[DOMJIT] Add DOMJIT::Signature annotation to Document::getElementById
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 5 Nov 2016 01:15:17 +0000 (01:15 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 5 Nov 2016 01:15:17 +0000 (01:15 +0000)
commitfcb587ba3287423fd80bb075862d7d9cff713b7b
tree48273d3c06d072c866c74ab6ca605dc2da950b88
parent2766f2137b76f8cf1c0b386d417a635e935e9300
[DOMJIT] Add DOMJIT::Signature annotation to Document::getElementById
https://bugs.webkit.org/show_bug.cgi?id=164356

Reviewed by Filip Pizlo.

Source/WebCore:

This patch implements DOMJIT::Signature annotation for getElementById.
Since getElementById is also implemented in DocumentFragment, we implement
the branchIfDocumentFragment/branchIfNotDocumentFragment for that.

In dromaeo, we have a test like this.

test( "getElementById", function(){
    for ( var i = 0; i < num * 30; i++ ) {
        ret = document.getElementById("testA" + num).nodeType;
        ret = document.getElementById("testB" + num).nodeType;
        ret = document.getElementById("testC" + num).nodeType;
        ret = document.getElementById("testD" + num).nodeType;
        ret = document.getElementById("testE" + num).nodeType;
        ret = document.getElementById("testF" + num).nodeType;
    }
});

In the above test, JSC already knows the following things.

1. Since nodeType is now handled as CallDOMGetter, we know that it is pure.
2. getElementById look up becomes PureGetById since document is impure object. But it is kept as PureGetById. So it does not write DOMState.
3. `"testA" + num` will be converted to constant string.
4. CallDOM for getElementById said it just reads(DOMState:DOM). And it saids that it returns the same value as long as DOMState is not clobbered.
5. CheckCell leading CallDOM ensures the inlined getElementById node. (CallDOM node).

The key thing is that no node clobbers DOMState during the loop. So CallDOM & CallDOMGetter can be hoisted.
This improves dom-query significantly. Dromaeo dom-query getElementById becomes 40x faster (247796 v.s. 6197).
Dromaeo dom-query getElementById (not in document) becomes 89x faster (630317.8 v.s. 7066.).

Tests: js/dom/domjit-function-get-element-by-id-changed.html
       js/dom/domjit-function-get-element-by-id-licm.html
       js/dom/domjit-function-get-element-by-id.html

* dom/NonElementParentNode.idl:
* domjit/DOMJITCheckDOM.h:
(WebCore::DOMJIT::TypeChecker<DocumentFragment>::branchIfFail):
* domjit/DOMJITHelpers.h:
(WebCore::DOMJIT::branchIfDocumentFragment):
(WebCore::DOMJIT::branchIfNotDocumentFragment):

LayoutTests:

* js/dom/domjit-function-get-element-by-id-changed-expected.txt: Added.
* js/dom/domjit-function-get-element-by-id-changed.html: Added.
* js/dom/domjit-function-get-element-by-id-expected.txt: Added.
* js/dom/domjit-function-get-element-by-id-licm-expected.txt: Added.
* js/dom/domjit-function-get-element-by-id-licm.html: Added.
* js/dom/domjit-function-get-element-by-id.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@208412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/js/dom/domjit-function-get-element-by-id-changed-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/domjit-function-get-element-by-id-changed.html [new file with mode: 0644]
LayoutTests/js/dom/domjit-function-get-element-by-id-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/domjit-function-get-element-by-id-licm-expected.txt [new file with mode: 0644]
LayoutTests/js/dom/domjit-function-get-element-by-id-licm.html [new file with mode: 0644]
LayoutTests/js/dom/domjit-function-get-element-by-id.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/NonElementParentNode.idl
Source/WebCore/domjit/DOMJITCheckDOM.h
Source/WebCore/domjit/DOMJITHelpers.h