Title: [107912] trunk/Source/_javascript_Core
- Revision
- 107912
- Author
- fpi...@apple.com
- Date
- 2012-02-16 02:06:28 -0800 (Thu, 16 Feb 2012)
Log Message
DFG should not check the types of arguments that are dead
https://bugs.webkit.org/show_bug.cgi?id=78518
Reviewed by Geoff Garen.
The argument checks are now elided if the corresponding SetArgument is dead,
and the abstract value of the argument is set to bottom (None, []). This is
performance neutral on the benchmarks we currently track.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::initialize):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (107911 => 107912)
--- trunk/Source/_javascript_Core/ChangeLog 2012-02-16 09:31:17 UTC (rev 107911)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-02-16 10:06:28 UTC (rev 107912)
@@ -1,3 +1,19 @@
+2012-02-13 Filip Pizlo <fpi...@apple.com>
+
+ DFG should not check the types of arguments that are dead
+ https://bugs.webkit.org/show_bug.cgi?id=78518
+
+ Reviewed by Geoff Garen.
+
+ The argument checks are now elided if the corresponding SetArgument is dead,
+ and the abstract value of the argument is set to bottom (None, []). This is
+ performance neutral on the benchmarks we currently track.
+
+ * dfg/DFGAbstractState.cpp:
+ (JSC::DFG::AbstractState::initialize):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
2012-02-15 Oliver Hunt <oli...@apple.com>
Ensure that the DFG JIT always plants a CodeOrigin when making calls
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (107911 => 107912)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-02-16 09:31:17 UTC (rev 107911)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp 2012-02-16 10:06:28 UTC (rev 107912)
@@ -104,7 +104,16 @@
BasicBlock* root = graph.m_blocks[0].get();
root->cfaShouldRevisit = true;
for (size_t i = 0; i < root->valuesAtHead.numberOfArguments(); ++i) {
- PredictedType prediction = graph[root->variablesAtHead.argument(i)].variableAccessData()->prediction();
+ Node& node = graph[root->variablesAtHead.argument(i)];
+ ASSERT(node.op == SetArgument);
+ if (!node.shouldGenerate()) {
+ // The argument is dead. We don't do any checks for such arguments, and so
+ // for the purpose of the analysis, they contain no value.
+ root->valuesAtHead.argument(i).clear();
+ continue;
+ }
+
+ PredictedType prediction = node.variableAccessData()->prediction();
if (isInt32Prediction(prediction))
root->valuesAtHead.argument(i).set(PredictInt32);
else if (isArrayPrediction(prediction))
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (107911 => 107912)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-02-16 09:31:17 UTC (rev 107911)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-02-16 10:06:28 UTC (rev 107912)
@@ -1073,7 +1073,14 @@
m_variables[i] = ValueSource(ValueInRegisterFile);
for (int i = 0; i < m_jit.codeBlock()->numParameters(); ++i) {
- VariableAccessData* variableAccessData = at(m_jit.graph().m_arguments[i]).variableAccessData();
+ Node& node = at(m_jit.graph().m_arguments[i]);
+ ASSERT(node.op == SetArgument);
+ if (!node.shouldGenerate()) {
+ // The argument is dead. We don't do any checks for such arguments.
+ continue;
+ }
+
+ VariableAccessData* variableAccessData = node.variableAccessData();
VirtualRegister virtualRegister = variableAccessData->local();
PredictedType predictedType = variableAccessData->prediction();
#if USE(JSVALUE64)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
