Changeset 154305 in webkit for trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

Timestamp:

Aug 19, 2013, 4:16:01 PM (12 years ago)

Author:

[email protected]

Message:

DFG should inline typedArray.byteOffset
​https://bugs.webkit.org/show_bug.cgi?id=119962

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

This adds a new node, GetTypedArrayByteOffset, which inlines
typedArray.byteOffset.

Also, I improved a bunch of the clobbering logic related to typed arrays
and clobbering in general. For example, PutByOffset/PutStructure are not
clobber-world so they can be handled by most default cases in CSE. Also,
It's better to use the 'Class_field' notation for typed arrays now that
they no longer involve magical descriptor thingies.

• bytecode/SpeculatedType.h:
• dfg/DFGAbstractHeap.h:
• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::::executeEffects):

• dfg/DFGArrayMode.h:

(JSC::DFG::neverNeedsStorage):

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::getByOffsetLoadElimination):
(JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::checkArrayElimination):
(JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
(JSC::DFG::FixupPhase::convertToGetArrayLength):
(JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):

• dfg/DFGNodeType.h:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):

• runtime/ArrayBuffer.h:

(JSC::ArrayBuffer::offsetOfData):

• runtime/Butterfly.h:

(JSC::Butterfly::offsetOfArrayBuffer):

• runtime/IndexingHeader.h:

(JSC::IndexingHeader::offsetOfArrayBuffer):

LayoutTests:

Reviewed by Oliver Hunt.

• fast/js/dfg-byteOffset-neuter.html: Added.
• fast/js/dfg-byteOffset-neuter-expected.txt: Added.
• fast/js/regress/ArrayBuffer-Int32Array-byteOffset-expected.txt: Added.
• fast/js/regress/ArrayBuffer-Int32Array-byteOffset.html: Added.
• fast/js/regress/script-tests/ArrayBuffer-Int32Array-byteOffset.js: Added.
• fast/js/script-tests/dfg-byteOffset-neuter.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (modified) (6 diffs)

trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

@@ -397 +397 @@
                 return 0;
             }
-            case PutStructure:
-            case PutByOffset:
-                // GetByVal currently always speculates that it's accessing an
-                // array with an integer index, which means that it's impossible
-                // for a structure change or a put to property storage to affect
-                // the GetByVal.
-                break;
             default:
                 if (m_graph.clobbersWorld(node))
@@ -635 +628 @@
                 break;
                 
-            case PutStructure:
-                // Changing the structure cannot change the outcome of a property get.
-                break;
-                
             case PutByVal:
             case PutByValAlias:
@@ -725 +714 @@
                 return 0;
                 
-            case PutByOffset:
-            case PutStructure:
-                // Changing the structure or putting to the storage cannot
-                // change the property storage pointer.
-                break;
-                
             case PutByVal:
             case PutByValAlias:
@@ -764 +747 @@
 
             switch (node->op()) {
-            case PutByOffset:
-            case PutStructure:
-                // Changing the structure or putting to the storage cannot
-                // change the property storage pointer.
-                break;
-                
             case CheckArray:
                 if (node->child1() == child1 && node->arrayMode() == arrayMode)
@@ -804 +781 @@
             }
 
-            case PutByOffset:
-            case PutStructure:
-                // Changing the structure or putting to the storage cannot
-                // change the property storage pointer.
-                break;
-                
+            default:
+                if (m_graph.clobbersWorld(node))
+                    return 0;
+                break;
+            }
+        }
+        return 0;
+    }
+    
+    Node* getTypedArrayByteOffsetLoadElimination(Node* child1)
+    {
+        for (unsigned i = m_indexInBlock; i--;) {
+            Node* node = m_currentBlock->at(i);
+            if (node == child1) 
+                break;
+
+            switch (node->op()) {
+            case GetTypedArrayByteOffset: {
+                if (node->child1() == child1)
+                    return node;
+                break;
+            }
+
             default:
                 if (m_graph.clobbersWorld(node))
@@ -1344 +1338 @@
             break;
         }
+            
+        case GetTypedArrayByteOffset: {
+            if (cseMode == StoreElimination)
+                break;
+            setReplacement(getTypedArrayByteOffsetLoadElimination(node->child1().node()));
+            break;
+        }
 
         case GetButterfly: