MapHash should speculate on the type of its child node
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 3 Oct 2016 20:49:34 +0000 (20:49 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 3 Oct 2016 20:49:34 +0000 (20:49 +0000)
commiteda65b806c705c5a0dcab9e3bde7033cb3d5680c
tree104cf37f72c5e010c4d88407b7d756ae2ad56952
parent0847eed2084860dc2c0366cd69d6654453fc7700
MapHash should speculate on the type of its child node
https://bugs.webkit.org/show_bug.cgi?id=161922

Reviewed by Filip Pizlo.

JSTests:

* microbenchmarks/map-key-well-typed.js: Added.
(assert):
(intKey):
(doubleKey):
(objectKey):
(stringKey):
(booleanKey):
(symbolKey):
(cellKey):
(assert.doubleKey):
(assert.booleanKey):

PerformanceTests:

I gave the main generator a name so it's easier to see what
it is when using the sampling profiler.

* ES6SampleBench/Basic/ast.js:
(Basic.Program):

Source/JavaScriptCore:

This allows us to remove runtime type checks when we've already
proven the type of the incoming value.

This is a 2-3% speedup on ES6SampleBench/Basic.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::wangsInt64Hash):
(JSC::FTL::DFG::LowerDFGToB3::mapHashString):
(JSC::FTL::DFG::LowerDFGToB3::compileMapHash):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@206746 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/microbenchmarks/map-key-well-typed.js [new file with mode: 0644]
PerformanceTests/ChangeLog
PerformanceTests/ES6SampleBench/Basic/ast.js
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp