Changeset 248798 in webkit for trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Timestamp:

Aug 16, 2019, 2:33:28 PM (6 years ago)

Author:

Justin Michaud

Message:

Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
​https://bugs.webkit.org/show_bug.cgi?id=200782

Reviewed by Saam Barati.

JSTests:

• microbenchmarks/int8-out-of-bounds.js: Added.

(foo):

• microbenchmarks/memcpy-typed-loop.js: Added.

(doTest):
(let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000):
(arr2):

• stress/int8-repeat-in-then-out-of-bounds.js: Added.

(foo):

Source/JavaScriptCore:

Speculate that putByVals on typed arrays are in bounds initially, and add an extra rule to integer range optimization to
remove CheckInBounds when we are looping over two arrays. We do this by fixing a bug in the llint slow paths that marked
typed array accesses as out of bounds, and we also add an extra step to integer range optimization to search for equality
relationships on the RHS value.

Microbenchmarks give a 40% improvement on the memcpy loop test, and neutral on the out-of-bounds typed array test.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:
• dfg/DFGOperations.cpp:

(JSC::DFG::putByVal):

• jit/JITOperations.cpp:
• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• runtime/JSGenericTypedArrayView.h:
• runtime/JSObject.h:

(JSC::JSObject::putByIndexInline):
(JSC::JSObject::canGetIndexQuickly const):
(JSC::JSObject::getIndexQuickly const):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::setIndexQuickly):

• runtime/JSObjectInlines.h:

(JSC::JSObject::canGetIndexQuicklyForTypedArray const):
(JSC::JSObject::canSetIndexQuicklyForTypedArray const):
(JSC::JSObject::getIndexQuicklyForTypedArray const):
(JSC::JSObject::setIndexQuicklyForTypedArray):

File:

• trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -275 +275 @@
         RELEASE_ASSERT(left != m_right);
         m_left = left;
+    }
+    void setRight(NodeFlowProjection right)
+    {
+        RELEASE_ASSERT(right != m_left);
+        m_right = right;
     }
     bool addToOffset(int offset)
@@ -1327 +1332 @@
                         }
                     }
+
+                    if (DFGIntegerRangeOptimizationPhaseInternal::verbose)
+                        dataLogLn("CheckInBounds ", node, " has: ", nonNegative, " ", lessThanLength);
                     
                     if (nonNegative && lessThanLength) {
@@ -1644 +1652 @@
             if (timeToLive && otherRelationship.kind() == Relationship::Equal) {
                 if (DFGIntegerRangeOptimizationPhaseInternal::verbose)
-                    dataLog("      Considering: ", otherRelationship, "\n");
+                    dataLog("      Considering (lhs): ", otherRelationship, "\n");
                 
                 // We have:
@@ -1665 +1673 @@
                     }
                 }
+            }
+        }
+
+        if (timeToLive && relationship.kind() != Relationship::Equal) {
+            for (Relationship& possibleEquality : relationshipMap.get(relationship.right())) {
+                if (possibleEquality.kind() != Relationship::Equal
+                    || possibleEquality.offset() == std::numeric_limits<int>::min()
+                    || possibleEquality.right() == relationship.left())
+                    continue;
+                if (DFGIntegerRangeOptimizationPhaseInternal::verbose)
+                    dataLog("      Considering (rhs): ", possibleEquality, "\n");
+
+                // We have:
+                //     @a op @b + C
+                //     @b == @c + D
+                //
+                // This implies:
+                //     @a op @c + (C + D)
+                //
+                // Where: @a == relationship.left(), @b == relationship.right()
+
+                Relationship newRelationship = relationship;
+                newRelationship.setRight(possibleEquality.right());
+                if (newRelationship.addToOffset(possibleEquality.offset()))
+                    toAdd.append(newRelationship);
             }
         }