Modified: trunk/LayoutTests/ChangeLog (185031 => 185032)
--- trunk/LayoutTests/ChangeLog 2015-05-30 08:52:28 UTC (rev 185031)
+++ trunk/LayoutTests/ChangeLog 2015-05-30 21:48:35 UTC (rev 185032)
@@ -1,3 +1,15 @@
+2015-05-30 Filip Pizlo <fpi...@apple.com>
+
+ FTL codegen for MultiGetByOffset and MultiPutByOffset where the structure set is already proved should have an unreachable default case instead of an exit
+ https://bugs.webkit.org/show_bug.cgi?id=145469
+
+ Reviewed by Geoffrey Garen.
+
+ * js/regress/repeat-multi-get-by-offset-expected.txt: Added.
+ * js/regress/repeat-multi-get-by-offset.html: Added.
+ * js/regress/script-tests/repeat-multi-get-by-offset.js: Added.
+ (foo):
+
2015-05-29 Keith Miller <keith_mil...@apple.com>
WeakMap reference w/ DOM element as key does not survive long enough.
Added: trunk/LayoutTests/js/regress/repeat-multi-get-by-offset-expected.txt (0 => 185032)
--- trunk/LayoutTests/js/regress/repeat-multi-get-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/repeat-multi-get-by-offset-expected.txt 2015-05-30 21:48:35 UTC (rev 185032)
@@ -0,0 +1,10 @@
+JSRegress/repeat-multi-get-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/regress/repeat-multi-get-by-offset.html (0 => 185032)
--- trunk/LayoutTests/js/regress/repeat-multi-get-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/repeat-multi-get-by-offset.html 2015-05-30 21:48:35 UTC (rev 185032)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/regress/script-tests/repeat-multi-get-by-offset.js (0 => 185032)
--- trunk/LayoutTests/js/regress/script-tests/repeat-multi-get-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/repeat-multi-get-by-offset.js 2015-05-30 21:48:35 UTC (rev 185032)
@@ -0,0 +1,12 @@
+function foo(o) {
+ return o.f + o.g;
+}
+
+noInline(foo);
+
+var o = { f:1, g:2 };
+var p = { g:3, f:4 };
+for (var i = 0; i < 2000000; ++i) {
+ foo(o);
+ foo(p);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (185031 => 185032)
--- trunk/Source/_javascript_Core/ChangeLog 2015-05-30 08:52:28 UTC (rev 185031)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-05-30 21:48:35 UTC (rev 185032)
@@ -1,3 +1,18 @@
+2015-05-29 Filip Pizlo <fpi...@apple.com>
+
+ FTL codegen for MultiGetByOffset and MultiPutByOffset where the structure set is already proved should have an unreachable default case instead of an exit
+ https://bugs.webkit.org/show_bug.cgi?id=145469
+
+ Reviewed by Geoffrey Garen.
+
+ Omitting the speculation on the fail path when the speculation is guaranteed not to be
+ taken hints to LLVM that the default case is impossible. This enables some useful
+ optimizations.
+
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+ (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+
2015-05-29 Mark Lam <mark....@apple.com>
Refactoring HandlerInfo and UnlinkedHandlerInfo.
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (185031 => 185032)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2015-05-30 08:52:28 UTC (rev 185031)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2015-05-30 21:48:35 UTC (rev 185032)
@@ -3778,11 +3778,13 @@
LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MultiGetByOffset continuation"));
Vector<SwitchCase, 2> cases;
+ StructureSet baseSet;
for (unsigned i = data.variants.size(); i--;) {
GetByIdVariant variant = data.variants[i];
for (unsigned j = variant.structureSet().size(); j--;) {
- cases.append(SwitchCase(
- weakStructureID(variant.structureSet()[j]), blocks[i], Weight(1)));
+ Structure* structure = variant.structureSet()[j];
+ baseSet.add(structure);
+ cases.append(SwitchCase(weakStructureID(structure), blocks[i], Weight(1)));
}
}
m_out.switchInstruction(
@@ -3795,6 +3797,7 @@
m_out.appendTo(blocks[i], i + 1 < data.variants.size() ? blocks[i + 1] : exit);
GetByIdVariant variant = data.variants[i];
+ baseSet.merge(variant.structureSet());
LValue result;
JSValue constantResult;
if (variant.alternateBase()) {
@@ -3819,7 +3822,8 @@
}
m_out.appendTo(exit, continuation);
- speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
+ if (!m_interpreter.forNode(m_node->child1()).m_structure.isSubsetOf(baseSet))
+ speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
m_out.unreachable();
m_out.appendTo(continuation, lastNext);
@@ -3849,11 +3853,13 @@
LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MultiPutByOffset continuation"));
Vector<SwitchCase, 2> cases;
+ StructureSet baseSet;
for (unsigned i = data.variants.size(); i--;) {
PutByIdVariant variant = data.variants[i];
for (unsigned j = variant.oldStructure().size(); j--;) {
- cases.append(
- SwitchCase(weakStructureID(variant.oldStructure()[j]), blocks[i], Weight(1)));
+ Structure* structure = variant.oldStructure()[j];
+ baseSet.add(structure);
+ cases.append(SwitchCase(weakStructureID(structure), blocks[i], Weight(1)));
}
}
m_out.switchInstruction(
@@ -3893,7 +3899,8 @@
}
m_out.appendTo(exit, continuation);
- speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
+ if (!m_interpreter.forNode(m_node->child1()).m_structure.isSubsetOf(baseSet))
+ speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
m_out.unreachable();
m_out.appendTo(continuation, lastNext);
