Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 62afbec76ca8be22b3d56e66c61b7e4cc9e590e2
https://github.com/WebKit/WebKit/commit/62afbec76ca8be22b3d56e66c61b7e4cc9e590e2
Author: Yusuke Suzuki <[email protected]>
Date: 2024-04-19 (Fri, 19 Apr 2024)
Changed paths:
A JSTests/stress/check-true.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGMayExit.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Carefully avoid speculation when it is not necessary in CompareStrictEq
https://bugs.webkit.org/show_bug.cgi?id=272937
rdar://126718615
Reviewed by Keith Miller.
We found that sometimes we do speculation too strongly. For example, the code
may have an object or undefined,
if (object.getter !== true)
...
In the above case, right now, we put OtherUse on object.getter result when the
prediction says it is Other.
But if rhs or lhs is a constant and it is boolean / undefined etc.,
CompareStrictEq can be performed as a bitwise comparison,
so no speculation is required. If object.getter's result is used in the other
place later, then it will have speculation at
that place anyway. So given that CompareStrictEq does not produce a new
prediction from the input (it always returns Boolean),
it can be nice if we can avoid speculation when one of input is a specific
constant.
In this patch, we add a code in DFGFixupPhase, which generates
(Untyped,Boolean) and (Untyped,Other) pair speculations when
one of the input is constant.
* JSTests/stress/check-true.js: Added.
(test):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
* Source/JavaScriptCore/dfg/DFGMayExit.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/277771@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
