Title: [279053] trunk
- Revision
- 279053
- Author
- [email protected]
- Date
- 2021-06-20 02:48:03 -0700 (Sun, 20 Jun 2021)
Log Message
[JSC] Add ValueOf fast path in toPrimitive
https://bugs.webkit.org/show_bug.cgi?id=226948
Reviewed by Ross Kirsling.
JSTests:
* microbenchmarks/valueof-via-toprimitive.js: Added.
Source/_javascript_Core:
Add fast path for Object.prototype.valueOf function call since we
sometimes encounter this case in Speedometer2/EmberJS-Debug-TodoMVC.
ToT Patched
value-of-call 65.7169+-0.6192 ^ 45.0986+-0.0830 ^ definitely 1.4572x faster
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toStringSlowCase const):
* runtime/JSObject.cpp:
(JSC::callToPrimitiveFunction):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (279052 => 279053)
--- trunk/JSTests/ChangeLog 2021-06-20 07:37:12 UTC (rev 279052)
+++ trunk/JSTests/ChangeLog 2021-06-20 09:48:03 UTC (rev 279053)
@@ -1,3 +1,12 @@
+2021-06-20 Yusuke Suzuki <[email protected]>
+
+ [JSC] Add ValueOf fast path in toPrimitive
+ https://bugs.webkit.org/show_bug.cgi?id=226948
+
+ Reviewed by Ross Kirsling.
+
+ * microbenchmarks/valueof-via-toprimitive.js: Added.
+
2021-06-17 Saam Barati <[email protected]>
Make microbenchmarks/delete-property-from-prototype-chain not time out on debug builds
Added: trunk/JSTests/microbenchmarks/valueof-via-toprimitive.js (0 => 279053)
--- trunk/JSTests/microbenchmarks/valueof-via-toprimitive.js (rev 0)
+++ trunk/JSTests/microbenchmarks/valueof-via-toprimitive.js 2021-06-20 09:48:03 UTC (rev 279053)
@@ -0,0 +1,8 @@
+var array = [];
+function test(data) {
+ return Number(data);
+}
+noInline(test);
+
+for (var i = 0; i < 1e6; ++i)
+ test(array);
Modified: trunk/Source/_javascript_Core/ChangeLog (279052 => 279053)
--- trunk/Source/_javascript_Core/ChangeLog 2021-06-20 07:37:12 UTC (rev 279052)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-06-20 09:48:03 UTC (rev 279053)
@@ -1,3 +1,22 @@
+2021-06-20 Yusuke Suzuki <[email protected]>
+
+ [JSC] Add ValueOf fast path in toPrimitive
+ https://bugs.webkit.org/show_bug.cgi?id=226948
+
+ Reviewed by Ross Kirsling.
+
+ Add fast path for Object.prototype.valueOf function call since we
+ sometimes encounter this case in Speedometer2/EmberJS-Debug-TodoMVC.
+
+ ToT Patched
+
+ value-of-call 65.7169+-0.6192 ^ 45.0986+-0.0830 ^ definitely 1.4572x faster
+
+ * runtime/JSCJSValue.cpp:
+ (JSC::JSValue::toStringSlowCase const):
+ * runtime/JSObject.cpp:
+ (JSC::callToPrimitiveFunction):
+
2021-06-20 Robin Morisset <[email protected]>
Fix speculated type in the one-argument overload of speculateNeitherDoubleNorHeapBigIntNorString
Modified: trunk/Source/_javascript_Core/runtime/JSCJSValue.cpp (279052 => 279053)
--- trunk/Source/_javascript_Core/runtime/JSCJSValue.cpp 2021-06-20 07:37:12 UTC (rev 279052)
+++ trunk/Source/_javascript_Core/runtime/JSCJSValue.cpp 2021-06-20 09:48:03 UTC (rev 279053)
@@ -434,8 +434,8 @@
return errorValue();
}
- ASSERT(isCell());
- JSValue value = asCell()->toPrimitive(globalObject, PreferString);
+ ASSERT(isObject()); // String, Symbol, and HeapBigInt are already handled.
+ JSValue value = asObject(asCell())->toPrimitive(globalObject, PreferString);
RETURN_IF_EXCEPTION(scope, errorValue());
ASSERT(!value.isObject());
JSString* result = value.toString(globalObject);
Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (279052 => 279053)
--- trunk/Source/_javascript_Core/runtime/JSObject.cpp 2021-06-20 07:37:12 UTC (rev 279052)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp 2021-06-20 09:48:03 UTC (rev 279053)
@@ -2234,6 +2234,11 @@
}
}
+ if constexpr (key == CachedSpecialPropertyKey::ValueOf) {
+ if (function == globalObject->objectProtoValueOfFunction())
+ return JSValue();
+ }
+
auto callData = getCallData(vm, function);
if (callData.type == CallData::Type::None) {
if constexpr (key == CachedSpecialPropertyKey::ToPrimitive)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
