Attachment 356320 Details for Bug 186178 – WIP - Patch

[patch] WIP - Patch

bug-186178-20181201190839.patch (text/plain), 35.34 KB, created by Caio Lima on 2018-12-01 13:08:41 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Caio Lima

Created: 2018-12-01 13:08:41 PST

Size: 35.34 KB

patch

obsolete

>Subversion Revision: 238779
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index c99091fd44292259f8fded2520c968aab4e816d7..942656f34222729af2a4f3416ff819760257613a 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,65 @@
>+2018-12-01  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueDiv into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186178
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This patch is introducing a new node type called ValueDiv. This node
>+        is responsible to handle Untyped and Bigint specialization of division
>+        operator, while the ArithDiv variant handles Number/Boolean cases.
>+
>+        BigInt specialization generates following speedup into simple
>+        benchmark:
>+
>+                                  noSpec                 changes
>+
>+        big-int-simple-div    10.6013+-0.4682    ^    8.4518+-0.0943   ^ definitely 1.2543x faster
>+
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGBackwardsPropagationPhase.cpp:
>+        (JSC::DFG::BackwardsPropagationPhase::propagate):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::makeDivSafe):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGClobberize.h:
>+        (JSC::DFG::clobberize):
>+        * dfg/DFGDoesGC.cpp:
>+        (JSC::DFG::doesGC):
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupDivision):
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGNode.h:
>+        (JSC::DFG::Node::arithNodeFlags):
>+        * dfg/DFGNodeType.h:
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileValueDiv):
>+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
>+        * dfg/DFGSpeculativeJIT.h:
>+        * dfg/DFGSpeculativeJIT32_64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGValidate.cpp:
>+        * ftl/FTLCapabilities.cpp:
>+        (JSC::FTL::canCompile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueSub):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueDiv):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileArithBitNot):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueBitAnd):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueBitOr):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueBitXor):
>+
> 2018-11-29  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         [JSC] Keep TypeMaybeBigInt small
>diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>index 25144b5b14240c7db2ce8716b79b9bfac38b547e..d13b20a0f70f7b6fa6e8f37a1e1bc5212ae159e2 100644
>--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>@@ -908,6 +908,15 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>         break;
>     }
>         
>+    case ValueDiv: {
>+        clobberWorld();
>+        if (node->binaryUseKind() == BigIntUse)
>+            setTypeForNode(node, SpecBigInt);
>+        else
>+            setTypeForNode(node, SpecBytecodeNumber | SpecBigInt);
>+        break;
>+    }
>+
>     case ArithDiv: {
>         JSValue left = forNode(node->child1()).value();
>         JSValue right = forNode(node->child2()).value();
>@@ -936,10 +945,6 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>                 typeOfDoubleQuotient(
>                     forNode(node->child1()).m_type, forNode(node->child2()).m_type));
>             break;
>-        case UntypedUse:
>-            clobberWorld();
>-            setNonCellTypeForNode(node, SpecBytecodeNumber);
>-            break;
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>             break;
>diff --git a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>index d06906a162de9bc8f747f967cd3b13c8a4e43410..396d8d3d4ac974c5030a27a6d4453c7182684fa0 100644
>--- a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>@@ -345,6 +345,7 @@ private:
>             break;
>         }
>             
>+        case ValueDiv:
>         case ArithDiv: {
>             flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero;
>             flags &= ~NodeBytecodeUsesAsOther;
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index 71fc92b19449ab2f7f7c4120f832ca2e2856ba76..a49f67e5dcf726abc0d9c031d1dca63373f38176 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -1001,7 +1001,7 @@ private:
>     
>     Node* makeDivSafe(Node* node)
>     {
>-        ASSERT(node->op() == ArithDiv);
>+        ASSERT(node->op() == ArithDiv || node->op() == ValueDiv);
>         
>         if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
>             node->mergeFlags(NodeMayOverflowInt32InDFG);
>@@ -1020,6 +1020,10 @@ private:
>         // FIXME: It might be possible to make this more granular.
>         node->mergeFlags(NodeMayOverflowInt32InBaseline | NodeMayNegZeroInBaseline);
>         
>+        ArithProfile* arithProfile = m_inlineStackTop->m_profiledBlock->arithProfileForBytecodeOffset(m_currentIndex);
>+        if (arithProfile->didObserveBigInt())
>+            node->mergeFlags(NodeMayHaveBigIntResult);
>+
>         return node;
>     }
>     
>@@ -5043,7 +5047,10 @@ void ByteCodeParser::parseBlock(unsigned limit)
>             auto bytecode = currentInstruction->as<OpDiv>();
>             Node* op1 = get(bytecode.lhs);
>             Node* op2 = get(bytecode.rhs);
>-            set(bytecode.dst, makeDivSafe(addToGraph(ArithDiv, op1, op2)));
>+            if (op1->hasNumberResult() && op2->hasNumberResult())
>+                set(bytecode.dst, makeDivSafe(addToGraph(ArithDiv, op1, op2)));
>+            else
>+                set(bytecode.dst, makeDivSafe(addToGraph(ValueDiv, op1, op2)));
>             NEXT_OPCODE(op_div);
>         }
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
>index 788eecc3c3bad1d915ba857f63a7578256705a0c..f2af6067da5a8ea100b038b9bbfeb410243e5652 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
>+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
>@@ -650,6 +650,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
>     case ValueNegate:
>     case ValueAdd:
>     case ValueSub:
>+    case ValueDiv:
>     case SetFunctionName:
>     case GetDynamicVar:
>     case PutDynamicVar:
>diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>index 6aa263cfa2a40a973ea229d83fa4215b9decabd1..d34088f150b927d5c21b39a51a07e3a69dc0eace 100644
>--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>@@ -103,6 +103,7 @@ bool doesGC(Graph& graph, Node* node)
>     case ValueAdd:
>     case ValueSub:
>     case ValueNegate:
>+    case ValueDiv:
>     case TryGetById:
>     case GetById:
>     case GetByIdFlush:
>diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>index 964e5bc65998d14c5bfdfb9edf0de6dfeb7ce9b8..9d33270e513b601dd30f78b71de5ee412e66e69c 100644
>--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>@@ -76,6 +76,45 @@ public:
>     }
> 
> private:
>+    void fixupDivision(Node* node, Edge& leftChild, Edge& rightChild)
>+    {
>+        if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>+            if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
>+                fixIntOrBooleanEdge(leftChild);
>+                fixIntOrBooleanEdge(rightChild);
>+                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>+                    node->setArithMode(Arith::Unchecked);
>+                else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+                    node->setArithMode(Arith::CheckOverflow);
>+                else
>+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>+                return;
>+            }
>+            
>+            // This will cause conversion nodes to be inserted later.
>+            fixDoubleOrBooleanEdge(leftChild);
>+            fixDoubleOrBooleanEdge(rightChild);
>+            
>+            // We don't need to do ref'ing on the children because we're stealing them from
>+            // the original division.
>+            Node* newDivision = m_insertionSet.insertNode(
>+                m_indexInBlock, SpecBytecodeDouble, *node);
>+            newDivision->setResult(NodeResultDouble);
>+            
>+            node->setOp(DoubleAsInt32);
>+            node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
>+            if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+                node->setArithMode(Arith::CheckOverflow);
>+            else
>+                node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>+            return;
>+        }
>+
>+        fixDoubleOrBooleanEdge(leftChild);
>+        fixDoubleOrBooleanEdge(rightChild);
>+        node->setResult(NodeResultDouble);
>+    }
>+
>     void fixupBlock(BasicBlock* block)
>     {
>         if (!block)
>@@ -422,52 +461,33 @@ private:
>             break;
>         }
> 
>-        case ArithDiv:
>-        case ArithMod: {
>+        case ValueDiv: {
>             Edge& leftChild = node->child1();
>             Edge& rightChild = node->child2();
>-            if (op == ArithDiv
>-                && Node::shouldSpeculateUntypedForArithmetic(leftChild.node(), rightChild.node())
>-                && m_graph.hasExitSite(node->origin.semantic, BadType)) {
>+
>+            if (Node::shouldSpeculateBigInt(leftChild.node(), rightChild.node())) {
>+                fixEdge<BigIntUse>(leftChild);
>+                fixEdge<BigIntUse>(rightChild);
>+                break; 
>+            }
>+
>+            if (Node::shouldSpeculateUntypedForArithmetic(leftChild.node(), rightChild.node())) {
>                 fixEdge<UntypedUse>(leftChild);
>                 fixEdge<UntypedUse>(rightChild);
>-                node->setResult(NodeResultJS);
>-                break;
>-            }
>-            if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
>-                if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
>-                    fixIntOrBooleanEdge(leftChild);
>-                    fixIntOrBooleanEdge(rightChild);
>-                    if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>-                        node->setArithMode(Arith::Unchecked);
>-                    else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>-                        node->setArithMode(Arith::CheckOverflow);
>-                    else
>-                        node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>-                    break;
>-                }
>-                
>-                // This will cause conversion nodes to be inserted later.
>-                fixDoubleOrBooleanEdge(leftChild);
>-                fixDoubleOrBooleanEdge(rightChild);
>-                
>-                // We don't need to do ref'ing on the children because we're stealing them from
>-                // the original division.
>-                Node* newDivision = m_insertionSet.insertNode(
>-                    m_indexInBlock, SpecBytecodeDouble, *node);
>-                newDivision->setResult(NodeResultDouble);
>-                
>-                node->setOp(DoubleAsInt32);
>-                node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
>-                if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>-                    node->setArithMode(Arith::CheckOverflow);
>-                else
>-                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>                 break;
>             }
>-            fixDoubleOrBooleanEdge(leftChild);
>-            fixDoubleOrBooleanEdge(rightChild);
>-            node->setResult(NodeResultDouble);
>+            node->setOp(ArithDiv);
>+            fixupDivision(node, leftChild, rightChild);
>+            break;
>+
>+        }
>+
>+        case ArithDiv:
>+        case ArithMod: {
>+            Edge& leftChild = node->child1();
>+            Edge& rightChild = node->child2();
>+
>+            fixupDivision(node, leftChild, rightChild);
>             break;
>         }
>             
>diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
>index 9952806583e727dd7f583578896a4947b6837b16..6f76c8e229ffdd868a3397e41bbc76c6d05550b7 100644
>--- a/Source/JavaScriptCore/dfg/DFGNode.h
>+++ b/Source/JavaScriptCore/dfg/DFGNode.h
>@@ -1129,7 +1129,7 @@ public:
>     NodeFlags arithNodeFlags()
>     {
>         NodeFlags result = m_flags & NodeArithFlagsMask;
>-        if (op() == ArithMul || op() == ArithDiv || op() == ArithMod || op() == ArithNegate || op() == ArithPow || op() == ArithRound || op() == ArithFloor || op() == ArithCeil || op() == ArithTrunc || op() == DoubleAsInt32 || op() == ValueNegate)
>+        if (op() == ArithMul || op() == ArithDiv || op() == ValueDiv || op() == ArithMod || op() == ArithNegate || op() == ArithPow || op() == ArithRound || op() == ArithFloor || op() == ArithCeil || op() == ArithTrunc || op() == DoubleAsInt32 || op() == ValueNegate)
>             return result;
>         return result & ~NodeBytecodeNeedsNegZero;
>     }
>diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
>index 509fcc9043a695d8f9f907f6490a53aab6c1b36f..70b3d7dafee7d05b6126dab51889931ae6df02d9 100644
>--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
>+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
>@@ -152,7 +152,7 @@ namespace JSC { namespace DFG {
>     macro(ArithNegate, NodeResultNumber | NodeMustGenerate) \
>     macro(ArithMul, NodeResultNumber | NodeMustGenerate) \
>     macro(ArithIMul, NodeResultInt32) \
>-    macro(ArithDiv, NodeResultNumber | NodeMustGenerate) \
>+    macro(ArithDiv, NodeResultNumber) \
>     macro(ArithMod, NodeResultNumber | NodeMustGenerate) \
>     macro(ArithAbs, NodeResultNumber | NodeMustGenerate) \
>     macro(ArithMin, NodeResultNumber) \
>@@ -174,6 +174,7 @@ namespace JSC { namespace DFG {
>     macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
>     \
>     macro(ValueSub, NodeResultJS | NodeMustGenerate) \
>+    macro(ValueDiv, NodeResultJS | NodeMustGenerate) \
>     \
>     /* Add of values that always convers its inputs to strings. May have two or three kids. */\
>     macro(StrCat, NodeResultJS | NodeMustGenerate) \
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>index 3f1f494a56a300105024a00d278fdd3cad2e27bf..8db2eef60d9fc1a158e6d8690c2b9cf4b75cbc3f 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>@@ -1322,6 +1322,17 @@ JSCell* JIT_OPERATION operationSubBigInt(ExecState* exec, JSCell* op1, JSCell* o
>     return JSBigInt::sub(exec, leftOperand, rightOperand);
> }
> 
>+JSCell* JIT_OPERATION operationDivBigInt(ExecState* exec, JSCell* op1, JSCell* op2)
>+{
>+    VM* vm = &exec->vm();
>+    NativeCallFrameTracer tracer(vm, exec);
>+    
>+    JSBigInt* leftOperand = jsCast<JSBigInt*>(op1);
>+    JSBigInt* rightOperand = jsCast<JSBigInt*>(op2);
>+    
>+    return JSBigInt::divide(exec, leftOperand, rightOperand);
>+}
>+
> JSCell* JIT_OPERATION operationBitAndBigInt(ExecState* exec, JSCell* op1, JSCell* op2)
> {
>     VM* vm = &exec->vm();
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
>index 512ac11153c8ff522cf62671551b9968df40c44e..af1844996a0b077aee783560af2a2cdc386b0e8f 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.h
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
>@@ -165,6 +165,7 @@ size_t JIT_OPERATION operationRegExpTest(ExecState*, JSGlobalObject*, RegExpObje
> size_t JIT_OPERATION operationRegExpTestGeneric(ExecState*, JSGlobalObject*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
> size_t JIT_OPERATION operationCompareStrictEqCell(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationSubBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
>+JSCell* JIT_OPERATION operationDivBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationBitAndBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationBitOrBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationAddBigInt(ExecState*, JSCell* op1, JSCell* op2) WTF_INTERNAL;
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index f8209fb048c0bcc1ea0cb23c2c1556e6f09a9283..6b0f537697b2728eb4efa124b6758a046d242c47 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -349,6 +349,7 @@ private:
>             break;
>         }
> 
>+        case ValueDiv:
>         case ArithDiv:
>         case ArithMod: {
>             SpeculatedType left = node->child1()->prediction();
>@@ -361,8 +362,13 @@ private:
>                         changed |= mergePrediction(SpecInt32Only);
>                     else
>                         changed |= mergePrediction(SpecBytecodeDouble);
>-                } else
>+                } else if (isBigIntSpeculation(left) && isBigIntSpeculation(right))
>+                    changed |= mergePrediction(SpecBigInt);
>+                else {
>                     changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
>+                    if (node->mayHaveBigIntResult())
>+                        changed |= mergePrediction(SpecBigInt);
>+                }
>             }
>             break;
>         }
>@@ -593,6 +599,7 @@ private:
>         case ArithMin:
>         case ArithMax:
>         case ArithMod:
>+        case ValueDiv:
>         case ArithDiv: {
>             SpeculatedType left = node->child1()->prediction();
>             SpeculatedType right = node->child2()->prediction();
>@@ -1101,6 +1108,7 @@ private:
>         case ValueNegate:
>         case ValueAdd:
>         case ValueSub:
>+        case ValueDiv:
>         case ArithAdd:
>         case ArithSub:
>         case ArithNegate:
>diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>index b43b7dfda9e779fd222eec3ef505d06fbd992d0e..6e68dd3b0999fe2e3d704f7be42083b3478e51c5 100644
>--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>@@ -233,6 +233,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node, bool igno
>     case ValueNegate:
>     case ValueAdd:
>     case ValueSub:
>+    case ValueDiv:
>     case TryGetById:
>     case DeleteById:
>     case DeleteByVal:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 2cda06dd6e37771551ddeacc161c9f25e7375893..25e17a7a6fb1566910b76526272332096a088eec 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -4962,6 +4962,131 @@ void SpeculativeJIT::compileArithMul(Node* node)
>     }
> }
> 
>+void SpeculativeJIT::compileValueDiv(Node* node)
>+{
>+    Edge& leftChild = node->child1();
>+    Edge& rightChild = node->child2();
>+
>+    if (leftChild.useKind() == BigIntUse && rightChild.useKind() == BigIntUse) {
>+        SpeculateCellOperand left(this, leftChild);
>+        SpeculateCellOperand right(this, rightChild);
>+        GPRReg leftGPR = left.gpr();
>+        GPRReg rightGPR = right.gpr();
>+
>+        speculateBigInt(leftChild, leftGPR);
>+        speculateBigInt(rightChild, rightGPR);
>+
>+        flushRegisters();
>+        GPRFlushedCallResult result(this);
>+        GPRReg resultGPR = result.gpr();
>+
>+        callOperation(operationDivBigInt, resultGPR, leftGPR, rightGPR);
>+
>+        m_jit.exceptionCheck();
>+        cellResult(resultGPR, node);
>+        return;
>+    }
>+
>+    if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
>+        JSValueOperand left(this, leftChild);
>+        JSValueOperand right(this, rightChild);
>+        JSValueRegs leftRegs = left.jsValueRegs();
>+        JSValueRegs rightRegs = right.jsValueRegs();
>+
>+        flushRegisters();
>+        JSValueRegsFlushedCallResult result(this);
>+        JSValueRegs resultRegs = result.regs();
>+        callOperation(operationValueDiv, resultRegs, leftRegs, rightRegs);
>+        m_jit.exceptionCheck();
>+
>+        jsValueResult(resultRegs, node);
>+        return;
>+    }
>+
>+    std::optional<JSValueOperand> left;
>+    std::optional<JSValueOperand> right;
>+
>+    JSValueRegs leftRegs;
>+    JSValueRegs rightRegs;
>+
>+    FPRTemporary leftNumber(this);
>+    FPRTemporary rightNumber(this);
>+    FPRReg leftFPR = leftNumber.fpr();
>+    FPRReg rightFPR = rightNumber.fpr();
>+    FPRTemporary fprScratch(this);
>+    FPRReg scratchFPR = fprScratch.fpr();
>+
>+#if USE(JSVALUE64)
>+    GPRTemporary result(this);
>+    JSValueRegs resultRegs = JSValueRegs(result.gpr());
>+    GPRTemporary scratch(this);
>+    GPRReg scratchGPR = scratch.gpr();
>+#else
>+    GPRTemporary resultTag(this);
>+    GPRTemporary resultPayload(this);
>+    JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
>+    GPRReg scratchGPR = resultTag.gpr();
>+#endif
>+
>+    SnippetOperand leftOperand(m_state.forNode(leftChild).resultType());
>+    SnippetOperand rightOperand(m_state.forNode(rightChild).resultType());
>+
>+    if (leftChild->isInt32Constant())
>+        leftOperand.setConstInt32(leftChild->asInt32());
>+#if USE(JSVALUE64)
>+    else if (leftChild->isDoubleConstant())
>+        leftOperand.setConstDouble(leftChild->asNumber());
>+#endif
>+
>+    if (leftOperand.isConst()) {
>+        // The snippet generator only supports 1 argument as a constant.
>+        // Ignore the rightChild's const-ness.
>+    } else if (rightChild->isInt32Constant())
>+        rightOperand.setConstInt32(rightChild->asInt32());
>+#if USE(JSVALUE64)
>+    else if (rightChild->isDoubleConstant())
>+        rightOperand.setConstDouble(rightChild->asNumber());
>+#endif
>+
>+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
>+
>+    if (!leftOperand.isConst()) {
>+        left.emplace(this, leftChild);
>+        leftRegs = left->jsValueRegs();
>+    }
>+    if (!rightOperand.isConst()) {
>+        right.emplace(this, rightChild);
>+        rightRegs = right->jsValueRegs();
>+    }
>+
>+    JITDivGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
>+        leftFPR, rightFPR, scratchGPR, scratchFPR);
>+    gen.generateFastPath(m_jit);
>+
>+    ASSERT(gen.didEmitFastPath());
>+    gen.endJumpList().append(m_jit.jump());
>+
>+    gen.slowPathJumpList().link(&m_jit);
>+    silentSpillAllRegisters(resultRegs);
>+
>+    if (leftOperand.isConst()) {
>+        leftRegs = resultRegs;
>+        m_jit.moveValue(leftChild->asJSValue(), leftRegs);
>+    }
>+    if (rightOperand.isConst()) {
>+        rightRegs = resultRegs;
>+        m_jit.moveValue(rightChild->asJSValue(), rightRegs);
>+    }
>+
>+    callOperation(operationValueDiv, resultRegs, leftRegs, rightRegs);
>+
>+    silentFillAllRegisters();
>+    m_jit.exceptionCheck();
>+
>+    gen.endJumpList().link(&m_jit);
>+    jsValueResult(resultRegs, node);
>+}
>+
> void SpeculativeJIT::compileArithDiv(Node* node)
> {
>     switch (node->binaryUseKind()) {
>@@ -5096,111 +5221,6 @@ void SpeculativeJIT::compileArithDiv(Node* node)
>         break;
>     }
> 
>-    case UntypedUse: {
>-        Edge& leftChild = node->child1();
>-        Edge& rightChild = node->child2();
>-
>-        if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
>-            JSValueOperand left(this, leftChild);
>-            JSValueOperand right(this, rightChild);
>-            JSValueRegs leftRegs = left.jsValueRegs();
>-            JSValueRegs rightRegs = right.jsValueRegs();
>-
>-            flushRegisters();
>-            JSValueRegsFlushedCallResult result(this);
>-            JSValueRegs resultRegs = result.regs();
>-            callOperation(operationValueDiv, resultRegs, leftRegs, rightRegs);
>-            m_jit.exceptionCheck();
>-
>-            jsValueResult(resultRegs, node);
>-            return;
>-        }
>-
>-        std::optional<JSValueOperand> left;
>-        std::optional<JSValueOperand> right;
>-
>-        JSValueRegs leftRegs;
>-        JSValueRegs rightRegs;
>-
>-        FPRTemporary leftNumber(this);
>-        FPRTemporary rightNumber(this);
>-        FPRReg leftFPR = leftNumber.fpr();
>-        FPRReg rightFPR = rightNumber.fpr();
>-        FPRTemporary fprScratch(this);
>-        FPRReg scratchFPR = fprScratch.fpr();
>-
>-#if USE(JSVALUE64)
>-        GPRTemporary result(this);
>-        JSValueRegs resultRegs = JSValueRegs(result.gpr());
>-        GPRTemporary scratch(this);
>-        GPRReg scratchGPR = scratch.gpr();
>-#else
>-        GPRTemporary resultTag(this);
>-        GPRTemporary resultPayload(this);
>-        JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
>-        GPRReg scratchGPR = resultTag.gpr();
>-#endif
>-
>-        SnippetOperand leftOperand(m_state.forNode(leftChild).resultType());
>-        SnippetOperand rightOperand(m_state.forNode(rightChild).resultType());
>-
>-        if (leftChild->isInt32Constant())
>-            leftOperand.setConstInt32(leftChild->asInt32());
>-#if USE(JSVALUE64)
>-        else if (leftChild->isDoubleConstant())
>-            leftOperand.setConstDouble(leftChild->asNumber());
>-#endif
>-
>-        if (leftOperand.isConst()) {
>-            // The snippet generator only supports 1 argument as a constant.
>-            // Ignore the rightChild's const-ness.
>-        } else if (rightChild->isInt32Constant())
>-            rightOperand.setConstInt32(rightChild->asInt32());
>-#if USE(JSVALUE64)
>-        else if (rightChild->isDoubleConstant())
>-            rightOperand.setConstDouble(rightChild->asNumber());
>-#endif
>-
>-        RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
>-
>-        if (!leftOperand.isConst()) {
>-            left.emplace(this, leftChild);
>-            leftRegs = left->jsValueRegs();
>-        }
>-        if (!rightOperand.isConst()) {
>-            right.emplace(this, rightChild);
>-            rightRegs = right->jsValueRegs();
>-        }
>-
>-        JITDivGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
>-            leftFPR, rightFPR, scratchGPR, scratchFPR);
>-        gen.generateFastPath(m_jit);
>-
>-        ASSERT(gen.didEmitFastPath());
>-        gen.endJumpList().append(m_jit.jump());
>-
>-        gen.slowPathJumpList().link(&m_jit);
>-        silentSpillAllRegisters(resultRegs);
>-
>-        if (leftOperand.isConst()) {
>-            leftRegs = resultRegs;
>-            m_jit.moveValue(leftChild->asJSValue(), leftRegs);
>-        }
>-        if (rightOperand.isConst()) {
>-            rightRegs = resultRegs;
>-            m_jit.moveValue(rightChild->asJSValue(), rightRegs);
>-        }
>-
>-        callOperation(operationValueDiv, resultRegs, leftRegs, rightRegs);
>-
>-        silentFillAllRegisters();
>-        m_jit.exceptionCheck();
>-
>-        gen.endJumpList().link(&m_jit);
>-        jsValueResult(resultRegs, node);
>-        return;
>-    }
>-
>     default:
>         RELEASE_ASSERT_NOT_REACHED();
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index adb3ba1c8e17c0a435c772f0fb40c3837074571f..53205f574df3dbaf77813bcc9e3a18706dcda33e 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -1355,6 +1355,7 @@ public:
>     void compileValueNegate(Node*);
>     void compileArithNegate(Node*);
>     void compileArithMul(Node*);
>+    void compileValueDiv(Node*);
>     void compileArithDiv(Node*);
>     void compileArithFRound(Node*);
>     void compileArithMod(Node*);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>index ce3e26635248959b19df566c8ee125838d758d5a..70ea7cba2be77576b02e91ddf4153a1218bca4b0 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>@@ -2067,6 +2067,11 @@ void SpeculativeJIT::compile(Node* node)
>         compileArithMul(node);
>         break;
> 
>+    case ValueDiv: {
>+        compileValueDiv(node);
>+        break;
>+    }
>+
>     case ArithDiv: {
>         compileArithDiv(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index fb161a72b54074f15abadbfc755356d20380558e..34c0f70231a9797bfeb137030e618a993a9ec0f4 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -2209,6 +2209,11 @@ void SpeculativeJIT::compile(Node* node)
>         compileArithMul(node);
>         break;
> 
>+    case ValueDiv: {
>+        compileValueDiv(node);
>+        break;
>+    }
>+
>     case ArithDiv: {
>         compileArithDiv(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGValidate.cpp b/Source/JavaScriptCore/dfg/DFGValidate.cpp
>index 5382f8a2cea70091c185d427b193a02a7d86ec76..2418d5c803851be45fd622beeff3bd5e0e20bd2b 100644
>--- a/Source/JavaScriptCore/dfg/DFGValidate.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGValidate.cpp
>@@ -255,6 +255,7 @@ public:
>                 case MakeRope:
>                 case ValueAdd:
>                 case ValueSub:
>+                case ValueDiv:
>                 case ArithAdd:
>                 case ArithSub:
>                 case ArithMul:
>diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>index da113812e17e1d0b044ad28c86ab8f8e74b78b9f..00e38bb0f2de9ac23956538c076f13308b73277c 100644
>--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>@@ -93,6 +93,7 @@ inline CapabilityLevel canCompile(Node* node)
>     case ValueNegate:
>     case ValueAdd:
>     case ValueSub:
>+    case ValueDiv:
>     case StrCat:
>     case ArithAdd:
>     case ArithClz32:
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index c254892721f547271d730b1eb9fad203d46551de..b6ab473da6e5ddafd21e38f79c03eccd680b788e 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -610,6 +610,9 @@ private:
>         case ArithMul:
>             compileArithMul();
>             break;
>+        case ValueDiv:
>+            compileValueDiv();
>+            break;
>         case ArithDiv:
>             compileArithDiv();
>             break;
>@@ -1872,7 +1875,7 @@ private:
>             LValue left = lowBigInt(m_node->child1());
>             LValue right = lowBigInt(m_node->child2());
> 
>-            LValue result = vmCall(pointerType(), m_out.operation(operationAddBigInt), m_callFrame, left, right);
>+            LValue result = vmCall(Int64, m_out.operation(operationAddBigInt), m_callFrame, left, right);
>             setJSValue(result);
>             return;
>         }
>@@ -1891,7 +1894,7 @@ private:
>             LValue left = lowBigInt(m_node->child1());
>             LValue right = lowBigInt(m_node->child2());
>             
>-            LValue result = vmCall(pointerType(), m_out.operation(operationSubBigInt), m_callFrame, left, right);
>+            LValue result = vmCall(Int64, m_out.operation(operationSubBigInt), m_callFrame, left, right);
>             setJSValue(result);
>             return;
>         }
>@@ -2268,6 +2271,20 @@ private:
>         }
>     }
> 
>+    void compileValueDiv()
>+    {
>+        if (m_node->isBinaryUseKind(BigIntUse)) {
>+            LValue left = lowBigInt(m_node->child1());
>+            LValue right = lowBigInt(m_node->child2());
>+            
>+            LValue result = vmCall(Int64, m_out.operation(operationDivBigInt), m_callFrame, left, right);
>+            setJSValue(result);
>+            return;
>+        }
>+
>+        emitBinarySnippet<JITDivGenerator, NeedScratchFPR>(operationValueDiv);
>+    }
>+
>     void compileArithDiv()
>     {
>         switch (m_node->binaryUseKind()) {
>@@ -2326,11 +2343,6 @@ private:
>             break;
>         }
> 
>-        case UntypedUse: {
>-            emitBinarySnippet<JITDivGenerator, NeedScratchFPR>(operationValueDiv);
>-            break;
>-        }
>-
>         default:
>             DFG_CRASH(m_graph, m_node, "Bad use kind");
>             break;
>@@ -2855,7 +2867,7 @@ private:
>     {
>         if (m_node->child1().useKind() == UntypedUse) {
>             LValue operand = lowJSValue(m_node->child1());
>-            LValue result = vmCall(pointerType(), m_out.operation(operationValueBitNot), m_callFrame, operand);
>+            LValue result = vmCall(Int64, m_out.operation(operationValueBitNot), m_callFrame, operand);
>             setJSValue(result);
>             return;
>         }
>@@ -2869,7 +2881,7 @@ private:
>             LValue left = lowBigInt(m_node->child1());
>             LValue right = lowBigInt(m_node->child2());
>             
>-            LValue result = vmCall(pointerType(), m_out.operation(operationBitAndBigInt), m_callFrame, left, right);
>+            LValue result = vmCall(Int64, m_out.operation(operationBitAndBigInt), m_callFrame, left, right);
>             setJSValue(result);
>             return;
>         }
>@@ -2888,7 +2900,7 @@ private:
>             LValue left = lowBigInt(m_node->child1());
>             LValue right = lowBigInt(m_node->child2());
> 
>-            LValue result = vmCall(pointerType(), m_out.operation(operationBitOrBigInt), m_callFrame, left, right);
>+            LValue result = vmCall(Int64, m_out.operation(operationBitOrBigInt), m_callFrame, left, right);
>             setJSValue(result);
>             return;
>         }
>@@ -2907,7 +2919,7 @@ private:
>             LValue left = lowBigInt(m_node->child1());
>             LValue right = lowBigInt(m_node->child2());
> 
>-            LValue result = vmCall(pointerType(), m_out.operation(operationBitXorBigInt), m_callFrame, left, right);
>+            LValue result = vmCall(Int64, m_out.operation(operationBitXorBigInt), m_callFrame, left, right);
>             setJSValue(result);
>             return;
>         }
>diff --git a/PerformanceTests/BigIntBench/big-int-simple-div.js b/PerformanceTests/BigIntBench/big-int-simple-div.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..990539d63b32773b10553d93d4ec3fc291c96de3
>--- /dev/null
>+++ b/PerformanceTests/BigIntBench/big-int-simple-div.js
>@@ -0,0 +1,15 @@
>+function bigInt(a, b) {
>+    let c = a / b;
>+    return a + c / b;
>+}
>+noInline(bigInt);
>+
>+for (let i = 0; i < 100000; i++) {
>+    bigInt(0b1111n, 0b1010n);
>+}
>+
>+let out;
>+for (let i = 0; i < 100000; i++) {
>+    out = bigInt(0xffffffffffffffffffn, 0xaaffffffffffffffffffn);
>+}
>+
>diff --git a/PerformanceTests/ChangeLog b/PerformanceTests/ChangeLog
>index 5d89525740e97c16feb154087968a42952d1a14c..2eae995d60025b58e6876549ab6773d910c160a5 100644
>--- a/PerformanceTests/ChangeLog
>+++ b/PerformanceTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-12-01  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [BigInt] Add ValueDiv into DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=186178
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * BigIntBench/big-int-simple-div.js: Added.
>+        (bigInt):
>+
> 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
> 
>         [BigInt] Add support to BigInt into ValueAdd

Actions: View | Formatted Diff | Diff

Attachments on bug 186178: 356320 | 357118 | 357119 | 357128 | 357171