[DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for...
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 18 Apr 2017 15:04:57 +0000 (15:04 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 18 Apr 2017 15:04:57 +0000 (15:04 +0000)
commit69d67961116647f4b8676953d93f8aee8b66da20
tree9b9ac92759a041317fddbf54b97871148f454599
parent48400cf9b8c9ceb1a6c52e5b8c8993a2eb331512
[DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
https://bugs.webkit.org/show_bug.cgi?id=170940

Reviewed by Filip Pizlo.

JSTests:

* microbenchmarks/for-of-array.js: Added.
(fn):

Source/JavaScriptCore:

The second argument of CheckCell is not used in meaningful way. It is just *use* the node.
The problem is that it effectively *use* the child2 in ObjectAllocationSinking phase, and
prevent us from eliminating object allocations. Actually, it materializes Array iterator
when inlining `next()`. Instead, we should use Phantom in such a case.

It improves destructuring.es6 in SixSpeed 2.5x.

destructuring.es6      308.5184+-25.3490    ^    119.5680+-15.0520       ^ definitely 2.5803x faster

Note that SixSpeed tested in arewefastyet executes all the tests in one process while our SixSpeed
tests each one in isolated way.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitFunctionChecks):
(JSC::DFG::ByteCodeParser::handleGetById):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@215459 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/microbenchmarks/for-of-array.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp