Changeset 253144 in webkit

Timestamp:

Dec 4, 2019 10:26:06 PM (4 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] AI should convert IsCellWithType to constant when Structure set is finite
​https://bugs.webkit.org/show_bug.cgi?id=204141

Reviewed by Mark Lam.

JSTests:

• stress/generator-cell-with-type.js: Added.

(shouldBe):
(shouldThrow):
(test):
(i.shouldThrow):

• stress/is-cell-with-type-should-check-non-cell-cases.js: Added.

(getter):
(foo):

Source/JavaScriptCore:

We should fold IsCellWithType if Structure set is finite since we have a chance to know what JSType is.
The difference from the last patch is that we have if (!(child.m_type & ~SpecCell)) check. Even if
structures meet the requirement, this structures do not guarantee that non cell types never come. We
should ensure it by using proven type.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/generator-cell-with-type.js (added)
• JSTests/stress/is-cell-with-type-should-check-non-cell-cases.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] AI should convert IsCellWithType to constant when Structure set is finite
+        https://bugs.webkit.org/show_bug.cgi?id=204141
+
+        Reviewed by Mark Lam.
+
+        * stress/generator-cell-with-type.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (test):
+        (i.shouldThrow):
+        * stress/is-cell-with-type-should-check-non-cell-cases.js: Added.
+        (getter):
+        (foo):
+
 2019-12-04  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] AI should convert IsCellWithType to constant when Structure set is finite
+        https://bugs.webkit.org/show_bug.cgi?id=204141
+
+        Reviewed by Mark Lam.
+
+        We should fold IsCellWithType if Structure set is finite since we have a chance to know what JSType is.
+        The difference from the last patch is that we have `if (!(child.m_type & ~SpecCell))` check. Even if
+        structures meet the requirement, this structures do not guarantee that non cell types never come. We
+        should ensure it by using proven type.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -1444 +1444 @@
             if (constantWasSet)
                 break;
+        }
+
+        if (!(child.m_type & ~SpecCell)) {
+            if (child.m_structure.isFinite()) {
+                bool constantWasSet = false;
+                switch (node->op()) {
+                case IsCellWithType: {
+                    bool ok = true;
+                    Optional<bool> result;
+                    child.m_structure.forEach(
+                        [&](RegisteredStructure structure) {
+                            bool matched = structure->typeInfo().type() == node->queriedType();
+                            if (!result)
+                                result = matched;
+                            else {
+                                if (result.value() != matched)
+                                    ok = false;
+                            }
+                        });
+                    if (ok && result) {
+                        setConstant(node, jsBoolean(result.value()));
+                        constantWasSet = true;
+                    }
+                    break;
+                }
+                default:
+                    break;
+                }
+                if (constantWasSet)
+                    break;
+            }
         }