[webkit-changes] [WebKit/WebKit] eebb37: [JSC] Clean up Float32Array access a bit more

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: eebb374f2bcd1ebf9c6b5740f839dcaa3e2af3a4
      https://github.com/WebKit/WebKit/commit/eebb374f2bcd1ebf9c6b5740f839dcaa3e2af3a4
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2024-01-25 (Thu, 25 Jan 2024)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGGraph.cpp
    M Source/JavaScriptCore/dfg/DFGGraph.h
    M Source/JavaScriptCore/dfg/DFGMayExit.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  [JSC] Clean up Float32Array access a bit more
https://bugs.webkit.org/show_bug.cgi?id=268055
rdar://116791798

Reviewed by Justin Michaud.

This patch further optimizes Float32Array access.

1. We forget removing some unnecessary code in FTLLowerDFGToB3 from 273389 at main. It does not have any effect, but it is simply wasteful.
2. In most of cases, we already emit CheckStructure for Float32Array. So we can leverage this structure information to ensure that this
   is never resizable / growable array. We use AI to remove this check, this contributes largely since we remove unnecessary load from
   Float32Array object!
3. We add more DFGMayExit cases for CompareStrictEq since this is common. We can observe this pattern in the benchmark script, and this
   makes it possible to wipe some of unnecessary exit cases, which allows us to remove some MovHint & its ValueRep.

                               ToT                     Patched

    segmentation         91.7487+-0.2857     ^     83.8224+-0.2430        ^ definitely 1.0946x faster

* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::isNeverResizableOrGrowableSharedTypedArrayIncludingDataView):
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGMayExit.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52):
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult):
(JSC::FTL::DFG::LowerDFGToB3::typedArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

Canonical link: https://commits.webkit.org/273481@main