Title: [134313] trunk/Source/_javascript_Core
- Revision
- 134313
- Author
- [email protected]
- Date
- 2012-11-12 14:52:32 -0800 (Mon, 12 Nov 2012)
Log Message
DFG should not emit function checks if we've already proved that the operand is that exact function
https://bugs.webkit.org/show_bug.cgi?id=101885
Reviewed by Oliver Hunt.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::filterByValue):
(AbstractValue):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (134312 => 134313)
--- trunk/Source/_javascript_Core/ChangeLog 2012-11-12 22:45:05 UTC (rev 134312)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-11-12 22:52:32 UTC (rev 134313)
@@ -1,3 +1,18 @@
+2012-11-11 Filip Pizlo <[email protected]>
+
+ DFG should not emit function checks if we've already proved that the operand is that exact function
+ https://bugs.webkit.org/show_bug.cgi?id=101885
+
+ Reviewed by Oliver Hunt.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ * dfg/DFGAbstractValue.h:
+ (JSC::DFG::AbstractValue::filterByValue):
+ (AbstractValue):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
2012-11-12 Kentaro Hara <[email protected]>
[V8][JSC] ScriptProfileNode::callUID needs not to be [Custom]
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (134312 => 134313)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-11-12 22:45:05 UTC (rev 134312)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-11-12 22:52:32 UTC (rev 134313)
@@ -1572,11 +1572,22 @@
forNode(node.child1()).filter(SpecCell);
break;
- case CheckFunction:
+ case CheckFunction: {
+ JSValue value = forNode(node.child1()).value();
+ if (value == node.function()) {
+ m_foundConstants = true;
+ ASSERT(value);
+ node.setCanExit(false);
+ break;
+ }
+
node.setCanExit(true); // Lies! We can do better.
- forNode(node.child1()).filter(SpecFunction);
- // FIXME: Should be able to propagate the fact that we know what the function is.
+ if (!forNode(node.child1()).filterByValue(node.function())) {
+ m_isValid = false;
+ break;
+ }
break;
+ }
case PutById:
case PutByIdDirect:
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h (134312 => 134313)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h 2012-11-12 22:45:05 UTC (rev 134312)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h 2012-11-12 22:52:32 UTC (rev 134313)
@@ -284,6 +284,21 @@
checkConsistency();
}
+ bool filterByValue(JSValue value)
+ {
+ if (!validate(value))
+ return false;
+
+ if (!!value && value.isCell())
+ filter(StructureSet(value.asCell()->structure()));
+ else
+ filter(speculationFromValue(value));
+
+ m_value = value;
+
+ return true;
+ }
+
bool validateType(JSValue value) const
{
if (isTop())
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (134312 => 134313)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2012-11-12 22:45:05 UTC (rev 134312)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2012-11-12 22:52:32 UTC (rev 134313)
@@ -124,6 +124,14 @@
break;
}
+ case CheckFunction: {
+ if (m_state.forNode(node.child1()).value() != node.function())
+ break;
+ node.setOpAndDefaultFlags(Phantom);
+ eliminated = true;
+ break;
+ }
+
default:
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
