- Revision
- 97410
- Author
- oli...@apple.com
- Date
- 2011-10-13 15:23:47 -0700 (Thu, 13 Oct 2011)
Log Message
Fix performance of ValueToInt32 node when predicting double
https://bugs.webkit.org/show_bug.cgi?id=70063
Reviewed by Filip Pizlo.
Currently we fail to inline double to int conversion when
performing a ValueToInt32 operation on a value we predict
to be a double.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
Apply correct filter for the double prediction path
* dfg/DFGJITCodeGenerator32_64.cpp:
(JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
* dfg/DFGJITCodeGenerator64.cpp:
(JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
Support double parameters even when value has been spilled.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
Moved old valueToInt32 code to this function, and added
path for double prediction
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Made the two implementations of ValueToInt32 call a single
shared compileValueToInt32 function.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (97409 => 97410)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-13 22:23:47 UTC (rev 97410)
@@ -1,3 +1,34 @@
+2011-10-13 Oliver Hunt <oli...@apple.com>
+
+ Fix performance of ValueToInt32 node when predicting double
+ https://bugs.webkit.org/show_bug.cgi?id=70063
+
+ Reviewed by Filip Pizlo.
+
+ Currently we fail to inline double to int conversion when
+ performing a ValueToInt32 operation on a value we predict
+ to be a double.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::execute):
+ Apply correct filter for the double prediction path
+ * dfg/DFGJITCodeGenerator32_64.cpp:
+ (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+ * dfg/DFGJITCodeGenerator64.cpp:
+ (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+ Support double parameters even when value has been spilled.
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+ Moved old valueToInt32 code to this function, and added
+ path for double prediction
+ * dfg/DFGSpeculativeJIT.h:
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ Made the two implementations of ValueToInt32 call a single
+ shared compileValueToInt32 function.
+
2011-10-13 Chris Marrin <cmar...@apple.com>
Sync requestAnimationFrame callback to CVDisplayLink on Mac
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2011-10-13 22:23:47 UTC (rev 97410)
@@ -212,8 +212,12 @@
break;
case ValueToInt32:
- if (!m_graph[node.child1()].shouldNotSpeculateInteger())
- forNode(node.child1()).filter(PredictInt32);
+ if (!m_graph[node.child1()].shouldNotSpeculateInteger()) {
+ if (m_graph[node.child1()].shouldSpeculateDouble())
+ forNode(node.child1()).filter(PredictNumber);
+ else
+ forNode(node.child1()).filter(PredictInt32);
+ }
forNode(nodeIndex).set(PredictInt32);
break;
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp 2011-10-13 22:23:47 UTC (rev 97410)
@@ -374,7 +374,7 @@
}
GenerationInfo& childInfo = m_generationInfo[at(node.child1()).virtualRegister()];
- if (isJSDouble(childInfo.registerFormat())) {
+ if (childInfo.isJSDouble()) {
DoubleOperand op1(this, node.child1());
GPRTemporary result(this);
FPRReg fpr = op1.fpr();
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator64.cpp (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator64.cpp 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator64.cpp 2011-10-13 22:23:47 UTC (rev 97410)
@@ -417,7 +417,7 @@
}
GenerationInfo& childInfo = m_generationInfo[at(node.child1()).virtualRegister()];
- if (isJSDouble(childInfo.registerFormat())) {
+ if (childInfo.isJSDouble()) {
DoubleOperand op1(this, node.child1());
GPRTemporary result(this);
FPRReg fpr = op1.fpr();
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-10-13 22:23:47 UTC (rev 97410)
@@ -607,6 +607,33 @@
cellResult(scratchReg, m_compileIndex);
}
+void SpeculativeJIT::compileValueToInt32(Node& node)
+{
+ if (at(node.child1()).shouldNotSpeculateInteger()) {
+ if (at(node.child1()).shouldSpeculateDouble()) {
+ SpeculateDoubleOperand op1(this, node.child1());
+ GPRTemporary result(this);
+ FPRReg fpr = op1.fpr();
+ GPRReg gpr = result.gpr();
+ JITCompiler::Jump truncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateSuccessful);
+
+ speculationCheck(m_jit.jump());
+
+ truncatedToInteger.link(&m_jit);
+ integerResult(gpr, m_compileIndex);
+ return;
+ }
+ // Do it the safe way.
+ nonSpeculativeValueToInt32(node);
+ return;
+ }
+
+ SpeculateIntegerOperand op1(this, node.child1());
+ GPRTemporary result(this, op1);
+ m_jit.move(op1.gpr(), result.gpr());
+ integerResult(result.gpr(), m_compileIndex, op1.format());
+}
+
} } // namespace JSC::DFG
#endif
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h 2011-10-13 22:23:47 UTC (rev 97410)
@@ -448,6 +448,7 @@
void compileGetCharCodeAt(Node&);
void compileGetByValOnString(Node&);
+ void compileValueToInt32(Node&);
// It is acceptable to have structure be equal to scratch, so long as you're fine
// with the structure GPR being clobbered.
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-13 22:23:47 UTC (rev 97410)
@@ -854,16 +854,7 @@
}
case ValueToInt32: {
- if (at(node.child1()).shouldNotSpeculateInteger()) {
- // Do it the safe way.
- nonSpeculativeValueToInt32(node);
- break;
- }
-
- SpeculateIntegerOperand op1(this, node.child1());
- GPRTemporary result(this, op1);
- m_jit.move(op1.gpr(), result.gpr());
- integerResult(result.gpr(), m_compileIndex, op1.format());
+ compileValueToInt32(node.child1());
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (97409 => 97410)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-10-13 22:11:36 UTC (rev 97409)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-10-13 22:23:47 UTC (rev 97410)
@@ -983,16 +983,7 @@
}
case ValueToInt32: {
- if (at(node.child1()).shouldNotSpeculateInteger()) {
- // Do it the safe way.
- nonSpeculativeValueToInt32(node);
- break;
- }
-
- SpeculateIntegerOperand op1(this, node.child1());
- GPRTemporary result(this, op1);
- m_jit.move(op1.gpr(), result.gpr());
- integerResult(result.gpr(), m_compileIndex, op1.format());
+ compileValueToInt32(node);
break;
}
