Title: [131973] trunk/Source/_javascript_Core
- Revision
- 131973
- Author
- [email protected]
- Date
- 2012-10-19 19:33:29 -0700 (Fri, 19 Oct 2012)
Log Message
Fix some of the regression cause by the non-local variable reworking
https://bugs.webkit.org/show_bug.cgi?id=99896
Reviewed by Filip Pizlo.
The non0local variable reworking led to some of the optimisations performed by
the bytecode generator being dropped. This in turn put more pressure on the DFG
optimisations. This exposed a short coming in our double speculation propogation.
Now we try to distinguish between places where we should SpecDoubleReal vs generic
SpecDouble.
* dfg/DFGPredictionPropagationPhase.cpp:
(PredictionPropagationPhase):
(JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
(JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPredictions):
(JSC::DFG::PredictionPropagationPhase::propagate):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (131972 => 131973)
--- trunk/Source/_javascript_Core/ChangeLog 2012-10-20 01:49:10 UTC (rev 131972)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-10-20 02:33:29 UTC (rev 131973)
@@ -1,3 +1,22 @@
+2012-10-19 Oliver Hunt <[email protected]>
+
+ Fix some of the regression cause by the non-local variable reworking
+ https://bugs.webkit.org/show_bug.cgi?id=99896
+
+ Reviewed by Filip Pizlo.
+
+ The non0local variable reworking led to some of the optimisations performed by
+ the bytecode generator being dropped. This in turn put more pressure on the DFG
+ optimisations. This exposed a short coming in our double speculation propogation.
+ Now we try to distinguish between places where we should SpecDoubleReal vs generic
+ SpecDouble.
+
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (PredictionPropagationPhase):
+ (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+ (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPredictions):
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+
2012-10-19 Michael Saboff <[email protected]>
Lexer should create 8 bit Identifiers for RegularExpressions and ASCII identifiers
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (131972 => 131973)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2012-10-20 01:49:10 UTC (rev 131972)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2012-10-20 02:33:29 UTC (rev 131973)
@@ -116,7 +116,21 @@
return false;
return !!m_graph.valueOfNumberConstant(nodeIndex);
}
-
+
+ SpeculatedType speculatedDoubleTypeForPrediction(SpeculatedType value)
+ {
+ if (!isNumberSpeculation(value))
+ return SpecDouble;
+ if (value & SpecDoubleNaN)
+ return SpecDouble;
+ return SpecDoubleReal;
+ }
+
+ SpeculatedType speculatedDoubleTypeForPredictions(SpeculatedType left, SpeculatedType right)
+ {
+ return speculatedDoubleTypeForPrediction(mergeSpeculations(left, right));
+ }
+
void propagate(Node& node)
{
if (!node.shouldGenerate())
@@ -248,7 +262,7 @@
if (m_graph.addShouldSpeculateInteger(node))
changed |= mergePrediction(SpecInt32);
else
- changed |= mergePrediction(SpecDouble);
+ changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
} else if (!(left & SpecNumber) || !(right & SpecNumber)) {
// left or right is definitely something other than a number.
changed |= mergePrediction(SpecString);
@@ -272,7 +286,7 @@
if (m_graph.addShouldSpeculateInteger(node))
changed |= mergePrediction(SpecInt32);
else
- changed |= mergePrediction(SpecDouble);
+ changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
}
if (isNotNegZero(node.child1().index()) || isNotNegZero(node.child2().index()))
@@ -291,7 +305,7 @@
if (m_graph.addShouldSpeculateInteger(node))
changed |= mergePrediction(SpecInt32);
else
- changed |= mergePrediction(SpecDouble);
+ changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
}
if (isNotZero(node.child1().index()) || isNotZero(node.child2().index()))
@@ -307,7 +321,7 @@
if (m_graph.negateShouldSpeculateInteger(node))
changed |= mergePrediction(SpecInt32);
else
- changed |= mergePrediction(SpecDouble);
+ changed |= mergePrediction(speculatedDoubleTypeForPrediction(m_graph[node.child1()].prediction()));
}
changed |= m_graph[node.child1()].mergeFlags(flags);
@@ -323,7 +337,7 @@
&& nodeCanSpeculateInteger(node.arithNodeFlags()))
changed |= mergePrediction(SpecInt32);
else
- changed |= mergePrediction(SpecDouble);
+ changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
}
flags |= NodeUsedAsNumber;
@@ -340,7 +354,7 @@
if (m_graph.mulShouldSpeculateInteger(node))
changed |= mergePrediction(SpecInt32);
else
- changed |= mergePrediction(SpecDouble);
+ changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
}
// As soon as a multiply happens, we can easily end up in the part
@@ -388,7 +402,7 @@
if (nodeCanSpeculateInteger(node.arithNodeFlags()))
changed |= mergePrediction(child);
else
- changed |= setPrediction(SpecDouble);
+ changed |= setPrediction(speculatedDoubleTypeForPrediction(child));
flags &= ~NodeNeedsNegZero;
changed |= m_graph[node.child1()].mergeFlags(flags);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
