<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[183615] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/183615">183615</a></dd>
<dt>Author</dt> <dd>benjamin@webkit.org</dd>
<dt>Date</dt> <dd>2015-04-29 21:40:55 -0700 (Wed, 29 Apr 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>[JSC] Remove RageConvert array conversion
https://bugs.webkit.org/show_bug.cgi?id=144433
Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-04-29
Reviewed by Filip Pizlo.
RageConvert was causing a subtle bug that was hitting the Kraken crypto tests
pretty hard:
-The indexing types shows that the array access varies between Int32 and DoubleArray.
-ArrayMode::fromObserved() decided to use the most generic type: DoubleArray.
An Arrayify node would convert the Int32 to that type.
-Somewhere, a GetByVal or PutByVal would have the flag NodeBytecodeUsesAsInt. That
node would use RageConvert instead of Convert.
-The Arrayify for that GetByVal with RageConvert would not convert the array to
Contiguous.
-All the following array access that do not have the flag NodeBytecodeUsesAsInt would
now expect a DoubleArray and always get a Contiguous Array. The CheckStructure
fail systematically and we never get to run the later code.
Getting rid of RageConvert fixes the problem and does not seems to have any
negative side effect on other benchmarks.
The improvments on Kraken are:
-stanford-crypto-aes: definitely 1.0915x faster.
-stanford-crypto-pbkdf2: definitely 1.2446x faster.
-stanford-crypto-sha256-iterative: definitely 1.0544x faster.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::refine):
(JSC::DFG::arrayConversionToString):
* dfg/DFGArrayMode.h:
* dfg/DFGArrayifySlowPathGenerator.h:
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
* runtime/JSObject.cpp:
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::ensureContiguousSlow):
(JSC::JSObject::genericConvertDoubleToContiguous): Deleted.
(JSC::JSObject::rageConvertDoubleToContiguous): Deleted.
(JSC::JSObject::rageEnsureContiguousSlow): Deleted.
* runtime/JSObject.h:
(JSC::JSObject::rageEnsureContiguous): Deleted.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArrayModecpp">trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArrayModeh">trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArrayifySlowPathGeneratorh">trunk/Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -1,3 +1,57 @@
</span><ins>+2015-04-29 Benjamin Poulain <bpoulain@apple.com>
+
+ [JSC] Remove RageConvert array conversion
+ https://bugs.webkit.org/show_bug.cgi?id=144433
+
+ Reviewed by Filip Pizlo.
+
+ RageConvert was causing a subtle bug that was hitting the Kraken crypto tests
+ pretty hard:
+ -The indexing types shows that the array access varies between Int32 and DoubleArray.
+ -ArrayMode::fromObserved() decided to use the most generic type: DoubleArray.
+ An Arrayify node would convert the Int32 to that type.
+ -Somewhere, a GetByVal or PutByVal would have the flag NodeBytecodeUsesAsInt. That
+ node would use RageConvert instead of Convert.
+ -The Arrayify for that GetByVal with RageConvert would not convert the array to
+ Contiguous.
+ -All the following array access that do not have the flag NodeBytecodeUsesAsInt would
+ now expect a DoubleArray and always get a Contiguous Array. The CheckStructure
+ fail systematically and we never get to run the later code.
+
+ Getting rid of RageConvert fixes the problem and does not seems to have any
+ negative side effect on other benchmarks.
+
+ The improvments on Kraken are:
+ -stanford-crypto-aes: definitely 1.0915x faster.
+ -stanford-crypto-pbkdf2: definitely 1.2446x faster.
+ -stanford-crypto-sha256-iterative: definitely 1.0544x faster.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGArrayMode.cpp:
+ (JSC::DFG::ArrayMode::refine):
+ (JSC::DFG::arrayConversionToString):
+ * dfg/DFGArrayMode.h:
+ * dfg/DFGArrayifySlowPathGenerator.h:
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGOperations.cpp:
+ * dfg/DFGOperations.h:
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGTypeCheckHoistingPhase.cpp:
+ (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::convertDoubleToContiguous):
+ (JSC::JSObject::ensureContiguousSlow):
+ (JSC::JSObject::genericConvertDoubleToContiguous): Deleted.
+ (JSC::JSObject::rageConvertDoubleToContiguous): Deleted.
+ (JSC::JSObject::rageEnsureContiguousSlow): Deleted.
+ * runtime/JSObject.h:
+ (JSC::JSObject::rageEnsureContiguous): Deleted.
+
</ins><span class="cx"> 2015-04-29 Joseph Pecoraro <pecoraro@apple.com>
</span><span class="cx">
</span><span class="cx"> Gracefully handle missing auto pause key on remote inspector setup
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -1686,8 +1686,7 @@
</span><span class="cx"> m_state.setFoundConstants(true);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- ASSERT(node->arrayMode().conversion() == Array::Convert
- || node->arrayMode().conversion() == Array::RageConvert);
</del><ins>+ ASSERT(node->arrayMode().conversion() == Array::Convert);
</ins><span class="cx"> clobberStructures(clobberLimit);
</span><span class="cx"> filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering());
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArrayModecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -151,8 +151,7 @@
</span><span class="cx">
</span><span class="cx"> ArrayMode ArrayMode::refine(
</span><span class="cx"> Graph& graph, Node* node,
</span><del>- SpeculatedType base, SpeculatedType index, SpeculatedType value,
- NodeFlags flags) const
</del><ins>+ SpeculatedType base, SpeculatedType index, SpeculatedType value) const
</ins><span class="cx"> {
</span><span class="cx"> if (!base || !index) {
</span><span class="cx"> // It can be that we had a legitimate arrayMode but no incoming predictions. That'll
</span><span class="lines">@@ -197,15 +196,11 @@
</span><span class="cx"> return withTypeAndConversion(Array::Contiguous, Array::Convert);
</span><span class="cx">
</span><span class="cx"> case Array::Double:
</span><del>- if (flags & NodeBytecodeUsesAsInt)
- return withTypeAndConversion(Array::Contiguous, Array::RageConvert);
</del><span class="cx"> if (!value || isFullNumberSpeculation(value))
</span><span class="cx"> return *this;
</span><span class="cx"> return withTypeAndConversion(Array::Contiguous, Array::Convert);
</span><span class="cx">
</span><span class="cx"> case Array::Contiguous:
</span><del>- if (doesConversion() && (flags & NodeBytecodeUsesAsInt))
- return withConversion(Array::RageConvert);
</del><span class="cx"> return *this;
</span><span class="cx">
</span><span class="cx"> case Array::Int8Array:
</span><span class="lines">@@ -579,8 +574,6 @@
</span><span class="cx"> return "AsIs";
</span><span class="cx"> case Array::Convert:
</span><span class="cx"> return "Convert";
</span><del>- case Array::RageConvert:
- return "RageConvert";
</del><span class="cx"> default:
</span><span class="cx"> return "Unknown!";
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArrayModeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -95,8 +95,7 @@
</span><span class="cx"> };
</span><span class="cx"> enum Conversion {
</span><span class="cx"> AsIs,
</span><del>- Convert,
- RageConvert
</del><ins>+ Convert
</ins><span class="cx"> };
</span><span class="cx"> } // namespace Array
</span><span class="cx">
</span><span class="lines">@@ -222,7 +221,7 @@
</span><span class="cx"> return ArrayMode(type, arrayClass(), speculation(), conversion);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- ArrayMode refine(Graph&, Node*, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone, NodeFlags = 0) const;
</del><ins>+ ArrayMode refine(Graph&, Node*, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone) const;
</ins><span class="cx">
</span><span class="cx"> bool alreadyChecked(Graph&, Node*, AbstractValue&) const;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArrayifySlowPathGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -101,10 +101,7 @@
</span><span class="cx"> jit->callOperation(operationEnsureDouble, m_tempGPR, m_baseGPR);
</span><span class="cx"> break;
</span><span class="cx"> case Array::Contiguous:
</span><del>- if (m_arrayMode.conversion() == Array::RageConvert)
- jit->callOperation(operationRageEnsureContiguous, m_tempGPR, m_baseGPR);
- else
- jit->callOperation(operationEnsureContiguous, m_tempGPR, m_baseGPR);
</del><ins>+ jit->callOperation(operationEnsureContiguous, m_tempGPR, m_baseGPR);
</ins><span class="cx"> break;
</span><span class="cx"> case Array::ArrayStorage:
</span><span class="cx"> case Array::SlowPutArrayStorage:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -517,7 +517,7 @@
</span><span class="cx"> m_graph, node,
</span><span class="cx"> node->child1()->prediction(),
</span><span class="cx"> node->child2()->prediction(),
</span><del>- SpecNone, node->flags()));
</del><ins>+ SpecNone));
</ins><span class="cx">
</span><span class="cx"> blessArrayOperation(node->child1(), node->child2(), node->child3());
</span><span class="cx">
</span><span class="lines">@@ -1105,7 +1105,7 @@
</span><span class="cx"> m_graph, node,
</span><span class="cx"> node->child1()->prediction(),
</span><span class="cx"> node->child2()->prediction(),
</span><del>- SpecNone, node->flags()));
</del><ins>+ SpecNone));
</ins><span class="cx">
</span><span class="cx"> blessArrayOperation(node->child1(), node->child2(), node->child3());
</span><span class="cx"> fixEdge<CellUse>(node->child1());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -951,17 +951,6 @@
</span><span class="cx"> return reinterpret_cast<char*>(asObject(cell)->ensureContiguous(vm).data());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-char* JIT_OPERATION operationRageEnsureContiguous(ExecState* exec, JSCell* cell)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- if (!cell->isObject())
- return 0;
-
- return reinterpret_cast<char*>(asObject(cell)->rageEnsureContiguous(vm).data());
-}
-
</del><span class="cx"> char* JIT_OPERATION operationEnsureArrayStorage(ExecState* exec, JSCell* cell)
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -113,7 +113,6 @@
</span><span class="cx"> char* JIT_OPERATION operationEnsureInt32(ExecState*, JSCell*);
</span><span class="cx"> char* JIT_OPERATION operationEnsureDouble(ExecState*, JSCell*);
</span><span class="cx"> char* JIT_OPERATION operationEnsureContiguous(ExecState*, JSCell*);
</span><del>-char* JIT_OPERATION operationRageEnsureContiguous(ExecState*, JSCell*);
</del><span class="cx"> char* JIT_OPERATION operationEnsureArrayStorage(ExecState*, JSCell*);
</span><span class="cx"> StringImpl* JIT_OPERATION operationResolveRope(ExecState*, JSString*);
</span><span class="cx"> JSString* JIT_OPERATION operationSingleCharacterString(ExecState*, int32_t);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -391,7 +391,7 @@
</span><span class="cx"> m_graph, node,
</span><span class="cx"> node->child1()->prediction(),
</span><span class="cx"> node->child2()->prediction(),
</span><del>- SpecNone, node->flags());
</del><ins>+ SpecNone);
</ins><span class="cx">
</span><span class="cx"> switch (arrayMode.type()) {
</span><span class="cx"> case Array::Double:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -228,7 +228,9 @@
</span><span class="cx"> noticeStructureCheck(variable, node->structureSet());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
</del><ins>+
+ case ArrayifyToStructure:
+ case Arrayify:
</ins><span class="cx"> case GetByOffset:
</span><span class="cx"> case PutByOffset:
</span><span class="cx"> case PutStructure:
</span><span class="lines">@@ -250,22 +252,6 @@
</span><span class="cx"> // Don't count these uses.
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case ArrayifyToStructure:
- case Arrayify:
- if (node->arrayMode().conversion() == Array::RageConvert) {
- // Rage conversion changes structures. We should avoid tying to do
- // any kind of hoisting when rage conversion is in play.
- Node* child = node->child1().node();
- if (child->op() != GetLocal)
- break;
- VariableAccessData* variable = child->variableAccessData();
- variable->vote(VoteOther);
- if (!shouldConsiderForHoisting<StructureTypeCheck>(variable))
- break;
- noticeStructureCheck(variable, 0);
- }
- break;
-
</del><span class="cx"> case SetLocal: {
</span><span class="cx"> // Find all uses of the source of the SetLocal. If any of them are a
</span><span class="cx"> // kind of CheckStructure, then we should notice them to ensure that
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -1943,10 +1943,7 @@
</span><span class="cx"> vmCall(m_out.operation(operationEnsureDouble), m_callFrame, cell);
</span><span class="cx"> break;
</span><span class="cx"> case Array::Contiguous:
</span><del>- if (m_node->arrayMode().conversion() == Array::RageConvert)
- vmCall(m_out.operation(operationRageEnsureContiguous), m_callFrame, cell);
- else
- vmCall(m_out.operation(operationEnsureContiguous), m_callFrame, cell);
</del><ins>+ vmCall(m_out.operation(operationEnsureContiguous), m_callFrame, cell);
</ins><span class="cx"> break;
</span><span class="cx"> case Array::ArrayStorage:
</span><span class="cx"> case Array::SlowPutArrayStorage:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -836,8 +836,7 @@
</span><span class="cx"> return convertInt32ToArrayStorage(vm, structure(vm)->suggestedArrayStorageTransition());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-template<JSObject::DoubleToContiguousMode mode>
-ContiguousJSValues JSObject::genericConvertDoubleToContiguous(VM& vm)
</del><ins>+ContiguousJSValues JSObject::convertDoubleToContiguous(VM& vm)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(hasDouble(indexingType()));
</span><span class="cx">
</span><span class="lines">@@ -849,20 +848,7 @@
</span><span class="cx"> currentAsValue->clear();
</span><span class="cx"> continue;
</span><span class="cx"> }
</span><del>- JSValue v;
- switch (mode) {
