Title: [96184] trunk/Source/_javascript_Core
- Revision
- 96184
- Author
- [email protected]
- Date
- 2011-09-27 20:39:36 -0700 (Tue, 27 Sep 2011)
Log Message
DFG JIT should speculate more aggressively on reads of array.length
https://bugs.webkit.org/show_bug.cgi?id=68932
Reviewed by Oliver Hunt.
This is a 2% speed-up on Kraken, neutral elsewhere.
* dfg/DFGNode.h:
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::propagateNodePredictions):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::performNodeCSE):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (96183 => 96184)
--- trunk/Source/_javascript_Core/ChangeLog 2011-09-28 03:37:23 UTC (rev 96183)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-09-28 03:39:36 UTC (rev 96184)
@@ -1,3 +1,20 @@
+2011-09-27 Filip Pizlo <[email protected]>
+
+ DFG JIT should speculate more aggressively on reads of array.length
+ https://bugs.webkit.org/show_bug.cgi?id=68932
+
+ Reviewed by Oliver Hunt.
+
+ This is a 2% speed-up on Kraken, neutral elsewhere.
+
+ * dfg/DFGNode.h:
+ * dfg/DFGPropagator.cpp:
+ (JSC::DFG::Propagator::propagateNodePredictions):
+ (JSC::DFG::Propagator::fixupNode):
+ (JSC::DFG::Propagator::performNodeCSE):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2011-09-27 Gavin Barraclough <[email protected]>
DFG JIT - merge changes between 95905 - 96175
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (96183 => 96184)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2011-09-28 03:37:23 UTC (rev 96183)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2011-09-28 03:39:36 UTC (rev 96184)
@@ -266,6 +266,7 @@
macro(PutByIdDirect, NodeMustGenerate | NodeClobbersWorld) \
macro(CheckStructure, NodeResultStorage | NodeMustGenerate) \
macro(GetByOffset, NodeResultJS) \
+ macro(GetArrayLength, NodeResultInt32) \
macro(GetMethod, NodeResultJS | NodeMustGenerate) \
macro(CheckMethod, NodeResultJS | NodeMustGenerate) \
macro(GetScopeChain, NodeResultJS) \
Modified: trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp (96183 => 96184)
--- trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp 2011-09-28 03:37:23 UTC (rev 96183)
+++ trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp 2011-09-28 03:39:36 UTC (rev 96184)
@@ -375,13 +375,6 @@
break;
}
- case ValueToDouble: {
- // This node should never be visible at this stage of compilation. It is
- // inserted by fixup(), which follows this phase.
- ASSERT_NOT_REACHED();
- break;
- }
-
case ValueAdd: {
PredictedType left = m_predictions[node.child1()];
PredictedType right = m_predictions[node.child2()];
@@ -546,6 +539,14 @@
break;
}
+ case ValueToDouble:
+ case GetArrayLength: {
+ // This node should never be visible at this stage of compilation. It is
+ // inserted by fixup(), which follows this phase.
+ ASSERT_NOT_REACHED();
+ break;
+ }
+
#ifndef NDEBUG
// These get ignored because they don't return anything.
case PutScopedVar:
@@ -681,6 +682,21 @@
break;
}
+ case GetById: {
+ if (!isArrayPrediction(m_predictions[node.child1()]))
+ break;
+ if (!isInt32Prediction(m_predictions[m_compileIndex]))
+ break;
+ if (m_codeBlock->identifier(node.identifierNumber()) != m_globalData.propertyNames->length)
+ break;
+
+#if ENABLE(DFG_DEBUG_PROPAGATION_VERBOSE)
+ printf(" @%u -> GetArrayLength", nodeIndex);
+#endif
+ node.op = GetArrayLength;
+ break;
+ }
+
default:
break;
}
@@ -1044,6 +1060,7 @@
case ArithMax:
case ArithSqrt:
case GetCallee:
+ case GetArrayLength:
setReplacement(pureCSE(node));
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (96183 => 96184)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-09-28 03:37:23 UTC (rev 96183)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-09-28 03:39:36 UTC (rev 96184)
@@ -1831,6 +1831,26 @@
jsValueResult(resultGPR, m_compileIndex, UseChildrenCalledExplicitly);
break;
}
+
+ case GetArrayLength: {
+ Node& baseNode = m_jit.graph()[node.child1()];
+ SpeculateCellOperand base(this, node.child1());
+ GPRTemporary result(this);
+
+ GPRReg baseGPR = base.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ if (baseNode.op != GetLocal || !isArrayPrediction(m_jit.graph().getPrediction(baseNode.local())))
+ speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+
+ m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), resultGPR);
+ m_jit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), resultGPR);
+
+ speculationCheck(m_jit.branch32(MacroAssembler::LessThan, resultGPR, MacroAssembler::TrustedImm32(0)));
+
+ integerResult(resultGPR, m_compileIndex);
+ break;
+ }
case CheckStructure: {
SpeculateCellOperand base(this, node.child1());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
