Title: [228837] branches/safari-605-branch/Source/_javascript_Core
- Revision
- 228837
- Author
- [email protected]
- Date
- 2018-02-20 14:30:03 -0800 (Tue, 20 Feb 2018)
Log Message
Cherry-pick r228693. rdar://problem/37697679
Modified Paths
Diff
Modified: branches/safari-605-branch/Source/_javascript_Core/ChangeLog (228836 => 228837)
--- branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-02-20 22:30:01 UTC (rev 228836)
+++ branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-02-20 22:30:03 UTC (rev 228837)
@@ -1,5 +1,32 @@
2018-02-20 Jason Marcell <[email protected]>
+ Cherry-pick r228693. rdar://problem/37697679
+
+ 2018-02-17 Filip Pizlo <[email protected]>
+
+ GetArrayMask should support constant folding
+ https://bugs.webkit.org/show_bug.cgi?id=182907
+
+ Reviewed by Saam Barati.
+
+ Implement constant folding for GetArrayMask. This revealed a bug in tryGetFoldableView, where it was
+ ignoring the result of a jsDynamicCast<>(). This wasn't a bug before because it would have been
+ impossible for that function to get called with a non-null value if the value was not an array view,
+ due to type filtering in CheckArray, the fact that CheckArray had to dominate GetArrayLength, and
+ the fact that the other tryGetFoldableView overload made sure that the array mode was some typed
+ array.
+
+ This isn't a measurable progression, but it does save a register in the codegen for typed array
+ accesses. Hopefully these improvements add up.
+
+ * assembler/AssemblerBuffer.h:
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::tryGetFoldableView):
+
+2018-02-20 Jason Marcell <[email protected]>
+
Cherry-pick r228565. rdar://problem/37697682
2018-02-16 Saam Barati <[email protected]>
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (228836 => 228837)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2018-02-20 22:30:01 UTC (rev 228836)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2018-02-20 22:30:03 UTC (rev 228837)
@@ -2511,9 +2511,15 @@
break;
}
- case GetArrayMask:
+ case GetArrayMask: {
+ JSArrayBufferView* view = m_graph.tryGetFoldableView(forNode(node->child1()).m_value);
+ if (view) {
+ setConstant(node, jsNumber(view->butterflyIndexingMask()));
+ break;
+ }
forNode(node).setType(SpecInt32Only);
break;
+ }
case GetVectorLength: {
forNode(node).setType(SpecInt32Only);
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGGraph.cpp (228836 => 228837)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGGraph.cpp 2018-02-20 22:30:01 UTC (rev 228836)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGGraph.cpp 2018-02-20 22:30:03 UTC (rev 228837)
@@ -1384,7 +1384,7 @@
if (!value)
return nullptr;
JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(m_vm, value);
- if (!value)
+ if (!view)
return nullptr;
if (!view->length())
return nullptr;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
