[FTL] Support DeleteById and DeleteByVal

https://bugs.webkit.org/show_bug.cgi?id=180022

Reviewed by Saam Barati.

JSTests:

* stress/delete-by-id.js: Added.
(shouldBe):
(test1):
(test2):
* stress/delete-by-val-ftl.js: Added.
(shouldBe):
(test1):
(test2):

Source/JavaScriptCore:

We should increase the coverage of FTL. Even if the code includes DeleteById,
it does not mean that remaining part of the code should not be optimized in FTL.
Right now, even CallEval and `with` scope are handled in FTL.

This patch just adds DeleteById and DeleteByVal handling to FTL to allow optimizing
code including them.

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteById):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225153 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index fb978c7fc068a9f66c057c676a5b715453325fb8..46c287069530cf26e2a985ba5b2b426506b1b338 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,19 @@
+2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [FTL] Support DeleteById and DeleteByVal
+        https://bugs.webkit.org/show_bug.cgi?id=180022
+
+        Reviewed by Saam Barati.
+
+        * stress/delete-by-id.js: Added.
+        (shouldBe):
+        (test1):
+        (test2):
+        * stress/delete-by-val-ftl.js: Added.
+        (shouldBe):
+        (test1):
+        (test2):
+
 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [DFG] Introduce {Set,Map,WeakMap}Fields

diff --git a/JSTests/stress/delete-by-id.js b/JSTests/stress/delete-by-id.js
new file mode 100644 (file)
index 0000000..516f01b
--- /dev/null
+++ b/JSTests/stress/delete-by-id.js
@@ -0,0 +1,28 @@
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test1(object)
+{
+    return delete object.cocoa;
+}
+noInline(test1);
+
+function test2(object)
+{
+    return delete object.cappuccino;
+}
+noInline(test2);
+
+for (var i = 0; i < 1e5; ++i) {
+    var object = {
+        cocoa: 42
+    };
+    Object.defineProperty(object, "cappuccino", {
+        value: 42
+    });
+    shouldBe(test1(object), true);
+    shouldBe(test2(object), false);
+}

diff --git a/JSTests/stress/delete-by-val-ftl.js b/JSTests/stress/delete-by-val-ftl.js
new file mode 100644 (file)
index 0000000..674eab9
--- /dev/null
+++ b/JSTests/stress/delete-by-val-ftl.js
@@ -0,0 +1,28 @@
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test1(object, key)
+{
+    return delete object[key];
+}
+noInline(test1);
+
+function test2(object, key)
+{
+    return delete object[key];
+}
+noInline(test2);
+
+for (var i = 0; i < 1e5; ++i) {
+    var object = {
+        cocoa: 42
+    };
+    Object.defineProperty(object, "cappuccino", {
+        value: 42
+    });
+    shouldBe(test1(object, "cocoa"), true);
+    shouldBe(test2(object, "cappuccino"), false);
+}

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 306da106228a9401b5874cecc80dc4d0af402ea8..d8c59910ac620cc276686f8b43de55506a741a15 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,24 @@
+2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [FTL] Support DeleteById and DeleteByVal
+        https://bugs.webkit.org/show_bug.cgi?id=180022
+
+        Reviewed by Saam Barati.
+
+        We should increase the coverage of FTL. Even if the code includes DeleteById,
+        it does not mean that remaining part of the code should not be optimized in FTL.
+        Right now, even CallEval and `with` scope are handled in FTL.
+
+        This patch just adds DeleteById and DeleteByVal handling to FTL to allow optimizing
+        code including them.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDeleteById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal):
+
 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [DFG] Introduce {Set,Map,WeakMap}Fields

diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
index e1b467cd7880ac3416f5f02e84a70bd985a041b2..daa132e890f7bffdd56967b97aa6cf3718231806 100644 (file)
--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
@@ -268,6 +268,8 @@ inline CapabilityLevel canCompile(Node* node)
     case PutGetterSetterById:
     case PutGetterByVal:
     case PutSetterByVal:
+    case DeleteById:
+    case DeleteByVal:
     case CreateRest:
     case GetRestLength:
     case RegExpExec:

diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 8f9a113037fe9ef0df596a67b05092259b499fd8..2971c7d379dd4f27925f4a28b83ec221a748d78a 100644 (file)
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -706,6 +706,12 @@ private:
         case PutSetterByVal:
             compilePutAccessorByVal();
             break;
+        case DeleteById:
+            compileDeleteById();
+            break;
+        case DeleteByVal:
+            compileDeleteByVal();
+            break;
         case GetButterfly:
         case GetButterflyWithoutCaging:
             compileGetButterfly();
@@ -4210,6 +4216,20 @@ private:
             m_out.operation(m_node->op() == PutGetterByVal ? operationPutGetterByVal : operationPutSetterByVal),
             m_callFrame, base, subscript, m_out.constInt32(m_node->accessorAttributes()), accessor);
     }
+
+    void compileDeleteById()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        auto uid = m_graph.identifiers()[m_node->identifierNumber()];
+        setBoolean(m_out.notZero64(vmCall(Int64, m_out.operation(operationDeleteById), m_callFrame, base, m_out.constIntPtr(uid))));
+    }
+
+    void compileDeleteByVal()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        LValue subscript = lowJSValue(m_node->child2());
+        setBoolean(m_out.notZero64(vmCall(Int64, m_out.operation(operationDeleteByVal), m_callFrame, base, subscript)));
+    }
     
     void compileArrayPush()
     {