Changeset 117819 in webkit

Timestamp:

May 21, 2012, 2:52:08 PM (14 years ago)

Author:

fpizlo@apple.com

Message:

DFG should not do unnecessary indirections when storing to objects
​https://bugs.webkit.org/show_bug.cgi?id=86959

Reviewed by Oliver Hunt.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::getByOffsetLoadElimination):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

branches/dfgopt/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (2 diffs)
• dfg/DFGCSEPhase.cpp (modified) (2 diffs)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

branches/dfgopt/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not do unnecessary indirections when storing to objects
+        https://bugs.webkit.org/show_bug.cgi?id=86959
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2012-05-17  Filip Pizlo  <fpizlo@apple.com>
 

branches/dfgopt/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -2050 +2050 @@
             if (!hasExitSite && putByIdStatus.isSimpleReplace()) {
                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(putByIdStatus.oldStructure())), base);
-                addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), base, addToGraph(GetPropertyStorage, base), value);
+                size_t offsetOffset;
+                NodeIndex propertyStorage;
+                if (putByIdStatus.oldStructure()->isUsingInlineStorage()) {
+                    propertyStorage = base;
+                    ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
+                    offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
+                } else {
+                    propertyStorage = addToGraph(GetPropertyStorage, base);
+                    offsetOffset = 0;
+                }
+                addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), propertyStorage, base, value);
                 
                 StorageAccessData storageAccessData;
-                storageAccessData.offset = putByIdStatus.offset();
+                storageAccessData.offset = putByIdStatus.offset() + offsetOffset;
                 storageAccessData.identifierNumber = identifierNumber;
                 m_graph.m_storageAccessData.append(storageAccessData);
@@ -2092 +2102 @@
                     base);
                 
+                size_t offsetOffset;
+                NodeIndex propertyStorage;
+                if (putByIdStatus.newStructure()->isUsingInlineStorage()) {
+                    propertyStorage = base;
+                    ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
+                    offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
+                } else {
+                    propertyStorage = addToGraph(GetPropertyStorage, base);
+                    offsetOffset = 0;
+                }
                 addToGraph(
                     PutByOffset,
                     OpInfo(m_graph.m_storageAccessData.size()),
+                    propertyStorage,
                     base,
-                    addToGraph(GetPropertyStorage, base),
                     value);
                 
                 StorageAccessData storageAccessData;
-                storageAccessData.offset = putByIdStatus.offset();
+                storageAccessData.offset = putByIdStatus.offset() + offsetOffset;
                 storageAccessData.identifierNumber = identifierNumber;
                 m_graph.m_storageAccessData.append(storageAccessData);

branches/dfgopt/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

@@ -308 +308 @@
         for (unsigned i = m_indexInBlock; i--;) {
             NodeIndex index = m_currentBlock->at(i);
-            if (index == child1) 
+            if (index == child1)
                 break;
 
@@ -321 +321 @@
             case PutByOffset:
                 if (m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber == identifierNumber) {
-                    if (node.child2() == child1)
+                    if (node.child1() == child1) // Must be same property storage.
                         return node.child3().index();
                     return NoNode;

branches/dfgopt/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -3538 +3538 @@
     case PutByOffset: {
 #if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
-        SpeculateCellOperand base(this, node.child1());
+        SpeculateCellOperand base(this, node.child2());
 #endif
-        StorageOperand storage(this, node.child2());
+        StorageOperand storage(this, node.child1());
         JSValueOperand value(this, node.child3());
 

branches/dfgopt/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -3539 +3539 @@
     case PutByOffset: {
 #if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
-        SpeculateCellOperand base(this, node.child1());
+        SpeculateCellOperand base(this, node.child2());
 #endif
-        StorageOperand storage(this, node.child2());
+        StorageOperand storage(this, node.child1());
         JSValueOperand value(this, node.child3());