Diff
Modified: branches/dfgopt/Source/_javascript_Core/ChangeLog (117818 => 117819)
--- branches/dfgopt/Source/_javascript_Core/ChangeLog 2012-05-21 21:40:47 UTC (rev 117818)
+++ branches/dfgopt/Source/_javascript_Core/ChangeLog 2012-05-21 21:52:08 UTC (rev 117819)
@@ -1,3 +1,19 @@
+2012-05-20 Filip Pizlo <[email protected]>
+
+ DFG should not do unnecessary indirections when storing to objects
+ https://bugs.webkit.org/show_bug.cgi?id=86959
+
+ Reviewed by Oliver Hunt.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGCSEPhase.cpp:
+ (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2012-05-17 Filip Pizlo <[email protected]>
Fix a typo that Geoff noticed but that I forgot to fix in the last commit.
Modified: branches/dfgopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (117818 => 117819)
--- branches/dfgopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-05-21 21:40:47 UTC (rev 117818)
+++ branches/dfgopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-05-21 21:52:08 UTC (rev 117819)
@@ -2049,10 +2049,20 @@
if (!hasExitSite && putByIdStatus.isSimpleReplace()) {
addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(putByIdStatus.oldStructure())), base);
- addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), base, addToGraph(GetPropertyStorage, base), value);
+ size_t offsetOffset;
+ NodeIndex propertyStorage;
+ if (putByIdStatus.oldStructure()->isUsingInlineStorage()) {
+ propertyStorage = base;
+ ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
+ offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
+ } else {
+ propertyStorage = addToGraph(GetPropertyStorage, base);
+ offsetOffset = 0;
+ }
+ addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), propertyStorage, base, value);
StorageAccessData storageAccessData;
- storageAccessData.offset = putByIdStatus.offset();
+ storageAccessData.offset = putByIdStatus.offset() + offsetOffset;
storageAccessData.identifierNumber = identifierNumber;
m_graph.m_storageAccessData.append(storageAccessData);
} else if (!hasExitSite
@@ -2091,15 +2101,25 @@
putByIdStatus.newStructure()))),
base);
+ size_t offsetOffset;
+ NodeIndex propertyStorage;
+ if (putByIdStatus.newStructure()->isUsingInlineStorage()) {
+ propertyStorage = base;
+ ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
+ offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
+ } else {
+ propertyStorage = addToGraph(GetPropertyStorage, base);
+ offsetOffset = 0;
+ }
addToGraph(
PutByOffset,
OpInfo(m_graph.m_storageAccessData.size()),
+ propertyStorage,
base,
- addToGraph(GetPropertyStorage, base),
value);
StorageAccessData storageAccessData;
- storageAccessData.offset = putByIdStatus.offset();
+ storageAccessData.offset = putByIdStatus.offset() + offsetOffset;
storageAccessData.identifierNumber = identifierNumber;
m_graph.m_storageAccessData.append(storageAccessData);
} else {
Modified: branches/dfgopt/Source/_javascript_Core/dfg/DFGCSEPhase.cpp (117818 => 117819)
--- branches/dfgopt/Source/_javascript_Core/dfg/DFGCSEPhase.cpp 2012-05-21 21:40:47 UTC (rev 117818)
+++ branches/dfgopt/Source/_javascript_Core/dfg/DFGCSEPhase.cpp 2012-05-21 21:52:08 UTC (rev 117819)
@@ -307,7 +307,7 @@
{
for (unsigned i = m_indexInBlock; i--;) {
NodeIndex index = m_currentBlock->at(i);
- if (index == child1)
+ if (index == child1)
break;
Node& node = m_graph[index];
@@ -320,7 +320,7 @@
case PutByOffset:
if (m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber == identifierNumber) {
- if (node.child2() == child1)
+ if (node.child1() == child1) // Must be same property storage.
return node.child3().index();
return NoNode;
}
Modified: branches/dfgopt/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (117818 => 117819)
--- branches/dfgopt/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-05-21 21:40:47 UTC (rev 117818)
+++ branches/dfgopt/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-05-21 21:52:08 UTC (rev 117819)
@@ -3537,9 +3537,9 @@
case PutByOffset: {
#if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
- SpeculateCellOperand base(this, node.child1());
+ SpeculateCellOperand base(this, node.child2());
#endif
- StorageOperand storage(this, node.child2());
+ StorageOperand storage(this, node.child1());
JSValueOperand value(this, node.child3());
GPRReg storageGPR = storage.gpr();
Modified: branches/dfgopt/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (117818 => 117819)
--- branches/dfgopt/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-05-21 21:40:47 UTC (rev 117818)
+++ branches/dfgopt/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-05-21 21:52:08 UTC (rev 117819)
@@ -3538,9 +3538,9 @@
case PutByOffset: {
#if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
- SpeculateCellOperand base(this, node.child1());
+ SpeculateCellOperand base(this, node.child2());
#endif
- StorageOperand storage(this, node.child2());
+ StorageOperand storage(this, node.child1());
JSValueOperand value(this, node.child3());
GPRReg storageGPR = storage.gpr();
