[webkit-changes] [WebKit/WebKit] aa1a84: [JSC] Add StringOrOther speculation against ToPrim...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: aa1a84a4b6aae5967a7a18b2d9bcca1c87f37129
      https://github.com/WebKit/WebKit/commit/aa1a84a4b6aae5967a7a18b2d9bcca1c87f37129
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2024-02-24 (Sat, 24 Feb 2024)

  Changed paths:
    A JSTests/microbenchmarks/string-or-other-add.js
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGMayExit.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  [JSC] Add StringOrOther speculation against ToPrimitive / ToString
https://bugs.webkit.org/show_bug.cgi?id=270028
rdar://123538433

Reviewed by Alexey Shvayka.

This patch further optimizes `value + ""` pattern. Now, we observed StringOrOther case super frequently. So we should have optimization for that.

1. Add ToPrimitive(StringOrOtherUse). Then it can be converted to Identity since both are already primitives.
2. Add ToString(StringOrOtherUse). It checks String or Other and returns strings without calling any functions.

                                    ToT                     Patched

    string-or-other-add      355.4531+-0.8540     ^     72.8445+-0.0395        ^ definitely 4.8796x faster

* JSTests/microbenchmarks/string-or-other-add.js: Added.
(shouldBe):
(test):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupToPrimitive):
(JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
(JSC::DFG::FixupPhase::fixupStringValueOf):
* Source/JavaScriptCore/dfg/DFGMayExit.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):

Canonical link: https://commits.webkit.org/275280@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications