[DFG] DFG should handle String#toString
authoryusukesuzuki@slowstart.org <yusukesuzuki@slowstart.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 7 Sep 2018 19:44:48 +0000 (19:44 +0000)
committeryusukesuzuki@slowstart.org <yusukesuzuki@slowstart.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 7 Sep 2018 19:44:48 +0000 (19:44 +0000)
commitb04bb1fe7c4785a578aff691e89d727566ae7c5e
tree4b61585524e3be9958c4f6d08f5c37f7e85cb3b2
parentd33061d52dd8ab48ba0f637152b86e5533a3808f
[DFG] DFG should handle String#toString
https://bugs.webkit.org/show_bug.cgi?id=189151

Reviewed by Saam Barati.

JSTests:

The error message in String#toString and String#valueOf is poor, which will be
handled in a separate bug[1].

[1]: https://bugs.webkit.org/show_bug.cgi?id=189357

* microbenchmarks/string-object-to-string.js: Added.
(test):
* microbenchmarks/string-object-value-of.js: Added.
(test):
* stress/string-to-string-error.js: Added.
(shouldThrow):
(test):
* stress/string-to-string.js: Added.
(shouldBe):
(test1):
(test2):
(test3):
* stress/string-value-of-error.js: Added.
(shouldThrow):
(test):
* stress/string-value-of.js: Added.
(shouldBe):
(test1):
(test2):
(test3):

Source/JavaScriptCore:

We handle String#toString and String#valueOf in DFG by introducing StringValueOf node.
In the fixup phase, we attempt to lower StringValueOf to the existing ToString or Identity
nodes. If we fail to lower it, we have StringValueOf(UntypedUse), which may raise an error
if an argument is neither String nor StringObject. The error message in String#toString and
String#valueOf is poor, which will be handled in a separate bug[1].

It improves simple microbenchmarks by 53.4 - 67.6%.

                                      baseline                  patched

    string-object-to-string       21.7308+-3.3147     ^     12.9655+-0.0527        ^ definitely 1.6760x faster
    string-object-value-of        20.1122+-0.0691     ^     13.1134+-0.2482        ^ definitely 1.5337x faster

[1]: https://bugs.webkit.org/show_bug.cgi?id=189357

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupStringValueOf):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToToString):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf):
(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructor): Deleted.
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235790 268f45cc-cd09-0410-ab3c-d52691b4dbfc
27 files changed:
JSTests/ChangeLog
JSTests/microbenchmarks/string-object-to-string.js [new file with mode: 0644]
JSTests/microbenchmarks/string-object-value-of.js [new file with mode: 0644]
JSTests/stress/string-to-string-error.js [new file with mode: 0644]
JSTests/stress/string-to-string.js [new file with mode: 0644]
JSTests/stress/string-value-of-error.js [new file with mode: 0644]
JSTests/stress/string-value-of.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGDoesGC.cpp
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGNode.h
Source/JavaScriptCore/dfg/DFGNodeType.h
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
Source/JavaScriptCore/dfg/DFGSafeToExecute.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Source/JavaScriptCore/runtime/StringConstructor.cpp
Source/JavaScriptCore/runtime/StringConstructor.h