ConvertThis should be turned into Identity based on predictions in Fixup, rather...
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Mar 2013 09:04:57 +0000 (09:04 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Mar 2013 09:04:57 +0000 (09:04 +0000)
commit4db11e5b48f72fe71cee33652380161a299612e9
treeaa7da20a81ec3182dd7a56feb6c99f01fd8c740f
parent6fc41e01fb51c9bb75a7dfe0540b936020ef9478
ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding
https://bugs.webkit.org/show_bug.cgi?id=111674

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup
convert them to either Identity(Object:@child) if the child is predicted object, or
Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other.

The goal of this is to ensure that the optimization fixpoint doesn't create
Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up
but I'm hoping this will be a step towards reducing the need to rerun the fixpoint
so as to ultimately reduce compile times.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::executeEffects):
* dfg/DFGAssemblyHelpers.h:
(AssemblyHelpers):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::globalThisObjectFor):
(Graph):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::convertToIdentity):
(JSC::DFG::Node::convertToWeakConstant):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Oliver Hunt.

* fast/js/dfg-convert-this-object-then-exit-on-other-expected.txt: Added.
* fast/js/dfg-convert-this-object-then-exit-on-other.html: Added.
* fast/js/dfg-convert-this-other-then-exit-on-object-expected.txt: Added.
* fast/js/dfg-convert-this-other-then-exit-on-object.html: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other-expected.txt: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other.html: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string-expected.txt: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-convert-this-object-then-exit-on-other.js: Added.
(foo):
* fast/js/script-tests/dfg-convert-this-other-then-exit-on-object.js: Added.
(foo):
* fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js: Added.
(foo):
* fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js: Added.
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@145052 268f45cc-cd09-0410-ab3c-d52691b4dbfc
23 files changed:
LayoutTests/ChangeLog
LayoutTests/fast/js/dfg-convert-this-object-then-exit-on-other-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-object-then-exit-on-other.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-other-then-exit-on-object-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-other-then-exit-on-object.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string.html [new file with mode: 0644]
LayoutTests/fast/js/jsc-test-list
LayoutTests/fast/js/script-tests/dfg-convert-this-object-then-exit-on-other.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-convert-this-other-then-exit-on-object.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractState.cpp
Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGGraph.h
Source/JavaScriptCore/dfg/DFGNode.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp