[DFG] More ArrayIndexOf fixups for various types
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 20 Jun 2017 02:46:08 +0000 (02:46 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 20 Jun 2017 02:46:08 +0000 (02:46 +0000)
commit4bb97ef4a437e148bc93cc9233e6af68af54836a
tree69489a49b9710ccfc1e9047217224ea93d00359f
parent5183c3054e5fa3556a7090224d2be6e6b15c248b
[DFG] More ArrayIndexOf fixups for various types
https://bugs.webkit.org/show_bug.cgi?id=173176

Reviewed by Saam Barati.

JSTests:

* stress/array-indexof-arraystorage.js: Added.
(shouldBe):
(indexOfInt32Other):
(indexOfInt32Cell):
(indexOfInt32Boolean):
(indexOfDoubleOther):
(indexOfDoubleCell):
(indexOfDoubleBoolean):
(indexOfInt32):
(indexOfDouble):
* stress/array-indexof-constant-folding.js: Added.
(shouldBe):
(indexOfInt32Other):
(indexOfInt32Cell):
(indexOfInt32Boolean):
(indexOfDoubleOther):
(indexOfDoubleCell):
(indexOfDoubleBoolean):
* stress/array-indexof-hole-and-other.js: Added.
(shouldBe):
(indexOf):
* stress/array-indexof-other.js: Added.
(shouldBe):
(indexOfInt32):
(indexOfDouble):
(indexOfString):
(indexOfObject):
* stress/array-indexof-symbol.js: Added.
(shouldBe):
(indexOfInt32):
(indexOfDouble):
(indexOfString):
(indexOfObject):

Source/JavaScriptCore:

This patch further expands coverage of ArrayIndexOf optimization in DFG and FTL.

1. We attempt to fold ArrayIndexOf to constant (-1) if we know that its array
never contains the given search value.

2. We support Symbol and Other specialization additionally. Especially, Other is
useful because null/undefined can be used as a sentinel value.

One interesting thing is that Array.prototype.indexOf does not consider holes as
undefineds. Thus,

    var array = [,,,,,,,];
    array.indexOf(undefined); // => -1

This can be trivially achieved in JSC because Empty and Undefined are different values.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupArrayIndexOf):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArrayIndexOf):
(JSC::DFG::SpeculativeJIT::speculateOther):
* dfg/DFGSpeculativeJIT.h:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOf):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@218525 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/array-indexof-arraystorage.js [new file with mode: 0644]
JSTests/stress/array-indexof-constant-folding.js [new file with mode: 0644]
JSTests/stress/array-indexof-hole-and-other.js [new file with mode: 0644]
JSTests/stress/array-indexof-other.js [new file with mode: 0644]
JSTests/stress/array-indexof-symbol.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp