[DFG] Introduce ArrayUse
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 16 Sep 2016 21:17:33 +0000 (21:17 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 16 Sep 2016 21:17:33 +0000 (21:17 +0000)
commit138d7ecd1ad7e52bf73eb1399f5f1c462c315925
tree8381eb7578d418fc2692952dc40eaf65497e7027
parent1e7c6e850c99c300ece6357cfb45283215078c94
[DFG] Introduce ArrayUse
https://bugs.webkit.org/show_bug.cgi?id=162063

Reviewed by Keith Miller.

ArrayUse is particularly useful: for IsJSArray.
We can drop IsJSArray in fixup phase by setting ArrayUse edge filter.

Since @isJSArray user is limited (Array.prototype.concat), the effect of this patch is small.
But later, I'll update {@isArray, Array.isArray} to use @isJSArray[1]. In that patch, we are planning
to implement more aggressive optimization like, setting CellUse edge filter to avoid cell check in
SpeculativeJIT::compileIsJSArray.

In the benchmark using Array.prototype.concat, we can see perf improvement since we can drop IsJSArray in fixup phase.

                                             baseline                  patched

    lazy-array-species-watchpoints       25.0911+-0.0516     ^     24.7687+-0.0767        ^ definitely 1.0130x faster

[1]: https://bugs.webkit.org/show_bug.cgi?id=162000

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateArray):
(JSC::DFG::SpeculativeJIT::speculate):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGUseKind.cpp:
(WTF::printInternal):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateArray):
(JSC::FTL::DFG::LowerDFGToB3::speculateObject): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@206047 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGSafeToExecute.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGUseKind.cpp
Source/JavaScriptCore/dfg/DFGUseKind.h
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp