Diff
Modified: trunk/LayoutTests/ChangeLog (200957 => 200958)
--- trunk/LayoutTests/ChangeLog 2016-05-16 19:20:40 UTC (rev 200957)
+++ trunk/LayoutTests/ChangeLog 2016-05-16 19:41:01 UTC (rev 200958)
@@ -1,3 +1,39 @@
+2016-05-16 Filip Pizlo <[email protected]>
+
+ FixupPhase should be more eager to demote bit math to untyped
+ https://bugs.webkit.org/show_bug.cgi?id=157746
+
+ Reviewed by Mark Lam.
+
+ * js/regress/object-and-expected.txt: Added.
+ * js/regress/object-and.html: Added.
+ * js/regress/object-int-and-array-expected.txt: Added.
+ * js/regress/object-int-and-array.html: Added.
+ * js/regress/object-lshift-expected.txt: Added.
+ * js/regress/object-lshift.html: Added.
+ * js/regress/object-or-expected.txt: Added.
+ * js/regress/object-or.html: Added.
+ * js/regress/object-rshift-expected.txt: Added.
+ * js/regress/object-rshift.html: Added.
+ * js/regress/object-urshift-expected.txt: Added.
+ * js/regress/object-urshift.html: Added.
+ * js/regress/object-xor-expected.txt: Added.
+ * js/regress/object-xor.html: Added.
+ * js/regress/script-tests/object-and.js: Added.
+ (o.valueOf):
+ * js/regress/script-tests/object-int-and-array.js: Added.
+ (i.o.valueOf):
+ * js/regress/script-tests/object-lshift.js: Added.
+ (o.valueOf):
+ * js/regress/script-tests/object-or.js: Added.
+ (o.valueOf):
+ * js/regress/script-tests/object-rshift.js: Added.
+ (o.valueOf):
+ * js/regress/script-tests/object-urshift.js: Added.
+ (o.valueOf):
+ * js/regress/script-tests/object-xor.js: Added.
+ (o.valueOf):
+
2016-05-16 Michael Saboff <[email protected]>
RegExp /y flag incorrect handling of mixed-length alternation
Added: trunk/LayoutTests/js/regress/object-and-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-and-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-and-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-and
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-and.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-and.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-and.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/object-int-and-array-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-int-and-array-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-int-and-array-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-int-and-array
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-int-and-array.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-int-and-array.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-int-and-array.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/object-lshift-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-lshift-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-lshift-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-lshift
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-lshift.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-lshift.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-lshift.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/object-or-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-or-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-or-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-or
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-or.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-or.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-or.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/object-rshift-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-rshift-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-rshift-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-rshift
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-rshift.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-rshift.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-rshift.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/object-urshift-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-urshift-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-urshift-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-urshift
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-urshift.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-urshift.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-urshift.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/object-xor-expected.txt (0 => 200958)
--- trunk/LayoutTests/js/regress/object-xor-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/object-xor-expected.txt 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,10 @@
+JSRegress/object-xor
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/object-xor.html (0 => 200958)
--- trunk/LayoutTests/js/regress/object-xor.html (rev 0)
+++ trunk/LayoutTests/js/regress/object-xor.html 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/script-tests/object-and.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-and.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-and.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,17 @@
+(function() {
+ var m = 1000;
+ var n = 1000;
+ var o = {valueOf: function() { return 42; }};
+ var result = 0;
+ for (var i = 0; i < m; ++i) {
+ result += o & 2;
+ for (var j = 0; j < n; ++j)
+ result *= 1.1;
+ for (var j = 0; j < n; ++j)
+ result /= 2;
+ }
+
+ if (result != 4.610197065037039e-260)
+ throw "Error: bad result: " + result;
+})();
+
