[DFG] AI should convert CreateThis to NewObject if the prototype object is proved
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 12 Mar 2018 03:25:39 +0000 (03:25 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 12 Mar 2018 03:25:39 +0000 (03:25 +0000)
commitc15ea305d5ec78a1410dbed03726dfa51871786c
tree2bd7f0070d9fc11b3e730c7c02077f3c47a00743
parentd0ffbb6bbd14ab025ed39a4f4e984c1d831118bb
[DFG] AI should convert CreateThis to NewObject if the prototype object is proved
https://bugs.webkit.org/show_bug.cgi?id=183310

Reviewed by Filip Pizlo.

JSTests:

* stress/ai-create-this-to-new-object-fire.js: Added.
(assert):
(test):
(func):
(check):
(test.body.A):
(test.body.B):
(test.body):
* stress/ai-create-this-to-new-object.js: Added.
(assert):
(test):
(func):
(check):
(test.body.A):
(test.body.B):
(test.body):

Source/JavaScriptCore:

This patch implements CreateThis -> NewObject conversion in AI if the given function is constant.
This contributes to 6% win in Octane/raytrace.

                                baseline                  patched

    raytrace       x2       1.19915+-0.01862    ^     1.13156+-0.01589       ^ definitely 1.0597x faster

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229520 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/ai-create-this-to-new-object-fire.js [new file with mode: 0644]
JSTests/stress/ai-create-this-to-new-object.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp