Changeset 230964 in webkit
- Timestamp:
- Apr 24, 2018 11:54:47 AM (6 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 6 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r230961 r230964 1 2018-04-24 Filip Pizlo <fpizlo@apple.com> 2 3 DFG CSE should know how to decay a MultiGetByOffset 4 https://bugs.webkit.org/show_bug.cgi?id=159859 5 6 Reviewed by Keith Miller. 7 8 This teaches Node::remove() how to decay a MultiGetByOffset to a CheckStructure, so that 9 clobberize() can report a def() for MultiGetByOffset. 10 11 This is a slight improvement to codegen in splay because splay is a heavy user of 12 MultiGetByOffset. It uses it redundantly in one of its hot functions (the function called 13 "splay_"). I don't see a net speed-up in the benchmark. However, this is just a first step to 14 removing MultiXByOffset-related redundancies, which by my estimates account for 16% of 15 splay's time. 16 17 * dfg/DFGClobberize.h: 18 (JSC::DFG::clobberize): 19 * dfg/DFGNode.cpp: 20 (JSC::DFG::Node::remove): 21 (JSC::DFG::Node::removeWithoutChecks): 22 (JSC::DFG::Node::replaceWith): 23 (JSC::DFG::Node::replaceWithWithoutChecks): 24 * dfg/DFGNode.h: 25 (JSC::DFG::Node::convertToMultiGetByOffset): 26 (JSC::DFG::Node::replaceWith): Deleted. 27 * dfg/DFGNodeType.h: 28 * dfg/DFGObjectAllocationSinkingPhase.cpp: 29 1 30 2018-04-24 Keith Miller <keith_miller@apple.com> 2 31 -
trunk/Source/JavaScriptCore/dfg/DFGClobberize.h
r230725 r230964 1189 1189 AbstractHeap heap(NamedProperties, node->multiGetByOffsetData().identifierNumber); 1190 1190 read(heap); 1191 // FIXME: We cannot def() for MultiGetByOffset because CSE is not smart enough to decay it 1192 // to a CheckStructure. 1193 // https://bugs.webkit.org/show_bug.cgi?id=159859 1191 def(HeapLocation(NamedPropertyLoc, heap, node->child1()), LazyNode(node)); 1194 1192 return; 1195 1193 } -
trunk/Source/JavaScriptCore/dfg/DFGNode.cpp
r229514 r230964 1 1 /* 2 * Copyright (C) 2013 , 2014, 2016Apple Inc. All rights reserved.2 * Copyright (C) 2013-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 84 84 void Node::remove(Graph& graph) 85 85 { 86 if (flags() & NodeHasVarArgs) { 87 unsigned targetIndex = 0; 88 for (unsigned i = 0; i < numChildren(); ++i) { 89 Edge& edge = graph.varArgChild(this, i); 90 if (!edge) 91 continue; 92 if (edge.willHaveCheck()) { 93 Edge& dst = graph.varArgChild(this, targetIndex++); 94 std::swap(dst, edge); 95 continue; 86 switch (op()) { 87 case MultiGetByOffset: { 88 MultiGetByOffsetData& data = multiGetByOffsetData(); 89 StructureSet set; 90 for (MultiGetByOffsetCase& getCase : data.cases) { 91 getCase.set().forEach( 92 [&] (RegisteredStructure structure) { 93 set.add(structure.get()); 94 }); 95 } 96 convertToCheckStructure(graph.addStructureSet(set)); 97 return; 98 } 99 100 default: 101 if (flags() & NodeHasVarArgs) { 102 unsigned targetIndex = 0; 103 for (unsigned i = 0; i < numChildren(); ++i) { 104 Edge& edge = graph.varArgChild(this, i); 105 if (!edge) 106 continue; 107 if (edge.willHaveCheck()) { 108 Edge& dst = graph.varArgChild(this, targetIndex++); 109 std::swap(dst, edge); 110 continue; 111 } 112 edge = Edge(); 96 113 } 97 edge = Edge(); 98 } 99 setOpAndDefaultFlags(CheckVarargs); 100 children.setNumChildren(targetIndex); 101 } else { 102 children = children.justChecks(); 103 setOpAndDefaultFlags(Check); 104 } 114 setOpAndDefaultFlags(CheckVarargs); 115 children.setNumChildren(targetIndex); 116 } else { 117 children = children.justChecks(); 118 setOpAndDefaultFlags(Check); 119 } 120 return; 121 } 122 } 123 124 void Node::removeWithoutChecks() 125 { 126 children = AdjacencyList(); 127 setOpAndDefaultFlags(Check); 128 } 129 130 void Node::replaceWith(Graph& graph, Node* other) 131 { 132 remove(graph); 133 setReplacement(other); 134 } 135 136 void Node::replaceWithWithoutChecks(Node* other) 137 { 138 removeWithoutChecks(); 139 setReplacement(other); 105 140 } 106 141 -
trunk/Source/JavaScriptCore/dfg/DFGNode.h
r230748 r230964 432 432 433 433 void remove(Graph&); 434 void removeWithoutChecks(); 434 435 435 436 void convertToCheckStructure(RegisteredStructureSet* set) … … 452 453 } 453 454 454 void replaceWith(Graph& graph, Node* other) 455 { 456 remove(graph); 457 setReplacement(other); 458 } 455 void replaceWith(Graph&, Node* other); 456 void replaceWithWithoutChecks(Node* other); 459 457 460 458 void convertToIdentity(); … … 563 561 void convertToMultiGetByOffset(MultiGetByOffsetData* data) 564 562 { 565 ASSERT(m_op == GetById || m_op == GetByIdFlush || m_op == GetByIdDirect || m_op == GetByIdDirectFlush);563 RELEASE_ASSERT(m_op == GetById || m_op == GetByIdFlush || m_op == GetByIdDirect || m_op == GetByIdDirectFlush); 566 564 m_opInfo = data; 567 565 child1().setUseKind(CellUse); 568 566 m_op = MultiGetByOffset; 569 ASSERT(m_flags & NodeMustGenerate);567 RELEASE_ASSERT(m_flags & NodeMustGenerate); 570 568 } 571 569 -
trunk/Source/JavaScriptCore/dfg/DFGNodeType.h
r230488 r230964 1 1 /* 2 * Copyright (C) 2012-201 7Apple Inc. All rights reserved.2 * Copyright (C) 2012-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without -
trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
r229893 r230964 1 1 /* 2 * Copyright (C) 2015 Apple Inc. All rights reserved.2 * Copyright (C) 2015-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 961 961 if (Node* value = heapResolve(location)) { 962 962 if (allocation->structures().isSubsetOf(validStructures)) 963 node->replaceWith (m_graph,value);963 node->replaceWithWithoutChecks(value); 964 964 else { 965 965 Node* structure = heapResolve(PromotedHeapLocation(allocation->identifier(), StructurePLoc));
Note: See TracChangeset
for help on using the changeset viewer.