Changeset 34964 in webkit for trunk/JavaScriptCore

Timestamp:

Jul 2, 2008, 5:47:00 PM (17 years ago)

Author:

[email protected]

Message:

2008-07-02 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

Optimized a[n] get for cases where a is an array or a string, and a[n]
put for cases where a is an array.

SunSpider says 9.0% faster.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• VM/Machine.cpp (modified) (4 diffs)
• VM/Machine.h (modified) (3 diffs)
• kjs/JSArray.cpp (modified) (2 diffs)
• kjs/JSArray.h (modified) (2 diffs)
• kjs/JSCell.h (modified) (3 diffs)
• kjs/JSString.h (modified) (1 diff)
• kjs/JSValue.h (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-07-02  Geoffrey Garen  <[email protected]>
+
+        Reviewed by Oliver Hunt.
+
+        Optimized a[n] get for cases where a is an array or a string, and a[n]
+        put for cases where a is an array.
+        
+        SunSpider says 9.0% faster.
+
 2008-07-02  Kevin McCullough  <[email protected]>
 

trunk/JavaScriptCore/VM/Machine.cpp

@@ -46 +46 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
+#include "collector.h"
 #include "debugger.h"
 #include "operations.h"
@@ -476 +477 @@
 {
     privateExecute(InitializeAndReturn);
+    
+    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
+    void* storage = fastMalloc(sizeof(CollectorBlock));
+
+    JSArray* jsArray = new (storage) JSArray(jsNull(), 0);
+    m_jsArrayVptr = jsArray->vptr();
+    jsArray->~JSCell();
+
+    JSString* jsString = new (storage) JSString("");
+    m_jsStringVptr = jsString->vptr();
+    jsString->~JSCell();
+    
+    fastFree(storage);
 }
 
@@ -1835 +1849 @@
 
         bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-        if (LIKELY(isUInt32))
-            result = baseValue->get(exec, i);
-        else {
+        if (LIKELY(isUInt32)) {
+            if (isJSArray(baseValue)) {
+                JSArray* jsArray = static_cast<JSArray*>(baseValue);
+                if (jsArray->canGetIndex(i))
+                    result = jsArray->getIndex(i);
+                else
+                    result = jsArray->JSArray::get(exec, i);
+            } else if (isJSString(baseValue) && static_cast<JSString*>(baseValue)->canGetIndex(i))
+                result = static_cast<JSString*>(baseValue)->getIndex(exec, i);
+            else
+                result = baseValue->get(exec, i);
+        } else {
             Identifier property(exec, subscript->toString(exec));
             result = baseValue->get(exec, property);
@@ -1868 +1891 @@
 
         bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-        if (LIKELY(isUInt32))
-            baseValue->put(exec, i, r[value].u.jsValue);
-        else {
+        if (LIKELY(isUInt32)) {
+            if (isJSArray(baseValue)) {
+                JSArray* jsArray = static_cast<JSArray*>(baseValue);
+                if (jsArray->canSetIndex(i))
+                    jsArray->setIndex(i, r[value].u.jsValue);
+                else
+                    jsArray->JSArray::put(exec, i, r[value].u.jsValue);
+            } else
+                baseValue->put(exec, i, r[value].u.jsValue);
+        } else {
             Identifier property(exec, subscript->toString(exec));
             if (!exec->hadException()) // Don't put to an object if toString threw an exception.

trunk/JavaScriptCore/VM/Machine.h

@@ -30 +30 @@
 #define Machine_h
 
+#include "JSCell.h"
+#include "JSValue.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
@@ -141 +143 @@
         void resetTimeoutCheck();
 
+        bool isJSArray(JSValue* v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsArrayVptr; }
+        bool isJSString(JSValue* v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsStringVptr; }
+        
         int m_reentryDepth;
         unsigned m_timeoutTime;
@@ -149 +154 @@
 
         RegisterFile m_registerFile;
+        
+        void* m_jsArrayVptr;
+        void* m_jsStringVptr;
 
 #if HAVE(COMPUTED_GOTO)

trunk/JavaScriptCore/kjs/JSArray.cpp

@@ -35 +35 @@
 namespace KJS {
 
-typedef HashMap<unsigned, JSValue*> SparseArrayValueMap;
-
-struct ArrayStorage {
-    unsigned m_vectorLength;
-    unsigned m_numValuesInVector;
-    SparseArrayValueMap* m_sparseValueMap;
-    void* lazyCreationData; // An JSArray subclass can use this to fill the vector lazily.
-    JSValue* m_vector[1];
-};
-
 // 0xFFFFFFFF is a bit weird -- is not an array index even though it's an integer.
 static const unsigned maxArrayIndex = 0xFFFFFFFEU;
@@ -82 +72 @@
 #endif
 
-JSArray::JSArray(JSObject* prototype, unsigned initialLength)
+JSArray::JSArray(JSValue* prototype, unsigned initialLength)
     : JSObject(prototype)
 {

trunk/JavaScriptCore/kjs/JSArray.h

@@ -27 +27 @@
 namespace KJS {
 
-  struct ArrayStorage;
+  typedef HashMap<unsigned, JSValue*> SparseArrayValueMap;
+
+  struct ArrayStorage {
+      unsigned m_vectorLength;
+      unsigned m_numValuesInVector;
+      SparseArrayValueMap* m_sparseValueMap;
+      void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
+      JSValue* m_vector[1];
+  };
 
   class JSArray : public JSObject {
   public:
-    JSArray(JSObject* prototype, unsigned initialLength);
+    JSArray(JSValue* prototype, unsigned initialLength);
     JSArray(JSObject* prototype, const ArgList& initialValues);
     virtual ~JSArray();
@@ -46 +54 @@
     void sort(ExecState*);
     void sort(ExecState*, JSValue* compareFunction, CallType, const CallData&);
+
+    bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
+    JSValue* getIndex(unsigned i)
+    {
+        ASSERT(canGetIndex(i));
+        return m_storage->m_vector[i];
+    }
+
+    bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
+    JSValue* setIndex(unsigned i, JSValue* v)
+    {
+        ASSERT(canSetIndex(i));
+        return m_storage->m_vector[i] = v;
+    }
 
   protected:

trunk/JavaScriptCore/kjs/JSCell.h

@@ -37 +37 @@
     friend class JSNumberCell;
     friend class JSString;
+    friend class Machine;
 private:
     JSCell();
@@ -75 +76 @@
     // Garbage collection.
     void* operator new(size_t, ExecState*);
+    void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
     virtual void mark();
     bool marked() const;
@@ -89 +91 @@
     virtual JSString* toThisJSString(ExecState*);
     virtual JSValue* getJSNumber();
+    void* vptr() { return *reinterpret_cast<void**>(this); }
 
 private:

trunk/JavaScriptCore/kjs/JSString.h

@@ -43 +43 @@
     bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
     bool getStringPropertySlot(unsigned propertyName, PropertySlot&);
+
+    bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
+    JSValue* getIndex(ExecState* exec, unsigned i)
+    {
+        ASSERT(canGetIndex(i));
+        return new (exec) JSString(m_value.substr(i, 1));
+    }
 
   private:

trunk/JavaScriptCore/kjs/JSValue.h

@@ -53 +53 @@
     friend class JSCell; // so it can derive from this class
     friend class Heap; // so it can call asCell()
+    friend class Machine; // so it can call asCell()
 private:
     JSValue();