Changeset 118323 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

Timestamp:

May 23, 2012, 10:33:09 PM (13 years ago)

Author:

[email protected]

Message:

DFG should optimize aliased uses of the Arguments object of the current call frame
​https://bugs.webkit.org/show_bug.cgi?id=86552

Source/JavaScriptCore:

Reviewed by Geoff Garen.

Merged r117542 and r117543 from dfgopt.

Performs must-alias and escape analysis on uses of CreateArguments, and if
a variable is must-aliased to CreateArguments and does not escape, then we
turn all uses of that variable into direct arguments accesses.

36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::uncheckedArgumentsRegister):

• bytecode/ValueRecovery.h:

(JSC::ValueRecovery::argumentsThatWereNotCreated):
(ValueRecovery):
(JSC::ValueRecovery::dump):

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGAdjacencyList.h:

(AdjacencyList):
(JSC::DFG::AdjacencyList::removeEdgeFromBag):

• dfg/DFGArgumentsSimplificationPhase.cpp:

(JSC::DFG::ArgumentsSimplificationPhase::run):
(ArgumentsSimplificationPhase):
(JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
(JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
(JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
(JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
(JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):

• dfg/DFGAssemblyHelpers.h:

(JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
(AssemblyHelpers):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):

• dfg/DFGGPRInfo.h:

(GPRInfo):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::collectGarbage):
(DFG):

• dfg/DFGGraph.h:

(Graph):
(JSC::DFG::Graph::executableFor):
(JSC::DFG::Graph::argumentsRegisterFor):
(JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
(JSC::DFG::Graph::clobbersWorld):

• dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):

• dfg/DFGNodeType.h:

(DFG):

• dfg/DFGOSRExitCompiler.cpp:
• dfg/DFGOSRExitCompiler.h:

(JSC::DFG::OSRExitCompiler::OSRExitCompiler):
(OSRExitCompiler):

• dfg/DFGOSRExitCompiler32_64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOperations.cpp:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::ValueSource::dump):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
(VariableAccessData):
(JSC::DFG::VariableAccessData::isArgumentsAlias):

• jit/JITOpcodes.cpp:

(JSC::JIT::emitSlow_op_get_argument_by_val):

LayoutTests:

Rubber stamped by Geoff Garen.

Merged r117542 from dfgopt.

Added a bunch of tests that check that our optimizations for aliased uses of the
'arguments' object are robust against various forms of JavaScript crazy.

• fast/js/dfg-arguments-alias-escape-expected.txt: Added.
• fast/js/dfg-arguments-alias-escape.html: Added.
• fast/js/dfg-arguments-alias-expected.txt: Added.
• fast/js/dfg-arguments-alias.html: Added.
• fast/js/dfg-arguments-cross-code-origin-expected.txt: Added.
• fast/js/dfg-arguments-cross-code-origin.html: Added.
• fast/js/dfg-arguments-mixed-alias-expected.txt: Added.
• fast/js/dfg-arguments-mixed-alias.html: Added.
• fast/js/dfg-arguments-osr-exit-expected.txt: Added.
• fast/js/dfg-arguments-osr-exit.html: Added.
• fast/js/dfg-arguments-unexpected-escape-expected.txt: Added.
• fast/js/dfg-arguments-unexpected-escape.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-arguments-alias-escape.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-arguments-alias.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-arguments-cross-code-origin.js: Added.

(foo):
(bar):
(baz):

• fast/js/script-tests/dfg-arguments-mixed-alias.js: Added.

(foo):
(bar):

• fast/js/script-tests/dfg-arguments-osr-exit.js: Added.

(baz):
(foo):
(bar):

• fast/js/script-tests/dfg-arguments-unexpected-escape.js: Added.

(baz):
(foo):
(bar):

File:

• trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@ -438 +438 @@
         }
             
-        case GetMyArgumentByVal: {
+        case GetMyArgumentByValSafe: {
             changed |= mergePrediction(node.getHeapPrediction());
             changed |= m_graph[node.child1()].mergeFlags(NodeUsedAsNumber | NodeUsedAsInt);
@@ -444 +444 @@
         }
             
-        case GetMyArgumentsLength: {
+        case GetMyArgumentsLengthSafe: {
             changed |= setPrediction(PredictInt32);
             break;
@@ -617 +617 @@
         case Int32ToDouble:
         case DoubleAsInt32:
-        case GetLocalUnlinked: {
+        case GetLocalUnlinked:
+        case GetMyArgumentsLength:
+        case GetMyArgumentByVal: {
             // This node should never be visible at this stage of compilation. It is
             // inserted by fixup(), which follows this phase.