Changeset 103604 in webkit for trunk/Source/JavaScriptCore/dfg/DFGNode.h

Timestamp:

Dec 22, 2011, 9:47:17 PM (13 years ago)

Author:

[email protected]

Message:

DFG should not speculate array even when predictions say that the base is not an array
​https://bugs.webkit.org/show_bug.cgi?id=75160
<rdar://problem/10622646>
<rdar://problem/10622649>

Reviewed by Oliver Hunt.

Added the ability to call slow path when the base is known to not be an array.
Also rationalized the logic for deciding when the index is not an int, and
cleaned up the logic for deciding when to speculate typed array.

Neutral for the most part, with odd speed-ups and slow-downs. The slow-downs can
likely be mitigated by having the notion of a polymorphic array access, where we
try, but don't speculate, to access the array one way before either trying some
other ways or calling slow path.

• bytecode/PredictedType.h:

(JSC::isActionableMutableArrayPrediction):
(JSC::isActionableArrayPrediction):

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateInt8Array):
(JSC::DFG::Node::shouldSpeculateInt16Array):
(JSC::DFG::Node::shouldSpeculateInt32Array):
(JSC::DFG::Node::shouldSpeculateUint8Array):
(JSC::DFG::Node::shouldSpeculateUint16Array):
(JSC::DFG::Node::shouldSpeculateUint32Array):
(JSC::DFG::Node::shouldSpeculateFloat32Array):
(JSC::DFG::Node::shouldSpeculateFloat64Array):

• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::byValIsPure):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

File:

• trunk/Source/JavaScriptCore/dfg/DFGNode.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -932 +932 @@
     bool shouldSpeculateInt8Array()
     {
-        return prediction() == PredictInt8Array;
+        return isInt8ArrayPrediction(prediction());
     }
     
     bool shouldSpeculateInt16Array()
     {
-        return prediction() == PredictInt16Array;
+        return isInt16ArrayPrediction(prediction());
     }
     
     bool shouldSpeculateInt32Array()
     {
-        return prediction() == PredictInt32Array;
+        return isInt32ArrayPrediction(prediction());
     }
     
     bool shouldSpeculateUint8Array()
     {
-        return prediction() == PredictUint8Array;
+        return isUint8ArrayPrediction(prediction());
     }
     
     bool shouldSpeculateUint16Array()
     {
-        return prediction() == PredictUint16Array;
+        return isUint16ArrayPrediction(prediction());
     }
     
     bool shouldSpeculateUint32Array()
     {
-        return prediction() == PredictUint32Array;
+        return isUint32ArrayPrediction(prediction());
     }
     
@@ -963 +963 @@
     {
 #if CPU(X86) || CPU(X86_64)
-        return !!(prediction() & PredictFloat32Array);
+        return isFloat32ArrayPrediction(prediction());
 #else
         return false;
@@ -971 +971 @@
     bool shouldSpeculateFloat64Array()
     {
-        return prediction() == PredictFloat64Array;
+        return isFloat64ArrayPrediction(prediction());
     }