Changeset 118323 in webkit for trunk/Source/JavaScriptCore/bytecode/ValueRecovery.h

Timestamp:

May 23, 2012, 10:33:09 PM (13 years ago)

Author:

[email protected]

Message:

DFG should optimize aliased uses of the Arguments object of the current call frame
​https://bugs.webkit.org/show_bug.cgi?id=86552

Source/JavaScriptCore:

Reviewed by Geoff Garen.

Merged r117542 and r117543 from dfgopt.

Performs must-alias and escape analysis on uses of CreateArguments, and if
a variable is must-aliased to CreateArguments and does not escape, then we
turn all uses of that variable into direct arguments accesses.

36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::uncheckedArgumentsRegister):

• bytecode/ValueRecovery.h:

(JSC::ValueRecovery::argumentsThatWereNotCreated):
(ValueRecovery):
(JSC::ValueRecovery::dump):

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGAdjacencyList.h:

(AdjacencyList):
(JSC::DFG::AdjacencyList::removeEdgeFromBag):

• dfg/DFGArgumentsSimplificationPhase.cpp:

(JSC::DFG::ArgumentsSimplificationPhase::run):
(ArgumentsSimplificationPhase):
(JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
(JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
(JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
(JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
(JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):

• dfg/DFGAssemblyHelpers.h:

(JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
(AssemblyHelpers):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):

• dfg/DFGGPRInfo.h:

(GPRInfo):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::collectGarbage):
(DFG):

• dfg/DFGGraph.h:

(Graph):
(JSC::DFG::Graph::executableFor):
(JSC::DFG::Graph::argumentsRegisterFor):
(JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
(JSC::DFG::Graph::clobbersWorld):

• dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):

• dfg/DFGNodeType.h:

(DFG):

• dfg/DFGOSRExitCompiler.cpp:
• dfg/DFGOSRExitCompiler.h:

(JSC::DFG::OSRExitCompiler::OSRExitCompiler):
(OSRExitCompiler):

• dfg/DFGOSRExitCompiler32_64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOperations.cpp:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::ValueSource::dump):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
(VariableAccessData):
(JSC::DFG::VariableAccessData::isArgumentsAlias):

• jit/JITOpcodes.cpp:

(JSC::JIT::emitSlow_op_get_argument_by_val):

LayoutTests:

Rubber stamped by Geoff Garen.

Merged r117542 from dfgopt.

Added a bunch of tests that check that our optimizations for aliased uses of the
'arguments' object are robust against various forms of JavaScript crazy.

• fast/js/dfg-arguments-alias-escape-expected.txt: Added.
• fast/js/dfg-arguments-alias-escape.html: Added.
• fast/js/dfg-arguments-alias-expected.txt: Added.
• fast/js/dfg-arguments-alias.html: Added.
• fast/js/dfg-arguments-cross-code-origin-expected.txt: Added.
• fast/js/dfg-arguments-cross-code-origin.html: Added.
• fast/js/dfg-arguments-mixed-alias-expected.txt: Added.
• fast/js/dfg-arguments-mixed-alias.html: Added.
• fast/js/dfg-arguments-osr-exit-expected.txt: Added.
• fast/js/dfg-arguments-osr-exit.html: Added.
• fast/js/dfg-arguments-unexpected-escape-expected.txt: Added.
• fast/js/dfg-arguments-unexpected-escape.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-arguments-alias-escape.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-arguments-alias.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-arguments-cross-code-origin.js: Added.

(foo):
(bar):
(baz):

• fast/js/script-tests/dfg-arguments-mixed-alias.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-arguments-osr-exit.js: Added.

(baz):
(foo):
(bar):

• fast/js/script-tests/dfg-arguments-unexpected-escape.js: Added.

(baz):
(foo):
(bar):

File:

• trunk/Source/JavaScriptCore/bytecode/ValueRecovery.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/bytecode/ValueRecovery.h

@@ -62 +62 @@
     CellDisplacedInRegisterFile,
     BooleanDisplacedInRegisterFile,
+    // It's an Arguments object.
+    ArgumentsThatWereNotCreated,
     // It's a constant.
     Constant,
@@ -188 +190 @@
         result.m_technique = Constant;
         result.m_source.constant = JSValue::encode(value);
+        return result;
+    }
+    
+    static ValueRecovery argumentsThatWereNotCreated()
+    {
+        ValueRecovery result;
+        result.m_technique = ArgumentsThatWereNotCreated;
         return result;
     }
@@ -316 +325 @@
             fprintf(out, "*bool(%d)", virtualRegister());
             break;
+        case ArgumentsThatWereNotCreated:
+            fprintf(out, "arguments");
+            break;
         case Constant:
             fprintf(out, "[%s]", constant().description());