Title: [151989] branches/dfgFourthTier/Source/_javascript_Core
- Revision
- 151989
- Author
- fpi...@apple.com
- Date
- 2013-06-26 08:18:41 -0700 (Wed, 26 Jun 2013)
Log Message
fourthTier: Convert versus AsIs should have no bearing on whether we can do the SaneChain optimization for double array GetByVals
https://bugs.webkit.org/show_bug.cgi?id=118028
Reviewed by Sam Weinig.
The SaneChain optimization allows us to get rid of the NaN check on loading from
a double array, if the result is used in an arithmetic op that wouldn't
distinguish between NaN and undefined. Normally the NaN check would be needed
because NaN is the hole marker.
The SaneChain optimization definitely requires that you're an Original array,
since we need to watchpoint the array prototype chain. And so it also needs to
be a JSArray, and not an object that has indexed double properties. We also
require an in-bounds access, since the backend is only capable of the
optimization in the in-bounds case (though we could extend it to OOB in the
future). But whether the array is being converted or is as-is isn't relevant.
Either way, if it's a double original array in-bounds access by the time that
the array check (or conversion!) completes, we can do the optimization.
Ever-so-slight speed-up on Kraken/imaging-gaussian-blur.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Modified Paths
Diff
Modified: branches/dfgFourthTier/Source/_javascript_Core/ChangeLog (151988 => 151989)
--- branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-06-26 14:28:00 UTC (rev 151988)
+++ branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-06-26 15:18:41 UTC (rev 151989)
@@ -1,5 +1,31 @@
2013-06-25 Filip Pizlo <fpi...@apple.com>
+ fourthTier: Convert versus AsIs should have no bearing on whether we can do the SaneChain optimization for double array GetByVals
+ https://bugs.webkit.org/show_bug.cgi?id=118028
+
+ Reviewed by Sam Weinig.
+
+ The SaneChain optimization allows us to get rid of the NaN check on loading from
+ a double array, if the result is used in an arithmetic op that wouldn't
+ distinguish between NaN and undefined. Normally the NaN check would be needed
+ because NaN is the hole marker.
+
+ The SaneChain optimization definitely requires that you're an Original array,
+ since we need to watchpoint the array prototype chain. And so it also needs to
+ be a JSArray, and not an object that has indexed double properties. We also
+ require an in-bounds access, since the backend is only capable of the
+ optimization in the in-bounds case (though we could extend it to OOB in the
+ future). But whether the array is being converted or is as-is isn't relevant.
+ Either way, if it's a double original array in-bounds access by the time that
+ the array check (or conversion!) completes, we can do the optimization.
+
+ Ever-so-slight speed-up on Kraken/imaging-gaussian-blur.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+
+2013-06-25 Filip Pizlo <fpi...@apple.com>
+
fourthTier: DFG should support switch_string
https://bugs.webkit.org/show_bug.cgi?id=117967
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (151988 => 151989)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-06-26 14:28:00 UTC (rev 151988)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-06-26 15:18:41 UTC (rev 151989)
@@ -389,7 +389,6 @@
case Array::Double:
if (arrayMode.arrayClass() == Array::OriginalArray
&& arrayMode.speculation() == Array::InBounds
- && arrayMode.conversion() == Array::AsIs
&& m_graph.globalObjectFor(node->codeOrigin)->arrayPrototypeChainIsSane()
&& !(node->flags() & NodeUsedAsOther))
node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
