<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[199686] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/199686">199686</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-04-18 13:33:47 -0700 (Mon, 18 Apr 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>ToThis should have a fast path based on type info flags
https://bugs.webkit.org/show_bug.cgi?id=156712
Reviewed by Geoffrey Garen.
Prior to this change, if we couldn't nail down the type of ToThis to something easy, we'd emit code
that would take slow path if the argument was not a final object. We'd end up taking that slow path
a lot.
This adds a type info flag for ToThis having non-obvious behavior and changes the DFG and FTL paths
to test this flag. This is a sub-1% speed-up on SunSpider and Octane.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileToThis):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::create):
* runtime/JSLexicalEnvironment.h:
(JSC::JSLexicalEnvironment::create):
* runtime/JSString.h:
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::overridesGetOwnPropertySlot):
(JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
(JSC::TypeInfo::structureIsImmortal):
(JSC::TypeInfo::overridesToThis):
(JSC::TypeInfo::overridesGetPropertyNames):
(JSC::TypeInfo::prohibitsPropertyCaching):
(JSC::TypeInfo::getOwnPropertySlotIsImpure):
* runtime/StrictEvalActivation.h:
(JSC::StrictEvalActivation::create):
* runtime/Symbol.h:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmenth">trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringh">trunk/Source/JavaScriptCore/runtime/JSString.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStrictEvalActivationh">trunk/Source/JavaScriptCore/runtime/StrictEvalActivation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolh">trunk/Source/JavaScriptCore/runtime/Symbol.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -1,5 +1,42 @@
</span><span class="cx"> 2016-04-18 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><ins>+ ToThis should have a fast path based on type info flags
+ https://bugs.webkit.org/show_bug.cgi?id=156712
+
+ Reviewed by Geoffrey Garen.
+
+ Prior to this change, if we couldn't nail down the type of ToThis to something easy, we'd emit code
+ that would take slow path if the argument was not a final object. We'd end up taking that slow path
+ a lot.
+
+ This adds a type info flag for ToThis having non-obvious behavior and changes the DFG and FTL paths
+ to test this flag. This is a sub-1% speed-up on SunSpider and Octane.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
+ * runtime/JSGlobalObject.h:
+ (JSC::JSGlobalObject::create):
+ * runtime/JSLexicalEnvironment.h:
+ (JSC::JSLexicalEnvironment::create):
+ * runtime/JSString.h:
+ * runtime/JSTypeInfo.h:
+ (JSC::TypeInfo::overridesGetOwnPropertySlot):
+ (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
+ (JSC::TypeInfo::structureIsImmortal):
+ (JSC::TypeInfo::overridesToThis):
+ (JSC::TypeInfo::overridesGetPropertyNames):
+ (JSC::TypeInfo::prohibitsPropertyCaching):
+ (JSC::TypeInfo::getOwnPropertySlotIsImpure):
+ * runtime/StrictEvalActivation.h:
+ (JSC::StrictEvalActivation::create):
+ * runtime/Symbol.h:
+
+2016-04-18 Filip Pizlo <fpizlo@apple.com>
+
</ins><span class="cx"> Check to see how the perf bots react to megamorphic load being disabled.
</span><span class="cx">
</span><span class="cx"> Rubber stamped by Chris Dumez.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -3842,10 +3842,11 @@
</span><span class="cx">
</span><span class="cx"> MacroAssembler::JumpList slowCases;
</span><span class="cx"> slowCases.append(m_jit.branchIfNotCell(thisValue.jsValueRegs()));
</span><del>- slowCases.append(m_jit.branch8(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(thisValuePayloadGPR, JSCell::typeInfoTypeOffset()),
- TrustedImm32(FinalObjectType)));
</del><ins>+ slowCases.append(
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(thisValuePayloadGPR, JSCell::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(OverridesToThis)));
</ins><span class="cx"> m_jit.move(thisValuePayloadGPR, tempGPR);
</span><span class="cx"> m_jit.move(thisValueTagGPR, tempTagGPR);
</span><span class="cx"> J_JITOperation_EJ function;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -3897,10 +3897,11 @@
</span><span class="cx">
</span><span class="cx"> MacroAssembler::JumpList slowCases;
</span><span class="cx"> slowCases.append(m_jit.branchIfNotCell(JSValueRegs(thisValueGPR)));
</span><del>- slowCases.append(m_jit.branch8(
- MacroAssembler::NotEqual,
- MacroAssembler::Address(thisValueGPR, JSCell::typeInfoTypeOffset()),
- TrustedImm32(FinalObjectType)));
</del><ins>+ slowCases.append(
+ m_jit.branchTest8(
+ MacroAssembler::NonZero,
+ MacroAssembler::Address(thisValueGPR, JSCell::typeInfoFlagsOffset()),
+ MacroAssembler::TrustedImm32(OverridesToThis)));
</ins><span class="cx"> m_jit.move(thisValueGPR, tempGPR);
</span><span class="cx"> J_JITOperation_EJ function;
</span><span class="cx"> if (m_jit.graph().executableFor(node->origin.semantic)->isStrictMode())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -1461,7 +1461,11 @@
</span><span class="cx">
</span><span class="cx"> LBasicBlock lastNext = m_out.appendTo(isCellCase, slowCase);
</span><span class="cx"> ValueFromBlock fastResult = m_out.anchor(value);
</span><del>- m_out.branch(isType(value, FinalObjectType), usually(continuation), rarely(slowCase));
</del><ins>+ m_out.branch(
+ m_out.testIsZero32(
+ m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoFlags),
+ m_out.constInt32(OverridesToThis)),
+ usually(continuation), rarely(slowCase));
</ins><span class="cx">
</span><span class="cx"> m_out.appendTo(slowCase, continuation);
</span><span class="cx"> J_JITOperation_EJ function;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -356,7 +356,7 @@
</span><span class="cx">
</span><span class="cx"> public:
</span><span class="cx"> typedef JSSegmentedVariableObject Base;
</span><del>- static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
</del><ins>+ static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesToThis;
</ins><span class="cx">
</span><span class="cx"> static JSGlobalObject* create(VM& vm, Structure* structure)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx">
</span><span class="cx"> public:
</span><span class="cx"> typedef JSEnvironmentRecord Base;
</span><del>- static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
</del><ins>+ static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesToThis;
</ins><span class="cx">
</span><span class="cx"> static JSLexicalEnvironment* create(
</span><span class="cx"> VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSString.h (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSString.h 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/runtime/JSString.h 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx"> friend struct ThunkHelpers;
</span><span class="cx">
</span><span class="cx"> typedef JSCell Base;
</span><del>- static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | StructureIsImmortal;
</del><ins>+ static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | StructureIsImmortal | OverridesToThis;
</ins><span class="cx">
</span><span class="cx"> static const bool needsDestruction = true;
</span><span class="cx"> static void destroy(JSCell*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -42,7 +42,8 @@
</span><span class="cx"> static const unsigned OverridesGetOwnPropertySlot = 1 << 3;
</span><span class="cx"> static const unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 4;
</span><span class="cx"> static const unsigned StructureIsImmortal = 1 << 5;
</span><del>-// There are two free bits at the end of the InlineTypeFlags.
</del><ins>+static const unsigned OverridesToThis = 1 << 6; // If this is false then this returns something other than 'this'. Non-object cells that are visible to JS have this set as do some exotic objects.
+// There is one free bit at the end of the InlineTypeFlags.
</ins><span class="cx">
</span><span class="cx"> static const unsigned ImplementsHasInstance = 1 << 8;
</span><span class="cx"> static const unsigned OverridesGetPropertyNames = 1 << 9;
</span><span class="lines">@@ -84,6 +85,7 @@
</span><span class="cx"> static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags & OverridesGetOwnPropertySlot; }
</span><span class="cx"> bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags1(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
</span><span class="cx"> bool structureIsImmortal() const { return isSetOnFlags1(StructureIsImmortal); }
</span><ins>+ bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }
</ins><span class="cx"> bool overridesGetPropertyNames() const { return isSetOnFlags2(OverridesGetPropertyNames); }
</span><span class="cx"> bool prohibitsPropertyCaching() const { return isSetOnFlags2(ProhibitsPropertyCaching); }
</span><span class="cx"> bool getOwnPropertySlotIsImpure() const { return isSetOnFlags2(GetOwnPropertySlotIsImpure); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStrictEvalActivationh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StrictEvalActivation.h (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StrictEvalActivation.h 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/runtime/StrictEvalActivation.h 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> class StrictEvalActivation : public JSScope {
</span><span class="cx"> public:
</span><span class="cx"> typedef JSScope Base;
</span><del>- static const unsigned StructureFlags = Base::StructureFlags | IsEnvironmentRecord;
</del><ins>+ static const unsigned StructureFlags = Base::StructureFlags | IsEnvironmentRecord | OverridesToThis;
</ins><span class="cx">
</span><span class="cx"> static StrictEvalActivation* create(ExecState* exec, JSScope* currentScope)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Symbol.h (199685 => 199686)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Symbol.h 2016-04-18 20:28:51 UTC (rev 199685)
+++ trunk/Source/JavaScriptCore/runtime/Symbol.h 2016-04-18 20:33:47 UTC (rev 199686)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> class Symbol final : public JSCell {
</span><span class="cx"> public:
</span><span class="cx"> typedef JSCell Base;
</span><del>- static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
</del><ins>+ static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal | OverridesToThis;
</ins><span class="cx">
</span><span class="cx"> DECLARE_EXPORT_INFO;
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>