Changeset 146996 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

Timestamp:

Mar 27, 2013, 10:54:22 AM (12 years ago)

Author:

[email protected]

Message:

DFG should use CheckStructure for typed array checks whenever possible
​https://bugs.webkit.org/show_bug.cgi?id=113374

Reviewed by Geoffrey Garen.

We used to do the right thing, but it appears that this regressed at some point. Since the
FixupPhase now has the ability to outright remove spurious CheckStructures on array
operations, it is profitable for the ByteCodeParser to insert CheckStructures whenver there
is a chance that it might be profitable, and when the profiling tells us what structure to
check.

Also added some code for doing ArrayProfile debugging.

This is a slightly speed-up. Maybe 3% on Mandreel.

• bytecode/ArrayProfile.cpp:

(JSC::ArrayProfile::computeUpdatedPrediction):

• dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::benefitsFromStructureCheck):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

@@ -350 +350 @@
         switch (type()) {
         case Array::SelectUsingPredictions:
+            // It might benefit from structure checks! If it ends up not benefiting, we can just
+            // remove it. The FixupPhase does this: if it finds a CheckStructure just before an
+            // array op and it had turned that array op into either generic or conversion mode,
+            // it will remove the CheckStructure.
+            return true;
         case Array::Unprofiled:
         case Array::ForceExit: