DFG SetLocal should use forwardSpeculationCheck instead of its own ha…

…lf-baked version of same

https://bugs.webkit.org/show_bug.cgi?id=103353

Reviewed by Oliver Hunt and Gavin Barraclough.

Source/JavaScriptCore: 

Made it possible to use forward speculations for most of the operand classes. Changed the conditional
direction parameter from being 'bool isForward' to an enum (SpeculationDirection). Changed SetLocal
to use forward speculations and got rid of its half-baked version of same.
        
Also added the ability to force the DFG's disassembler to dump all nodes, even ones that are dead.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGDisassembler.cpp:
(JSC::DFG::Disassembler::dump):
* dfg/DFGDriver.cpp:
(JSC::DFG::compile):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculationCheck):
(DFG):
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
(JSC::DFG::SpeculativeJIT::speculationWatchpoint):
(JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
(JSC::DFG::SpeculativeJIT::fillStorage):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
(JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
(JSC::DFG::SpeculateIntegerOperand::gpr):
(SpeculateIntegerOperand):
(JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
(JSC::DFG::SpeculateDoubleOperand::fpr):
(SpeculateDoubleOperand):
(JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
(JSC::DFG::SpeculateCellOperand::gpr):
(SpeculateCellOperand):
(JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
(JSC::DFG::SpeculateBooleanOperand::gpr):
(SpeculateBooleanOperand):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compile):
* runtime/Options.h:
(JSC):

LayoutTests: 

* fast/js/dfg-intrinsic-side-effect-assignment-osr-exit-expected.txt: Added.
* fast/js/dfg-intrinsic-side-effect-assignment-osr-exit.html: Added.
* fast/js/dfg-side-effect-assignment-osr-exit-expected.txt: Added.
* fast/js/dfg-side-effect-assignment-osr-exit.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-intrinsic-side-effect-assignment-osr-exit.js: Added.
(foo):
* fast/js/script-tests/dfg-side-effect-assignment-osr-exit.js: Added.
(foo):
(bar):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@135923 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog

@@ -1,3 +1,21 @@
+2012-11-26  Filip Pizlo  <[email protected]>
+
+        DFG SetLocal should use forwardSpeculationCheck instead of its own half-baked version of same
+        https://bugs.webkit.org/show_bug.cgi?id=103353
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        * fast/js/dfg-intrinsic-side-effect-assignment-osr-exit-expected.txt: Added.
+        * fast/js/dfg-intrinsic-side-effect-assignment-osr-exit.html: Added.
+        * fast/js/dfg-side-effect-assignment-osr-exit-expected.txt: Added.
+        * fast/js/dfg-side-effect-assignment-osr-exit.html: Added.
+        * fast/js/jsc-test-list:
+        * fast/js/script-tests/dfg-intrinsic-side-effect-assignment-osr-exit.js: Added.
+        (foo):
+        * fast/js/script-tests/dfg-side-effect-assignment-osr-exit.js: Added.
+        (foo):
+        (bar):
+
 2012-11-27  Alexandru Chiculita  <[email protected]>
 
         [CSS Regions] Elements using transforms are not repainted correctly when rendered in a region