Modified: trunk/Source/_javascript_Core/ChangeLog (91114 => 91115)
--- trunk/Source/_javascript_Core/ChangeLog 2011-07-15 21:54:20 UTC (rev 91114)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-07-15 21:57:35 UTC (rev 91115)
@@ -1,3 +1,23 @@
+2011-07-15 Gavin Barraclough <[email protected]>
+
+ DFG JIT - Where arguments passed are integers, speculate this.
+ https://bugs.webkit.org/show_bug.cgi?id=64630
+
+ Reviewed by Sam Weinig.
+
+ Presently the DFG JIT is overly aggressively predicting double.
+ Use a bit of dynamic information, and curtail this a little.
+
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::predictArgumentTypes):
+ - Check for integer arguments.
+ * dfg/DFGGraph.h:
+ - Function declaration.
+ * runtime/Executable.cpp:
+ (JSC::tryDFGCompile):
+ (JSC::FunctionExecutable::compileForCallInternal):
+ - Add call to predictArgumentTypes.
+
2011-07-15 Filip Pizlo <[email protected]>
DFG JIT is inconsistent about fusing branches and speculating
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.cpp (91114 => 91115)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2011-07-15 21:54:20 UTC (rev 91114)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2011-07-15 21:57:35 UTC (rev 91115)
@@ -176,6 +176,16 @@
}
}
+void Graph::predictArgumentTypes(ExecState* exec)
+{
+ size_t numberOfArguments = std::min(exec->argumentCountIncludingThis(), m_argumentPredictions.size());
+
+ for (size_t arg = 1; arg < numberOfArguments; ++arg) {
+ if (exec->argument(arg - 1).isInt32())
+ m_argumentPredictions[arg].m_value |= PredictInt32;
+ }
+}
+
} } // namespace JSC::DFG
#endif
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.h (91114 => 91115)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.h 2011-07-15 21:54:20 UTC (rev 91114)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.h 2011-07-15 21:57:35 UTC (rev 91115)
@@ -36,6 +36,7 @@
namespace JSC {
class CodeBlock;
+struct ExecState;
namespace DFG {
@@ -164,6 +165,8 @@
static const char *opName(NodeType);
#endif
+ void predictArgumentTypes(ExecState*);
+
Vector< OwnPtr<BasicBlock> , 8> m_blocks;
Vector<NodeIndex, 16> m_varArgChildren;
private:
Modified: trunk/Source/_javascript_Core/runtime/Executable.cpp (91114 => 91115)
--- trunk/Source/_javascript_Core/runtime/Executable.cpp 2011-07-15 21:54:20 UTC (rev 91114)
+++ trunk/Source/_javascript_Core/runtime/Executable.cpp 2011-07-15 21:57:35 UTC (rev 91115)
@@ -259,8 +259,9 @@
}
#if ENABLE(JIT)
-static bool tryDFGCompile(JSGlobalData* globalData, CodeBlock* codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck)
+static bool tryDFGCompile(ExecState* exec, CodeBlock* codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck)
{
+ JSGlobalData* globalData = &exec->globalData();
#if ENABLE(DFG_JIT)
#if ENABLE(DFG_JIT_RESTRICTIONS)
// FIXME: No flow control yet supported, don't bother scanning the bytecode if there are any jump targets.
@@ -272,6 +273,8 @@
if (!parse(dfg, globalData, codeBlock))
return false;
+ dfg.predictArgumentTypes(exec);
+
DFG::JITCompiler dataFlowJIT(globalData, dfg, codeBlock);
dataFlowJIT.compileFunction(jitCode, jitCodeWithArityCheck);
return true;
@@ -329,7 +332,7 @@
#if ENABLE(JIT)
if (exec->globalData().canUseJIT()) {
- bool dfgCompiled = tryDFGCompile(&exec->globalData(), m_codeBlockForCall.get(), m_jitCodeForCall, m_jitCodeForCallWithArityCheck);
+ bool dfgCompiled = tryDFGCompile(exec, m_codeBlockForCall.get(), m_jitCodeForCall, m_jitCodeForCallWithArityCheck);
if (!dfgCompiled)
m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_codeBlockForCall.get(), &m_jitCodeForCallWithArityCheck);
