Changeset 229520 in webkit
- Timestamp:
- Mar 11, 2018 8:25:39 PM (6 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 4 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r229514 r229520 1 2018-03-11 Yusuke Suzuki <utatane.tea@gmail.com> 2 3 [DFG] AI should convert CreateThis to NewObject if the prototype object is proved 4 https://bugs.webkit.org/show_bug.cgi?id=183310 5 6 Reviewed by Filip Pizlo. 7 8 * stress/ai-create-this-to-new-object-fire.js: Added. 9 (assert): 10 (test): 11 (func): 12 (check): 13 (test.body.A): 14 (test.body.B): 15 (test.body): 16 * stress/ai-create-this-to-new-object.js: Added. 17 (assert): 18 (test): 19 (func): 20 (check): 21 (test.body.A): 22 (test.body.B): 23 (test.body): 24 1 25 2018-03-10 Yusuke Suzuki <utatane.tea@gmail.com> 2 26 -
trunk/Source/JavaScriptCore/ChangeLog
r229519 r229520 1 2018-03-11 Yusuke Suzuki <utatane.tea@gmail.com> 2 3 [DFG] AI should convert CreateThis to NewObject if the prototype object is proved 4 https://bugs.webkit.org/show_bug.cgi?id=183310 5 6 Reviewed by Filip Pizlo. 7 8 This patch implements CreateThis -> NewObject conversion in AI if the given function is constant. 9 This contributes to 6% win in Octane/raytrace. 10 11 baseline patched 12 13 raytrace x2 1.19915+-0.01862 ^ 1.13156+-0.01589 ^ definitely 1.0597x faster 14 15 * dfg/DFGAbstractInterpreterInlines.h: 16 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): 17 * dfg/DFGConstantFoldingPhase.cpp: 18 (JSC::DFG::ConstantFoldingPhase::foldConstants): 19 1 20 2018-03-11 Wenson Hsieh <wenson_hsieh@apple.com> 2 21 -
trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
r229514 r229520 2258 2258 2259 2259 case CreateThis: { 2260 // FIXME: We can fold this to NewObject if the incoming callee is a constant. 2260 if (JSValue base = forNode(node->child1()).m_value) { 2261 if (auto* function = jsDynamicCast<JSFunction*>(m_vm, base)) { 2262 if (FunctionRareData* rareData = function->rareData()) { 2263 if (Structure* structure = rareData->objectAllocationStructure()) { 2264 // FIXME: we should be able to allocate a poly proto object here: 2265 // https://bugs.webkit.org/show_bug.cgi?id=177517 2266 if (structure->hasMonoProto()) { 2267 m_graph.freeze(rareData); 2268 m_graph.watchpoints().addLazily(rareData->allocationProfileWatchpointSet()); 2269 m_state.setFoundConstants(true); 2270 forNode(node).set(m_graph, structure); 2271 break; 2272 } 2273 } 2274 } 2275 } 2276 } 2261 2277 forNode(node).setType(m_graph, SpecFinalObject); 2262 2278 break; -
trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
r228565 r229520 637 637 } 638 638 639 case CreateThis: { 640 if (JSValue base = m_state.forNode(node->child1()).m_value) { 641 if (auto* function = jsDynamicCast<JSFunction*>(m_graph.m_vm, base)) { 642 if (FunctionRareData* rareData = function->rareData()) { 643 if (Structure* structure = rareData->objectAllocationStructure()) { 644 // FIXME: we should be able to allocate a poly proto object here: 645 // https://bugs.webkit.org/show_bug.cgi?id=177517 646 if (structure->hasMonoProto()) { 647 m_graph.freeze(rareData); 648 m_graph.watchpoints().addLazily(rareData->allocationProfileWatchpointSet()); 649 node->convertToNewObject(m_graph.registerStructure(structure)); 650 changed = true; 651 break; 652 } 653 } 654 } 655 } 656 } 657 break; 658 } 659 639 660 case ToNumber: { 640 661 if (m_state.forNode(node->child1()).m_type & ~SpecBytecodeNumber)
Note: See TracChangeset
for help on using the changeset viewer.