Title: [221328] trunk/Source/_javascript_Core
- Revision
- 221328
- Author
- utatane....@gmail.com
- Date
- 2017-08-29 17:29:39 -0700 (Tue, 29 Aug 2017)
Log Message
[DFG] Add constant folding rule to convert CompareStrictEq(Untyped, Untyped [with non string cell constant]) to CompareEqPtr(Untyped)
https://bugs.webkit.org/show_bug.cgi?id=175895
Reviewed by Saam Barati.
We have `bucket === @sentinelMapBucket` code in builtin. Since @sentinelMapBucket and bucket
are MapBucket cell (SpecCellOther), we do not have any good fixup for CompareStrictEq.
But rather than introducing a special fixup edge (like, NonStringCellUse), converting
CompareStrictEq(Untyped, Untyped) to CompareEqPtr is simpler.
In constant folding phase, we convert CompareStrictEq(Untyped, Untyped) to CompareEqPtr(Untyed)
if one side of the children is constant non String cell.
This slightly optimizes map/set iteration.
set-for-each 4.5064+-0.3072 ^ 3.2862+-0.2098 ^ definitely 1.3713x faster
large-map-iteration 56.2583+-1.6640 53.6798+-2.0097 might be 1.0480x faster
set-for-of 8.8058+-0.5953 ^ 7.5832+-0.3805 ^ definitely 1.1612x faster
map-for-each 4.2633+-0.2694 ^ 3.3967+-0.3013 ^ definitely 1.2551x faster
map-for-of 13.1556+-0.5707 12.4911+-0.6004 might be 1.0532x faster
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToCompareEqPtr):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (221327 => 221328)
--- trunk/Source/_javascript_Core/ChangeLog 2017-08-30 00:06:43 UTC (rev 221327)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-08-30 00:29:39 UTC (rev 221328)
@@ -1,5 +1,34 @@
2017-08-29 Yusuke Suzuki <utatane....@gmail.com>
+ [DFG] Add constant folding rule to convert CompareStrictEq(Untyped, Untyped [with non string cell constant]) to CompareEqPtr(Untyped)
+ https://bugs.webkit.org/show_bug.cgi?id=175895
+
+ Reviewed by Saam Barati.
+
+ We have `bucket === @sentinelMapBucket` code in builtin. Since @sentinelMapBucket and bucket
+ are MapBucket cell (SpecCellOther), we do not have any good fixup for CompareStrictEq.
+ But rather than introducing a special fixup edge (like, NonStringCellUse), converting
+ CompareStrictEq(Untyped, Untyped) to CompareEqPtr is simpler.
+ In constant folding phase, we convert CompareStrictEq(Untyped, Untyped) to CompareEqPtr(Untyed)
+ if one side of the children is constant non String cell.
+
+ This slightly optimizes map/set iteration.
+
+ set-for-each 4.5064+-0.3072 ^ 3.2862+-0.2098 ^ definitely 1.3713x faster
+ large-map-iteration 56.2583+-1.6640 53.6798+-2.0097 might be 1.0480x faster
+ set-for-of 8.8058+-0.5953 ^ 7.5832+-0.3805 ^ definitely 1.1612x faster
+ map-for-each 4.2633+-0.2694 ^ 3.3967+-0.3013 ^ definitely 1.2551x faster
+ map-for-of 13.1556+-0.5707 12.4911+-0.6004 might be 1.0532x faster
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToCompareEqPtr):
+
+2017-08-29 Yusuke Suzuki <utatane....@gmail.com>
+
[JSC] Use reifying system for "name" property of builtin JSFunction
https://bugs.webkit.org/show_bug.cgi?id=175260
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (221327 => 221328)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2017-08-30 00:06:43 UTC (rev 221327)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2017-08-30 00:29:39 UTC (rev 221328)
@@ -1499,6 +1499,19 @@
break;
}
}
+
+ if (node->isBinaryUseKind(UntypedUse)) {
+ // FIXME: Revisit this condition when introducing BigInt to JSC.
+ auto isNonStringCellConstant = [] (JSValue value) {
+ return value && value.isCell() && !value.isString();
+ };
+
+ if (isNonStringCellConstant(left) || isNonStringCellConstant(right)) {
+ m_state.setFoundConstants(true);
+ forNode(node).setType(SpecBoolean);
+ break;
+ }
+ }
SpeculatedType leftLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(leftNode).m_type);
SpeculatedType rightLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(rightNode).m_type);
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (221327 => 221328)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2017-08-30 00:06:43 UTC (rev 221327)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2017-08-30 00:29:39 UTC (rev 221328)
@@ -139,6 +139,28 @@
// See: https://bugs.webkit.org/show_bug.cgi?id=174844
break;
}
+
+ case CompareStrictEq: {
+ if (node->isBinaryUseKind(UntypedUse)) {
+ JSValue child1Constant = m_state.forNode(node->child1().node()).value();
+ JSValue child2Constant = m_state.forNode(node->child2().node()).value();
+
+ // FIXME: Revisit this condition when introducing BigInt to JSC.
+ auto isNonStringCellConstant = [] (JSValue value) {
+ return value && value.isCell() && !value.isString();
+ };
+
+ if (isNonStringCellConstant(child1Constant)) {
+ node->convertToCompareEqPtr(m_graph.freezeStrong(child1Constant.asCell()), node->child2());
+ changed = true;
+ } else if (isNonStringCellConstant(child2Constant)) {
+ node->convertToCompareEqPtr(m_graph.freezeStrong(child2Constant.asCell()), node->child1());
+ changed = true;
+ }
+ }
+ break;
+ }
+
case CheckStructure:
case ArrayifyToStructure: {
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (221327 => 221328)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-08-30 00:06:43 UTC (rev 221327)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-08-30 00:29:39 UTC (rev 221328)
@@ -682,6 +682,15 @@
ASSERT(m_op == ArithAbs && child1().useKind() == Int32Use);
m_op = ArithNegate;
}
+
+ void convertToCompareEqPtr(FrozenValue* cell, Edge node)
+ {
+ ASSERT(m_op == CompareStrictEq);
+ setOpAndDefaultFlags(CompareEqPtr);
+ children.setChild1(node);
+ children.setChild2(Edge());
+ m_opInfo = cell;
+ }
void convertToDirectCall(FrozenValue*);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
