Title: [206047] trunk/Source/_javascript_Core
Revision
206047
Author
utatane....@gmail.com
Date
2016-09-16 14:17:33 -0700 (Fri, 16 Sep 2016)

Log Message

[DFG] Introduce ArrayUse
https://bugs.webkit.org/show_bug.cgi?id=162063

Reviewed by Keith Miller.

ArrayUse is particularly useful: for IsJSArray.
We can drop IsJSArray in fixup phase by setting ArrayUse edge filter.

Since @isJSArray user is limited (Array.prototype.concat), the effect of this patch is small.
But later, I'll update {@isArray, Array.isArray} to use @isJSArray[1]. In that patch, we are planning
to implement more aggressive optimization like, setting CellUse edge filter to avoid cell check in
SpeculativeJIT::compileIsJSArray.

In the benchmark using Array.prototype.concat, we can see perf improvement since we can drop IsJSArray in fixup phase.

                                             baseline                  patched

    lazy-array-species-watchpoints       25.0911+-0.0516     ^     24.7687+-0.0767        ^ definitely 1.0130x faster

[1]: https://bugs.webkit.org/show_bug.cgi?id=162000

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateArray):
(JSC::DFG::SpeculativeJIT::speculate):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGUseKind.cpp:
(WTF::printInternal):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateArray):
(JSC::FTL::DFG::LowerDFGToB3::speculateObject): Deleted.

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (206046 => 206047)


--- trunk/Source/_javascript_Core/ChangeLog	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-09-16 21:17:33 UTC (rev 206047)
@@ -1,3 +1,46 @@
+2016-09-16  Yusuke Suzuki  <utatane....@gmail.com>
+
+        [DFG] Introduce ArrayUse
+        https://bugs.webkit.org/show_bug.cgi?id=162063
+
+        Reviewed by Keith Miller.
+
+        ArrayUse is particularly useful: for IsJSArray.
+        We can drop IsJSArray in fixup phase by setting ArrayUse edge filter.
+
+        Since @isJSArray user is limited (Array.prototype.concat), the effect of this patch is small.
+        But later, I'll update {@isArray, Array.isArray} to use @isJSArray[1]. In that patch, we are planning
+        to implement more aggressive optimization like, setting CellUse edge filter to avoid cell check in
+        SpeculativeJIT::compileIsJSArray.
+
+        In the benchmark using Array.prototype.concat, we can see perf improvement since we can drop IsJSArray in fixup phase.
+
+                                                     baseline                  patched
+
+            lazy-array-species-watchpoints       25.0911+-0.0516     ^     24.7687+-0.0767        ^ definitely 1.0130x faster
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=162000
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateArray):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateArray):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateObject): Deleted.
+
 2016-09-16  Joseph Pecoraro  <pecor...@apple.com>
 
         test262: Various Constructors length properties should be configurable

Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (206046 => 206047)


--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2016-09-16 21:17:33 UTC (rev 206047)
@@ -1417,6 +1417,16 @@
             }
             break;
 
+        case IsJSArray:
+            if (node->child1()->shouldSpeculateArray()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), ArrayUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<ArrayUse>(node);
+            }
+            break;
+
         case GetEnumerableLength: {
             fixEdge<CellUse>(node->child1());
             break;
@@ -1622,7 +1632,6 @@
         case NewRegexp:
         case DeleteById:
         case DeleteByVal:
-        case IsJSArray:
         case IsTypedArrayView:
         case IsEmpty:
         case IsUndefined:

Modified: trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h (206046 => 206047)


--- trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h	2016-09-16 21:17:33 UTC (rev 206047)
@@ -55,6 +55,7 @@
         case CellUse:
         case CellOrOtherUse:
         case ObjectUse:
+        case ArrayUse:
         case FunctionUse:
         case FinalObjectUse:
         case RegExpObjectUse:

