNode, nodeIndex, !!value, node, lastMovHint))
        return;

    ASSERT(node->codeOrigin != currentNode->codeOrigin);
    
    m_codeOrigin = node->codeOrigin;
    
    if (!value)
        return;
    
    int overriddenOperand = lastMovHint->local();
    m_lastSetOperand = overriddenOperand;
    
    // Is the value for this operand being passed as an argument to the exit, or is
    // it something else? If it's an argument already, then replace that argument;
    // otherwise add another argument.
    if (m_values[overriddenOperand].isArgument()) {
        ExitArgument exitArgument = m_values[overriddenOperand].exitArgument();
        arguments[exitArgument.argument()] = value.value();
        m_values[overriddenOperand] = ExitValue::exitArgument(
            exitArgument.withFormat(value.format()));
        return;
    }
    
    unsigned argument = arguments.size();
    arguments.append(value.value());
    m_values[m_lastSetOperand] = ExitValue::exitArgument(
        ExitArgument(value.format(), argument));
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLOSRExit_h
#define FTLOSRExit_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "CodeOrigin.h"
#include "DFGExitProfile.h"
#include "DFGOSRExitBase.h"
#include "FTLAbbreviations.h"
#include "FTLExitArgumentList.h"
#include "FTLExitValue.h"
#include "FTLFormattedValue.h"
#include "MethodOfGettingAValueProfile.h"
#include "Operands.h"
#include "ValueProfile.h"

namespace JSC { namespace FTL {

// Tracks one OSR exit site within the FTL JIT. OSR exit in FTL works by deconstructing
// the crazy that is OSR down to simple SSA CFG primitives that any compiler backend
// (including of course LLVM) can grok and do meaningful things to. Except for
// watchpoint-based exits, which haven't yet been implemented (see webkit.org/b/113647),
// an exit is just a conditional branch in the emitted code where one destination is the
// continuation and the other is a basic block that performs a no-return tail-call to an
// exit thunk. This thunk takes as its arguments the live non-constant
// not-already-accounted-for bytecode state. To appreciate how this works consider the
// following JavaScript program, and its lowering down to LLVM IR including the relevant
// exits:
//
// function foo(o) {
//     var a = o.a; // predicted int
//     var b = o.b;
//     var c = o.c; // NB this is dead
//     a = a | 5; // our example OSR exit: need to check if a is an int
//     return a + b;
// }
//
// Just consider the "a | 5". In the DFG IR, this looks like:
//
// BitOr(Check:Int32:@a, Int32:5)
//
// Where @a is the node for the GetLocal node that gets the value of the 'a' variable.
// Conceptually, this node can be further broken down to the following (note that this
// particular lowering never actually happens - we skip this step and go straight to
// LLVM IR - but it's still useful to see this):
//
// exitIf(@a is not int32);
// continuation;
//
// Where 'exitIf()' is a function that will exit if the argument is true, and
// 'continuation' is the stuff that we will do after the exitIf() check. (Note that
// FTL refers to 'exitIf()' as 'speculate()', which is in line with DFG terminology.)
// This then gets broken down to the following LLVM IR, assuming that %0 is the LLVM
// value corresponding to variable 'a', and %1 is the LLVM value for variable 'b':
//
//   %2 = ... // the predictate corresponding to '@a is not int32'
//   br i1 %2, label %3, label %4
// ; <label>:3
//   call void exitThunk1(%0, %1) // pass 'a' and 'b', since they're both live-in-bytecode
//   unreachable
// ; <label>:4
//   ... // code for the continuation
//
// Where 'exitThunk1' is the IR to get the exit thunk for *this* OSR exit. Each OSR
// exit will appear to LLVM to have a distinct exit thunk.
//
// Note that this didn't have to pass '5', 'o', or 'c' to the exit thunk. 5 is a
// constant and the DFG already knows that, and can already tell the OSR exit machinery
// what that contant is and which bytecode variables (if any) it needs to be dropped
// into. This is conveyed to the exit statically, via the OSRExit data structure below.
// See the code for ExitValue for details. 'o' is an argument, and arguments are always
// "flushed" - if you never assign them then their values are still in the argument
// stack slots, and if you do assign them then we eagerly store them into those slots.
// 'c' is dead in bytecode, and the DFG knows this; we statically tell the exit thunk
// that it's dead and don't have to pass anything. The exit thunk will "initialize" its
// value to Undefined.
//
// This approach to OSR exit has a number of virtues:
//
// - It is an entirely unsurprising representation for a compiler that already groks
//   CFG-like IRs for C-like languages. All existing analyses and transformations just
//   work.
//
// - It lends itself naturally to modern approaches to code motion. For example, you
//   could sink operations from above the exit to below it, if you just duplicate the
//   operation into the OSR exit block. This is both legal and desirable. It works
//   because the backend sees the OSR exit block as being no different than any other,
//   and LLVM already supports sinking if it sees that a value is only partially used.
//   Hence there exists a value that dominates the exit but is only used by the exit
//   thunk and not by the continuation, sinking ought to kick in for that value.
//   Hoisting operations from below it to above it is also possible, for similar
//   reasons.
//
// - The no-return tail-call to the OSR exit thunk can be subjected to specialized
//   code-size reduction optimizations, though this is optional. For example, instead
//   of actually emitting a call along with all that goes with it (like placing the
//   arguments into argument position), the backend could choose to simply inform us
//   where it had placed the arguments and expect the callee (i.e. the exit thunk) to
//   figure it out from there. It could also tell us what we need to do to pop stack,
//   although again, it doesn't have to; it could just emit that code normally. Though
//   we don't support this yet, we could; the only thing that would change on our end
//   is that we'd need feedback from the backend about the location of the arguments
//   and a description of the things that need to be done to pop stack. This would
//   involve switching the m_values array to use something more akin to ValueRecovery
//   rather than the current ExitValue, albeit possibly with some hacks to better
//   understand the kinds of places where the LLVM backend would put values.
//
// - It could be extended to allow the backend to do its own exit hoisting, by using
//   intrinsics (or meta-data, or something) to inform the backend that it's safe to
//   make the predicate passed to 'exitIf()' more truthy.
//
// - It could be extended to support watchpoints (see webkit.org/b/113647) by making
//   the predicate passed to 'exitIf()' be an intrinsic that the backend knows to be
//   true at compile-time. The backend could then turn the conditional branch into a
//   replaceable jump, much like the DFG does.

struct OSRExit : public DFG::OSRExitBase {
    OSRExit(
        ExitKind, ValueFormat profileValueFormat, MethodOfGettingAValueProfile,
        CodeOrigin, int lastSetOperand, unsigned numberOfArguments,
        unsigned numberOfLocals);
    
    MacroAssemblerCodeRef m_code;
    
    // The first argument to the exit call may be a value we wish to profile.
    // If that's the case, the format will be not Invalid and we'll have a
    // method of getting a value profile. Note that all of the ExitArgument's
    // are already aware of this possible off-by-one, so there is no need to
    // correct them.
    ValueFormat m_profileValueFormat;
    MethodOfGettingAValueProfile m_valueProfile;
    
    // Offset within the exit stubs of the stub for this exit.
    unsigned m_patchableCodeOffset;
    
    int m_lastSetOperand;
    
    Operands<ExitValue> m_values;
    
    CodeLocationJump codeLocationForRepatch(CodeBlock* ftlCodeBlock) const;
    
    void convertToForward(
        DFG::BasicBlock*, DFG::Node* currentNode, unsigned nodeIndex,
        const FormattedValue&, ExitArgumentList& arguments);
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLOSRExit_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLOSRExitCompilationInfo_h
#define FTLOSRExitCompilationInfo_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "FTLAbbreviations.h"
#include "MacroAssembler.h"

namespace JSC { namespace FTL {

struct OSRExitCompilationInfo {
    OSRExitCompilationInfo()
        : m_thunkAddress(0)
    {
    }
    
    MacroAssembler::Label m_thunkLabel;
    MacroAssembler::PatchableJump m_thunkJump;
    LValue m_thunkAddress;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLOSRExitCompilationInfo_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLOSRExitCompiler.h"

#if ENABLE(FTL_JIT)

#include "DFGOSRExitCompilerCommon.h"
#include "DFGOSRExitPreparation.h"
#include "FTLCArgumentGetter.h"
#include "FTLExitArgumentForOperand.h"
#include "FTLJITCode.h"
#include "FTLOSRExit.h"
#include "RepatchBuffer.h"

namespace JSC { namespace FTL {

using namespace DFG;

static void compileStub(
    unsigned exitID, OSRExit& exit, JSGlobalData* globalData, CodeBlock* codeBlock)
{
    CCallHelpers jit(globalData, codeBlock);
    
    // This is actually fairly easy, even though it is horribly gross. We know that
    // LLVM would have passes us all of the state via arguments. We know how to get
    // the arguments. And, we know how to pop stack back to the JIT stack frame, sort
    // of: we know that it's two frames beneath us. This is terrible and I feel
    // ashamed of it, but it will work for now.
    
    CArgumentGetter arguments(jit);
    
    // First recover our call frame and tag thingies.
    arguments.loadNextPtr(GPRInfo::callFrameRegister);
    jit.move(MacroAssembler::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
    jit.move(MacroAssembler::TrustedImm64(TagMask), GPRInfo::tagMaskRegister);
    
    // Do some value profiling.
    if (exit.m_profileValueFormat != InvalidValueFormat) {
        arguments.loadNextAndBox(exit.m_profileValueFormat, GPRInfo::nonArgGPR0);
        
        if (exit.m_kind == BadCache || exit.m_kind == BadIndexingType) {
            CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
            if (ArrayProfile* arrayProfile = jit.baselineCodeBlockFor(codeOrigin)->getArrayProfile(codeOrigin.bytecodeIndex)) {
                jit.loadPtr(MacroAssembler::Address(GPRInfo::nonArgGPR0, JSCell::structureOffset()), GPRInfo::nonArgGPR1);
                jit.storePtr(GPRInfo::nonArgGPR1, arrayProfile->addressOfLastSeenStructure());
                jit.load8(MacroAssembler::Address(GPRInfo::nonArgGPR1, Structure::indexingTypeOffset()), GPRInfo::nonArgGPR1);
                jit.move(MacroAssembler::TrustedImm32(1), GPRInfo::nonArgGPR2);
                jit.lshift32(GPRInfo::nonArgGPR1, GPRInfo::nonArgGPR2);
                jit.or32(GPRInfo::nonArgGPR2, MacroAssembler::AbsoluteAddress(arrayProfile->addressOfArrayModes()));
            }
        }
        
        if (!!exit.m_valueProfile)
            jit.store64(GPRInfo::nonArgGPR0, exit.m_valueProfile.getSpecFailBucket(0));
    }
    
    // Start by dumping all argument exit values to the stack.
    
    Vector<ExitArgumentForOperand, 16> sortedArguments;
    for (unsigned i = exit.m_values.size(); i--;) {
        ExitValue value = exit.m_values[i];
        int operand = exit.m_values.operandForIndex(i);
        
        if (!value.isArgument())
            continue;
        
        sortedArguments.append(ExitArgumentForOperand(value.exitArgument(), operand));
    }
    std::sort(sortedArguments.begin(), sortedArguments.end(), lesserArgumentIndex);
    
    for (unsigned i = 0; i < sortedArguments.size(); ++i) {
        ExitArgumentForOperand argument = sortedArguments[i];
        
        arguments.loadNextAndBox(argument.exitArgument().format(), GPRInfo::nonArgGPR0);
        jit.store64(GPRInfo::nonArgGPR0, AssemblyHelpers::addressFor(argument.operand()));
    }
    
    // Box anything that is already on the stack, or that is a constant.
    
    for (unsigned i = exit.m_values.size(); i--;) {
        ExitValue value = exit.m_values[i];
        int operand = exit.m_values.operandForIndex(i);
        
        MacroAssembler::Address address = AssemblyHelpers::addressFor(operand);
        
        switch (value.kind()) {
        case ExitValueDead:
            jit.store64(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), address);
            break;
        case ExitValueConstant:
            jit.store64(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), address);
            break;
        case ExitValueInJSStack:
            break;
        case ExitValueInJSStackAsInt32:
            jit.load32(
                address.withOffset(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)),
                GPRInfo::regT0);
            jit.or64(GPRInfo::tagTypeNumberRegister, GPRInfo::regT0);
            jit.store64(GPRInfo::regT0, address);
            break;
        case ExitValueInJSStackAsDouble:
            jit.loadDouble(address, FPRInfo::fpRegT0);
            jit.boxDouble(FPRInfo::fpRegT0, GPRInfo::regT0);
            jit.store64(GPRInfo::regT0, address);
            break;
        case ExitValueArgument:
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
    }
    
    handleExitCounts(jit, exit);
    reifyInlinedCallFrames(jit, exit);
    
    // Adjust the C stack. The frame pointer should at this point still hold the pointer
    // to the frame of the LLVM-generated code.
    
    jit.move(MacroAssembler::framePointerRegister, MacroAssembler::stackPointerRegister);
    jit.pop(MacroAssembler::framePointerRegister);
    jit.pop(GPRInfo::nonArgGPR0); // ignore the result.
    
    if (exit.m_lastSetOperand != std::numeric_limits<int>::max()) {
        jit.load64(
            AssemblyHelpers::addressFor(exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
    }
    
    adjustAndJumpToTarget(jit, exit);
    
    LinkBuffer patchBuffer(*globalData, &jit, codeBlock);
    exit.m_code = FINALIZE_CODE_IF(
        shouldShowDisassembly(),
        patchBuffer,
        ("FTL OSR exit #%u (bc#%u, %s) from %s",
            exitID, exit.m_codeOrigin.bytecodeIndex,
            exitKindToString(exit.m_kind), toCString(*codeBlock).data()));
}

extern "C" void* compileFTLOSRExit(ExecState* exec, unsigned exitID)
{
    SamplingRegion samplingRegion("FTL OSR Exit Compilation");
    
    CodeBlock* codeBlock = exec->codeBlock();
    
    ASSERT(codeBlock);
    ASSERT(codeBlock->getJITType() == JITCode::FTLJIT);
    
    JSGlobalData* globalData = &exec->globalData();
    
    OSRExit& exit = codeBlock->getJITCode()->ftl()->osrExit[exitID];
    
    prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
    
    compileStub(exitID, exit, globalData, codeBlock);
    
    RepatchBuffer repatchBuffer(codeBlock);
    repatchBuffer.relink(
        exit.codeLocationForRepatch(codeBlock), CodeLocationLabel(exit.m_code.code()));
    
    return exit.m_code.code().executableAddress();
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLOSRExitCompiler_h
#define FTLOSRExitCompiler_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "DFGOperations.h"

namespace JSC { namespace FTL {

// Takes the call frame and the index of the exit, and returns the address to
// jump to.
extern "C" {
void* DFG_OPERATION compileFTLOSRExit(ExecState*, unsigned exitID) WTF_INTERNAL;
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLOSRExitCompiler_h




    LValue zeroExt(LValue value, LType type) { return buildZExt(m_builder, value, type); }
    LValue intCast(LValue value, LType type) { return buildIntCast(m_builder, value, type); }
    LValue castToInt32(LValue value) { return intCast(value, int32); }
    LValue intToPtr(LValue value, LType type) { return buildIntToPtr(m_builder, value, type); }
    
    LValue get(LValue reference) { return buildLoad(m_builder, reference); }
    LValue set(LValue value, LValue reference) { return buildStore(m_builder, value, reference); }
    
    LValue load(TypedPointer pointer, LType refType)
    {
        LValue result = get(intToPtr(pointer.value(), refType));
        pointer.heap().decorateInstruction(result, *m_heaps);
        return result;
    }
    void store(LValue value, TypedPointer pointer, LType refType)
    {
        LValue result = set(value, intToPtr(pointer.value(), refType));
        pointer.heap().decorateInstruction(result, *m_heaps);
    }
    

    LValue select(LValue value, LValue taken, LValue notTaken) { return buildSelect(m_builder, value, taken, notTaken); }
    LValue extractValue(LValue aggVal, unsigned index) { return buildExtractValue(m_builder, aggVal, index); }
    
    template<typename VectorType>
    LValue call(LValue function, const VectorType& vector) { return buildCall(m_builder, function, vector); }
    LValue call(LValue function) { return buildCall(m_builder, function); }
    LValue call(LValue function, LValue arg1) { return buildCall(m_builder, function, arg1); }
    LValue call(LValue function, LValue arg1, LValue arg2) { return buildCall(m_builder, function, arg1, arg2); }
    
    LValue convertToTailCall(LValue call)
    {
        setTailCall(call, IsTailCall);
        return call;
    }
    
    void jump(LBasicBlock destination) { buildBr(m_builder, destination); }
    void branch(LValue condition, LBasicBlock taken, LBasicBlock notTaken) { buildCondBr(m_builder, condition, taken, notTaken); }
    void ret(LValue value) { buildRet(m_builder, value); }



#include "DFGGraph.h"
#include "FTLAbbreviations.h"
#include "FTLJITCode.h"
#include "FTLOSRExitCompilationInfo.h"
#include <wtf/Noncopyable.h>

namespace JSC { namespace FTL {

    LModule module;
    LValue function;
    RefPtr<JITCode> jitCode;
    Vector<OSRExitCompilationInfo> osrExit;
    
    void dumpState(const char* when);
};



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLThunks.h"

#if ENABLE(FTL_JIT)

#include "DFGGPRInfo.h"
#include "DFGFPRInfo.h"
#include "FTLOSRExitCompiler.h"
#include "LinkBuffer.h"
#include "MacroAssembler.h"

namespace JSC { namespace FTL {

using namespace DFG;

MacroAssemblerCodeRef osrExitGenerationThunkGenerator(JSGlobalData* globalData)
{
    MacroAssembler jit;
    
    // Pretend that we're a C call frame.
    jit.push(MacroAssembler::framePointerRegister);
    jit.move(MacroAssembler::stackPointerRegister, MacroAssembler::framePointerRegister);
    jit.push(GPRInfo::regT0);
    jit.push(GPRInfo::regT0);
    
    size_t scratchSize = sizeof(EncodedJSValue) * (GPRInfo::numberOfArgumentRegisters + FPRInfo::numberOfArgumentRegisters);
    ScratchBuffer* scratchBuffer = globalData->scratchBufferForSize(scratchSize);
    EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
    
    for (unsigned i = 0; i < GPRInfo::numberOfArgumentRegisters; ++i)
        jit.store64(GPRInfo::toArgumentRegister(i), buffer + i);
    for (unsigned i = 0; i < FPRInfo::numberOfArgumentRegisters; ++i) {
        jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfArgumentRegisters + i), GPRInfo::nonArgGPR1);
        jit.storeDouble(FPRInfo::toArgumentRegister(i), GPRInfo::nonArgGPR1);
    }
    
    // Tell GC mark phase how much of the scratch buffer is active during call.
    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR1);
    jit.storePtr(MacroAssembler::TrustedImmPtr(scratchSize), GPRInfo::nonArgGPR1);

    // argument 0 is already the call frame.
    jit.move(GPRInfo::nonArgGPR0, GPRInfo::argumentGPR1);
    MacroAssembler::Call functionCall = jit.call();
    
    // Make sure that we're not using the return register if it's an argument register.
    jit.move(GPRInfo::returnValueGPR, GPRInfo::nonArgGPR0);
    
    // Prepare for tail call.
    jit.pop(GPRInfo::nonArgGPR1);
    jit.pop(GPRInfo::nonArgGPR1);
    jit.pop(MacroAssembler::framePointerRegister);
    
    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR1);
    jit.storePtr(MacroAssembler::TrustedImmPtr(0), GPRInfo::nonArgGPR1);
    
    for (unsigned i = 0; i < FPRInfo::numberOfArgumentRegisters; ++i) {
        jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfArgumentRegisters + i), GPRInfo::nonArgGPR1);
        jit.loadDouble(GPRInfo::nonArgGPR1, FPRInfo::toArgumentRegister(i));
    }
    for (unsigned i = 0; i < GPRInfo::numberOfArgumentRegisters; ++i)
        jit.load64(buffer + i, GPRInfo::toArgumentRegister(i));
    
    jit.jump(GPRInfo::nonArgGPR0);
    
    LinkBuffer patchBuffer(*globalData, &jit, GLOBAL_THUNK_ID);
    patchBuffer.link(functionCall, compileFTLOSRExit);
    return FINALIZE_CODE(patchBuffer, ("FTL OSR exit generation thunk"));
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLThunks_h
#define FTLThunks_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "MacroAssemblerCodeRef.h"

namespace JSC {

class JSGlobalData;

namespace FTL {

MacroAssemblerCodeRef osrExitGenerationThunkGenerator(JSGlobalData*);

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLTHunks_h



/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLValueFormat.h"

#if ENABLE(FTL_JIT)

namespace WTF {

using namespace JSC::FTL;

void printInternal(PrintStream& out, ValueFormat format)
{
    switch (format) {
    case InvalidValueFormat:
        out.print("Invalid");
        return;
    case ValueFormatInt32:
        out.print("Int32");
        return;
    case ValueFormatUInt32:
        out.print("UInt32");
        return;
    case ValueFormatBoolean:
        out.print("Boolean");
        return;
    case ValueFormatJSValue:
        out.print("JSValue");
        return;
    case ValueFormatDouble:
        out.print("Double");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

} // namespace WTF

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLValueFormat_h
#define FTLValueFormat_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include <wtf/PrintStream.h>

namespace JSC { namespace FTL {

// Note that this is awkwardly similar to DataFormat in other parts of JSC, except that
// unlike DataFormat and like ValueRecovery, it distinguishes between UInt32 and Int32.

enum ValueFormat {
    InvalidValueFormat,
    ValueFormatInt32,
    ValueFormatUInt32,
    ValueFormatBoolean,
    ValueFormatJSValue,
    ValueFormatDouble
};

} } // namespace JSC::FTL

namespace WTF {

void printInternal(PrintStream&, JSC::FTL::ValueFormat);

} // namespace WTF

#endif // ENABLE(FTL_JIT)

#endif // FTLValueFormat_h




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLValueSource.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

void ValueSource::dump(PrintStream& out) const
{
    switch (kind()) {
    case SourceNotSet:
        out.print("SourceNotSet");
        return;
    case ValueInJSStack:
        out.print("ValueInJSStack");
        return;
    case Int32InJSStack:
        out.print("Int32InJSStack");
        return;
    case DoubleInJSStack:
        out.print("DoubleInJSStack");
        return;
    case ValueInLocals:
        out.print("ValueInLocals");
        return;
    case Int32InLocals:
        out.print("Int32InLocals");
        return;
    case BooleanInLocals:
        out.print("BooleanInLocals");
        return;
    case DoubleInLocals:
        out.print("DoubleInLocals");
        return;
    case ArgumentsSource:
        out.print("ArgumentsSource");
        return;
    case SourceIsDead:
        out.print("SourceIsDead");
        return;
    case HaveNode:
        out.print("Node(", node(), ")");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2013 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLValueSource_h
#define FTLValueSource_h

#include <wtf/Platform.h>

#if ENABLE(FTL_JIT)

#include "DFGNode.h"
#include <wtf/PrintStream.h>
#include <wtf/StdLibExtras.h>

namespace JSC { namespace FTL {

enum ValueSourceKind {
    SourceNotSet,
    ValueInJSStack,
    Int32InJSStack,
    DoubleInJSStack,
    ValueInLocals,
    Int32InLocals,
    BooleanInLocals,
    DoubleInLocals,
    ArgumentsSource,
    SourceIsDead,
    HaveNode
};

class ValueSource {
public:
    ValueSource()
        : m_value(SourceNotSet)
    {
    }
    
    explicit ValueSource(ValueSourceKind kind)
        : m_value(kind)
    {
    }
    
    explicit ValueSource(DFG::Node* node)
        : m_value(bitwise_cast<uintptr_t>(node))
    {
    }
    
    ValueSourceKind kind() const
    {
        if (m_value < static_cast<uintptr_t>(HaveNode))
            return static_cast<ValueSourceKind>(m_value);
        return HaveNode;
    }
    
    bool operator!() const { return kind() != SourceNotSet; }
    
    DFG::Node* node() const
    {
        ASSERT(kind() == HaveNode);
        return bitwise_cast<DFG::Node*>(m_value);
    }
    
    void dump(PrintStream&) const;

private:
    uintptr_t m_value;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLValueSource_h


Return to Bug 113623

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +256 lines
		1	2013-04-12 Filip Pizlo <fpizlo@apple.com>
		2
		3	fourthTier: FTL should have OSR exit
		4	https://bugs.webkit.org/show_bug.cgi?id=113623
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	This implements OSR exit, and hilariously, it actually works. The idea is to have
		9	LLVM call a no-return function on the off-ramp, passing it everything we know about
		10	bytecode state that isn't already flushed to the call frame. Our own JIT takes care
		11	of the rest.
		12
		13	The details are described in FTLOSRExit.h.
		14
		15	* JavaScriptCore.xcodeproj/project.pbxproj:
		16	* assembler/AbstractMacroAssembler.h:
		17	(Address):
		18	(JSC::AbstractMacroAssembler::Address::withOffset):
		19	* assembler/LinkBuffer.h:
		20	(JSC::LinkBuffer::offsetOf):
		21	(LinkBuffer):
		22	* assembler/MacroAssemblerX86Common.h:
		23	* assembler/RepatchBuffer.h:
		24	(JSC::RepatchBuffer::RepatchBuffer):
		25	(JSC::RepatchBuffer::~RepatchBuffer):
		26	(RepatchBuffer):
		27	* bytecode/Operands.h:
		28	(Operands):
		29	(JSC):
		30	(JSC::::dump):
		31	* dfg/DFGAbstractState.cpp:
		32	(JSC::DFG::AbstractState::initialize):
		33	* dfg/DFGGPRInfo.h:
		34	(DFG):
		35	(GPRInfo):
		36	* dfg/DFGMinifiedNode.h:
		37	(JSC::DFG::belongsInMinifiedGraph):
		38	* dfg/DFGNodeType.h:
		39	(JSC::DFG::needsOSRBackwardRewiring):
		40	(DFG):
		41	(JSC::DFG::needsOSRForwardRewiring):
		42	* dfg/DFGOSRExit.cpp:
		43	(JSC::DFG::OSRExit::OSRExit):
		44	(DFG):
		45	(JSC::DFG::OSRExit::convertToForward):
		46	* dfg/DFGOSRExit.h:
		47	(OSRExit):
		48	* dfg/DFGOSRExitBase.cpp: Added.
		49	(DFG):
		50	(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
		51	(JSC::DFG::OSRExitBase::doSearchForForwardConversion):
		52	* dfg/DFGOSRExitBase.h: Added.
		53	(DFG):
		54	(JSC::DFG::OSRExitBase::OSRExitBase):
		55	(OSRExitBase):
		56	(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
		57	* dfg/DFGOSRExitCompiler.cpp:
		58	* dfg/DFGOSRExitCompiler64.cpp:
		59	(JSC::DFG::OSRExitCompiler::compileExit):
		60	* dfg/DFGOSRExitCompilerCommon.cpp:
		61	(JSC::DFG::handleExitCounts):
		62	(JSC::DFG::reifyInlinedCallFrames):
		63	(JSC::DFG::adjustAndJumpToTarget):
		64	* dfg/DFGOSRExitCompilerCommon.h:
65	(DFG):
66	* dfg/DFGOSRExitPreparation.cpp: Added.
67	(DFG):
68	(JSC::DFG::prepareCodeOriginForOSRExit):
69	* dfg/DFGOSRExitPreparation.h: Added.
70	(DFG):
71	* dfg/DFGSpeculativeJIT.cpp:
72	(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
73	* dfg/DFGValueSource.h:
74	(JSC::DFG::ValueSource::forSpeculation):
75	* dfg/DFGVariableEventStream.cpp:
76	(JSC::DFG::VariableEventStream::reconstruct):
77	* ftl/FTLAbbreviations.h:
78	(JSC::FTL::functionType):
79	(FTL):
80	(JSC::FTL::typeOf):
81	(JSC::FTL::buildCall):
82	(JSC::FTL::setTailCall):
83	* ftl/FTLCArgumentGetter.cpp: Added.
84	(FTL):
85	(JSC::FTL::CArgumentGetter::loadNextAndBox):
86	* ftl/FTLCArgumentGetter.h: Added.
87	(FTL):
88	(JSC::FTL::isArgumentRegister):
89	(CArgumentGetter):
90	(JSC::FTL::CArgumentGetter::CArgumentGetter):
91	(JSC::FTL::CArgumentGetter::loadNext8):
92	(JSC::FTL::CArgumentGetter::loadNext32):
93	(JSC::FTL::CArgumentGetter::loadNext64):
94	(JSC::FTL::CArgumentGetter::loadNextPtr):
95	(JSC::FTL::CArgumentGetter::loadNextDouble):
96	(JSC::FTL::CArgumentGetter::nextAddress):
97	* ftl/FTLCompile.cpp:
98	(JSC::FTL::compile):
99	* ftl/FTLExitArgument.cpp: Added.
100	(FTL):
101	(JSC::FTL::ExitArgument::dump):
102	* ftl/FTLExitArgument.h: Added.
103	(FTL):
104	(ExitArgumentRepresentation):
105	(ExitArgument):
106	(JSC::FTL::ExitArgument::ExitArgument):
107	(JSC::FTL::ExitArgument::operator!):
108	(JSC::FTL::ExitArgument::format):
109	(JSC::FTL::ExitArgument::argument):
110	(JSC::FTL::ExitArgument::withFormat):
111	(JSC::FTL::ExitArgument::representation):
112	* ftl/FTLExitArgumentForOperand.cpp: Added.
113	(FTL):
114	(JSC::FTL::ExitArgumentForOperand::dump):
115	* ftl/FTLExitArgumentForOperand.h: Added.
116	(FTL):
117	(ExitArgumentForOperand):
118	(JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
119	(JSC::FTL::ExitArgumentForOperand::operator!):
120	(JSC::FTL::ExitArgumentForOperand::exitArgument):
121	(JSC::FTL::ExitArgumentForOperand::operand):
122	(JSC::FTL::lesserArgumentIndex):
123	* ftl/FTLExitArgumentList.h: Added.
124	(FTL):
125	* ftl/FTLExitThunkGenerator.cpp: Added.
126	(FTL):
127	(JSC::FTL::ExitThunkGenerator::ExitThunkGenerator):
128	(JSC::FTL::ExitThunkGenerator::~ExitThunkGenerator):
129	(JSC::FTL::ExitThunkGenerator::emitThunk):
130	* ftl/FTLExitThunkGenerator.h: Added.
131	(FTL):
132	(ExitThunkGenerator):
133	* ftl/FTLExitValue.cpp: Added.
134	(FTL):
135	(JSC::FTL::ExitValue::dump):
136	* ftl/FTLExitValue.h: Added.
137	(FTL):
138	(ExitValue):
139	(JSC::FTL::ExitValue::ExitValue):
140	(JSC::FTL::ExitValue::operator!):
141	(JSC::FTL::ExitValue::dead):
142	(JSC::FTL::ExitValue::inJSStack):
143	(JSC::FTL::ExitValue::inJSStackAsInt32):
144	(JSC::FTL::ExitValue::inJSStackAsDouble):
145	(JSC::FTL::ExitValue::constant):
146	(JSC::FTL::ExitValue::exitArgument):
147	(JSC::FTL::ExitValue::kind):
148	(JSC::FTL::ExitValue::isDead):
149	(JSC::FTL::ExitValue::isInJSStackSomehow):
150	(JSC::FTL::ExitValue::isConstant):
151	(JSC::FTL::ExitValue::isArgument):
152	* ftl/FTLFormattedValue.h:
153	(FTL):
154	(JSC::FTL::noValue):
155	(JSC::FTL::int32Value):
156	(JSC::FTL::uInt32Value):
157	(JSC::FTL::booleanValue):
158	(JSC::FTL::jsValueValue):
159	(JSC::FTL::doubleValue):
160	* ftl/FTLJITCode.cpp:
161	(JSC::FTL::JITCode::initializeExitThunks):
162	(FTL):
163	(JSC::FTL::JITCode::exitThunks):
164	* ftl/FTLJITCode.h:
165	(JITCode):
166	* ftl/FTLLowerDFGToLLVM.cpp:
167	(FTL):
168	(JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
169	(JSC::FTL::LowerDFGToLLVM::lower):
170	(JSC::FTL::LowerDFGToLLVM::transferAndCheckArguments):
171	(JSC::FTL::LowerDFGToLLVM::compileBlock):
172	(JSC::FTL::LowerDFGToLLVM::compileNode):
173	(JSC::FTL::LowerDFGToLLVM::compileGetLocal):
174	(JSC::FTL::LowerDFGToLLVM::compileSetLocal):
175	(LowerDFGToLLVM):
176	(JSC::FTL::LowerDFGToLLVM::compileMovHint):
177	(JSC::FTL::LowerDFGToLLVM::compileZombieHint):
178	(JSC::FTL::LowerDFGToLLVM::compileMovHintAndCheck):
179	(JSC::FTL::LowerDFGToLLVM::compileAdd):
180	(JSC::FTL::LowerDFGToLLVM::compileArithSub):
181	(JSC::FTL::LowerDFGToLLVM::compileArithMul):
182	(JSC::FTL::LowerDFGToLLVM::compileArithNegate):
183	(JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
184	(JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
185	(JSC::FTL::LowerDFGToLLVM::compileGetByVal):
186	(JSC::FTL::LowerDFGToLLVM::speculateBackward):
187	(JSC::FTL::LowerDFGToLLVM::speculateForward):
188	(JSC::FTL::LowerDFGToLLVM::speculate):
189	(JSC::FTL::LowerDFGToLLVM::terminate):
190	(JSC::FTL::LowerDFGToLLVM::backwardTypeCheck):
191	(JSC::FTL::LowerDFGToLLVM::forwardTypeCheck):
192	(JSC::FTL::LowerDFGToLLVM::typeCheck):
193	(JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
194	(JSC::FTL::LowerDFGToLLVM::lowInt32):
195	(JSC::FTL::LowerDFGToLLVM::lowCell):
196	(JSC::FTL::LowerDFGToLLVM::lowBoolean):
197	(JSC::FTL::LowerDFGToLLVM::speculateObject):
198	(JSC::FTL::LowerDFGToLLVM::isLive):
199	(JSC::FTL::LowerDFGToLLVM::use):
200	(JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
201	(JSC::FTL::LowerDFGToLLVM::appendOSRExit):
202	(JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
203	(JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
204	(JSC::FTL::LowerDFGToLLVM::addExitArgument):
205	(JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
206	(JSC::FTL::LowerDFGToLLVM::observeMovHint):
207	* ftl/FTLOSRExit.cpp: Added.
208	(FTL):
209	(JSC::FTL::OSRExit::OSRExit):
210	(JSC::FTL::OSRExit::codeLocationForRepatch):
211	(JSC::FTL::OSRExit::convertToForward):
212	* ftl/FTLOSRExit.h: Added.
213	(FTL):
214	(OSRExit):
215	* ftl/FTLOSRExitCompilationInfo.h: Added.
216	(FTL):
217	(JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
218	(OSRExitCompilationInfo):
219	* ftl/FTLOSRExitCompiler.cpp: Added.
220	(FTL):
221	(JSC::FTL::compileStub):
222	(JSC::FTL::compileFTLOSRExit):
223	* ftl/FTLOSRExitCompiler.h: Added.
224	(FTL):
225	* ftl/FTLOutput.h:
226	(JSC::FTL::Output::intToPtr):
227	(JSC::FTL::Output::load):
228	(JSC::FTL::Output::store):
229	(Output):
230	(JSC::FTL::Output::call):
231	(JSC::FTL::Output::convertToTailCall):
232	* ftl/FTLState.h:
233	(State):
234	* ftl/FTLThunks.cpp: Added.
235	(FTL):
236	(JSC::FTL::osrExitGenerationThunkGenerator):
237	* ftl/FTLThunks.h: Added.
238	(JSC):
239	(FTL):
240	* ftl/FTLValueFormat.cpp: Added.
241	(WTF):
242	(WTF::printInternal):
243	* ftl/FTLValueFormat.h: Added.
244	(FTL):
245	(WTF):
246	* ftl/FTLValueSource.cpp: Added.
247	(FTL):
248	(JSC::FTL::ValueSource::dump):
249	* ftl/FTLValueSource.h: Added.
250	(FTL):
251	(ValueSource):
252	(JSC::FTL::ValueSource::ValueSource):
253	(JSC::FTL::ValueSource::kind):
254	(JSC::FTL::ValueSource::operator!):
255	(JSC::FTL::ValueSource::node):
256
1	2013-04-12 Filip Pizlo <fpizlo@apple.com>	257	2013-04-12 Filip Pizlo <fpizlo@apple.com>
2		258
3	fourthTier: switch to using MCJIT and disable frame pointer elimination	259	fourthTier: switch to using MCJIT and disable frame pointer elimination

Lines 46-61 class RepatchBuffer { Source/JavaScriptCore/assembler/RepatchBuffer.h_sec1
- Source/JavaScriptCore/assembler/RepatchBuffer.h +8 lines
46	public:	46	public:
47	RepatchBuffer(CodeBlock* codeBlock)	47	RepatchBuffer(CodeBlock* codeBlock)
48	{	48	{
		49	#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
49	RefPtr<JITCode> code = codeBlock->getJITCode();	50	RefPtr<JITCode> code = codeBlock->getJITCode();
50	m_start = code->start();	51	m_start = code->start();
51	m_size = code->size();	52	m_size = code->size();
52		53
53	ExecutableAllocator::makeWritable(m_start, m_size);	54	ExecutableAllocator::makeWritable(m_start, m_size);
		55	#else
		56	UNUSED_PARAM(codeBlock);
		57	#endif
54	}	58	}
55		59
56	~RepatchBuffer()	60	~RepatchBuffer()
57	{	61	{
		62	#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
58	ExecutableAllocator::makeExecutable(m_start, m_size);	63	ExecutableAllocator::makeExecutable(m_start, m_size);
		64	#endif
59	}	65	}
60		66
61	void relink(CodeLocationJump jump, CodeLocationLabel destination)	67	void relink(CodeLocationJump jump, CodeLocationLabel destination)
Lines 170-177 public: Source/JavaScriptCore/assembler/RepatchBuffer.h_sec2
170	}	176	}
171		177
172	private:	178	private:
		179	#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
173	void* m_start;	180	void* m_start;
174	size_t m_size;	181	size_t m_size;
		182	#endif
175	};	183	};
176		184
177	} // namespace JSC	185	} // namespace JSC

Lines 95-101 void AbstractState::initialize(Graph& gr Source/JavaScriptCore/dfg/DFGAbstractState.cpp_sec1
- Source/JavaScriptCore/dfg/DFGAbstractState.cpp -1 / +2 lines
95	continue;	95	continue;
96	}	96	}
97		97
98	SpeculatedType prediction = node->variableAccessData()->prediction();	98	SpeculatedType prediction =
		99	node->variableAccessData()->argumentAwarePrediction();
99	if (isInt32Speculation(prediction))	100	if (isInt32Speculation(prediction))
100	root->valuesAtHead.argument(i).set(SpecInt32);	101	root->valuesAtHead.argument(i).set(SpecInt32);
101	else if (isBooleanSpeculation(prediction))	102	else if (isBooleanSpeculation(prediction))

Lines 36-42 Source/JavaScriptCore/dfg/DFGGPRInfo.h_sec1
- Source/JavaScriptCore/dfg/DFGGPRInfo.h -2 / +2 lines
36	namespace JSC { namespace DFG {	36	namespace JSC { namespace DFG {
37		37
38	typedef MacroAssembler::RegisterID GPRReg;	38	typedef MacroAssembler::RegisterID GPRReg;
39	#define InvalidGPRReg ((GPRReg)-1)	39	#define InvalidGPRReg ((::JSC::DFG::GPRReg)-1)
40		40
41	#if USE(JSVALUE64)	41	#if USE(JSVALUE64)
42	class JSValueRegs {	42	class JSValueRegs {
Lines 367-373 public: Source/JavaScriptCore/dfg/DFGGPRInfo.h_sec2
367	static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3, argumentGPR4, argumentGPR5 };	367	static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3, argumentGPR4, argumentGPR5 };
368	return registerForIndex[index];	368	return registerForIndex[index];
369	}	369	}
370		370
371	static unsigned toIndex(GPRReg reg)	371	static unsigned toIndex(GPRReg reg)
372	{	372	{
373	ASSERT(reg != InvalidGPRReg);	373	ASSERT(reg != InvalidGPRReg);

Lines 287-292 inline NodeFlags defaultFlags(NodeType o Source/JavaScriptCore/dfg/DFGNodeType.h_sec1
- Source/JavaScriptCore/dfg/DFGNodeType.h +19 lines
287	}	287	}
288	}	288	}
289		289
		290	inline bool needsOSRBackwardRewiring(NodeType op)
		291	{
		292	return op == UInt32ToNumber;
		293	}
		294
		295	inline bool needsOSRForwardRewiring(NodeType op)
		296	{
		297	switch (op) {
		298	case Int32ToDouble:
		299	case ForwardInt32ToDouble:
		300	case ValueToInt32:
		301	case UInt32ToNumber:
		302	case DoubleAsInt32:
		303	return true;
		304	default:
		305	return false;
		306	}
		307	}
		308
290	} } // namespace JSC::DFG	309	} } // namespace JSC::DFG
291		310
292	#endif // ENABLE(DFG_JIT)	311	#endif // ENABLE(DFG_JIT)

Lines 36-50 Source/JavaScriptCore/dfg/DFGOSRExit.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRExit.cpp -53 / +8 lines
36	namespace JSC { namespace DFG {	36	namespace JSC { namespace DFG {
37		37
38	OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, SpeculativeJIT* jit, unsigned streamIndex, unsigned recoveryIndex)	38	OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, SpeculativeJIT* jit, unsigned streamIndex, unsigned recoveryIndex)
39	: m_jsValueSource(jsValueSource)	39	: OSRExitBase(kind, jit->m_codeOriginForOSR)
		40	, m_jsValueSource(jsValueSource)
40	, m_valueProfile(valueProfile)	41	, m_valueProfile(valueProfile)
41	, m_patchableCodeOffset(0)	42	, m_patchableCodeOffset(0)
42	, m_codeOrigin(jit->m_codeOriginForOSR)
43	, m_codeOriginForExitProfile(m_codeOrigin)
44	, m_recoveryIndex(recoveryIndex)	43	, m_recoveryIndex(recoveryIndex)
45	, m_watchpointIndex(std::numeric_limits<unsigned>::max())	44	, m_watchpointIndex(std::numeric_limits<unsigned>::max())
46	, m_kind(kind)
47	, m_count(0)
48	, m_streamIndex(streamIndex)	45	, m_streamIndex(streamIndex)
49	, m_lastSetOperand(jit->m_lastSetOperand)	46	, m_lastSetOperand(jit->m_lastSetOperand)
50	{	47	{
Lines 73-129 void OSRExit::correctJump(LinkBuffer& li Source/JavaScriptCore/dfg/DFGOSRExit.cpp_sec2
73	m_patchableCodeOffset = linkBuffer.offsetOf(label);	70	m_patchableCodeOffset = linkBuffer.offsetOf(label);
74	}	71	}
75		72
76	bool OSRExit::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
77	{
78	if (static_cast<double>(m_count) / dfgCodeBlock->osrExitCounter() <= Options::osrExitProminenceForFrequentExitSite())
79	return false;
80
81	FrequentExitSite exitSite;
82
83	if (m_kind == ArgumentsEscaped) {
84	// Count this one globally. It doesn't matter where in the code block the arguments excaped;
85	// the fact that they did is not associated with any particular instruction.
86	exitSite = FrequentExitSite(m_kind);
87	} else
88	exitSite = FrequentExitSite(m_codeOriginForExitProfile.bytecodeIndex, m_kind);
89
90	return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOriginForExitProfile, profiledCodeBlock)->addFrequentExitSite(exitSite);
91	}
92
93	void OSRExit::convertToForward(BasicBlock* block, Node* currentNode, unsigned nodeIndex, const ValueRecovery& valueRecovery)	73	void OSRExit::convertToForward(BasicBlock* block, Node* currentNode, unsigned nodeIndex, const ValueRecovery& valueRecovery)
94	{	74	{
95	// Check that either the current node is a SetLocal, or the preceding node was a	75	Node* node;
96	// SetLocal with the same code origin, or that we've provided a valueRecovery.	76	Node* lastMovHint;
97	if (!ASSERT_DISABLED	77	if (!doSearchForForwardConversion(block, currentNode, nodeIndex, !!valueRecovery, node, lastMovHint))
98	&& !valueRecovery	78	return;
99	&& !currentNode->containsMovHint()) {	79
100	Node* setLocal = block->at(nodeIndex - 1);
101	ASSERT_UNUSED(setLocal, setLocal->containsMovHint());
102	ASSERT_UNUSED(setLocal, setLocal->codeOrigin == currentNode->codeOrigin);
103	}
104
105	// Find the first node for the next bytecode instruction. Also track the last mov hint
106	// on this node.
107	unsigned indexInBlock = nodeIndex + 1;
108	Node* node = 0;
109	Node* lastMovHint = 0;
110	for (;;) {
111	if (indexInBlock == block->size()) {
112	// This is an inline return. Give up and do a backwards speculation. This is safe
113	// because an inline return has its own bytecode index and it's always safe to
114	// reexecute that bytecode.
115	ASSERT(node->op() == Jump);
116	return;
117	}
118	node = block->at(indexInBlock);
119	if (node->containsMovHint() && node->child1() == currentNode)
120	lastMovHint = node;
121	if (node->codeOrigin != currentNode->codeOrigin)
122	break;
123	indexInBlock++;
124	}
125
126	ASSERT(node->codeOrigin != currentNode->codeOrigin);	80	ASSERT(node->codeOrigin != currentNode->codeOrigin);
		81
127	m_codeOrigin = node->codeOrigin;	82	m_codeOrigin = node->codeOrigin;
128		83
129	if (!valueRecovery)	84	if (!valueRecovery)

