DFG doesn't support to_jsnumber

https://bugs.webkit.org/show_bug.cgi?id=115129

Reviewed by Geoffrey Garen.

Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
tell us to. Identity is later turned into Phantom.

Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
wrong; NodeDoesNotExit is not a backward propagation property.

Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).

This more than doubles the FPS on ammo.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.h:
(JSC::DFG::canCompileOpcode):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::observeUseKindOnEdge):
* dfg/DFGNodeFlags.h:
(DFG):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@149162 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 52d72f1..b7bd8b7 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,37 @@
+2013-04-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG doesn't support to_jsnumber
+        https://bugs.webkit.org/show_bug.cgi?id=115129
+
+        Reviewed by Geoffrey Garen.
+        
+        Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
+        an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
+        tell us to. Identity is later turned into Phantom.
+        
+        Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
+        wrong; NodeDoesNotExit is not a backward propagation property.
+        
+        Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).
+        
+        This more than doubles the FPS on ammo.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::observeUseKindOnEdge):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
 2013-04-24  Oliver Hunt  <oliver@apple.com>
 
         Add support for Math.imul

diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 58c9ccf..3df5a6e 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -3377,6 +3377,12 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NEXT_OPCODE(op_typeof);
         }
 
+        case op_to_jsnumber: {
+            set(currentInstruction[1].u.operand,
+                addToGraph(Identity, Edge(get(currentInstruction[2].u.operand), NumberUse)));
+            NEXT_OPCODE(op_to_jsnumber);
+        }
+
         default:
             // Parse failed! This should not happen because the capabilities checker
             // should have caught it.

diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.h b/Source/JavaScriptCore/dfg/DFGCapabilities.h
index ccb48a0..3bf4e8f 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.h
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.h
@@ -183,6 +183,7 @@ inline CapabilityLevel canCompileOpcode(OpcodeID opcodeID, CodeBlock*, Instructi
     case op_put_to_base_variable:
     case op_put_to_base:
     case op_typeof:
+    case op_to_jsnumber:
         return CanCompile;
         
     case op_call_varargs:

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 3af1b58..c9a58d6 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -792,9 +792,22 @@ private:
             setUseKindAndUnboxIfProfitable<CellUse>(node->child2());
             break;
         }
-            
+
+        case Phantom:
+        case Identity: {
+            switch (node->child1().useKind()) {
+            case NumberUse:
+                if (node->child1()->shouldSpeculateIntegerForArithmetic())
+                    node->child1().setUseKind(Int32Use);
+                break;
+            default:
+                break;
+            }
+            observeUseKindOnEdge(node->child1());
+            break;
+        }
+
         case GetArrayLength:
-        case Identity:
         case Nop:
         case Phi:
         case ForwardInt32ToDouble:
@@ -810,7 +823,6 @@ private:
 #if !ASSERT_DISABLED    
         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
         case SetArgument:
-        case Phantom:
         case JSConstant:
         case WeakJSConstant:
         case GetLocal:
@@ -1246,10 +1258,20 @@ private:
         return true;
 #endif
     }
-    
+
     template<UseKind useKind>
     void observeUseKindOnNode(Node* node)
     {
+        observeUseKindOnNode(node, useKind);
+    }
+
+    void observeUseKindOnEdge(Edge edge)
+    {
+        observeUseKindOnNode(edge.node(), edge.useKind());
+    }
+
+    void observeUseKindOnNode(Node* node, UseKind useKind)
+    {
         if (node->op() != GetLocal)
             return;
         

diff --git a/Source/JavaScriptCore/dfg/DFGNodeFlags.h b/Source/JavaScriptCore/dfg/DFGNodeFlags.h
index 926f371..adb34bf 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGNodeFlags.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeFlags.h
@@ -53,7 +53,7 @@ namespace JSC { namespace DFG {
 #define NodeMayOverflow           0x080
 #define NodeMayNegZero            0x100
                                 
-#define NodeBackPropMask         0x3E00
+#define NodeBackPropMask         0x1E00
 #define NodeUseBottom            0x0000
 #define NodeUsedAsNumber         0x0200 // The result of this computation may be used in a context that observes fractional, or bigger-than-int32, results.
 #define NodeNeedsNegZero         0x0400 // The result of this computation may be used in a context that observes -0.

diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
index 29d7e0a..9039e3f 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
@@ -46,7 +46,7 @@ namespace JSC { namespace DFG {
     /* Marker to indicate that an operation was optimized entirely and all that is left */\
     /* is to make one node alias another. CSE will later usually eliminate this node, */\
     /* though it may choose not to if it would corrupt predictions (very rare). */\
-    macro(Identity, NodeResultJS | NodeDoesNotExit) \
+    macro(Identity, NodeResultJS) \
     \
     /* Nodes for handling functions (both as call and as construct). */\
     macro(ConvertThis, NodeResultJS) \

diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index 63a135b..b166309 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -473,7 +473,6 @@ private:
         case CheckArray:
         case Arrayify:
         case ArrayifyToStructure:
-        case Identity:
         case MovHint:
         case MovHintAndCheck:
         case ZombieHint: {
@@ -493,6 +492,10 @@ private:
             changed |= setPrediction(SpecCellOther);
             break;
 
+        case Identity:
+            changed |= mergePrediction(node->child1()->prediction());
+            break;
+
 #ifndef NDEBUG
         // These get ignored because they don't return anything.
         case PutByVal: