Changeset 132554 in webkit

Timestamp:

Oct 25, 2012 6:57:07 PM (11 years ago)

Author:

fpizlo@apple.com

Message:

DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
​https://bugs.webkit.org/show_bug.cgi?id=100441

Reviewed by Oliver Hunt and Gavin Barraclough.

Source/JavaScriptCore:

Made array profiler's to-string helper behave correctly.

Made Arrayify elimination do the right thing (convert to GetButterfly).

Made CFA's interference analysis track clobbered array modes correctly, mostly by
simplifying the machinery.

• bytecode/ArrayProfile.cpp:

(JSC::arrayModesToString):

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::clobberArrayModes):
(AbstractValue):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests:

• fast/js/dfg-arrayify-elimination-expected.txt: Added.
• fast/js/dfg-arrayify-elimination.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-arrayify-elimination.js: Added.

(foo):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/dfg-arrayify-elimination-expected.txt (added)
• LayoutTests/fast/js/dfg-arrayify-elimination.html (added)
• LayoutTests/fast/js/jsc-test-list (modified) (1 diff)
• LayoutTests/fast/js/script-tests/dfg-arrayify-elimination.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/bytecode/ArrayProfile.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractState.cpp (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGAbstractValue.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
+        https://bugs.webkit.org/show_bug.cgi?id=100441
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        * fast/js/dfg-arrayify-elimination-expected.txt: Added.
+        * fast/js/dfg-arrayify-elimination.html: Added.
+        * fast/js/jsc-test-list:
+        * fast/js/script-tests/dfg-arrayify-elimination.js: Added.
+        (foo):
+
 2012-10-25  Keishi Hattori  <keishi@webkit.org>
 

trunk/LayoutTests/fast/js/jsc-test-list

@@ -80 +80 @@
 fast/js/dfg-arguments-out-of-bounds
 fast/js/dfg-arguments-unexpected-escape
+fast/js/dfg-arrayify-elimination
 fast/js/dfg-arrayify-when-late-prevent-extensions
 fast/js/dfg-arrayify-when-prevent-extensions

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
+        https://bugs.webkit.org/show_bug.cgi?id=100441
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Made array profiler's to-string helper behave correctly.
+        
+        Made Arrayify elimination do the right thing (convert to GetButterfly).
+        
+        Made CFA's interference analysis track clobbered array modes correctly, mostly by
+        simplifying the machinery.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::arrayModesToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clobberArrayModes):
+        (AbstractValue):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
 2012-10-25  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/ArrayProfile.cpp

@@ -39 +39 @@
         return "TOP";
 
-    bool isNonArray = !!(arrayModes & NonArray);
-    bool isNonArrayWithContiguous = !!(arrayModes & NonArrayWithContiguous);
-    bool isNonArrayWithArrayStorage = !!(arrayModes & NonArrayWithArrayStorage);
-    bool isNonArrayWithSlowPutArrayStorage = !!(arrayModes & NonArrayWithSlowPutArrayStorage);
-    bool isArray = !!(arrayModes & ArrayClass);
-    bool isArrayWithContiguous = !!(arrayModes & ArrayWithContiguous);
-    bool isArrayWithArrayStorage = !!(arrayModes & ArrayWithArrayStorage);
-    bool isArrayWithSlowPutArrayStorage = !!(arrayModes & ArrayWithSlowPutArrayStorage);
+    bool isNonArray = !!(arrayModes & asArrayModes(NonArray));
+    bool isNonArrayWithContiguous = !!(arrayModes & asArrayModes(NonArrayWithContiguous));
+    bool isNonArrayWithArrayStorage = !!(arrayModes & asArrayModes(NonArrayWithArrayStorage));
+    bool isNonArrayWithSlowPutArrayStorage = !!(arrayModes & asArrayModes(NonArrayWithSlowPutArrayStorage));
+    bool isArray = !!(arrayModes & asArrayModes(ArrayClass));
+    bool isArrayWithContiguous = !!(arrayModes & asArrayModes(ArrayWithContiguous));
+    bool isArrayWithArrayStorage = !!(arrayModes & asArrayModes(ArrayWithArrayStorage));
+    bool isArrayWithSlowPutArrayStorage = !!(arrayModes & asArrayModes(ArrayWithSlowPutArrayStorage));
     
     static char result[256];

trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

@@ -1422 +1422 @@
         }
         forNode(node.child1()).filterArrayModes(arrayModesFor(node.arrayMode()));
+        m_haveStructures = true;
         break;
     }
@@ -1439 +1440 @@
             clobberStructures(indexInBlock);
             forNode(node.child1()).filterArrayModes(arrayModesFor(node.arrayMode()));
+            m_haveStructures = true;
             break;
         default:

trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h

@@ -459 +459 @@
     void clobberArrayModes()
     {
-        if (m_arrayModes == ALL_ARRAY_MODES)
-            return;
-        
-        if (LIKELY(m_arrayModes & asArrayModes(NonArray)))
-            m_arrayModes = ALL_ARRAY_MODES;
-        else
-            clobberArrayModesSlow();
-    }
-    
-    void clobberArrayModesSlow()
-    {
-        if (m_arrayModes & asArrayModes(ArrayClass))
-            m_arrayModes = ALL_ARRAY_MODES;
-        else if (m_arrayModes & asArrayModes(NonArrayWithContiguous))
-            m_arrayModes |= asArrayModes(NonArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage);
-        else if (m_arrayModes & asArrayModes(ArrayWithContiguous))
-            m_arrayModes |= asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage);
-        else if (m_arrayModes & asArrayModes(NonArrayWithArrayStorage))
-            m_arrayModes |= asArrayModes(NonArrayWithSlowPutArrayStorage);
-        else if (m_arrayModes & asArrayModes(ArrayWithArrayStorage))
-            m_arrayModes |= asArrayModes(ArrayWithArrayStorage);
-    }
-
+        // FIXME: We could make this try to predict the set of array modes that this object
+        // could have in the future. For now, just do the simple thing.
+        m_arrayModes = ALL_ARRAY_MODES;
+    }
+    
     void setFuturePossibleStructure(Structure* structure)
     {

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -103 +103 @@
             }
                 
-            case CheckArray:
-            case Arrayify: {
+            case CheckArray: {
                 if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
                     break;
@@ -113 +112 @@
             }
                 
+            case Arrayify: {
+                if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
+                    break;
+                ASSERT(node.refCount() >= 1);
+                node.setOpAndDefaultFlags(GetButterfly);
+                m_graph.deref(nodeIndex);
+                eliminated = true;
+                break;
+            }
+
             default:
                 break;