Added: trunk/LayoutTests/js/regress/script-tests/object-int-and-array.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-int-and-array.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-int-and-array.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,18 @@
+(function() {
+ var result = 0;
+ var m = 100;
+ var n = 100000;
+ var array = [];
+ for (var i = 0; i < 100; ++i)
+ array.push(12);
+ for (var i = 0; i < m; ++i) {
+ var value = 0;
+ var o = {valueOf: function() { return 42; }};
+ value += o;
+ var result = 0;
+ for (var j = 0; j < n; ++j)
+ result += array[value];
+ }
+ if (result != n * 12)
+ throw "Error: bad result: " + result;
+})();
Added: trunk/LayoutTests/js/regress/script-tests/object-lshift.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-lshift.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-lshift.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,17 @@
+(function() {
+ var m = 1000;
+ var n = 1000;
+ var o = {valueOf: function() { return 1; }};
+ var result = 0;
+ for (var i = 0; i < m; ++i) {
+ result += 1 << o;
+ for (var j = 0; j < n; ++j)
+ result *= 1.1;
+ for (var j = 0; j < n; ++j)
+ result /= 2;
+ }
+
+ if (result != 4.610197065037039e-260)
+ throw "Error: bad result: " + result;
+})();
+
Added: trunk/LayoutTests/js/regress/script-tests/object-or.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-or.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-or.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,17 @@
+(function() {
+ var m = 1000;
+ var n = 1000;
+ var o = {valueOf: function() { return 42; }};
+ var result = 0;
+ for (var i = 0; i < m; ++i) {
+ result += o | 1;
+ for (var j = 0; j < n; ++j)
+ result *= 1.1;
+ for (var j = 0; j < n; ++j)
+ result /= 2;
+ }
+
+ if (result != 9.911923689829635e-259)
+ throw "Error: bad result: " + result;
+})();
+
Added: trunk/LayoutTests/js/regress/script-tests/object-rshift.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-rshift.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-rshift.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,17 @@
+(function() {
+ var m = 1000;
+ var n = 1000;
+ var o = {valueOf: function() { return 1; }};
+ var result = 0;
+ for (var i = 0; i < m; ++i) {
+ result += 2 >> o;
+ for (var j = 0; j < n; ++j)
+ result *= 1.1;
+ for (var j = 0; j < n; ++j)
+ result /= 2;
+ }
+
+ if (result != 2.3050985325185195e-260)
+ throw "Error: bad result: " + result;
+})();
+
Added: trunk/LayoutTests/js/regress/script-tests/object-urshift.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-urshift.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-urshift.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,17 @@
+(function() {
+ var m = 1000;
+ var n = 1000;
+ var o = {valueOf: function() { return 1; }};
+ var result = 0;
+ for (var i = 0; i < m; ++i) {
+ result += 2 >>> o;
+ for (var j = 0; j < n; ++j)
+ result *= 1.1;
+ for (var j = 0; j < n; ++j)
+ result /= 2;
+ }
+
+ if (result != 2.3050985325185195e-260)
+ throw "Error: bad result: " + result;
+})();
+
Added: trunk/LayoutTests/js/regress/script-tests/object-xor.js (0 => 200958)
--- trunk/LayoutTests/js/regress/script-tests/object-xor.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/object-xor.js 2016-05-16 19:41:01 UTC (rev 200958)
@@ -0,0 +1,17 @@
+(function() {
+ var m = 1000;
+ var n = 1000;
+ var o = {valueOf: function() { return 42; }};
+ var result = 0;
+ for (var i = 0; i < m; ++i) {
+ result += o ^ 2;
+ for (var j = 0; j < n; ++j)
+ result *= 1.1;
+ for (var j = 0; j < n; ++j)
+ result /= 2;
+ }
+
+ if (result != 9.220394130074086e-259)
+ throw "Error: bad result: " + result;
+})();
+
Modified: trunk/Source/_javascript_Core/ChangeLog (200957 => 200958)
--- trunk/Source/_javascript_Core/ChangeLog 2016-05-16 19:20:40 UTC (rev 200957)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-05-16 19:41:01 UTC (rev 200958)
@@ -1,3 +1,26 @@
+2016-05-16 Filip Pizlo <[email protected]>
+
+ FixupPhase should be more eager to demote bit math to untyped
+ https://bugs.webkit.org/show_bug.cgi?id=157746
+
+ Reviewed by Mark Lam.
+
+ This just makes the logic for how we fixup bit math match the way we do it in other places.
+ This doesn't affect performance on any major benchmark but it's a big win on new
+ microbenchmarks added in this change.
+
+ Details:
+
+ object-and 11.1610+-0.7602 ^ 4.8105+-0.1690 ^ definitely 2.3201x faster
+ object-or 11.0845+-0.2487 ^ 4.7146+-0.0374 ^ definitely 2.3511x faster
+ object-xor 10.2946+-0.9946 ^ 4.7278+-0.0814 ^ definitely 2.1775x faster
+ object-lshift 10.4896+-1.0867 ^ 4.7699+-0.0721 ^ definitely 2.1991x faster
+ object-rshift 11.1239+-0.5010 ^ 4.7194+-0.0445 ^ definitely 2.3570x faster
+ object-urshift 10.9745+-0.1315 ^ 4.7848+-0.0479 ^ definitely 2.2936x faster
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+
2016-05-15 Michael Saboff <[email protected]>
RegExp /y flag incorrect handling of mixed-length alternation
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (200957 => 200958)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-05-16 19:20:40 UTC (rev 200957)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-05-16 19:41:01 UTC (rev 200958)
@@ -105,8 +105,7 @@
case BitRShift:
case BitLShift:
case BitURShift: {
- if (Node::shouldSpeculateUntypedForBitOps(node->child1().node(), node->child2().node())
- && m_graph.hasExitSite(node->origin.semantic, BadType)) {
+ if (Node::shouldSpeculateUntypedForBitOps(node->child1().node(), node->child2().node())) {
fixEdge<UntypedUse>(node->child1());
fixEdge<UntypedUse>(node->child2());
break;
