Changeset 149162 in webkit for trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h

Timestamp:

Apr 25, 2013, 6:18:18 PM (12 years ago)

Author:

[email protected]

Message:

DFG doesn't support to_jsnumber
​https://bugs.webkit.org/show_bug.cgi?id=115129

Reviewed by Geoffrey Garen.

Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
tell us to. Identity is later turned into Phantom.

Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
wrong; NodeDoesNotExit is not a backward propagation property.

Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).

This more than doubles the FPS on ammo.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.h:

(JSC::DFG::canCompileOpcode):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::observeUseKindOnEdge):

• dfg/DFGNodeFlags.h:

(DFG):

• dfg/DFGNodeType.h:

(DFG):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

File:

• trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h

@@ -54 +54 @@
 #define NodeMayNegZero            0x100
                                 
-#define NodeBackPropMask         0x3E00
+#define NodeBackPropMask         0x1E00
 #define NodeUseBottom            0x0000
 #define NodeUsedAsNumber         0x0200 // The result of this computation may be used in a context that observes fractional, or bigger-than-int32, results.