Add a Int-or-Boolean speculation to Branch
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 18 May 2015 20:41:54 +0000 (20:41 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 18 May 2015 20:41:54 +0000 (20:41 +0000)
https://bugs.webkit.org/show_bug.cgi?id=145134

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

After https://bugs.webkit.org/show_bug.cgi?id=126778 we no longer have a reason not to do the
int-or-boolean optimization that we already do everywhere else.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

LayoutTests:

Added the reduced asm.js test case from https://bugs.webkit.org/show_bug.cgi?id=144136. We don't yet
run it as fast as we should but this is a big step.

* js/regress/script-tests/slow-ternaries.js: Added.
(.f):
(asmMod):
* js/regress/slow-ternaries-expected.txt: Added.
* js/regress/slow-ternaries.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184510 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/js/regress/script-tests/slow-ternaries.js [new file with mode: 0644]
LayoutTests/js/regress/slow-ternaries-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/slow-ternaries.html [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

index f6553b6..eccc86b 100644 (file)
@@ -1,3 +1,19 @@
+2015-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a Int-or-Boolean speculation to Branch
+        https://bugs.webkit.org/show_bug.cgi?id=145134
+
+        Reviewed by Benjamin Poulain.
+        
+        Added the reduced asm.js test case from https://bugs.webkit.org/show_bug.cgi?id=144136. We don't yet
+        run it as fast as we should but this is a big step.
+
+        * js/regress/script-tests/slow-ternaries.js: Added.
+        (.f):
+        (asmMod):
+        * js/regress/slow-ternaries-expected.txt: Added.
+        * js/regress/slow-ternaries.html: Added.
+
 2015-05-17  Benjamin Poulain  <benjamin@webkit.org>
 
         [JSC] Make StringRecursionChecker faster in the simple cases without any recursion
diff --git a/LayoutTests/js/regress/script-tests/slow-ternaries.js b/LayoutTests/js/regress/script-tests/slow-ternaries.js
new file mode 100644 (file)
index 0000000..7ef2464
--- /dev/null
@@ -0,0 +1,16 @@
+var asmMod = function test (glob, env, b) {
+  'use asm';
+  const i8 = new glob.Int8Array(b);
+  function f() {
+    var i = 0; var r = 0;
+    for (i = 0; (i | 0) < 3000000; i = (i + 1) | 0) {
+      if ((i8[(i & 0xff) >> 0] | 0) == 1 ? ((i8[((i & 0xff) + 1) >> 0] | 0) == 2 ? ((i8[((i & 0xff) + 2) >> 0] | 0) == 3 ? (i8[((i & 0xff) + 3) >> 0] | 0) == 4 : 0) : 0) : 0)
+        r = 1;
+    }
+    return r | 0;
+  }
+  return f;
+};
+var buffer1 = new ArrayBuffer(64*1024);
+var asm1 = asmMod(this, {}, buffer1);
+for (var i = 0; i < 5; i++) asm1();
diff --git a/LayoutTests/js/regress/slow-ternaries-expected.txt b/LayoutTests/js/regress/slow-ternaries-expected.txt
new file mode 100644 (file)
index 0000000..035c73a
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/slow-ternaries
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/slow-ternaries.html b/LayoutTests/js/regress/slow-ternaries.html
new file mode 100644 (file)
index 0000000..5ae320e
--- /dev/null
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/slow-ternaries.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
index b2f73c5..7778ba0 100644 (file)
@@ -1,3 +1,16 @@
+2015-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a Int-or-Boolean speculation to Branch
+        https://bugs.webkit.org/show_bug.cgi?id=145134
+
+        Reviewed by Benjamin Poulain.
+        
+        After https://bugs.webkit.org/show_bug.cgi?id=126778 we no longer have a reason not to do the
+        int-or-boolean optimization that we already do everywhere else.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
 2015-05-18  Andreas Kling  <akling@apple.com>
 
         [JSC] Speed up URL encode/decode by using bitmaps instead of strchr().
index 0a89a88..ecdeb7b 100644 (file)
@@ -786,11 +786,8 @@ private:
                 fixEdge<BooleanUse>(node->child1());
             else if (node->child1()->shouldSpeculateObjectOrOther())
                 fixEdge<ObjectOrOtherUse>(node->child1());
-            // FIXME: We should just be able to do shouldSpeculateInt32OrBoolean() and
-            // shouldSpeculateNumberOrBoolean() here now that
-            // https://bugs.webkit.org/show_bug.cgi?id=126778 is fixed.
-            else if (node->child1()->shouldSpeculateInt32())
-                fixEdge<Int32Use>(node->child1());
+            else if (node->child1()->shouldSpeculateInt32OrBoolean())
+                fixIntOrBooleanEdge(node->child1());
             else if (node->child1()->shouldSpeculateNumber())
                 fixEdge<DoubleRepUse>(node->child1());
             else if (node->child1()->shouldSpeculateString())