FTL should support CompareEq(String:, String:)

https://bugs.webkit.org/show_bug.cgi?id=154269
rdar://problem/24499921

Reviewed by Benjamin Poulain.

Looks like a slight pdfjs slow-down, probably because we're having some recompilations. I
think we should land the increased coverage first and fix the issues after, especially since
the regression is so small and doesn't have a statistically significant effect on the overall
score.

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
(JSC::FTL::DFG::LowerDFGToLLVM::stringsEqual):
* tests/stress/ftl-string-equality.js: Added.
* tests/stress/ftl-string-ident-equality.js: Added.
* tests/stress/ftl-string-strict-equality.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@196685 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index dbd72c5..871e7bb 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,29 @@
 2016-02-16  Filip Pizlo  <fpizlo@apple.com>
 
+        FTL should support CompareEq(String:, String:)
+        https://bugs.webkit.org/show_bug.cgi?id=154269
+        rdar://problem/24499921
+
+        Reviewed by Benjamin Poulain.
+
+        Looks like a slight pdfjs slow-down, probably because we're having some recompilations. I
+        think we should land the increased coverage first and fix the issues after, especially since
+        the regression is so small and doesn't have a statistically significant effect on the overall
+        score.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
+        (JSC::FTL::DFG::LowerDFGToLLVM::stringsEqual):
+        * tests/stress/ftl-string-equality.js: Added.
+        * tests/stress/ftl-string-ident-equality.js: Added.
+        * tests/stress/ftl-string-strict-equality.js: Added.
+
+2016-02-16  Filip Pizlo  <fpizlo@apple.com>
+
         FTL should support NewTypedArray
         https://bugs.webkit.org/show_bug.cgi?id=154268
 

diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
index c62bbe8..8348dcc 100644 (file)
--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
@@ -337,6 +337,8 @@ inline CapabilityLevel canCompile(Node* node)
             break;
         if (node->isBinaryUseKind(StringIdentUse))
             break;
+        if (node->isBinaryUseKind(StringUse))
+            break;
         if (node->isBinaryUseKind(SymbolUse))
             break;
         if (node->isBinaryUseKind(ObjectUse))
@@ -361,6 +363,8 @@ inline CapabilityLevel canCompile(Node* node)
             break;
         if (node->isBinaryUseKind(StringIdentUse))
             break;
+        if (node->isBinaryUseKind(StringUse))
+            break;
         if (node->isBinaryUseKind(ObjectUse, UntypedUse))
             break;
         if (node->isBinaryUseKind(UntypedUse, ObjectUse))

diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
index 5d98f68..c31399e 100644 (file)
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
@@ -4920,7 +4920,8 @@ private:
             || m_node->isBinaryUseKind(ObjectUse)
             || m_node->isBinaryUseKind(BooleanUse)
             || m_node->isBinaryUseKind(SymbolUse)
-            || m_node->isBinaryUseKind(StringIdentUse)) {
+            || m_node->isBinaryUseKind(StringIdentUse)
+            || m_node->isBinaryUseKind(StringUse)) {
             compileCompareStrictEq();
             return;
         }
@@ -4987,6 +4988,31 @@ private:
             return;
         }
 
+        if (m_node->isBinaryUseKind(StringUse)) {
+            LValue left = lowCell(m_node->child1());
+            LValue right = lowCell(m_node->child2());
+
+            LBasicBlock notTriviallyEqualCase = FTL_NEW_BLOCK(m_out, ("CompareStrictEq/String not trivially equal case"));
+            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CompareStrictEq/String continuation"));
+
+            speculateString(m_node->child1(), left);
+
+            ValueFromBlock fastResult = m_out.anchor(m_out.booleanTrue);
+            m_out.branch(
+                m_out.equal(left, right), unsure(continuation), unsure(notTriviallyEqualCase));
+
+            LBasicBlock lastNext = m_out.appendTo(notTriviallyEqualCase, continuation);
+
+            speculateString(m_node->child2(), right);
+            
+            ValueFromBlock slowResult = m_out.anchor(stringsEqual(left, right));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setBoolean(m_out.phi(m_out.boolean, fastResult, slowResult));
+            return;
+        }
+
         if (m_node->isBinaryUseKind(ObjectUse, UntypedUse)) {
             setBoolean(
                 m_out.equal(
@@ -7701,6 +7727,107 @@ private:
         setBoolean(m_out.phi(m_out.boolean, fastResult, slowResult));
     }
 
+    LValue stringsEqual(LValue leftJSString, LValue rightJSString)
+    {
+        LBasicBlock notTriviallyUnequalCase = FTL_NEW_BLOCK(m_out, ("stringsEqual not trivially unequal case"));
+        LBasicBlock notEmptyCase = FTL_NEW_BLOCK(m_out, ("stringsEqual not empty case"));
+        LBasicBlock leftReadyCase = FTL_NEW_BLOCK(m_out, ("stringsEqual left ready case"));
+        LBasicBlock rightReadyCase = FTL_NEW_BLOCK(m_out, ("stringsEqual right ready case"));
+        LBasicBlock left8BitCase = FTL_NEW_BLOCK(m_out, ("stringsEqual left 8-bit case"));
+        LBasicBlock right8BitCase = FTL_NEW_BLOCK(m_out, ("stringsEqual right 8-bit case"));
+        LBasicBlock loop = FTL_NEW_BLOCK(m_out, ("stringsEqual loop"));
+        LBasicBlock bytesEqual = FTL_NEW_BLOCK(m_out, ("stringsEqual bytes equal"));
+        LBasicBlock trueCase = FTL_NEW_BLOCK(m_out, ("stringsEqual true case"));
+        LBasicBlock falseCase = FTL_NEW_BLOCK(m_out, ("stringsEqual false case"));
+        LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("stringsEqual slow case"));
+        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("stringsEqual continuation"));
+
+        LValue length = m_out.load32(leftJSString, m_heaps.JSString_length);
+
+        m_out.branch(
+            m_out.notEqual(length, m_out.load32(rightJSString, m_heaps.JSString_length)),
+            unsure(falseCase), unsure(notTriviallyUnequalCase));
+
+        LBasicBlock lastNext = m_out.appendTo(notTriviallyUnequalCase, notEmptyCase);
+
+        m_out.branch(m_out.isZero32(length), unsure(trueCase), unsure(notEmptyCase));
+
+        m_out.appendTo(notEmptyCase, leftReadyCase);
+
+        LValue left = m_out.loadPtr(leftJSString, m_heaps.JSString_value);
+        LValue right = m_out.loadPtr(rightJSString, m_heaps.JSString_value);
+
+        m_out.branch(m_out.notNull(left), usually(leftReadyCase), rarely(slowCase));
+
+        m_out.appendTo(leftReadyCase, rightReadyCase);
+        
+        m_out.branch(m_out.notNull(right), usually(rightReadyCase), rarely(slowCase));
+
+        m_out.appendTo(rightReadyCase, left8BitCase);
+
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(left, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(slowCase), unsure(left8BitCase));
+
+        m_out.appendTo(left8BitCase, right8BitCase);
+
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(right, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(slowCase), unsure(right8BitCase));
+
+        m_out.appendTo(right8BitCase, loop);
+
+        LValue leftData = m_out.loadPtr(left, m_heaps.StringImpl_data);
+        LValue rightData = m_out.loadPtr(right, m_heaps.StringImpl_data);
+
+        ValueFromBlock indexAtStart = m_out.anchor(length);
+
+        m_out.jump(loop);
+
+        m_out.appendTo(loop, bytesEqual);
+
+        LValue indexAtLoopTop = m_out.phi(m_out.int32, indexAtStart);
+        LValue indexInLoop = m_out.sub(indexAtLoopTop, m_out.int32One);
+
+        LValue leftByte = m_out.load8ZeroExt32(
+            m_out.baseIndex(m_heaps.characters8, leftData, m_out.zeroExtPtr(indexInLoop)));
+        LValue rightByte = m_out.load8ZeroExt32(
+            m_out.baseIndex(m_heaps.characters8, rightData, m_out.zeroExtPtr(indexInLoop)));
+
+        m_out.branch(m_out.notEqual(leftByte, rightByte), unsure(falseCase), unsure(bytesEqual));
+
+        m_out.appendTo(bytesEqual, trueCase);
+
+        ValueFromBlock indexForNextIteration = m_out.anchor(indexInLoop);
+        m_out.addIncomingToPhi(indexAtLoopTop, indexForNextIteration);
+        m_out.branch(m_out.notZero32(indexInLoop), unsure(loop), unsure(trueCase));
+
+        m_out.appendTo(trueCase, falseCase);
+        
+        ValueFromBlock trueResult = m_out.anchor(m_out.booleanTrue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(falseCase, slowCase);
+
+        ValueFromBlock falseResult = m_out.anchor(m_out.booleanFalse);
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowCase, continuation);
+
+        LValue slowResultValue = vmCall(
+            m_out.int64, m_out.operation(operationCompareStringEq), m_callFrame,
+            leftJSString, rightJSString);
+        ValueFromBlock slowResult = m_out.anchor(unboxBoolean(slowResultValue));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(m_out.boolean, trueResult, falseResult, slowResult);
+    }
+
 #if FTL_USES_B3
     enum ScratchFPRUsage {
         DontNeedScratchFPR,

diff --git a/Source/JavaScriptCore/tests/stress/ftl-string-equality.js b/Source/JavaScriptCore/tests/stress/ftl-string-equality.js
new file mode 100644 (file)
index 0000000..3f803e6
--- /dev/null
+++ b/Source/JavaScriptCore/tests/stress/ftl-string-equality.js
@@ -0,0 +1,35 @@
+function makeString(char) {
+    var result = "";
+    for (var i = 0; i < 10; ++i)
+        result += char;
+    return result;
+}
+
+var array = [ "a", "b", "c", "d" ];
+
+for (var i = 0; i < array.length; ++i)
+    array[i] = makeString(array[i]);
+
+function foo(array, s) {
+    for (var i = 0; i < array.length; ++i) {
+        if (array[i] == s)
+            return i;
+    }
+    return null;
+}
+
+noInline(foo);
+
+var array2 = [ "a", "b", "c", "d", "e" ];
+
+for (var i = 0; i < array2.length; ++i)
+    array2[i] = makeString(array2[i]);
+
+for (var i = 0; i < 100000; ++i) {
+    var index = i % array2.length;
+    var result = foo(array, array2[index]);
+    var expected = index >= array.length ? null : index
+    if (result !== expected)
+        throw "Error: bad result: " + result;
+}
+

diff --git a/Source/JavaScriptCore/tests/stress/ftl-string-ident-equality.js b/Source/JavaScriptCore/tests/stress/ftl-string-ident-equality.js
new file mode 100644 (file)
index 0000000..ccb36d8
--- /dev/null
+++ b/Source/JavaScriptCore/tests/stress/ftl-string-ident-equality.js
@@ -0,0 +1,18 @@
+var array = [ "a", "b", "c", "d" ];
+
+function foo(array, s) {
+    for (var i = 0; i < array.length; ++i) {
+        if (array[i] == s)
+            return true;
+    }
+    return false;
+}
+
+noInline(foo);
+
+var result = 0;
+for (var i = 0; i < 100000; ++i)
+    result += foo(array, "d");
+
+if (result != 100000)
+    throw "Bad result: " + result;

diff --git a/Source/JavaScriptCore/tests/stress/ftl-string-strict-equality.js b/Source/JavaScriptCore/tests/stress/ftl-string-strict-equality.js
new file mode 100644 (file)
index 0000000..043a760
--- /dev/null
+++ b/Source/JavaScriptCore/tests/stress/ftl-string-strict-equality.js
@@ -0,0 +1,35 @@
+function makeString(char) {
+    var result = "";
+    for (var i = 0; i < 10; ++i)
+        result += char;
+    return result;
+}
+
+var array = [ "a", "b", "c", "d" ];
+
+for (var i = 0; i < array.length; ++i)
+    array[i] = makeString(array[i]);
+
+function foo(array, s) {
+    for (var i = 0; i < array.length; ++i) {
+        if (array[i] === s)
+            return i;
+    }
+    return null;
+}
+
+noInline(foo);
+
+var array2 = [ "a", "b", "c", "d", "e" ];
+
+for (var i = 0; i < array2.length; ++i)
+    array2[i] = makeString(array2[i]);
+
+for (var i = 0; i < 100000; ++i) {
+    var index = i % array2.length;
+    var result = foo(array, array2[index]);
+    var expected = index >= array.length ? null : index
+    if (result !== expected)
+        throw "Error: bad result: " + result;
+}
+