Changeset 153281 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

Timestamp:

Jul 24, 2013, 9:04:59 PM (12 years ago)

Author:

[email protected]

Message:

fourthTier: DFG shouldn't create CheckStructures for array accesses except if the ArrayMode implies an original array access
​https://bugs.webkit.org/show_bug.cgi?id=118867

Reviewed by Mark Hahnenberg.

This allows us to kill off a bunch of code in the parser, in fixup, and to simplify
ArrayProfile.

It also makes it easier to ask any array-using node how to create its type check.

Doing this required fixing a bug in LowLevelInterpreter64, where it was storing into
an array profile, thinking that it was storing into a value profile. Reshuffling the
fields in ArrayProfile revealed this.

• bytecode/ArrayProfile.cpp:

(JSC::ArrayProfile::computeUpdatedPrediction):
(JSC::ArrayProfile::briefDescriptionWithoutUpdating):

• bytecode/ArrayProfile.h:

(JSC::ArrayProfile::ArrayProfile):
(ArrayProfile):

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::updateAllArrayPredictions):
(JSC::CodeBlock::updateAllPredictions):

• bytecode/CodeBlock.h:

(CodeBlock):
(JSC::CodeBlock::updateAllArrayPredictions):

• dfg/DFGArrayMode.h:

(ArrayMode):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::getArrayModeConsideringSlowPath):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::checkArray):
(JSC::DFG::FixupPhase::blessArrayOperation):

• llint/LowLevelInterpreter64.asm:

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

@@ -346 +346 @@
     Structure* originalArrayStructure(Graph&, Node*) const;
     
-    bool benefitsFromStructureCheck() const
-    {
-        switch (type()) {
-        case Array::SelectUsingPredictions:
-            // It might benefit from structure checks! If it ends up not benefiting, we can just
-            // remove it. The FixupPhase does this: if it finds a CheckStructure just before an
-            // array op and it had turned that array op into either generic or conversion mode,
-            // it will remove the CheckStructure.
-            return true;
-        case Array::Unprofiled:
-        case Array::ForceExit:
-        case Array::Generic:
-            return false;
-        default:
-            return conversion() == Array::AsIs;
-        }
-    }
-    
     bool doesConversion() const
     {