Title: [252416] trunk
- Revision
- 252416
- Author
- [email protected]
- Date
- 2019-11-13 10:45:52 -0800 (Wed, 13 Nov 2019)
Log Message
[JSC] AI should convert IsCellWithType to constant when Structure set is finite
https://bugs.webkit.org/show_bug.cgi?id=204141
Reviewed by Saam Barati.
JSTests:
* stress/generator-cell-with-type.js: Added.
(shouldBe):
(shouldThrow):
(test):
(i.shouldThrow):
Source/_javascript_Core:
We should fold IsCellWithType if Structure set is finite since we have a chance to know what JSType is.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (252415 => 252416)
--- trunk/JSTests/ChangeLog 2019-11-13 18:39:44 UTC (rev 252415)
+++ trunk/JSTests/ChangeLog 2019-11-13 18:45:52 UTC (rev 252416)
@@ -1,3 +1,16 @@
+2019-11-13 Yusuke Suzuki <[email protected]>
+
+ [JSC] AI should convert IsCellWithType to constant when Structure set is finite
+ https://bugs.webkit.org/show_bug.cgi?id=204141
+
+ Reviewed by Saam Barati.
+
+ * stress/generator-cell-with-type.js: Added.
+ (shouldBe):
+ (shouldThrow):
+ (test):
+ (i.shouldThrow):
+
2019-11-12 Yusuke Suzuki <[email protected]>
[JSC] JSC GC relies on CodeBlock is not PreciseAllocation
Added: trunk/JSTests/stress/generator-cell-with-type.js (0 => 252416)
--- trunk/JSTests/stress/generator-cell-with-type.js (rev 0)
+++ trunk/JSTests/stress/generator-cell-with-type.js 2019-11-13 18:45:52 UTC (rev 252416)
@@ -0,0 +1,43 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function shouldThrow(func, errorMessage) {
+ var errorThrown = false;
+ var error = null;
+ try {
+ func();
+ } catch (e) {
+ errorThrown = true;
+ error = e;
+ }
+ if (!errorThrown)
+ throw new Error('not thrown');
+ if (String(error) !== errorMessage)
+ throw new Error(`bad error: ${String(error)}`);
+}
+
+function *generator()
+{
+}
+
+function test(gen)
+{
+ var func = gen.next;
+ shouldBe(gen.next().done, true);
+ return func;
+}
+noInline(test);
+var gen = generator();
+for (var i = 0; i < 1e6; ++i)
+ test(gen);
+
+for (var i = 0; i < 1e6; ++i) {
+ test(gen);
+ shouldThrow(() => {
+ test({
+ __proto__: gen.__proto__
+ });
+ }, `TypeError: |this| should be a generator`);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (252415 => 252416)
--- trunk/Source/_javascript_Core/ChangeLog 2019-11-13 18:39:44 UTC (rev 252415)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-11-13 18:45:52 UTC (rev 252416)
@@ -1,3 +1,15 @@
+2019-11-13 Yusuke Suzuki <[email protected]>
+
+ [JSC] AI should convert IsCellWithType to constant when Structure set is finite
+ https://bugs.webkit.org/show_bug.cgi?id=204141
+
+ Reviewed by Saam Barati.
+
+ We should fold IsCellWithType if Structure set is finite since we have a chance to know what JSType is.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
2019-11-12 Yusuke Suzuki <[email protected]>
[JSC] Put more things in IsoSubspace
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (252415 => 252416)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2019-11-13 18:39:44 UTC (rev 252415)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2019-11-13 18:45:52 UTC (rev 252416)
@@ -1419,6 +1419,35 @@
if (constantWasSet)
break;
}
+
+ if (forNode(node->child1()).m_structure.isFinite()) {
+ bool constantWasSet = false;
+ switch (node->op()) {
+ case IsCellWithType: {
+ bool ok = true;
+ Optional<bool> result;
+ forNode(node->child1()).m_structure.forEach(
+ [&](RegisteredStructure structure) {
+ bool matched = structure->typeInfo().type() == node->queriedType();
+ if (!result)
+ result = matched;
+ else {
+ if (result.value() != matched)
+ ok = false;
+ }
+ });
+ if (ok && result) {
+ setConstant(node, jsBoolean(result.value()));
+ constantWasSet = true;
+ }
+ break;
+ }
+ default:
+ break;
+ }
+ if (constantWasSet)
+ break;
+ }
// FIXME: This code should really use AbstractValue::isType() and
// AbstractValue::couldBeType().
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
