Changeset 145052 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h

Timestamp:

Mar 7, 2013, 1:04:57 AM (12 years ago)

Author:

[email protected]

Message:

ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding
​https://bugs.webkit.org/show_bug.cgi?id=111674

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup
convert them to either Identity(Object:@child) if the child is predicted object, or
Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other.

The goal of this is to ensure that the optimization fixpoint doesn't create
Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up
but I'm hoping this will be a step towards reducing the need to rerun the fixpoint
so as to ultimately reduce compile times.

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::executeEffects):

• dfg/DFGAssemblyHelpers.h:

(AssemblyHelpers):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):

• dfg/DFGGraph.h:

(JSC::DFG::Graph::globalThisObjectFor):
(Graph):

• dfg/DFGNode.h:

(Node):
(JSC::DFG::Node::convertToIdentity):
(JSC::DFG::Node::convertToWeakConstant):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Oliver Hunt.

• fast/js/dfg-convert-this-object-then-exit-on-other-expected.txt: Added.
• fast/js/dfg-convert-this-object-then-exit-on-other.html: Added.
• fast/js/dfg-convert-this-other-then-exit-on-object-expected.txt: Added.
• fast/js/dfg-convert-this-other-then-exit-on-object.html: Added.
• fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other-expected.txt: Added.
• fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other.html: Added.
• fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string-expected.txt: Added.
• fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-convert-this-object-then-exit-on-other.js: Added.

(foo):

• fast/js/script-tests/dfg-convert-this-other-then-exit-on-object.js: Added.

(foo):

• fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js: Added.

(foo):

• fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h

@@ -320 +320 @@
     }
     
-    JSObject* globalThisObjectFor(CodeOrigin codeOrigin)
-    {
-        JSGlobalObject* object = globalObjectFor(codeOrigin);
-        return object->methodTable()->toThisObject(object, 0);
-    }
-    
     bool strictModeFor(CodeOrigin codeOrigin)
     {