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (206046 => 206047)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2016-09-16 21:17:33 UTC (rev 206047)
@@ -7394,6 +7394,20 @@
     speculateRegExpObject(edge, operand.gpr());
 }
 
+void SpeculativeJIT::speculateArray(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecArray, ArrayType);
+}
+
+void SpeculativeJIT::speculateArray(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecArray))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateArray(edge, operand.gpr());
+}
+
 void SpeculativeJIT::speculateMapObject(Edge edge, GPRReg cell)
 {
     speculateCellType(edge, cell, SpecMapObject, JSMapType);
@@ -7703,6 +7717,9 @@
     case FunctionUse:
         speculateFunction(edge);
         break;
+    case ArrayUse:
+        speculateArray(edge);
+        break;
     case FinalObjectUse:
         speculateFinalObject(edge);
         break;

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (206046 => 206047)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h	2016-09-16 21:17:33 UTC (rev 206047)
@@ -2674,6 +2674,8 @@
     void speculateCell(Edge);
     void speculateCellOrOther(Edge);
     void speculateObject(Edge);
+    void speculateArray(Edge, GPRReg cell);
+    void speculateArray(Edge);
     void speculateFunction(Edge);
     void speculateFinalObject(Edge);
     void speculateRegExpObject(Edge, GPRReg cell);

Modified: trunk/Source/_javascript_Core/dfg/DFGUseKind.cpp (206046 => 206047)


--- trunk/Source/_javascript_Core/dfg/DFGUseKind.cpp	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/dfg/DFGUseKind.cpp	2016-09-16 21:17:33 UTC (rev 206047)
@@ -85,6 +85,9 @@
     case ObjectUse:
         out.print("Object");
         return;
+    case ArrayUse:
+        out.print("Array");
+        return;
     case FunctionUse:
         out.print("Function");
         return;

Modified: trunk/Source/_javascript_Core/dfg/DFGUseKind.h (206046 => 206047)


--- trunk/Source/_javascript_Core/dfg/DFGUseKind.h	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/dfg/DFGUseKind.h	2016-09-16 21:17:33 UTC (rev 206047)
@@ -53,6 +53,7 @@
     KnownCellUse,
     CellOrOtherUse,
     ObjectUse,
+    ArrayUse,
     FunctionUse,
     FinalObjectUse,
     RegExpObjectUse,
@@ -117,6 +118,8 @@
         return SpecCell | SpecOther;
     case ObjectUse:
         return SpecObject;
+    case ArrayUse:
+        return SpecArray;
     case FunctionUse:
         return SpecFunction;
     case FinalObjectUse:
@@ -218,6 +221,7 @@
     case CellUse:
     case KnownCellUse:
     case ObjectUse:
+    case ArrayUse:
     case FunctionUse:
     case FinalObjectUse:
     case RegExpObjectUse:

Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (206046 => 206047)


--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp	2016-09-16 21:17:33 UTC (rev 206047)
@@ -422,6 +422,7 @@
                 case KnownCellUse:
                 case CellOrOtherUse:
                 case ObjectUse:
+                case ArrayUse:
                 case FunctionUse:
                 case ObjectOrOtherUse:
                 case StringUse:

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (206046 => 206047)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2016-09-16 20:49:16 UTC (rev 206046)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2016-09-16 21:17:33 UTC (rev 206047)
@@ -10676,6 +10676,9 @@
         case ObjectUse:
             speculateObject(edge);
             break;
+        case ArrayUse:
+            speculateArray(edge);
+            break;
         case FunctionUse:
             speculateFunction(edge);
             break;
@@ -10960,6 +10963,17 @@
     {
         speculateObject(edge, lowCell(edge));
     }
+
+    void speculateArray(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecArray, isNotType(cell, ArrayType));
+    }
+
+    void speculateArray(Edge edge)
+    {
+        speculateArray(edge, lowCell(edge));
+    }
     
     void speculateFunction(Edge edge, LValue cell)
     {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to