<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[206746] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/206746">206746</a></dd>
<dt>Author</dt> <dd>sbarati@apple.com</dd>
<dt>Date</dt> <dd>2016-10-03 13:49:34 -0700 (Mon, 03 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>MapHash should speculate on the type of its child node
https://bugs.webkit.org/show_bug.cgi?id=161922
Reviewed by Filip Pizlo.
JSTests:
* microbenchmarks/map-key-well-typed.js: Added.
(assert):
(intKey):
(doubleKey):
(objectKey):
(stringKey):
(booleanKey):
(symbolKey):
(cellKey):
(assert.doubleKey):
(assert.booleanKey):
PerformanceTests:
I gave the main generator a name so it's easier to see what
it is when using the sampling profiler.
* ES6SampleBench/Basic/ast.js:
(Basic.Program):
Source/JavaScriptCore:
This allows us to remove runtime type checks when we've already
proven the type of the incoming value.
This is a 2-3% speedup on ES6SampleBench/Basic.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::wangsInt64Hash):
(JSC::FTL::DFG::LowerDFGToB3::mapHashString):
(JSC::FTL::DFG::LowerDFGToB3::compileMapHash):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>
<li><a href="#trunkPerformanceTestsChangeLog">trunk/PerformanceTests/ChangeLog</a></li>
<li><a href="#trunkPerformanceTestsES6SampleBenchBasicastjs">trunk/PerformanceTests/ES6SampleBench/Basic/ast.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkJSTestsmicrobenchmarksmapkeywelltypedjs">trunk/JSTests/microbenchmarks/map-key-well-typed.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/ChangeLog 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/JSTests/ChangeLog 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2016-10-03 Saam Barati <sbarati@apple.com>
+
+ MapHash should speculate on the type of its child node
+ https://bugs.webkit.org/show_bug.cgi?id=161922
+
+ Reviewed by Filip Pizlo.
+
+ * microbenchmarks/map-key-well-typed.js: Added.
+ (assert):
+ (intKey):
+ (doubleKey):
+ (objectKey):
+ (stringKey):
+ (booleanKey):
+ (symbolKey):
+ (cellKey):
+ (assert.doubleKey):
+ (assert.booleanKey):
+
</ins><span class="cx"> 2016-10-03 Yusuke Suzuki <utatane.tea@gmail.com>
</span><span class="cx">
</span><span class="cx"> [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
</span></span></pre></div>
<a id="trunkJSTestsmicrobenchmarksmapkeywelltypedjs"></a>
<div class="addfile"><h4>Added: trunk/JSTests/microbenchmarks/map-key-well-typed.js (0 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/microbenchmarks/map-key-well-typed.js (rev 0)
+++ trunk/JSTests/microbenchmarks/map-key-well-typed.js 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -0,0 +1,127 @@
</span><ins>+function assert(b) {
+ if (!b)
+ throw new Error("Bad!");
+}
+noInline(assert);
+
+let map = new Map;
+
+function intKey(key) {
+ key++;
+ key--;
+ return map.get(key);
+}
+noInline(intKey);
+
+function doubleKey(key) {
+ key += 0.5;
+ return map.get(key);
+}
+noInline(doubleKey);
+
+function objectKey(o) {
+ o.f;
+ return map.get(o);
+}
+noInline(objectKey);
+
+function stringKey(s) {
+ s = s + s;
+ s = s.toString();
+ return map.get(s);
+}
+noInline(stringKey);
+
+function booleanKey(boolValue) {
+ return map.get(!boolValue);
+}
+noInline(booleanKey);
+
+function symbolKey(o) {
+ let symbol = o.symbol;
+ return map.get(symbol);
+}
+noInline(symbolKey);
+
+function cellKey(k) {
+ return map.get(k);
+}
+noInline(cellKey);
+
+const iters = 300000;
+let start = Date.now();
+
+map.set(20, 50);
+for (let i = 0; i < iters; i++) {
+ assert(intKey(20) === 50);
+}
+
+map.set(20.5, 55);
+for (let i = 0; i < iters; i++) {
+ assert(doubleKey(20.0) === 55);
+}
+
+map.set(30.0, 60);
+for (let i = 0; i < iters; i++) {
+ assert(doubleKey(29.5) === 60);
+}
+
+{
+ let o = {f: 20};
+ map.set(o, o);
+ for (let i = 0; i < iters; i++) {
+ assert(objectKey(o) === o);
+ }
+ let str = "93421njkfsadhjklfsdahuy9i4312";
+ map.set(str, str);
+ for (let i = 0; i < 100; i++)
+ assert(objectKey(str) === str);
+}
+
+{
+ let s = "foofoo";
+ map.set(s, s);
+ for (let i = 0; i < iters; i++) {
+ assert(stringKey("foo") === s);
+ }
+}
+
+map.set(true, "abc");
+for (let i = 0; i < iters; i++) {
+ assert(booleanKey(false) === "abc");
+}
+
+map.set(false, "abcd");
+for (let i = 0; i < iters; i++) {
+ assert(booleanKey(true) === "abcd");
+}
+
+{
+ let symbol = Symbol();
+ let o = {symbol};
+ map.set(symbol, o);
+ for (let i = 0; i < iters; i++) {
+ assert(symbolKey(o) === o);
+ }
+}
+
+{
+ let o1 = {};
+ let o2 = {};
+ let s1 = "s1s1s1s1s1s1";
+ let s2 = "s1s1s1s1s1s1s2";
+ map.set(o1, o2);
+ map.set(s1, s2);
+ let keys = [o1, o2, s1, s2];
+ for (let i = 0; i < iters; i++) {
+ let k = keys[i % keys.length];
+ let result = k === o1 ? o2 :
+ k === s1 ? s2 :
+ undefined;
+ assert(cellKey(k) === result);
+ }
+}
+
+const verbose = false;
+if (verbose)
+ print(Date.now() - start);
</ins></span></pre></div>
<a id="trunkPerformanceTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/PerformanceTests/ChangeLog (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/PerformanceTests/ChangeLog 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/PerformanceTests/ChangeLog 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-10-03 Saam Barati <sbarati@apple.com>
+
+ MapHash should speculate on the type of its child node
+ https://bugs.webkit.org/show_bug.cgi?id=161922
+
+ Reviewed by Filip Pizlo.
+
+ I gave the main generator a name so it's easier to see what
+ it is when using the sampling profiler.
+
+ * ES6SampleBench/Basic/ast.js:
+ (Basic.Program):
+
</ins><span class="cx"> 2016-09-19 Sergio Villar Senin <svillar@igalia.com>
</span><span class="cx">
</span><span class="cx"> [css-grid] Remove the x2 computation of row sizes with indefinite heights
</span></span></pre></div>
<a id="trunkPerformanceTestsES6SampleBenchBasicastjs"></a>
<div class="modfile"><h4>Modified: trunk/PerformanceTests/ES6SampleBench/Basic/ast.js (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/PerformanceTests/ES6SampleBench/Basic/ast.js 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/PerformanceTests/ES6SampleBench/Basic/ast.js 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -257,7 +257,7 @@
</span><span class="cx">
</span><span class="cx"> Basic.End.isBlockEnd = true;
</span><span class="cx">
</span><del>-Basic.Program = function*(state)
</del><ins>+Basic.Program = function* programGenerator(state)
</ins><span class="cx"> {
</span><span class="cx"> state.validate(state.program == this, "State must match program");
</span><span class="cx"> let maxLineNumber = Math.max(...this.statements.keys());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2016-10-03 Saam Barati <sbarati@apple.com>
+
+ MapHash should speculate on the type of its child node
+ https://bugs.webkit.org/show_bug.cgi?id=161922
+
+ Reviewed by Filip Pizlo.
+
+ This allows us to remove runtime type checks when we've already
+ proven the type of the incoming value.
