- Revision
- 248825
- Author
- ysuz...@apple.com
- Date
- 2019-08-17 18:50:46 -0700 (Sat, 17 Aug 2019)
Log Message
[JSC] DFG ToNumber should support Boolean in fixup
https://bugs.webkit.org/show_bug.cgi?id=200864
Reviewed by Mark Lam.
JSTests:
* microbenchmarks/to-number-boolean.js: Added.
(test):
* stress/to-number-boolean-int32.js: Added.
(shouldBe):
(test):
(check):
* stress/to-number-boolean.js: Added.
(shouldBe):
(test):
(check):
* stress/to-number-int32.js: Added.
(shouldBe):
(test):
(check):
Source/_javascript_Core:
ToNumber should speculate on Boolean, or BooleanOrInt32 in fixup phase to optimize it.
ToT Patched
to-number-boolean 897.6430+-26.8843 ^ 87.4802+-5.2831 ^ definitely 10.2611x faster
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupToNumber):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (248824 => 248825)
--- trunk/JSTests/ChangeLog 2019-08-18 01:47:58 UTC (rev 248824)
+++ trunk/JSTests/ChangeLog 2019-08-18 01:50:46 UTC (rev 248825)
@@ -1,3 +1,25 @@
+2019-08-17 Yusuke Suzuki <ysuz...@apple.com>
+
+ [JSC] DFG ToNumber should support Boolean in fixup
+ https://bugs.webkit.org/show_bug.cgi?id=200864
+
+ Reviewed by Mark Lam.
+
+ * microbenchmarks/to-number-boolean.js: Added.
+ (test):
+ * stress/to-number-boolean-int32.js: Added.
+ (shouldBe):
+ (test):
+ (check):
+ * stress/to-number-boolean.js: Added.
+ (shouldBe):
+ (test):
+ (check):
+ * stress/to-number-int32.js: Added.
+ (shouldBe):
+ (test):
+ (check):
+
2019-08-16 Mark Lam <mark....@apple.com>
More missing exception checks in string comparison operators.
Added: trunk/JSTests/microbenchmarks/to-number-boolean.js (0 => 248825)
--- trunk/JSTests/microbenchmarks/to-number-boolean.js (rev 0)
+++ trunk/JSTests/microbenchmarks/to-number-boolean.js 2019-08-18 01:50:46 UTC (rev 248825)
@@ -0,0 +1,16 @@
+var array = [];
+var casted = [];
+for (var i = 0; i < 1e3; ++i) {
+ array[i] = Math.random();
+ casted[i] = 0;
+}
+
+function test(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ casted[i] = Number(array[i] < .5);
+}
+noInline(test);
+
+for (var i = 0; i < 1e5; ++i)
+ test(array, casted);
Added: trunk/JSTests/stress/to-number-boolean-int32.js (0 => 248825)
--- trunk/JSTests/stress/to-number-boolean-int32.js (rev 0)
+++ trunk/JSTests/stress/to-number-boolean-int32.js 2019-08-18 01:50:46 UTC (rev 248825)
@@ -0,0 +1,30 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+var array = [];
+var casted = [];
+for (var i = 0; i < 1e2; ++i) {
+ array[i] = Math.random();
+ casted[i] = 0;
+}
+
+function test(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ casted[i] = Number(array[i] < .5 ? true : 0);
+}
+noInline(test);
+
+function check(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ shouldBe(casted[i], (array[i] < .5 ? 1 : 0));
+}
+noInline(check);
+
+for (var i = 0; i < 1e5; ++i) {
+ test(array, casted);
+ check(array, casted);
+}
Added: trunk/JSTests/stress/to-number-boolean.js (0 => 248825)
--- trunk/JSTests/stress/to-number-boolean.js (rev 0)
+++ trunk/JSTests/stress/to-number-boolean.js 2019-08-18 01:50:46 UTC (rev 248825)
@@ -0,0 +1,30 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+var array = [];
+var casted = [];
+for (var i = 0; i < 1e2; ++i) {
+ array[i] = Math.random();
+ casted[i] = 0;
+}
+
+function test(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ casted[i] = Number(array[i] < .5);
+}
+noInline(test);
+
+function check(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ shouldBe(casted[i], (array[i] < .5 ? 1 : 0));
+}
+noInline(check);
+
+for (var i = 0; i < 1e5; ++i) {
+ test(array, casted);
+ check(array, casted);
+}
Added: trunk/JSTests/stress/to-number-int32.js (0 => 248825)
--- trunk/JSTests/stress/to-number-int32.js (rev 0)
+++ trunk/JSTests/stress/to-number-int32.js 2019-08-18 01:50:46 UTC (rev 248825)
@@ -0,0 +1,30 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+var array = [];
+var casted = [];
+for (var i = 0; i < 1e2; ++i) {
+ array[i] = Math.random();
+ casted[i] = 0;
+}
+
+function test(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ casted[i] = Number(array[i] < .5 ? 1 : 0);
+}
+noInline(test);
+
+function check(array, casted)
+{
+ for (var i = 0; i < array.length; i++)
+ shouldBe(casted[i], (array[i] < .5 ? 1 : 0));
+}
+noInline(check);
+
+for (var i = 0; i < 1e5; ++i) {
+ test(array, casted);
+ check(array, casted);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (248824 => 248825)
--- trunk/Source/_javascript_Core/ChangeLog 2019-08-18 01:47:58 UTC (rev 248824)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-08-18 01:50:46 UTC (rev 248825)
@@ -1,5 +1,21 @@
2019-08-17 Yusuke Suzuki <ysuz...@apple.com>
+ [JSC] DFG ToNumber should support Boolean in fixup
+ https://bugs.webkit.org/show_bug.cgi?id=200864
+
+ Reviewed by Mark Lam.
+
+ ToNumber should speculate on Boolean, or BooleanOrInt32 in fixup phase to optimize it.
+
+ ToT Patched
+
+ to-number-boolean 897.6430+-26.8843 ^ 87.4802+-5.2831 ^ definitely 10.2611x faster
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupToNumber):
+
+2019-08-17 Yusuke Suzuki <ysuz...@apple.com>
+
[JSC] WebAssembly BBQ should switch compile mode for size of modules
https://bugs.webkit.org/show_bug.cgi?id=200807
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (248824 => 248825)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2019-08-18 01:47:58 UTC (rev 248824)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2019-08-18 01:50:46 UTC (rev 248825)
@@ -2820,6 +2820,15 @@
void fixupToNumber(Node* node)
{
+ // At first, attempt to fold Boolean or Int32 to Int32.
+ if (node->child1()->shouldSpeculateInt32OrBoolean()) {
+ if (isInt32Speculation(node->getHeapPrediction())) {
+ fixIntOrBooleanEdge(node->child1());
+ node->convertToIdentity();
+ return;
+ }
+ }
+
// If the prediction of the child is Number, we attempt to convert ToNumber to Identity.
if (node->child1()->shouldSpeculateNumber()) {
if (isInt32Speculation(node->getHeapPrediction())) {
