[DFG] Add ArrayIndexOf intrinsic
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 12 Jun 2017 03:58:23 +0000 (03:58 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 12 Jun 2017 03:58:23 +0000 (03:58 +0000)
commit8619718b3834517e1268682b07727fae03960ef5
treeb45a805d2fb3d489bd203b80fdc38d56fff43320
parent7758ded7da9c0c3a4f91d63cb0b996f6f43447d6
[DFG] Add ArrayIndexOf intrinsic
https://bugs.webkit.org/show_bug.cgi?id=172421

Reviewed by Saam Barati.

JSTests:

* stress/array-indexof-array-prototype-change.js: Added.
(shouldBe):
(indexOfInt32):
* stress/array-indexof-have-a-bad-time-getter.js: Added.
(shouldBe):
(indexOfInt32):
* stress/array-indexof-have-a-bad-time.js: Added.
(shouldBe):
(indexOfInt32):
* stress/array-indexof-hole-with-prototype.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof-hole.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof-index.js: Added.
(shouldBe):
(indexOfInt32):
(indexOfDouble):
(indexOfString):
(indexOfObject):
(indexOfValue):
* stress/array-indexof-negative-index.js: Added.
(shouldBe):
(indexOfInt32):
(indexOfDouble):
(indexOfString):
(indexOfObject):
(indexOfValue):
* stress/array-indexof-non-int32-start-index.js: Added.
(shouldBe):
(indexOf):
(object.valueOf):
* stress/array-indexof-object-prototype-change.js: Added.
(shouldBe):
(indexOfInt32):
* stress/array-indexof-object.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof-original-array.js: Added.
(shouldBe):
(indexOfInt32):
* stress/array-indexof-string.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof-structure-change-convert.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof-structure-change.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof.js: Added.
(shouldBe):
(indexOf):

Source/JavaScriptCore:

This patch introduces ArrayIndexOfInstrinsic for DFG and FTL optimizations.
We emit array check and go fast path if the array is Array::Int32, Array::Double
or Array::Continugous. In addition, for Array::Int32 and Array::Double case,
we have inlined fast paths.

With updated ARES-6 Babylon,

Before
    firstIteration:     45.76 +- 3.87 ms
    averageWorstCase:   24.41 +- 2.17 ms
    steadyState:        8.01 +- 0.22 ms
After
    firstIteration:     45.64 +- 4.23 ms
    averageWorstCase:   23.03 +- 3.34 ms
    steadyState:        7.33 +- 0.34 ms

In SixSpeed.
                                 baseline                  patched

    map-set-lookup.es5      734.4701+-10.4383    ^    102.0968+-2.6357        ^ definitely 7.1939x faster
    map-set.es5              41.1396+-1.0558     ^     33.1916+-0.7986        ^ definitely 1.2395x faster
    map-set-object.es5       62.8317+-1.2518     ^     45.6944+-0.8369        ^ definitely 1.3750x faster

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasArrayMode):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArrayIndexOf):
(JSC::DFG::SpeculativeJIT::speculateObject):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::speculateInt32):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOf):
* jit/JITOperations.h:
* runtime/ArrayPrototype.cpp:
(JSC::ArrayPrototype::finishCreation):
* runtime/Intrinsic.cpp:
(JSC::intrinsicName):
* runtime/Intrinsic.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@218084 268f45cc-cd09-0410-ab3c-d52691b4dbfc
38 files changed:
JSTests/ChangeLog
JSTests/stress/array-indexof-array-prototype-change.js [new file with mode: 0644]
JSTests/stress/array-indexof-have-a-bad-time-getter.js [new file with mode: 0644]
JSTests/stress/array-indexof-have-a-bad-time.js [new file with mode: 0644]
JSTests/stress/array-indexof-hole-with-prototype.js [new file with mode: 0644]
JSTests/stress/array-indexof-hole.js [new file with mode: 0644]
JSTests/stress/array-indexof-index.js [new file with mode: 0644]
JSTests/stress/array-indexof-negative-index.js [new file with mode: 0644]
JSTests/stress/array-indexof-non-int32-start-index.js [new file with mode: 0644]
JSTests/stress/array-indexof-object-prototype-change.js [new file with mode: 0644]
JSTests/stress/array-indexof-object.js [new file with mode: 0644]
JSTests/stress/array-indexof-original-array.js [new file with mode: 0644]
JSTests/stress/array-indexof-string.js [new file with mode: 0644]
JSTests/stress/array-indexof-structure-change-convert.js [new file with mode: 0644]
JSTests/stress/array-indexof-structure-change.js [new file with mode: 0644]
JSTests/stress/array-indexof.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGDoesGC.cpp
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGNode.h
Source/JavaScriptCore/dfg/DFGNodeType.h
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
Source/JavaScriptCore/dfg/DFGSafeToExecute.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Source/JavaScriptCore/jit/JITOperations.h
Source/JavaScriptCore/runtime/ArrayPrototype.cpp
Source/JavaScriptCore/runtime/Intrinsic.cpp
Source/JavaScriptCore/runtime/Intrinsic.h