[DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be...
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 8 Sep 2017 15:36:05 +0000 (15:36 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 8 Sep 2017 15:36:05 +0000 (15:36 +0000)
commite68f7ba0981b7006deac0278fb66e3e1ffa40c84
treed1c4ecd05e7fa348aa659b0a7866e7b64d502fde
parent3080a3f47b1daae80262d684fe4fa935489cd8d9
[DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
https://bugs.webkit.org/show_bug.cgi?id=176590

Reviewed by Saam Barati.

JSTests:

* microbenchmarks/object-iterate-symbols.js: Added.
(test):
* microbenchmarks/object-iterate.js: Added.
(test):
* stress/object-iterate-symbols.js: Added.
(shouldBe):
(test):
* stress/object-iterate.js: Added.
(shouldBe):
(test):

Source/JavaScriptCore:

We add fixup edges for GetByVal(Array::Generic) to call faster operation instead of generic operationGetByVal.

                                 baseline                  patched

object-iterate                5.8531+-0.3029            5.7903+-0.2795          might be 1.0108x faster
object-iterate-symbols        7.4099+-0.3993     ^      5.8254+-0.2276        ^ definitely 1.2720x faster

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGOperations.cpp:
(JSC::DFG::getByValObject):
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString):
(JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221783 268f45cc-cd09-0410-ab3c-d52691b4dbfc
14 files changed:
JSTests/ChangeLog
JSTests/microbenchmarks/object-iterate-symbols.js [new file with mode: 0644]
JSTests/microbenchmarks/object-iterate.js [new file with mode: 0644]
JSTests/stress/object-iterate-symbols.js [new file with mode: 0644]
JSTests/stress/object-iterate.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp