[DFG][FTL] Make ArraySlice(0) code tight
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 20 Mar 2018 07:12:56 +0000 (07:12 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 20 Mar 2018 07:12:56 +0000 (07:12 +0000)
commit2b832813e82abc416be834346cc5ce4413ab9700
treea774caf324d3334e81a78033353cdd973856e3c1
parent1160089e5398093af5756e40ec4d4df31bf621b5
[DFG][FTL] Make ArraySlice(0) code tight
https://bugs.webkit.org/show_bug.cgi?id=183590

Reviewed by Saam Barati.

JSTests:

* stress/array-slice-with-zero.js: Added.
(shouldBe):
(test):
(test2):
* stress/array-slice-zero-args.js: Added.
(shouldBe):
(test):

Source/JavaScriptCore:

This patch tightens ArraySlice code, in particular, startIndex = 0 case.

1. We support array.slice() call. This is a well-used way to clone array.
For example, underscore.js uses this technique.

2. We remove several checks if the given index value is a proven constant.

* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitPopulateSliceIndex):
(JSC::DFG::SpeculativeJIT::compileArraySlice):
We can skip some of checks if the given value is a proven constant.

* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileArraySlice):
Change below to belowOrEqual. It does not change meaning in the code. But it allows us
to fold BelowEqual(0, x) to true.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229742 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/array-slice-with-zero.js [new file with mode: 0644]
JSTests/stress/array-slice-zero-args.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp