From 726b120ca70c72aad242abab2f39b29d3b8dc6c4 Mon Sep 17 00:00:00 2001 From: Ryan VanderMeulen Date: Sat, 9 Aug 2014 15:14:09 -0400 Subject: [PATCH] Backed out changesets 37df1d58af4a and 792b068b7805 (bug 1025445) for Gaia unit test failures. --- js/src/jit-test/tests/ion/bug1025445.js | 8 -- js/src/jit/LIR-Common.h | 4 - js/src/jit/Lowering.cpp | 8 +- js/src/jit/MIR.h | 23 +----- js/src/jit/RangeAnalysis.cpp | 32 -------- .../jit/shared/CodeGenerator-x86-shared.cpp | 80 ++++++++----------- 6 files changed, 36 insertions(+), 119 deletions(-) delete mode 100644 js/src/jit-test/tests/ion/bug1025445.js diff --git a/js/src/jit-test/tests/ion/bug1025445.js b/js/src/jit-test/tests/ion/bug1025445.js deleted file mode 100644 index 05ae58cd2110..000000000000 --- a/js/src/jit-test/tests/ion/bug1025445.js +++ /dev/null @@ -1,8 +0,0 @@ -setJitCompilerOption("baseline.usecount.trigger", 10); -setJitCompilerOption("ion.usecount.trigger", 20); - -var y = 1; -for (var i = 0; i < 64; i++) { - assertEq(Math.floor(y), y); - y *= 2; -} diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h index 3912fa1bd6a0..987632e67189 100644 --- a/js/src/jit/LIR-Common.h +++ b/js/src/jit/LIR-Common.h @@ -4844,10 +4844,6 @@ class LFloor : public LInstructionHelper<1, 1, 0> explicit LFloor(const LAllocation &num) { setOperand(0, num); } - - const MFloor *mir() const { - return mir_->toFloor(); - } }; // Take the floor of a single precision number. Implements Math.floor(). diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp index 963e3c2ec71a..1b9af346bf21 100644 --- a/js/src/jit/Lowering.cpp +++ b/js/src/jit/Lowering.cpp @@ -1197,13 +1197,9 @@ bool LIRGenerator::visitFloor(MFloor *ins) { MIRType type = ins->input()->type(); - JS_ASSERT(IsNumberType(type)); + JS_ASSERT(IsFloatingPointType(type)); - // Handle here truncation propagation - // If input is truncated to Int32 LFloor actually becomes a no-op - if (type == MIRType_Int32) - return redefine(ins, ins->input()); - else if (type == MIRType_Double) { + if (type == MIRType_Double) { LFloor *lir = new(alloc()) LFloor(useRegister(ins->input())); if (!assignSnapshot(lir, Bailout_Round)) return false; diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index d975b6e0b3b2..40d2fa10c8cc 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -9167,22 +9167,13 @@ class MFloor public FloatingPointPolicy<0> { explicit MFloor(MDefinition *num) - : MUnaryInstruction(num), - isFiniteNonNegative_(false), - canSkipZeroChecks_(false), - canSkipNegativeCase_(false), - outputTruncation_(NoTruncate) + : MUnaryInstruction(num) { setResultType(MIRType_Int32); setPolicyType(MIRType_Double); setMovable(); } - bool isFiniteNonNegative_; - bool canSkipZeroChecks_; - bool canSkipNegativeCase_; - TruncateKind outputTruncation_; - public: INSTRUCTION_HEADER(Floor) @@ -9209,22 +9200,10 @@ class MFloor return congruentIfOperandsEqual(ins); } void computeRange(TempAllocator &alloc); - void setTruncateKind(TruncateKind kind) { - outputTruncation_ = kind; - } - void collectRangeInfoPreTrunc(); - TruncateKind operandTruncateKind(size_t index) const; - bool truncate(TruncateKind kind); bool writeRecoverData(CompactBufferWriter &writer) const; bool canRecoverOnBailout() const { return true; } - bool canSkipZeroChecks() const { - return canSkipZeroChecks_; - } - bool canSkipNegativeCase() const { - return canSkipNegativeCase_; - } }; // Inlined version of Math.ceil(). diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp index 9124f258fa7e..1473f802a91d 100644 --- a/js/src/jit/RangeAnalysis.cpp +++ b/js/src/jit/RangeAnalysis.cpp @@ -2296,20 +2296,6 @@ MMod::truncate(TruncateKind kind) return false; } -bool -MFloor::truncate(TruncateKind kind) -{ - setTruncateKind(kind); - - if (isFiniteNonNegative_) { - setResultType(MIRType_Int32); - return true; - } - - // No Modifications - return false; -} - bool MToDouble::truncate(TruncateKind kind) { @@ -2394,12 +2380,6 @@ MMul::operandTruncateKind(size_t index) const return Min(truncateKind(), IndirectTruncate); } -MDefinition::TruncateKind -MFloor::operandTruncateKind(size_t index) const -{ - return isFiniteNonNegative_ && outputTruncation_ >= IndirectTruncate ? outputTruncation_ : NoTruncate; -} - MDefinition::TruncateKind MToDouble::operandTruncateKind(size_t index) const { @@ -2798,18 +2778,6 @@ MMod::collectRangeInfoPreTrunc() } -void -MFloor::collectRangeInfoPreTrunc() -{ - Range inputRange(input()); - if (inputRange.isFiniteNonNegative()) - isFiniteNonNegative_ = true; - if (!inputRange.canBeZero()) - canSkipZeroChecks_ = true; - if (!inputRange.canBeFiniteNegative()) - canSkipNegativeCase_ = true; -} - void MToInt32::collectRangeInfoPreTrunc() { diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp index b919a55aa6fb..61f14fe4d29e 100644 --- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp +++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp @@ -1562,73 +1562,59 @@ CodeGeneratorX86Shared::visitFloor(LFloor *lir) FloatRegister input = ToFloatRegister(lir->input()); FloatRegister scratch = ScratchDoubleReg; Register output = ToRegister(lir->output()); - bool canSkipZeroChecks = lir->mir()->canSkipZeroChecks(); - bool canSkipNegativeCase = lir->mir()->canSkipNegativeCase(); + Label bailout; if (AssemblerX86Shared::HasSSE41()) { + // Bail on negative-zero. + masm.branchNegativeZero(input, output, &bailout); + if (!bailoutFrom(&bailout, lir->snapshot())) + return false; - if (!canSkipZeroChecks) { - // Bail on negative-zero. - masm.branchNegativeZero(input, output, &bailout); - if (!bailoutFrom(&bailout, lir->snapshot())) - return false; - } - - if (!canSkipNegativeCase) { - // Round toward -Infinity. - masm.roundsd(input, scratch, JSC::X86Assembler::RoundDown); - } + // Round toward -Infinity. + masm.roundsd(input, scratch, JSC::X86Assembler::RoundDown); if (!bailoutCvttsd2si(scratch, output, lir->snapshot())) return false; } else { Label negative, end; - if (!canSkipZeroChecks) { - // Bail on negative-zero. - masm.branchNegativeZero(input, output, &bailout); - if (!bailoutFrom(&bailout, lir->snapshot())) - return false; - } + // Branch to a slow path for negative inputs. Doesn't catch NaN or -0. + masm.xorpd(scratch, scratch); + masm.branchDouble(Assembler::DoubleLessThan, input, scratch, &negative); - if (!canSkipNegativeCase) { - // Branch to a slow path for negative inputs. Doesn't catch NaN or -0. - masm.xorpd(scratch, scratch); - masm.branchDouble(Assembler::DoubleLessThan, input, scratch, &negative); - } + // Bail on negative-zero. + masm.branchNegativeZero(input, output, &bailout); + if (!bailoutFrom(&bailout, lir->snapshot())) + return false; // Input is non-negative, so truncation correctly rounds. if (!bailoutCvttsd2si(input, output, lir->snapshot())) return false; + masm.jump(&end); - if (!canSkipNegativeCase) { - masm.jump(&end); - // Input is negative, but isn't -0. - // Negative values go on a comparatively expensive path, since no - // native rounding mode matches JS semantics. Still better than callVM. - masm.bind(&negative); - { - // Truncate and round toward zero. - // This is off-by-one for everything but integer-valued inputs. - if (!bailoutCvttsd2si(input, output, lir->snapshot())) - return false; + // Input is negative, but isn't -0. + // Negative values go on a comparatively expensive path, since no + // native rounding mode matches JS semantics. Still better than callVM. + masm.bind(&negative); + { + // Truncate and round toward zero. + // This is off-by-one for everything but integer-valued inputs. + if (!bailoutCvttsd2si(input, output, lir->snapshot())) + return false; - // Test whether the input double was integer-valued. - masm.convertInt32ToDouble(output, scratch); - masm.branchDouble(Assembler::DoubleEqualOrUnordered, - input, - scratch, - &end); + // Test whether the input double was integer-valued. + masm.convertInt32ToDouble(output, scratch); + masm.branchDouble(Assembler::DoubleEqualOrUnordered, input, scratch, &end); - // Input is not integer-valued, so we rounded off-by-one in the - // wrong direction. Correct by subtraction. - masm.subl(Imm32(1), output); - // Cannot overflow: output was already checked against INT_MIN. - } - masm.bind(&end); + // Input is not integer-valued, so we rounded off-by-one in the + // wrong direction. Correct by subtraction. + masm.subl(Imm32(1), output); + // Cannot overflow: output was already checked against INT_MIN. } + + masm.bind(&end); } return true; }