Changeset 113557 in webkit for trunk/Source/JavaScriptCore/bytecode

Timestamp:

Apr 9, 2012, 12:48:08 AM (13 years ago)

Author:

[email protected]

Message:

DFG should not load the property storage if it is inline.
​https://bugs.webkit.org/show_bug.cgi?id=83455

Reviewed by Gavin Barraclough.

We had previously decided to have all property storage accesses go through
the property storage pointer even if they don't "really" have to, because
we were thinking this would help GC barriers somehow. Well, we never ended
up doing anything with that. Hence, doing these wasted loads of the
property storage pointer when the storage is inline is just a waste of CPU
cycles.

This change makes the DFG's inline property accesses (GetByOffset and
PutByOffset) go directly to the inline property storage if the structure(s)
tell us that it's OK.

This looks like an across-the-board 1% win.

• bytecode/StructureSet.h:

(JSC):
(JSC::StructureSet::allAreUsingInlinePropertyStorage):
(StructureSet):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::fillStorage):

File:

• trunk/Source/JavaScriptCore/bytecode/StructureSet.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecode/StructureSet.h

@@ -28 +28 @@
 
 #include "PredictedType.h"
+#include "Structure.h"
 #include <stdio.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
-
-class Structure;
 
 namespace DFG {
@@ -108 +107 @@
     size_t size() const { return m_structures.size(); }
     
+    bool allAreUsingInlinePropertyStorage() const
+    {
+        for (size_t i = 0; i < m_structures.size(); ++i) {
+            if (!m_structures[i]->isUsingInlineStorage())
+                return false;
+        }
+        return true;
+    }
+    
     Structure* at(size_t i) const { return m_structures.at(i); }