- case EncodeValueAsDouble:
- v = JSValue(JSValue::EncodeAsDouble, value);
- break;
- case RageConvertDoubleToValue:
- v = jsNumber(value);
- break;
- default:
- v = JSValue();
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
- ASSERT(v.isNumber());
</del><ins>+ JSValue v = JSValue(JSValue::EncodeAsDouble, value);
</ins><span class="cx"> currentAsValue->setWithoutWriteBarrier(v);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -870,16 +856,6 @@
</span><span class="cx"> return m_butterfly->contiguous();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ContiguousJSValues JSObject::convertDoubleToContiguous(VM& vm)
-{
- return genericConvertDoubleToContiguous<EncodeValueAsDouble>(vm);
-}
-
-ContiguousJSValues JSObject::rageConvertDoubleToContiguous(VM& vm)
-{
- return genericConvertDoubleToContiguous<RageConvertDoubleToValue>(vm);
-}
-
</del><span class="cx"> ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm, NonPropertyTransition transition)
</span><span class="cx"> {
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="lines">@@ -1049,7 +1025,7 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ContiguousJSValues JSObject::ensureContiguousSlow(VM& vm, DoubleToContiguousMode mode)
</del><ins>+ContiguousJSValues JSObject::ensureContiguousSlow(VM& vm)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(inherits(info()));
</span><span class="cx">
</span><span class="lines">@@ -1066,8 +1042,6 @@
</span><span class="cx"> return convertInt32ToContiguous(vm);
</span><span class="cx">
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES:
</span><del>- if (mode == RageConvertDoubleToValue)
- return rageConvertDoubleToContiguous(vm);
</del><span class="cx"> return convertDoubleToContiguous(vm);
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><span class="lines">@@ -1079,16 +1053,6 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ContiguousJSValues JSObject::ensureContiguousSlow(VM& vm)
-{
- return ensureContiguousSlow(vm, EncodeValueAsDouble);
-}
-
-ContiguousJSValues JSObject::rageEnsureContiguousSlow(VM& vm)
-{
- return ensureContiguousSlow(vm, RageConvertDoubleToValue);
-}
-
</del><span class="cx"> ArrayStorage* JSObject::ensureArrayStorageSlow(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(inherits(info()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (183614 => 183615)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2015-04-30 04:15:11 UTC (rev 183614)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2015-04-30 04:40:55 UTC (rev 183615)
</span><span class="lines">@@ -689,18 +689,7 @@
</span><span class="cx">
</span><span class="cx"> return ensureContiguousSlow(vm);
</span><span class="cx"> }
</span><del>-
- // Same as ensureContiguous(), except that if the indexed storage is in
- // double mode, then it does a rage conversion to contiguous: it
- // attempts to convert each double to an int32.
- ContiguousJSValues rageEnsureContiguous(VM& vm)
- {
- if (LIKELY(hasContiguous(indexingType())))
- return m_butterfly->contiguous();
-
- return rageEnsureContiguousSlow(vm);
- }
-
</del><ins>+
</ins><span class="cx"> // Ensure that the object is in a mode where it has array storage. Use
</span><span class="cx"> // this if you're about to perform actions that would have required the
</span><span class="cx"> // object to be converted to have array storage, if it didn't have it
</span><span class="lines">@@ -797,7 +786,6 @@
</span><span class="cx"> ArrayStorage* convertInt32ToArrayStorage(VM&);
</span><span class="cx">
</span><span class="cx"> ContiguousJSValues convertDoubleToContiguous(VM&);
</span><del>- ContiguousJSValues rageConvertDoubleToContiguous(VM&);
</del><span class="cx"> ArrayStorage* convertDoubleToArrayStorage(VM&, NonPropertyTransition);
</span><span class="cx"> ArrayStorage* convertDoubleToArrayStorage(VM&);
</span><span class="cx">
</span><span class="lines">@@ -983,14 +971,8 @@
</span><span class="cx"> ContiguousJSValues ensureInt32Slow(VM&);
</span><span class="cx"> ContiguousDoubles ensureDoubleSlow(VM&);
</span><span class="cx"> ContiguousJSValues ensureContiguousSlow(VM&);
</span><del>- ContiguousJSValues rageEnsureContiguousSlow(VM&);
</del><span class="cx"> JS_EXPORT_PRIVATE ArrayStorage* ensureArrayStorageSlow(VM&);
</span><del>-
- enum DoubleToContiguousMode { EncodeValueAsDouble, RageConvertDoubleToValue };
- template<DoubleToContiguousMode mode>
- ContiguousJSValues genericConvertDoubleToContiguous(VM&);
- ContiguousJSValues ensureContiguousSlow(VM&, DoubleToContiguousMode);
-
</del><ins>+
</ins><span class="cx"> protected:
</span><span class="cx"> CopyWriteBarrier<Butterfly> m_butterfly;
</span><span class="cx"> #if USE(JSVALUE32_64)
</span></span></pre>
</div>
</div>
</body>
</html>