Lines 1-5 Source/JavaScriptCore/dfg/DFGOSRExit.h_sec1
- Source/JavaScriptCore/dfg/DFGOSRExit.h -17 / +3 lines
1	/*	1	/*
2	* Copyright (C) 2011 Apple Inc. All rights reserved.	2	* Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
3	*	3	*
4	* Redistribution and use in source and binary forms, with or without	4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions	5	* modification, are permitted provided that the following conditions
Lines 34-39 Source/JavaScriptCore/dfg/DFGOSRExit.h_sec2
34	#include "DFGCommon.h"	34	#include "DFGCommon.h"
35	#include "DFGExitProfile.h"	35	#include "DFGExitProfile.h"
36	#include "DFGGPRInfo.h"	36	#include "DFGGPRInfo.h"
		37	#include "DFGOSRExitBase.h"
37	#include "DFGValueRecoveryOverride.h"	38	#include "DFGValueRecoveryOverride.h"
38	#include "MacroAssembler.h"	39	#include "MacroAssembler.h"
39	#include "MethodOfGettingAValueProfile.h"	40	#include "MethodOfGettingAValueProfile.h"
Lines 84-90 private: Source/JavaScriptCore/dfg/DFGOSRExit.h_sec3
84	//	85	//
85	// This structure describes how to exit the speculative path by	86	// This structure describes how to exit the speculative path by
86	// going into baseline code.	87	// going into baseline code.
87	struct OSRExit {	88	struct OSRExit : public OSRExitBase {
88	OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = UINT_MAX);	89	OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = UINT_MAX);
89		90
90	MacroAssemblerCodeRef m_code;	91	MacroAssemblerCodeRef m_code;
Lines 93-114 struct OSRExit { Source/JavaScriptCore/dfg/DFGOSRExit.h_sec4
93	MethodOfGettingAValueProfile m_valueProfile;	94	MethodOfGettingAValueProfile m_valueProfile;
94		95
95	unsigned m_patchableCodeOffset;	96	unsigned m_patchableCodeOffset;
96	CodeOrigin m_codeOrigin;
97	CodeOrigin m_codeOriginForExitProfile;
98		97
99	unsigned m_recoveryIndex;	98	unsigned m_recoveryIndex;
100	unsigned m_watchpointIndex;	99	unsigned m_watchpointIndex;
101		100
102	ExitKind m_kind;
103	uint32_t m_count;
104
105	bool considerAddingAsFrequentExitSite(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
106	{
107	if (!m_count \|\| !exitKindIsCountable(m_kind))
108	return false;
109	return considerAddingAsFrequentExitSiteSlow(dfgCodeBlock, profiledCodeBlock);
110	}
111
112	void setPatchableCodeOffset(MacroAssembler::PatchableJump);	101	void setPatchableCodeOffset(MacroAssembler::PatchableJump);
113	MacroAssembler::Jump getPatchableCodeOffsetAsJump() const;	102	MacroAssembler::Jump getPatchableCodeOffsetAsJump() const;
114	CodeLocationJump codeLocationForRepatch(CodeBlock*) const;	103	CodeLocationJump codeLocationForRepatch(CodeBlock*) const;
Lines 120-128 struct OSRExit { Source/JavaScriptCore/dfg/DFGOSRExit.h_sec5
120	int m_lastSetOperand;	109	int m_lastSetOperand;
121		110
122	RefPtr<ValueRecoveryOverride> m_valueRecoveryOverride;	111	RefPtr<ValueRecoveryOverride> m_valueRecoveryOverride;
123
124	private:
125	bool considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock);
126	};	112	};
127		113
128	struct SpeculationFailureDebugInfo {	114	struct SpeculationFailureDebugInfo {

Line 0 Source/JavaScriptCore/dfg/DFGOSRExitBase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRExitBase.cpp +97 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "DFGOSRExitBase.h"
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "CodeBlock.h"
		32	#include "DFGBasicBlock.h"
		33	#include "DFGNode.h"
		34	#include "Operations.h"
		35
		36	namespace JSC { namespace DFG {
		37
		38	bool OSRExitBase::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
		39	{
		40	if (static_cast<double>(m_count) / dfgCodeBlock->osrExitCounter() <= Options::osrExitProminenceForFrequentExitSite())
		41	return false;
		42
		43	FrequentExitSite exitSite;
		44
		45	if (m_kind == ArgumentsEscaped) {
		46	// Count this one globally. It doesn't matter where in the code block the arguments excaped;
		47	// the fact that they did is not associated with any particular instruction.
		48	exitSite = FrequentExitSite(m_kind);
		49	} else
		50	exitSite = FrequentExitSite(m_codeOriginForExitProfile.bytecodeIndex, m_kind);
		51
		52	return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOriginForExitProfile, profiledCodeBlock)->addFrequentExitSite(exitSite);
		53	}
		54
		55	bool OSRExitBase::doSearchForForwardConversion(
		56	BasicBlock* block, Node* currentNode, unsigned nodeIndex, bool hasValueRecovery,
		57	Node& node, Node& lastMovHint)
		58	{
		59	// Check that either the current node is a SetLocal, or the preceding node was a
		60	// SetLocal with the same code origin, or that we've provided a valueRecovery.
		61	if (!ASSERT_DISABLED
		62	&& !hasValueRecovery
		63	&& !currentNode->containsMovHint()) {
		64	Node* setLocal = block->at(nodeIndex - 1);
65	ASSERT_UNUSED(setLocal, setLocal->containsMovHint());
66	ASSERT_UNUSED(setLocal, setLocal->codeOrigin == currentNode->codeOrigin);
67	}
68
69	// Find the first node for the next bytecode instruction. Also track the last mov hint
70	// on this node.
71	unsigned indexInBlock = nodeIndex + 1;
72	node = 0;
73	lastMovHint = 0;
74	for (;;) {
75	if (indexInBlock == block->size()) {
76	// This is an inline return. Give up and do a backwards speculation. This is safe
77	// because an inline return has its own bytecode index and it's always safe to
78	// reexecute that bytecode.
79	ASSERT(node->op() == Jump);
80	return false;
81	}
82	node = block->at(indexInBlock);
83	if (node->containsMovHint() && node->child1() == currentNode)
84	lastMovHint = node;
85	if (node->codeOrigin != currentNode->codeOrigin)
86	break;
87	indexInBlock++;
88	}
89
90	ASSERT(node->codeOrigin != currentNode->codeOrigin);
91	return true;
92	}
93
94	} } // namespace JSC::DFG
95
96	#endif // ENABLE(DFG_JIT)
97

Lines 31-36 Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp -14 / +2 lines
31	#include "CallFrame.h"	31	#include "CallFrame.h"
32	#include "DFGCommon.h"	32	#include "DFGCommon.h"
33	#include "DFGJITCode.h"	33	#include "DFGJITCode.h"
		34	#include "DFGOSRExitPreparation.h"
34	#include "LinkBuffer.h"	35	#include "LinkBuffer.h"
35	#include "Operations.h"	36	#include "Operations.h"
36	#include "RepatchBuffer.h"	37	#include "RepatchBuffer.h"
Lines 54-73 void compileOSRExit(ExecState* exec) Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp_sec2
54	uint32_t exitIndex = globalData->osrExitIndex;	55	uint32_t exitIndex = globalData->osrExitIndex;
55	OSRExit& exit = codeBlock->getJITCode()->dfg()->osrExit[exitIndex];	56	OSRExit& exit = codeBlock->getJITCode()->dfg()->osrExit[exitIndex];
56		57
57	// Make sure all code on our inline stack is JIT compiled. This is necessary since	58	prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
58	// we may opt to inline a code block even before it had ever been compiled by the
59	// JIT, but our OSR exit infrastructure currently only works if the target of the
60	// OSR exit is JIT code. This could be changed since there is nothing particularly
61	// hard about doing an OSR exit into the interpreter, but for now this seems to make
62	// sense in that if we're OSR exiting from inlined code of a DFG code block, then
63	// probably it's a good sign that the thing we're exiting into is hot. Even more
64	// interestingly, since the code was inlined, it may never otherwise get JIT
65	// compiled since the act of inlining it may ensure that it otherwise never runs.
66	for (CodeOrigin codeOrigin = exit.m_codeOrigin; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->caller) {
67	static_cast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())
68	->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)
69	->jitCompile(exec);
70	}
71		59
72	// Compute the value recoveries.	60	// Compute the value recoveries.
73	Operands<ValueRecovery> operands;	61	Operands<ValueRecovery> operands;

Line 0 Source/JavaScriptCore/dfg/DFGOSRExitPreparation.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRExitPreparation.cpp +49 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGOSRExitPreparation.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	#include "CodeBlock.h"
	32	#include "Executable.h"
	33	#include "Operations.h"
	34
	35	namespace JSC { namespace DFG {
	36
	37	void prepareCodeOriginForOSRExit(ExecState* exec, CodeOrigin codeOrigin)
	38	{
	39	for (; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->caller) {
	40	static_cast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())
	41	->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)
	42	->jitCompile(exec);
	43	}
	44	}
	45
	46	} } // namespace JSC::DFG
	47
	48	#endif // ENABLE(DFG_JIT)
	49

Lines 214-220 void VariableEventStream::reconstruct( Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp_sec1
- Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp -1 / +2 lines
214		214
215	bool found = false;	215	bool found = false;
216		216
217	if (node && node->op() == UInt32ToNumber) {	217	if (node && needsOSRBackwardRewiring(node->op())) {
218	MinifiedID id = node->child1();	218	MinifiedID id = node->child1();
219	if (tryToSetConstantRecovery(valueRecoveries[i], codeBlock, graph.at(id)))	219	if (tryToSetConstantRecovery(valueRecoveries[i], codeBlock, graph.at(id)))
220	continue;	220	continue;
Lines 257-262 void VariableEventStream::reconstruct( Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp_sec2
257	doubleAsInt32ID = id;	257	doubleAsInt32ID = id;
258	break;	258	break;
259	default:	259	default:
		260	ASSERT(!needsOSRForwardRewiring(node->op()));
260	break;	261	break;
261	}	262	}
262	}	263	}

Line 0 Source/JavaScriptCore/ftl/FTLCArgumentGetter.cpp_sec1
- Source/JavaScriptCore/ftl/FTLCArgumentGetter.cpp +99 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "FTLCArgumentGetter.h"
		28
		29	#if ENABLE(FTL_JIT)
		30
		31	namespace JSC { namespace FTL {
		32
		33	using namespace DFG;
		34
		35	void CArgumentGetter::loadNextAndBox(ValueFormat format, GPRReg destination, GPRReg scratch)
		36	{
		37	if (scratch == InvalidGPRReg) {
		38	if (destination == GPRInfo::nonArgGPR0)
		39	scratch = GPRInfo::nonArgGPR1;
		40	else
		41	scratch = GPRInfo::nonArgGPR0;
		42	}
		43
		44	switch (format) {
		45	case ValueFormatInt32: {
		46	loadNext32(destination);
		47	m_jit.or64(GPRInfo::tagTypeNumberRegister, destination);
		48	break;
		49	}
		50
		51	case ValueFormatUInt32: {
		52	loadNext32(destination);
		53	MacroAssembler::Jump isInt = m_jit.branch32(
		54	MacroAssembler::GreaterThanOrEqual,
		55	destination, MacroAssembler::TrustedImm32(0));
		56
		57	m_jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch);
		58	m_jit.convertInt32ToDouble(destination, FPRInfo::fpRegT0);
		59	m_jit.boxDouble(FPRInfo::fpRegT0, destination);
		60	m_jit.move64ToDouble(scratch, FPRInfo::fpRegT0);
		61
		62	MacroAssembler::Jump done = m_jit.jump();
		63
		64	isInt.link(&m_jit);
65	m_jit.or64(GPRInfo::tagTypeNumberRegister, destination);
66
67	done.link(&m_jit);
68	break;
69	}
70
71	case ValueFormatBoolean: {
72	loadNext8(destination);
73	m_jit.or32(MacroAssembler::TrustedImm32(ValueFalse), destination);
74	break;
75	}
76
77	case ValueFormatJSValue: {
78	loadNext64(destination);
79	break;
80	}
81
82	case ValueFormatDouble: {
83	m_jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch);
84	loadNextDouble(FPRInfo::fpRegT0);
85	m_jit.boxDouble(FPRInfo::fpRegT0, destination);
86	m_jit.move64ToDouble(scratch, FPRInfo::fpRegT0);
87	break;
88	}
89
90	default:
91	RELEASE_ASSERT_NOT_REACHED();
92	break;
93	}
94	}
95
96	} } // namespace JSC::FTL
97
98	#endif // ENABLE(FTL_JIT)
99

Lines 87-95 void compile(State& state, RefPtr<JSC::J Source/JavaScriptCore/ftl/FTLCompile.cpp_sec1
- Source/JavaScriptCore/ftl/FTLCompile.cpp -2 / +2 lines
87	// FIXME: This is a total kludge - LLVM should just use our calling convention.	87	// FIXME: This is a total kludge - LLVM should just use our calling convention.
88	// https://bugs.webkit.org/show_bug.cgi?id=113621	88	// https://bugs.webkit.org/show_bug.cgi?id=113621
89	CCallHelpers jit(&state.graph.m_globalData, state.graph.m_codeBlock);	89	CCallHelpers jit(&state.graph.m_globalData, state.graph.m_codeBlock);
90		90
91	compileEntry(jit);	91	compileEntry(jit);
92		92
93	// This part is only necessary for functions. We currently only compile functions.	93	// This part is only necessary for functions. We currently only compile functions.
94		94
95	CCallHelpers::Label fromArityCheck = jit.label();	95	CCallHelpers::Label fromArityCheck = jit.label();

Line 0 Source/JavaScriptCore/ftl/FTLExitArgument.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitArgument.cpp +41 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLExitArgument.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	namespace JSC { namespace FTL {
	32
	33	void ExitArgument::dump(PrintStream& out) const
	34	{
	35	out.print("arg", argument(), " as ", format());
	36	}
	37
	38	} } // namespace JSC::FTL
	39
	40	#endif // ENABLE(FTL_JIT)
	41

Line 0 Source/JavaScriptCore/ftl/FTLExitThunkGenerator.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitThunkGenerator.cpp +60 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLExitThunkGenerator.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	#include "FTLOSRExitCompilationInfo.h"
	32	#include "FTLState.h"
	33
	34	namespace JSC { namespace FTL {
	35
	36	using namespace JSC::DFG;
	37
	38	ExitThunkGenerator::ExitThunkGenerator(State& state)
	39	: CCallHelpers(&state.graph.m_globalData, state.graph.m_codeBlock)
	40	, m_state(state)
	41	{
	42	}
	43
	44	ExitThunkGenerator::~ExitThunkGenerator()
	45	{
	46	}
	47
	48	void ExitThunkGenerator::emitThunk(unsigned index)
	49	{
	50	OSRExitCompilationInfo& info = m_state.osrExit[index];
	51
	52	info.m_thunkLabel = label();
	53	move(TrustedImm32(index), GPRInfo::nonArgGPR0);
	54	info.m_thunkJump = patchableJump();
	55	}
	56
	57	} } // namespace JSC::FTL
	58
	59	#endif // ENABLE(FTL_JIT)
	60

Line 0 Source/JavaScriptCore/ftl/FTLExitValue.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitValue.cpp +65 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLExitValue.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	namespace JSC { namespace FTL {
	32
	33	void ExitValue::dump(PrintStream& out) const
	34	{
	35	switch (kind()) {
	36	case InvalidExitValue:
	37	out.print("Invalid");
	38	return;
	39	case ExitValueDead:
	40	out.print("Dead");
	41	return;
	42	case ExitValueArgument:
	43	out.print("Argument(", exitArgument(), ")");
	44	return;
	45	case ExitValueConstant:
	46	out.print("Constant(", constant(), ")");
	47	return;
	48	case ExitValueInJSStack:
	49	out.print("InJSStack");
	50	return;
	51	case ExitValueInJSStackAsInt32:
	52	out.print("InJSStackAsInt32");
	53	return;
	54	case ExitValueInJSStackAsDouble:
	55	out.print("InJSStackAsDouble");
	56	return;
	57	}
	58
	59	RELEASE_ASSERT_NOT_REACHED();
	60	}
	61
	62	} } // namespace JSC::FTL
	63
	64	#endif // ENABLE(FTL_JIT)
65

Lines 31-36 Source/JavaScriptCore/ftl/FTLFormattedValue.h_sec1
- Source/JavaScriptCore/ftl/FTLFormattedValue.h -12 / +8 lines
31	#if ENABLE(FTL_JIT)	31	#if ENABLE(FTL_JIT)
32		32
33	#include "FTLAbbreviations.h"	33	#include "FTLAbbreviations.h"
		34	#include "FTLValueFormat.h"
34		35
35	namespace JSC { namespace FTL {	36	namespace JSC { namespace FTL {
36		37
Lines 41-58 namespace JSC { namespace FTL { Source/JavaScriptCore/ftl/FTLFormattedValue.h_sec2
41	// use this in situations where there is no good way to say what node the value came	42	// use this in situations where there is no good way to say what node the value came
42	// from.	43	// from.
43		44
44	// Note that this is awkwardly similar to DataFormat in other parts of JSC, except that
45	// unlike DataFormat and like ValueRecovery, it distinguishes between UInt32 and Int32.
46
47	enum ValueFormat {
48	InvalidValueFormat,
49	ValueFormatInt32,
50	ValueFormatUInt32,
51	ValueFormatBoolean,
52	ValueFormatJSValue,
53	ValueFormatDouble
54	};
55
56	class FormattedValue {	45	class FormattedValue {
57	public:	46	public:
58	FormattedValue()	47	FormattedValue()
Lines 81-86 private: Source/JavaScriptCore/ftl/FTLFormattedValue.h_sec3
81	LValue m_value;	70	LValue m_value;
82	};	71	};
83		72
		73	static inline FormattedValue noValue() { return FormattedValue(); }
		74	static inline FormattedValue int32Value(LValue value) { return FormattedValue(ValueFormatInt32, value); }
		75	static inline FormattedValue uInt32Value(LValue value) { return FormattedValue(ValueFormatUInt32, value); }
		76	static inline FormattedValue booleanValue(LValue value) { return FormattedValue(ValueFormatBoolean, value); }
		77	static inline FormattedValue jsValueValue(LValue value) { return FormattedValue(ValueFormatJSValue, value); }
		78	static inline FormattedValue doubleValue(LValue value) { return FormattedValue(ValueFormatDouble, value); }
		79
84	} } // namespace JSC::FTL	80	} } // namespace JSC::FTL
85		81
86	#endif // ENABLE(FTL_JIT)	82	#endif // ENABLE(FTL_JIT)

Line 0 Source/JavaScriptCore/ftl/FTLOSRExit.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOSRExit.cpp +103 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "FTLOSRExit.h"
		28
		29	#if ENABLE(FTL_JIT)
		30
		31	#include "CodeBlock.h"
		32	#include "DFGBasicBlock.h"
		33	#include "DFGNode.h"
		34	#include "FTLExitArgument.h"
		35	#include "FTLExitArgumentList.h"
		36	#include "FTLJITCode.h"
		37	#include "Operations.h"
		38
		39	namespace JSC { namespace FTL {
		40
		41	using namespace DFG;
		42
		43	OSRExit::OSRExit(
		44	ExitKind exitKind, ValueFormat profileValueFormat,
		45	MethodOfGettingAValueProfile valueProfile, CodeOrigin codeOrigin,
		46	int lastSetOperand, unsigned numberOfArguments, unsigned numberOfLocals)
		47	: OSRExitBase(exitKind, codeOrigin)
		48	, m_profileValueFormat(profileValueFormat)
		49	, m_valueProfile(valueProfile)
		50	, m_patchableCodeOffset(0)
		51	, m_lastSetOperand(lastSetOperand)
		52	, m_values(numberOfArguments, numberOfLocals)
		53	{
		54	}
		55
		56	CodeLocationJump OSRExit::codeLocationForRepatch(CodeBlock* ftlCodeBlock) const
		57	{
		58	return CodeLocationJump(
		59	reinterpret_cast<char*>(
		60	ftlCodeBlock->getJITCode()->ftl()->exitThunks().dataLocation()) +
		61	m_patchableCodeOffset);
		62	}
		63
		64	void OSRExit::convertToForward(
65	BasicBlock* block, Node* currentNode, unsigned nodeIndex,
66	const FormattedValue &value, ExitArgumentList& arguments)
67	{
68	Node* node;
69	Node* lastMovHint;
70	if (!doSearchForForwardConversion(block, currentNode, nodeIndex, !!value, node, lastMovHint))
71	return;
72
73	ASSERT(node->codeOrigin != currentNode->codeOrigin);
74
75	m_codeOrigin = node->codeOrigin;
76
77	if (!value)
78	return;
79
80	int overriddenOperand = lastMovHint->local();
81	m_lastSetOperand = overriddenOperand;
82
83	// Is the value for this operand being passed as an argument to the exit, or is
84	// it something else? If it's an argument already, then replace that argument;
85	// otherwise add another argument.
86	if (m_values[overriddenOperand].isArgument()) {
87	ExitArgument exitArgument = m_values[overriddenOperand].exitArgument();
88	arguments[exitArgument.argument()] = value.value();
89	m_values[overriddenOperand] = ExitValue::exitArgument(
90	exitArgument.withFormat(value.format()));
91	return;
92	}
93
94	unsigned argument = arguments.size();
95	arguments.append(value.value());
96	m_values[m_lastSetOperand] = ExitValue::exitArgument(
97	ExitArgument(value.format(), argument));
98	}
99
100	} } // namespace JSC::FTL
101
102	#endif // ENABLE(FTL_JIT)
103

Line 0 Source/JavaScriptCore/ftl/FTLOSRExit.h_sec1
- Source/JavaScriptCore/ftl/FTLOSRExit.h +179 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#ifndef FTLOSRExit_h
		27	#define FTLOSRExit_h
		28
		29	#include <wtf/Platform.h>
		30
		31	#if ENABLE(FTL_JIT)
		32
		33	#include "CodeOrigin.h"
		34	#include "DFGExitProfile.h"
		35	#include "DFGOSRExitBase.h"
		36	#include "FTLAbbreviations.h"
		37	#include "FTLExitArgumentList.h"
		38	#include "FTLExitValue.h"
		39	#include "FTLFormattedValue.h"
		40	#include "MethodOfGettingAValueProfile.h"
		41	#include "Operands.h"
		42	#include "ValueProfile.h"
		43
		44	namespace JSC { namespace FTL {
		45
		46	// Tracks one OSR exit site within the FTL JIT. OSR exit in FTL works by deconstructing
		47	// the crazy that is OSR down to simple SSA CFG primitives that any compiler backend
		48	// (including of course LLVM) can grok and do meaningful things to. Except for
		49	// watchpoint-based exits, which haven't yet been implemented (see webkit.org/b/113647),
		50	// an exit is just a conditional branch in the emitted code where one destination is the
		51	// continuation and the other is a basic block that performs a no-return tail-call to an
		52	// exit thunk. This thunk takes as its arguments the live non-constant
		53	// not-already-accounted-for bytecode state. To appreciate how this works consider the
		54	// following JavaScript program, and its lowering down to LLVM IR including the relevant
		55	// exits:
		56	//
		57	// function foo(o) {
		58	// var a = o.a; // predicted int
		59	// var b = o.b;
		60	// var c = o.c; // NB this is dead
		61	// a = a \| 5; // our example OSR exit: need to check if a is an int
		62	// return a + b;
		63	// }
		64	//
65	// Just consider the "a \| 5". In the DFG IR, this looks like:
66	//
67	// BitOr(Check:Int32:@a, Int32:5)
68	//
69	// Where @a is the node for the GetLocal node that gets the value of the 'a' variable.
70	// Conceptually, this node can be further broken down to the following (note that this
71	// particular lowering never actually happens - we skip this step and go straight to
72	// LLVM IR - but it's still useful to see this):
73	//
74	// exitIf(@a is not int32);
75	// continuation;
76	//
77	// Where 'exitIf()' is a function that will exit if the argument is true, and
78	// 'continuation' is the stuff that we will do after the exitIf() check. (Note that
79	// FTL refers to 'exitIf()' as 'speculate()', which is in line with DFG terminology.)
80	// This then gets broken down to the following LLVM IR, assuming that %0 is the LLVM
81	// value corresponding to variable 'a', and %1 is the LLVM value for variable 'b':
82	//
83	// %2 = ... // the predictate corresponding to '@a is not int32'
84	// br i1 %2, label %3, label %4
85	// ; <label>:3
86	// call void exitThunk1(%0, %1) // pass 'a' and 'b', since they're both live-in-bytecode
87	// unreachable
88	// ; <label>:4
89	// ... // code for the continuation
90	//
91	// Where 'exitThunk1' is the IR to get the exit thunk for this OSR exit. Each OSR
92	// exit will appear to LLVM to have a distinct exit thunk.
93	//
94	// Note that this didn't have to pass '5', 'o', or 'c' to the exit thunk. 5 is a
95	// constant and the DFG already knows that, and can already tell the OSR exit machinery
96	// what that contant is and which bytecode variables (if any) it needs to be dropped
97	// into. This is conveyed to the exit statically, via the OSRExit data structure below.
98	// See the code for ExitValue for details. 'o' is an argument, and arguments are always
99	// "flushed" - if you never assign them then their values are still in the argument
100	// stack slots, and if you do assign them then we eagerly store them into those slots.
101	// 'c' is dead in bytecode, and the DFG knows this; we statically tell the exit thunk
102	// that it's dead and don't have to pass anything. The exit thunk will "initialize" its
103	// value to Undefined.
104	//
105	// This approach to OSR exit has a number of virtues:
106	//
107	// - It is an entirely unsurprising representation for a compiler that already groks
108	// CFG-like IRs for C-like languages. All existing analyses and transformations just
109	// work.
110	//
111	// - It lends itself naturally to modern approaches to code motion. For example, you
112	// could sink operations from above the exit to below it, if you just duplicate the
113	// operation into the OSR exit block. This is both legal and desirable. It works
114	// because the backend sees the OSR exit block as being no different than any other,
115	// and LLVM already supports sinking if it sees that a value is only partially used.
116	// Hence there exists a value that dominates the exit but is only used by the exit
117	// thunk and not by the continuation, sinking ought to kick in for that value.
118	// Hoisting operations from below it to above it is also possible, for similar
119	// reasons.
120	//
121	// - The no-return tail-call to the OSR exit thunk can be subjected to specialized
122	// code-size reduction optimizations, though this is optional. For example, instead
123	// of actually emitting a call along with all that goes with it (like placing the
124	// arguments into argument position), the backend could choose to simply inform us
125	// where it had placed the arguments and expect the callee (i.e. the exit thunk) to
126	// figure it out from there. It could also tell us what we need to do to pop stack,
127	// although again, it doesn't have to; it could just emit that code normally. Though
128	// we don't support this yet, we could; the only thing that would change on our end
129	// is that we'd need feedback from the backend about the location of the arguments
130	// and a description of the things that need to be done to pop stack. This would
131	// involve switching the m_values array to use something more akin to ValueRecovery
132	// rather than the current ExitValue, albeit possibly with some hacks to better
133	// understand the kinds of places where the LLVM backend would put values.
134	//
135	// - It could be extended to allow the backend to do its own exit hoisting, by using
136	// intrinsics (or meta-data, or something) to inform the backend that it's safe to
137	// make the predicate passed to 'exitIf()' more truthy.
138	//
139	// - It could be extended to support watchpoints (see webkit.org/b/113647) by making
140	// the predicate passed to 'exitIf()' be an intrinsic that the backend knows to be
141	// true at compile-time. The backend could then turn the conditional branch into a
142	// replaceable jump, much like the DFG does.
143
144	struct OSRExit : public DFG::OSRExitBase {
145	OSRExit(
146	ExitKind, ValueFormat profileValueFormat, MethodOfGettingAValueProfile,
147	CodeOrigin, int lastSetOperand, unsigned numberOfArguments,
148	unsigned numberOfLocals);
149
150	MacroAssemblerCodeRef m_code;
151
152	// The first argument to the exit call may be a value we wish to profile.
153	// If that's the case, the format will be not Invalid and we'll have a
154	// method of getting a value profile. Note that all of the ExitArgument's
155	// are already aware of this possible off-by-one, so there is no need to
156	// correct them.
157	ValueFormat m_profileValueFormat;
158	MethodOfGettingAValueProfile m_valueProfile;
159
160	// Offset within the exit stubs of the stub for this exit.
161	unsigned m_patchableCodeOffset;
162
163	int m_lastSetOperand;
164
165	Operands<ExitValue> m_values;
166
167	CodeLocationJump codeLocationForRepatch(CodeBlock* ftlCodeBlock) const;
168
169	void convertToForward(
170	DFG::BasicBlock, DFG::Node currentNode, unsigned nodeIndex,
171	const FormattedValue&, ExitArgumentList& arguments);
172	};
173
174	} } // namespace JSC::FTL
175
176	#endif // ENABLE(FTL_JIT)
177
178	#endif // FTLOSRExit_h
179

Line 0 Source/JavaScriptCore/ftl/FTLOSRExitCompilationInfo.h_sec1
- Source/JavaScriptCore/ftl/FTLOSRExitCompilationInfo.h +54 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#ifndef FTLOSRExitCompilationInfo_h
	27	#define FTLOSRExitCompilationInfo_h
	28
	29	#include <wtf/Platform.h>
	30
	31	#if ENABLE(FTL_JIT)
	32
	33	#include "FTLAbbreviations.h"
	34	#include "MacroAssembler.h"
	35
	36	namespace JSC { namespace FTL {
	37
	38	struct OSRExitCompilationInfo {
	39	OSRExitCompilationInfo()
	40	: m_thunkAddress(0)
	41	{
	42	}
	43
	44	MacroAssembler::Label m_thunkLabel;
	45	MacroAssembler::PatchableJump m_thunkJump;
	46	LValue m_thunkAddress;
	47	};
	48
	49	} } // namespace JSC::FTL
	50
	51	#endif // ENABLE(FTL_JIT)
	52
	53	#endif // FTLOSRExitCompilationInfo_h
	54

