Title: [215459] trunk
- Revision
- 215459
- Author
- [email protected]
- Date
- 2017-04-18 08:04:57 -0700 (Tue, 18 Apr 2017)
Log Message
[DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
https://bugs.webkit.org/show_bug.cgi?id=170940
Reviewed by Filip Pizlo.
JSTests:
* microbenchmarks/for-of-array.js: Added.
(fn):
Source/_javascript_Core:
The second argument of CheckCell is not used in meaningful way. It is just *use* the node.
The problem is that it effectively *use* the child2 in ObjectAllocationSinking phase, and
prevent us from eliminating object allocations. Actually, it materializes Array iterator
when inlining `next()`. Instead, we should use Phantom in such a case.
It improves destructuring.es6 in SixSpeed 2.5x.
destructuring.es6 308.5184+-25.3490 ^ 119.5680+-15.0520 ^ definitely 2.5803x faster
Note that SixSpeed tested in arewefastyet executes all the tests in one process while our SixSpeed
tests each one in isolated way.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitFunctionChecks):
(JSC::DFG::ByteCodeParser::handleGetById):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (215458 => 215459)
--- trunk/JSTests/ChangeLog 2017-04-18 11:54:23 UTC (rev 215458)
+++ trunk/JSTests/ChangeLog 2017-04-18 15:04:57 UTC (rev 215459)
@@ -1,3 +1,13 @@
+2017-04-18 Yusuke Suzuki <[email protected]>
+
+ [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
+ https://bugs.webkit.org/show_bug.cgi?id=170940
+
+ Reviewed by Filip Pizlo.
+
+ * microbenchmarks/for-of-array.js: Added.
+ (fn):
+
2017-04-17 Saam Barati <[email protected]>
BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
Added: trunk/JSTests/microbenchmarks/for-of-array.js (0 => 215459)
--- trunk/JSTests/microbenchmarks/for-of-array.js (rev 0)
+++ trunk/JSTests/microbenchmarks/for-of-array.js 2017-04-18 15:04:57 UTC (rev 215459)
@@ -0,0 +1,12 @@
+var data = ""
+
+function fn() {
+ var ret = '';
+ for (var value of data)
+ ret += value;
+ return ret;
+}
+noInline(fn);
+
+for (var i = 0; i < 1e5; ++i)
+ fn();
Modified: trunk/Source/_javascript_Core/ChangeLog (215458 => 215459)
--- trunk/Source/_javascript_Core/ChangeLog 2017-04-18 11:54:23 UTC (rev 215458)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-04-18 15:04:57 UTC (rev 215459)
@@ -1,5 +1,28 @@
2017-04-18 Yusuke Suzuki <[email protected]>
+ [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
+ https://bugs.webkit.org/show_bug.cgi?id=170940
+
+ Reviewed by Filip Pizlo.
+
+ The second argument of CheckCell is not used in meaningful way. It is just *use* the node.
+ The problem is that it effectively *use* the child2 in ObjectAllocationSinking phase, and
+ prevent us from eliminating object allocations. Actually, it materializes Array iterator
+ when inlining `next()`. Instead, we should use Phantom in such a case.
+
+ It improves destructuring.es6 in SixSpeed 2.5x.
+
+ destructuring.es6 308.5184+-25.3490 ^ 119.5680+-15.0520 ^ definitely 2.5803x faster
+
+ Note that SixSpeed tested in arewefastyet executes all the tests in one process while our SixSpeed
+ tests each one in isolated way.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+ (JSC::DFG::ByteCodeParser::handleGetById):
+
+2017-04-18 Yusuke Suzuki <[email protected]>
+
[JSC][GTK] glib RunLoop does not accept negative start interval
https://bugs.webkit.org/show_bug.cgi?id=170775
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (215458 => 215459)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-04-18 11:54:23 UTC (rev 215458)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-04-18 15:04:57 UTC (rev 215459)
@@ -1370,7 +1370,7 @@
if (thisArgumentReg.isValid())
thisArgument = get(thisArgumentReg);
else
- thisArgument = 0;
+ thisArgument = nullptr;
JSCell* calleeCell;
Node* callTargetForCheck;
@@ -1383,7 +1383,9 @@
}
ASSERT(calleeCell);
- addToGraph(CheckCell, OpInfo(m_graph.freeze(calleeCell)), callTargetForCheck, thisArgument);
+ if (thisArgument)
+ addToGraph(Phantom, thisArgument);
+ addToGraph(CheckCell, OpInfo(m_graph.freeze(calleeCell)), callTargetForCheck);
}
Node* ByteCodeParser::getArgumentCount()
@@ -3612,7 +3614,8 @@
if (handleIntrinsicGetter(destinationOperand, variant, base,
[&] () {
- addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter, base);
+ addToGraph(Phantom, base);
+ addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter);
})) {
addToGraph(Phantom, getter);
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
