Title: [95136] trunk/Source/_javascript_Core
- Revision
- 95136
- Author
- fpi...@apple.com
- Date
- 2011-09-14 16:06:04 -0700 (Wed, 14 Sep 2011)
Log Message
DFG JIT should not speculate integer if the value is always going to be
used as a double anyway
https://bugs.webkit.org/show_bug.cgi?id=68127
Reviewed by Oliver Hunt.
Added a ValueToDouble node, which is a variant of ValueToNumber that
hints that it will only be used as a double and never as an integer.
Thus, it turns off integer speculation even if the value profiler
told us that the value source is an int. The logic for converting a
ValueToNumber into a ValueToDouble is found in Propagator.
This appears to be a 22% speed-up in imaging-darkroom.
* dfg/DFGNode.h:
* dfg/DFGNonSpeculativeJIT.cpp:
(JSC::DFG::NonSpeculativeJIT::compile):
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::fixpoint):
(JSC::DFG::Propagator::toDouble):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::fixup):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (95135 => 95136)
--- trunk/Source/_javascript_Core/ChangeLog 2011-09-14 23:01:23 UTC (rev 95135)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-09-14 23:06:04 UTC (rev 95136)
@@ -1,5 +1,33 @@
2011-09-14 Filip Pizlo <fpi...@apple.com>
+ DFG JIT should not speculate integer if the value is always going to be
+ used as a double anyway
+ https://bugs.webkit.org/show_bug.cgi?id=68127
+
+ Reviewed by Oliver Hunt.
+
+ Added a ValueToDouble node, which is a variant of ValueToNumber that
+ hints that it will only be used as a double and never as an integer.
+ Thus, it turns off integer speculation even if the value profiler
+ told us that the value source is an int. The logic for converting a
+ ValueToNumber into a ValueToDouble is found in Propagator.
+
+ This appears to be a 22% speed-up in imaging-darkroom.
+
+ * dfg/DFGNode.h:
+ * dfg/DFGNonSpeculativeJIT.cpp:
+ (JSC::DFG::NonSpeculativeJIT::compile):
+ * dfg/DFGPropagator.cpp:
+ (JSC::DFG::Propagator::fixpoint):
+ (JSC::DFG::Propagator::toDouble):
+ (JSC::DFG::Propagator::fixupNode):
+ (JSC::DFG::Propagator::fixup):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
+2011-09-14 Filip Pizlo <fpi...@apple.com>
+
Tiered compilation heuristics do not account for value profile fullness
https://bugs.webkit.org/show_bug.cgi?id=68116
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (95135 => 95136)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2011-09-14 23:01:23 UTC (rev 95135)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2011-09-14 23:06:04 UTC (rev 95136)
@@ -158,6 +158,9 @@
/* Arithmetic operators call ToNumber on their operands. */\
macro(ValueToNumber, NodeResultNumber | NodeMustGenerate) \
\
+ /* A variant of ValueToNumber, which a hint that the parents will always use this as a double. */\
+ macro(ValueToDouble, NodeResultNumber | NodeMustGenerate) \
+ \
/* Add of values may either be arithmetic, or result in string concatenation. */\
macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
\
Modified: trunk/Source/_javascript_Core/dfg/DFGNonSpeculativeJIT.cpp (95135 => 95136)
--- trunk/Source/_javascript_Core/dfg/DFGNonSpeculativeJIT.cpp 2011-09-14 23:01:23 UTC (rev 95135)
+++ trunk/Source/_javascript_Core/dfg/DFGNonSpeculativeJIT.cpp 2011-09-14 23:06:04 UTC (rev 95136)
@@ -595,7 +595,8 @@
break;
}
- case ValueToNumber: {
+ case ValueToNumber:
+ case ValueToDouble: {
ASSERT(!isInt32Constant(node.child1()));
ASSERT(!isNumberConstant(node.child1()));
Modified: trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp (95135 => 95136)
--- trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp 2011-09-14 23:01:23 UTC (rev 95135)
+++ trunk/Source/_javascript_Core/dfg/DFGPropagator.cpp 2011-09-14 23:06:04 UTC (rev 95136)
@@ -85,6 +85,8 @@
m_changed = false;
propagateBackward();
} while (m_changed);
+
+ fixup();
}
private:
@@ -321,6 +323,80 @@
propagateNode(m_graph[m_compileIndex]);
}
+ void toDouble(NodeIndex nodeIndex)
+ {
+ if (m_graph[nodeIndex].op == ValueToNumber) {
+#if ENABLE(DFG_DEBUG_VERBOSE)
+ printf(" @%u -> ValueToDouble", nodeIndex);
+#endif
+ m_graph[nodeIndex].op = ValueToDouble;
+ }
+ }
+
+ void fixupNode(Node& node)
+ {
+ if (!node.shouldGenerate())
+ return;
+
+ NodeType op = node.op;
+
+#if ENABLE(DFG_DEBUG_VERBOSE)
+ printf(" %s[%u]: ", Graph::opName(op), m_compileIndex);
+#endif
+
+ switch (op) {
+ case ValueAdd: {
+ PredictedType left = m_predictions[node.child1()];
+ PredictedType right = m_predictions[node.child2()];
+
+ if (isStrongPrediction(left) && isStrongPrediction(right) && isNumberPrediction(left) && isNumberPrediction(right)) {
+ if (left & PredictDouble)
+ toDouble(node.child2());
+ if (right & PredictDouble)
+ toDouble(node.child1());
+ }
+ break;
+ }
+
+ case ArithAdd:
+ case ArithSub:
+ case ArithMul: {
+ PredictedType left = m_predictions[node.child1()];
+ PredictedType right = m_predictions[node.child2()];
+
+ if (isStrongPrediction(left) && isStrongPrediction(right)) {
+ if (left & PredictDouble)
+ toDouble(node.child2());
+ if (right & PredictDouble)
+ toDouble(node.child1());
+ }
+ break;
+ }
+
+ case ArithDiv: {
+ toDouble(node.child1());
+ toDouble(node.child2());
+ break;
+ }
+
+ default:
+ break;
+ }
+
+#if ENABLE(DFG_DEBUG_VERBOSE)
+ printf("\n");
+#endif
+ }
+
+ void fixup()
+ {
+#if ENABLE(DFG_DEBUG_VERBOSE)
+ printf("Performing Fixup\n");
+#endif
+ for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
+ fixupNode(m_graph[m_compileIndex]);
+ }
+
Graph& m_graph;
JSGlobalData& m_globalData;
CodeBlock* m_codeBlock;
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (95135 => 95136)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-09-14 23:01:23 UTC (rev 95135)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-09-14 23:06:04 UTC (rev 95136)
@@ -870,6 +870,14 @@
break;
}
+ case ValueToDouble: {
+ SpeculateDoubleOperand op1(this, node.child1());
+ FPRTemporary result(this, op1);
+ m_jit.moveDouble(op1.fpr(), result.fpr());
+ doubleResult(result.fpr(), m_compileIndex);
+ break;
+ }
+
case ValueAdd:
case ArithAdd: {
if (shouldSpeculateInteger(node.child1(), node.child2())) {
@@ -1694,6 +1702,7 @@
continue;
switch (node.op) {
case ValueToNumber:
+ case ValueToDouble:
valueToNumberIndex = info.nodeIndex();
break;
case ValueToInt32:
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
