Title: [228693] trunk/Source/_javascript_Core
- Revision
- 228693
- Author
- fpi...@apple.com
- Date
- 2018-02-19 09:39:52 -0800 (Mon, 19 Feb 2018)
Log Message
GetArrayMask should support constant folding
https://bugs.webkit.org/show_bug.cgi?id=182907
Reviewed by Saam Barati.
Implement constant folding for GetArrayMask. This revealed a bug in tryGetFoldableView, where it was
ignoring the result of a jsDynamicCast<>(). This wasn't a bug before because it would have been
impossible for that function to get called with a non-null value if the value was not an array view,
due to type filtering in CheckArray, the fact that CheckArray had to dominate GetArrayLength, and
the fact that the other tryGetFoldableView overload made sure that the array mode was some typed
array.
This isn't a measurable progression, but it does save a register in the codegen for typed array
accesses. Hopefully these improvements add up.
* assembler/AssemblerBuffer.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryGetFoldableView):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (228692 => 228693)
--- trunk/Source/_javascript_Core/ChangeLog 2018-02-19 16:57:41 UTC (rev 228692)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-02-19 17:39:52 UTC (rev 228693)
@@ -1,3 +1,26 @@
+2018-02-17 Filip Pizlo <fpi...@apple.com>
+
+ GetArrayMask should support constant folding
+ https://bugs.webkit.org/show_bug.cgi?id=182907
+
+ Reviewed by Saam Barati.
+
+ Implement constant folding for GetArrayMask. This revealed a bug in tryGetFoldableView, where it was
+ ignoring the result of a jsDynamicCast<>(). This wasn't a bug before because it would have been
+ impossible for that function to get called with a non-null value if the value was not an array view,
+ due to type filtering in CheckArray, the fact that CheckArray had to dominate GetArrayLength, and
+ the fact that the other tryGetFoldableView overload made sure that the array mode was some typed
+ array.
+
+ This isn't a measurable progression, but it does save a register in the codegen for typed array
+ accesses. Hopefully these improvements add up.
+
+ * assembler/AssemblerBuffer.h:
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::tryGetFoldableView):
+
2018-02-18 Dominik Inführ <dominik.infu...@gmail.com>
Offlineasm/MIPS: immediates need to be within 16-bit signed values
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (228692 => 228693)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2018-02-19 16:57:41 UTC (rev 228692)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2018-02-19 17:39:52 UTC (rev 228693)
@@ -2526,9 +2526,15 @@
break;
}
- case GetArrayMask:
+ case GetArrayMask: {
+ JSArrayBufferView* view = m_graph.tryGetFoldableView(forNode(node->child1()).m_value);
+ if (view) {
+ setConstant(node, jsNumber(view->butterflyIndexingMask()));
+ break;
+ }
forNode(node).setType(SpecInt32Only);
break;
+ }
case GetVectorLength: {
forNode(node).setType(SpecInt32Only);
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.cpp (228692 => 228693)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2018-02-19 16:57:41 UTC (rev 228692)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2018-02-19 17:39:52 UTC (rev 228693)
@@ -1386,7 +1386,7 @@
if (!value)
return nullptr;
JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(m_vm, value);
- if (!value)
+ if (!view)
return nullptr;
if (!view->length())
return nullptr;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
