Title: [145578] trunk/Source/_javascript_Core
- Revision
- 145578
- Author
- fpi...@apple.com
- Date
- 2013-03-12 13:38:26 -0700 (Tue, 12 Mar 2013)
Log Message
DFG generic array access cases should not be guarded by CheckStructure even of the profiling tells us that it could be
https://bugs.webkit.org/show_bug.cgi?id=112183
Reviewed by Oliver Hunt.
Slight speed-up on string-unpack-code.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::findAndRemoveUnnecessaryStructureCheck):
(FixupPhase):
(JSC::DFG::FixupPhase::checkArray):
(JSC::DFG::FixupPhase::blessArrayOperation):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (145577 => 145578)
--- trunk/Source/_javascript_Core/ChangeLog 2013-03-12 20:27:53 UTC (rev 145577)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-03-12 20:38:26 UTC (rev 145578)
@@ -1,3 +1,18 @@
+2013-03-12 Filip Pizlo <fpi...@apple.com>
+
+ DFG generic array access cases should not be guarded by CheckStructure even of the profiling tells us that it could be
+ https://bugs.webkit.org/show_bug.cgi?id=112183
+
+ Reviewed by Oliver Hunt.
+
+ Slight speed-up on string-unpack-code.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::findAndRemoveUnnecessaryStructureCheck):
+ (FixupPhase):
+ (JSC::DFG::FixupPhase::checkArray):
+ (JSC::DFG::FixupPhase::blessArrayOperation):
+
2013-03-12 Gabor Rapcsanyi <rga...@webkit.org>
https://bugs.webkit.org/show_bug.cgi?id=112141
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (145577 => 145578)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-03-12 20:27:53 UTC (rev 145577)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-03-12 20:38:26 UTC (rev 145578)
@@ -838,8 +838,27 @@
m_insertionSet.execute(block);
}
- Node* checkArray(ArrayMode arrayMode, CodeOrigin codeOrigin, Node* array, Node* index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage)
+ void findAndRemoveUnnecessaryStructureCheck(Node* array, const CodeOrigin& codeOrigin)
{
+ for (unsigned index = m_indexInBlock; index--;) {
+ Node* previousNode = m_block->at(index);
+ if (previousNode->codeOrigin != codeOrigin)
+ return;
+
+ if (previousNode->op() != CheckStructure)
+ continue;
+
+ if (previousNode->child1() != array)
+ continue;
+
+ previousNode->child1() = Edge();
+ previousNode->convertToPhantom();
+ return; // Assume we were smart enough to only insert one CheckStructure on the array.
+ }
+ }
+
+ Node* checkArray(ArrayMode arrayMode, const CodeOrigin& codeOrigin, Node* array, Node* index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage)
+ {
ASSERT(arrayMode.isSpecific());
Structure* structure = arrayMode.originalArrayStructure(m_graph, codeOrigin);
@@ -850,12 +869,9 @@
if (structure) {
if (m_indexInBlock > 0) {
// If the previous node was a CheckStructure inserted because of stuff
- // that the array profile told us, then remove it.
- Node* previousNode = m_block->at(m_indexInBlock - 1);
- if (previousNode->op() == CheckStructure
- && previousNode->child1() == array
- && previousNode->codeOrigin == codeOrigin)
- previousNode->convertToPhantom();
+ // that the array profile told us, then remove it, since we're going to be
+ // doing arrayification instead.
+ findAndRemoveUnnecessaryStructureCheck(array, codeOrigin);
}
m_insertionSet.insertNode(
@@ -908,6 +924,7 @@
return;
case Array::Generic:
+ findAndRemoveUnnecessaryStructureCheck(base.node(), node->codeOrigin);
return;
default: {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
