Changeset 278465 in webkit


Ignore:
Timestamp:
Jun 4, 2021 9:32:57 AM (3 years ago)
Author:
fpizlo@apple.com
Message:

DFG should speculate on CompareStrictEq(@x, @x)
​https://bugs.webkit.org/show_bug.cgi?id=226621

Reviewed by Mark Lam.

JSTests:

  • microbenchmarks/untyped-stricteq-self.js: Added.

(foo):

  • stress/untyped-stricteq-self-fail.js: Added.

(bar):
(foo):

Source/JavaScriptCore:

Introduces a NotDouble: speculation. We use it to speculate on CompareStrictEq(@x, @x).

  • bytecode/SpeculatedType.h:

(JSC::isNotDoubleSpeculation):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):

  • dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateNotDouble):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculateNotDouble):
(JSC::DFG::SpeculativeJIT::speculate):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGUseKind.cpp:

(WTF::printInternal):

  • dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::checkMayCrashIfInputIsEmpty):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateNotDouble):

Location:
trunk
Files:
2 added
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r278464 r278465  
     12021-06-03  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG should speculate on CompareStrictEq(@x, @x)
     4        https://bugs.webkit.org/show_bug.cgi?id=226621
     5
     6        Reviewed by Mark Lam.
     7
     8        * microbenchmarks/untyped-stricteq-self.js: Added.
     9        (foo):
     10        * stress/untyped-stricteq-self-fail.js: Added.
     11        (bar):
     12        (foo):
     13
    1142021-06-04  Keith Miller  <keith_miller@apple.com>
    215

  • trunk/Source/JavaScriptCore/ChangeLog

    r278463 r278465  
     12021-06-03  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG should speculate on CompareStrictEq(@x, @x)
     4        https://bugs.webkit.org/show_bug.cgi?id=226621
     5
     6        Reviewed by Mark Lam.
     7
     8        Introduces a NotDouble: speculation. We use it to speculate on CompareStrictEq(@x, @x).
     9
     10        * bytecode/SpeculatedType.h:
     11        (JSC::isNotDoubleSpeculation):
     12        * dfg/DFGFixupPhase.cpp:
     13        (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
     14        * dfg/DFGNode.h:
     15        (JSC::DFG::Node::shouldSpeculateNotDouble):
     16        * dfg/DFGSafeToExecute.h:
     17        (JSC::DFG::SafeToExecuteEdge::operator()):
     18        * dfg/DFGSpeculativeJIT.cpp:
     19        (JSC::DFG::SpeculativeJIT::speculateNotDouble):
     20        (JSC::DFG::SpeculativeJIT::speculate):
     21        * dfg/DFGSpeculativeJIT.h:
     22        * dfg/DFGUseKind.cpp:
     23        (WTF::printInternal):
     24        * dfg/DFGUseKind.h:
     25        (JSC::DFG::typeFilterFor):
     26        (JSC::DFG::checkMayCrashIfInputIsEmpty):
     27        * ftl/FTLCapabilities.cpp:
     28        (JSC::FTL::canCompile):
     29        * ftl/FTLLowerDFGToB3.cpp:
     30        (JSC::FTL::DFG::LowerDFGToB3::speculate):
     31        (JSC::FTL::DFG::LowerDFGToB3::speculateNotDouble):
     32
    1332021-06-04  Robin Morisset  <rmorisset@apple.com>
    234

  • trunk/Source/JavaScriptCore/bytecode/SpeculatedType.h

    r278253 r278465  
    440440}
    441441
     442inline bool isNotDoubleSpeculation(SpeculatedType type)
     443{
     444    return !(type & SpecFullDouble);
     445}
     446
    442447inline bool isOtherSpeculation(SpeculatedType value)
    443448{

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r278462 r278465  
    42834283        ASSERT(node->op() == SameValue || node->op() == CompareStrictEq);
    42844284
     4285        if (node->child1().node() == node->child2().node()
     4286            && node->child1()->shouldSpeculateNotDouble()) {
     4287            m_insertionSet.insertNode(
     4288                m_indexInBlock, SpecNone, Check, node->origin,
     4289                Edge(node->child1().node(), NotDoubleUse));
     4290            m_graph.convertToConstant(node, jsBoolean(true));
     4291            return;
     4292        }
    42854293        if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
    42864294            fixEdge<BooleanUse>(node->child1());

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r278445 r278465  
    27982798        return isNotCellNorBigIntSpeculation(prediction());
    27992799    }
     2800
     2801    bool shouldSpeculateNotDouble()
     2802    {
     2803        return isNotDoubleSpeculation(prediction());
     2804    }
    28002805   
    28012806    bool shouldSpeculateUntypedForArithmetic()

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r278462 r278465  
    9393        case AnyIntUse:
    9494        case DoubleRepAnyIntUse:
     95        case NotDoubleUse:
    9596            return;
    9697           

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r278462 r278465  
    1143311433}
    1143411434
     11435void SpeculativeJIT::speculateNotDouble(Edge edge)
     11436{
     11437    JSValueOperand operand(this, edge, ManualOperandSpeculation);
     11438    GPRTemporary temp(this);
     11439    JSValueRegs regs = operand.jsValueRegs();
     11440    GPRReg tempGPR = temp.gpr();
     11441   
     11442    JITCompiler::Jump done = m_jit.branchIfInt32(regs);
     11443    DFG_TYPE_CHECK(regs, edge, ~SpecFullDouble, m_jit.branchIfNumber(regs, tempGPR));
     11444    done.link(&m_jit);
     11445}
     11446
    1143511447void SpeculativeJIT::speculateOther(Edge edge, JSValueRegs regs, GPRReg tempGPR)
    1143611448{
    … …  
    1161411626    case NotCellNorBigIntUse:
    1161511627        speculateNotCellNorBigInt(edge);
     11628        break;
     11629    case NotDoubleUse:
     11630        speculateNotDouble(edge);
    1161611631        break;
    1161711632    case OtherUse:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r278462 r278465  
    16721672    void speculateNotCell(Edge);
    16731673    void speculateNotCellNorBigInt(Edge);
     1674    void speculateNotDouble(Edge);
    16741675    void speculateOther(Edge, JSValueRegs, GPRReg temp);
    16751676    void speculateOther(Edge, JSValueRegs);

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp

    r261755 r278465  
    171171        out.print("NotCellNorBigInt");
    172172        return;
     173    case NotDoubleUse:
     174        out.print("NotDouble");
     175        return;
    173176    case KnownOtherUse:
    174177        out.print("KnownOther");

  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.h

    r261147 r278465  
    8282    NotCellUse,
    8383    NotCellNorBigIntUse,
     84    NotDoubleUse,
    8485    KnownOtherUse,
    8586    OtherUse,
    … …  
    188189    case NotCellNorBigIntUse:
    189190        return ~SpecCellCheck & ~SpecBigInt;
     191    case NotDoubleUse:
     192        return ~SpecFullDouble;
    190193    case KnownOtherUse:
    191194    case OtherUse:
    … …  
    306309    case NotCellUse:
    307310    case NotCellNorBigIntUse:
     311    case NotDoubleUse:
    308312        return false;
    309313    default:

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r278462 r278465  
    529529                case AnyIntUse:
    530530                case DoubleRepAnyIntUse:
     531                case NotDoubleUse:
    531532                    // These are OK.
    532533                    break;

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r278463 r278465  
    1840418404            speculateNotCellNorBigInt(edge);
    1840518405            break;
     18406        case NotDoubleUse:
     18407            speculateNotDouble(edge);
     18408            break;
    1840618409        case OtherUse:
    1840718410            speculateOther(edge);
    … …  
    1844718450        speculateNotCell(edge);
    1844818451#endif
     18452    }
     18453
     18454    void speculateNotDouble(Edge edge)
     18455    {
     18456        LValue value = lowJSValue(edge, ManualOperandSpeculation);
     18457       
     18458        LBasicBlock isNotInt32 = m_out.newBlock();
     18459        LBasicBlock continuation = m_out.newBlock();
     18460
     18461        m_out.branch(isInt32(value, provenType(edge)), unsure(continuation), unsure(isNotInt32));
     18462
     18463        LBasicBlock lastNext = m_out.appendTo(isNotInt32, continuation);
     18464        FTL_TYPE_CHECK(jsValueValue(value), edge, ~SpecFullDouble, isNumber(value));
     18465        m_out.jump(continuation);
     18466
     18467        m_out.appendTo(continuation, lastNext);
    1844918468    }
    1845018469   
Note: See TracChangeset for help on using the changeset viewer.