Lines 135-153 public: Source/JavaScriptCore/ftl/FTLOutput.h_sec1
- Source/JavaScriptCore/ftl/FTLOutput.h -2 / +11 lines
135	LValue zeroExt(LValue value, LType type) { return buildZExt(m_builder, value, type); }	135	LValue zeroExt(LValue value, LType type) { return buildZExt(m_builder, value, type); }
136	LValue intCast(LValue value, LType type) { return buildIntCast(m_builder, value, type); }	136	LValue intCast(LValue value, LType type) { return buildIntCast(m_builder, value, type); }
137	LValue castToInt32(LValue value) { return intCast(value, int32); }	137	LValue castToInt32(LValue value) { return intCast(value, int32); }
		138	LValue intToPtr(LValue value, LType type) { return buildIntToPtr(m_builder, value, type); }
138		139
139	LValue get(LValue reference) { return buildLoad(m_builder, reference); }	140	LValue get(LValue reference) { return buildLoad(m_builder, reference); }
140	LValue set(LValue value, LValue reference) { return buildStore(m_builder, value, reference); }	141	LValue set(LValue value, LValue reference) { return buildStore(m_builder, value, reference); }
141		142
142	LValue load(TypedPointer pointer, LType refType)	143	LValue load(TypedPointer pointer, LType refType)
143	{	144	{
144	LValue result = get(buildIntToPtr(m_builder, pointer.value(), refType));	145	LValue result = get(intToPtr(pointer.value(), refType));
145	pointer.heap().decorateInstruction(result, *m_heaps);	146	pointer.heap().decorateInstruction(result, *m_heaps);
146	return result;	147	return result;
147	}	148	}
148	void store(LValue value, TypedPointer pointer, LType refType)	149	void store(LValue value, TypedPointer pointer, LType refType)
149	{	150	{
150	LValue result = set(value, buildIntToPtr(m_builder, pointer.value(), refType));	151	LValue result = set(value, intToPtr(pointer.value(), refType));
151	pointer.heap().decorateInstruction(result, *m_heaps);	152	pointer.heap().decorateInstruction(result, *m_heaps);
152	}	153	}
153		154
Lines 244-253 public: Source/JavaScriptCore/ftl/FTLOutput.h_sec2
244	LValue select(LValue value, LValue taken, LValue notTaken) { return buildSelect(m_builder, value, taken, notTaken); }	245	LValue select(LValue value, LValue taken, LValue notTaken) { return buildSelect(m_builder, value, taken, notTaken); }
245	LValue extractValue(LValue aggVal, unsigned index) { return buildExtractValue(m_builder, aggVal, index); }	246	LValue extractValue(LValue aggVal, unsigned index) { return buildExtractValue(m_builder, aggVal, index); }
246		247
		248	template<typename VectorType>
		249	LValue call(LValue function, const VectorType& vector) { return buildCall(m_builder, function, vector); }
247	LValue call(LValue function) { return buildCall(m_builder, function); }	250	LValue call(LValue function) { return buildCall(m_builder, function); }
248	LValue call(LValue function, LValue arg1) { return buildCall(m_builder, function, arg1); }	251	LValue call(LValue function, LValue arg1) { return buildCall(m_builder, function, arg1); }
249	LValue call(LValue function, LValue arg1, LValue arg2) { return buildCall(m_builder, function, arg1, arg2); }	252	LValue call(LValue function, LValue arg1, LValue arg2) { return buildCall(m_builder, function, arg1, arg2); }
250		253
		254	LValue convertToTailCall(LValue call)
		255	{
		256	setTailCall(call, IsTailCall);
		257	return call;
		258	}
		259
251	void jump(LBasicBlock destination) { buildBr(m_builder, destination); }	260	void jump(LBasicBlock destination) { buildBr(m_builder, destination); }
252	void branch(LValue condition, LBasicBlock taken, LBasicBlock notTaken) { buildCondBr(m_builder, condition, taken, notTaken); }	261	void branch(LValue condition, LBasicBlock taken, LBasicBlock notTaken) { buildCondBr(m_builder, condition, taken, notTaken); }
253	void ret(LValue value) { buildRet(m_builder, value); }	262	void ret(LValue value) { buildRet(m_builder, value); }

Lines 33-38 Source/JavaScriptCore/ftl/FTLState.h_sec1
- Source/JavaScriptCore/ftl/FTLState.h +2 lines
33	#include "DFGGraph.h"	33	#include "DFGGraph.h"
34	#include "FTLAbbreviations.h"	34	#include "FTLAbbreviations.h"
35	#include "FTLJITCode.h"	35	#include "FTLJITCode.h"
		36	#include "FTLOSRExitCompilationInfo.h"
36	#include <wtf/Noncopyable.h>	37	#include <wtf/Noncopyable.h>
37		38
38	namespace JSC { namespace FTL {	39	namespace JSC { namespace FTL {
Lines 49-54 public: Source/JavaScriptCore/ftl/FTLState.h_sec2
49	LModule module;	50	LModule module;
50	LValue function;	51	LValue function;
51	RefPtr<JITCode> jitCode;	52	RefPtr<JITCode> jitCode;
		53	Vector<OSRExitCompilationInfo> osrExit;
52		54
53	void dumpState(const char* when);	55	void dumpState(const char* when);
54	};	56	};

Line 0 Source/JavaScriptCore/ftl/FTLThunks.cpp_sec1
- Source/JavaScriptCore/ftl/FTLThunks.cpp +98 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "FTLThunks.h"
		28
		29	#if ENABLE(FTL_JIT)
		30
		31	#include "DFGGPRInfo.h"
		32	#include "DFGFPRInfo.h"
		33	#include "FTLOSRExitCompiler.h"
		34	#include "LinkBuffer.h"
		35	#include "MacroAssembler.h"
		36
		37	namespace JSC { namespace FTL {
		38
		39	using namespace DFG;
		40
		41	MacroAssemblerCodeRef osrExitGenerationThunkGenerator(JSGlobalData* globalData)
		42	{
		43	MacroAssembler jit;
		44
		45	// Pretend that we're a C call frame.
		46	jit.push(MacroAssembler::framePointerRegister);
		47	jit.move(MacroAssembler::stackPointerRegister, MacroAssembler::framePointerRegister);
		48	jit.push(GPRInfo::regT0);
		49	jit.push(GPRInfo::regT0);
		50
		51	size_t scratchSize = sizeof(EncodedJSValue) * (GPRInfo::numberOfArgumentRegisters + FPRInfo::numberOfArgumentRegisters);
		52	ScratchBuffer* scratchBuffer = globalData->scratchBufferForSize(scratchSize);
		53	EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
		54
		55	for (unsigned i = 0; i < GPRInfo::numberOfArgumentRegisters; ++i)
		56	jit.store64(GPRInfo::toArgumentRegister(i), buffer + i);
		57	for (unsigned i = 0; i < FPRInfo::numberOfArgumentRegisters; ++i) {
		58	jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfArgumentRegisters + i), GPRInfo::nonArgGPR1);
		59	jit.storeDouble(FPRInfo::toArgumentRegister(i), GPRInfo::nonArgGPR1);
		60	}
		61
		62	// Tell GC mark phase how much of the scratch buffer is active during call.
		63	jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR1);
		64	jit.storePtr(MacroAssembler::TrustedImmPtr(scratchSize), GPRInfo::nonArgGPR1);
65
66	// argument 0 is already the call frame.
67	jit.move(GPRInfo::nonArgGPR0, GPRInfo::argumentGPR1);
68	MacroAssembler::Call functionCall = jit.call();
69
70	// Make sure that we're not using the return register if it's an argument register.
71	jit.move(GPRInfo::returnValueGPR, GPRInfo::nonArgGPR0);
72
73	// Prepare for tail call.
74	jit.pop(GPRInfo::nonArgGPR1);
75	jit.pop(GPRInfo::nonArgGPR1);
76	jit.pop(MacroAssembler::framePointerRegister);
77
78	jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR1);
79	jit.storePtr(MacroAssembler::TrustedImmPtr(0), GPRInfo::nonArgGPR1);
80
81	for (unsigned i = 0; i < FPRInfo::numberOfArgumentRegisters; ++i) {
82	jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfArgumentRegisters + i), GPRInfo::nonArgGPR1);
83	jit.loadDouble(GPRInfo::nonArgGPR1, FPRInfo::toArgumentRegister(i));
84	}
85	for (unsigned i = 0; i < GPRInfo::numberOfArgumentRegisters; ++i)
86	jit.load64(buffer + i, GPRInfo::toArgumentRegister(i));
87
88	jit.jump(GPRInfo::nonArgGPR0);
89
90	LinkBuffer patchBuffer(*globalData, &jit, GLOBAL_THUNK_ID);
91	patchBuffer.link(functionCall, compileFTLOSRExit);
92	return FINALIZE_CODE(patchBuffer, ("FTL OSR exit generation thunk"));
93	}
94
95	} } // namespace JSC::FTL
96
97	#endif // ENABLE(FTL_JIT)
98

Line 0 Source/JavaScriptCore/ftl/FTLThunks.h_sec1
- Source/JavaScriptCore/ftl/FTLThunks.h +47 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#ifndef FTLThunks_h
	27	#define FTLThunks_h
	28
	29	#include <wtf/Platform.h>
	30
	31	#if ENABLE(FTL_JIT)
	32
	33	#include "MacroAssemblerCodeRef.h"
	34
	35	namespace JSC {
	36
	37	class JSGlobalData;
	38
	39	namespace FTL {
	40
	41	MacroAssemblerCodeRef osrExitGenerationThunkGenerator(JSGlobalData*);
	42
	43	} } // namespace JSC::FTL
	44
	45	#endif // ENABLE(FTL_JIT)
	46
	47	#endif // FTLTHunks_h

Line 0 Source/JavaScriptCore/ftl/FTLValueFormat.cpp_sec1
- Source/JavaScriptCore/ftl/FTLValueFormat.cpp +64 lines
	1	/*
	2	* Copyright (C) 2013 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLValueFormat.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	namespace WTF {
	32
	33	using namespace JSC::FTL;
	34
	35	void printInternal(PrintStream& out, ValueFormat format)
	36	{
	37	switch (format) {
	38	case InvalidValueFormat:
	39	out.print("Invalid");
	40	return;
	41	case ValueFormatInt32:
	42	out.print("Int32");
	43	return;
	44	case ValueFormatUInt32:
	45	out.print("UInt32");
	46	return;
	47	case ValueFormatBoolean:
	48	out.print("Boolean");
	49	return;
	50	case ValueFormatJSValue:
	51	out.print("JSValue");
	52	return;
	53	case ValueFormatDouble:
	54	out.print("Double");
	55	return;
	56	}
	57
	58	RELEASE_ASSERT_NOT_REACHED();
	59	}
	60
	61	} // namespace WTF
	62
	63	#endif // ENABLE(FTL_JIT)
	64

Line 0 Source/JavaScriptCore/ftl/FTLValueSource.cpp_sec1
- Source/JavaScriptCore/ftl/FTLValueSource.cpp +77 lines
		1	/*
		2	* Copyright (C) 2013 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "FTLValueSource.h"
		28
		29	#if ENABLE(FTL_JIT)
		30
		31	namespace JSC { namespace FTL {
		32
		33	void ValueSource::dump(PrintStream& out) const
		34	{
		35	switch (kind()) {
		36	case SourceNotSet:
		37	out.print("SourceNotSet");
		38	return;
		39	case ValueInJSStack:
		40	out.print("ValueInJSStack");
		41	return;
		42	case Int32InJSStack:
		43	out.print("Int32InJSStack");
		44	return;
		45	case DoubleInJSStack:
		46	out.print("DoubleInJSStack");
		47	return;
		48	case ValueInLocals:
		49	out.print("ValueInLocals");
		50	return;
		51	case Int32InLocals:
		52	out.print("Int32InLocals");
		53	return;
		54	case BooleanInLocals:
		55	out.print("BooleanInLocals");
		56	return;
		57	case DoubleInLocals:
		58	out.print("DoubleInLocals");
		59	return;
		60	case ArgumentsSource:
		61	out.print("ArgumentsSource");
		62	return;
		63	case SourceIsDead:
		64	out.print("SourceIsDead");
65	return;
66	case HaveNode:
67	out.print("Node(", node(), ")");
68	return;
69	}
70
71	RELEASE_ASSERT_NOT_REACHED();
72	}
73
74	} } // namespace JSC::FTL
75
76	#endif // ENABLE(FTL_JIT)
77