Changeset 95136 in webkit

Timestamp:

Sep 14, 2011 4:06:04 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG JIT should not speculate integer if the value is always going to be
used as a double anyway
​https://bugs.webkit.org/show_bug.cgi?id=68127

Reviewed by Oliver Hunt.

Added a ValueToDouble node, which is a variant of ValueToNumber that
hints that it will only be used as a double and never as an integer.
Thus, it turns off integer speculation even if the value profiler
told us that the value source is an int. The logic for converting a
ValueToNumber into a ValueToDouble is found in Propagator.

This appears to be a 22% speed-up in imaging-darkroom.

• dfg/DFGNode.h:
• dfg/DFGNonSpeculativeJIT.cpp:

(JSC::DFG::NonSpeculativeJIT::compile):

• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::fixpoint):
(JSC::DFG::Propagator::toDouble):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::fixup):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGNode.h (modified) (1 diff)
• dfg/DFGNonSpeculativeJIT.cpp (modified) (1 diff)
• dfg/DFGPropagator.cpp (modified) (2 diffs)
• dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should not speculate integer if the value is always going to be
+        used as a double anyway
+        https://bugs.webkit.org/show_bug.cgi?id=68127
+
+        Reviewed by Oliver Hunt.
+        
+        Added a ValueToDouble node, which is a variant of ValueToNumber that
+        hints that it will only be used as a double and never as an integer.
+        Thus, it turns off integer speculation even if the value profiler
+        told us that the value source is an int. The logic for converting a
+        ValueToNumber into a ValueToDouble is found in Propagator.
+        
+        This appears to be a 22% speed-up in imaging-darkroom.
+
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::toDouble):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::fixup):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -159 +159 @@
     macro(ValueToNumber, NodeResultNumber | NodeMustGenerate) \
     \
+    /* A variant of ValueToNumber, which a hint that the parents will always use this as a double. */\
+    macro(ValueToDouble, NodeResultNumber | NodeMustGenerate) \
+    \
     /* Add of values may either be arithmetic, or result in string concatenation. */\
     macro(ValueAdd, NodeResultJS | NodeMustGenerate) \

trunk/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp

@@ -596 +596 @@
     }
 
-    case ValueToNumber: {
+    case ValueToNumber:
+    case ValueToDouble: {
         ASSERT(!isInt32Constant(node.child1()));
         ASSERT(!isNumberConstant(node.child1()));

trunk/Source/JavaScriptCore/dfg/DFGPropagator.cpp

@@ -86 +86 @@
             propagateBackward();
         } while (m_changed);
+        
+        fixup();
     }
     
@@ -322 +324 @@
     }
     
+    void toDouble(NodeIndex nodeIndex)
+    {
+        if (m_graph[nodeIndex].op == ValueToNumber) {
+#if ENABLE(DFG_DEBUG_VERBOSE)
+            printf("  @%u -> ValueToDouble", nodeIndex);
+#endif
+            m_graph[nodeIndex].op = ValueToDouble;
+        }
+    }
+    
+    void fixupNode(Node& node)
+    {
+        if (!node.shouldGenerate())
+            return;
+        
+        NodeType op = node.op;
+
+#if ENABLE(DFG_DEBUG_VERBOSE)
+        printf("   %s[%u]: ", Graph::opName(op), m_compileIndex);
+#endif
+        
+        switch (op) {
+        case ValueAdd: {
+            PredictedType left = m_predictions[node.child1()];
+            PredictedType right = m_predictions[node.child2()];
+            
+            if (isStrongPrediction(left) && isStrongPrediction(right) && isNumberPrediction(left) && isNumberPrediction(right)) {
+                if (left & PredictDouble)
+                    toDouble(node.child2());
+                if (right & PredictDouble)
+                    toDouble(node.child1());
+            }
+            break;
+        }
+            
+        case ArithAdd:
+        case ArithSub:
+        case ArithMul: {
+            PredictedType left = m_predictions[node.child1()];
+            PredictedType right = m_predictions[node.child2()];
+            
+            if (isStrongPrediction(left) && isStrongPrediction(right)) {
+                if (left & PredictDouble)
+                    toDouble(node.child2());
+                if (right & PredictDouble)
+                    toDouble(node.child1());
+            }
+            break;
+        }
+            
+        case ArithDiv: {
+            toDouble(node.child1());
+            toDouble(node.child2());
+            break;
+        }
+            
+        default:
+            break;
+        }
+
+#if ENABLE(DFG_DEBUG_VERBOSE)
+        printf("\n");
+#endif
+    }
+    
+    void fixup()
+    {
+#if ENABLE(DFG_DEBUG_VERBOSE)
+        printf("Performing Fixup\n");
+#endif
+        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
+            fixupNode(m_graph[m_compileIndex]);
+    }
+    
     Graph& m_graph;
     JSGlobalData& m_globalData;

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -864 +864 @@
             break;
         }
+        SpeculateDoubleOperand op1(this, node.child1());
+        FPRTemporary result(this, op1);
+        m_jit.moveDouble(op1.fpr(), result.fpr());
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ValueToDouble: {
         SpeculateDoubleOperand op1(this, node.child1());
         FPRTemporary result(this, op1);
@@ -1695 +1703 @@
                 switch (node.op) {
                 case ValueToNumber:
+                case ValueToDouble:
                     valueToNumberIndex = info.nodeIndex();
                     break;