+
+ This is a 2-3% speedup on ES6SampleBench/Basic.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::wangsInt64Hash):
+ (JSC::FTL::DFG::LowerDFGToB3::mapHashString):
+ (JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
+
</ins><span class="cx"> 2016-10-03 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> B3 trapping memory accesses should be documented
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -1599,9 +1599,40 @@
</span><span class="cx"> fixEdge<KnownCellUse>(node->child1());
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case MapHash:
</del><ins>+ case MapHash: {
+ if (node->child1()->shouldSpeculateBoolean()) {
+ fixEdge<BooleanUse>(node->child1());
+ break;
+ }
+
+ if (node->child1()->shouldSpeculateInt32()) {
+ fixEdge<Int32Use>(node->child1());
+ break;
+ }
+
+ if (node->child1()->shouldSpeculateSymbol()) {
+ fixEdge<SymbolUse>(node->child1());
+ break;
+ }
+
+ if (node->child1()->shouldSpeculateObject()) {
+ fixEdge<ObjectUse>(node->child1());
+ break;
+ }
+
+ if (node->child1()->shouldSpeculateString()) {
+ fixEdge<StringUse>(node->child1());
+ break;
+ }
+
+ if (node->child1()->shouldSpeculateCell()) {
+ fixEdge<CellUse>(node->child1());
+ break;
+ }
+
</ins><span class="cx"> fixEdge<UntypedUse>(node->child1());
</span><span class="cx"> break;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> #if !ASSERT_DISABLED
</span><span class="cx"> // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -4602,6 +4602,79 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MapHash: {
</span><ins>+ switch (node->child1().useKind()) {
+ case BooleanUse:
+ case Int32Use:
+ case SymbolUse:
+ case ObjectUse: {
+ JSValueOperand input(this, node->child1(), ManualOperandSpeculation);
+ GPRTemporary result(this, Reuse, input);
+ GPRTemporary temp(this);
+
+ GPRReg inputGPR = input.gpr();
+ GPRReg resultGPR = result.gpr();
+ GPRReg tempGPR = temp.gpr();
+
+ speculate(node, node->child1());
+
+ m_jit.move(inputGPR, resultGPR);
+ m_jit.wangsInt64Hash(resultGPR, tempGPR);
+ int32Result(resultGPR, node);
+ break;
+ }
+ case CellUse:
+ case StringUse: {
+ SpeculateCellOperand input(this, node->child1());
+ GPRTemporary result(this);
+ Optional<GPRTemporary> temp;
+
+ GPRReg tempGPR;
+ if (node->child1().useKind() == CellUse) {
+ temp = GPRTemporary(this);
+ tempGPR = temp->gpr();
+ }
+
+ GPRReg inputGPR = input.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ MacroAssembler::JumpList slowPath;
+ MacroAssembler::JumpList done;
+
+ if (node->child1().useKind() == StringUse)
+ speculateString(node->child1(), inputGPR);
+ else {
+ auto isString = m_jit.branch8(MacroAssembler::Equal, MacroAssembler::Address(inputGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType));
+ m_jit.move(inputGPR, resultGPR);
+ m_jit.wangsInt64Hash(resultGPR, tempGPR);
+ done.append(m_jit.jump());
+ isString.link(&m_jit);
+ }
+
+ m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR);
+ slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));
+ m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR);
+ m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR);
+ slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR));
+ done.append(m_jit.jump());
+
+ slowPath.link(&m_jit);
+ silentSpillAllRegisters(resultGPR);
+ callOperation(operationMapHash, resultGPR, JSValueRegs(inputGPR));
+ silentFillAllRegisters(resultGPR);
+ m_jit.exceptionCheck();
+
+ done.link(&m_jit);
+ int32Result(resultGPR, node);
+ break;
+ }
+ default:
+ RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
+ break;
+ }
+
+ if (node->child1().useKind() != UntypedUse)
+ break;
+
</ins><span class="cx"> JSValueOperand input(this, node->child1());
</span><span class="cx"> GPRTemporary temp(this);
</span><span class="cx"> GPRTemporary result(this);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (206745 => 206746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-10-03 20:31:06 UTC (rev 206745)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-10-03 20:49:34 UTC (rev 206746)
</span><span class="lines">@@ -6335,8 +6335,121 @@
</span><span class="cx"> setBoolean(m_out.phi(Int32, notCellResult, cellResult));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ LValue wangsInt64Hash(LValue input)
+ {
+ // key += ~(key << 32);
+ LValue key = input;
+ LValue temp = key;
+ temp = m_out.shl(temp, m_out.constInt32(32));
+ temp = m_out.bitNot(temp);
+ key = m_out.add(key, temp);
+ // key ^= (key >> 22);
+ temp = key;
+ temp = m_out.lShr(temp, m_out.constInt32(22));
+ key = m_out.bitXor(key, temp);
+ // key += ~(key << 13);
+ temp = key;
+ temp = m_out.shl(temp, m_out.constInt32(13));
+ temp = m_out.bitNot(temp);
+ key = m_out.add(key, temp);
+ // key ^= (key >> 8);
+ temp = key;
+ temp = m_out.lShr(temp, m_out.constInt32(8));
+ key = m_out.bitXor(key, temp);
+ // key += (key << 3);
+ temp = key;
+ temp = m_out.shl(temp, m_out.constInt32(3));
+ key = m_out.add(key, temp);
+ // key ^= (key >> 15);
+ temp = key;
+ temp = m_out.lShr(temp, m_out.constInt32(15));
+ key = m_out.bitXor(key, temp);
+ // key += ~(key << 27);
+ temp = key;
+ temp = m_out.shl(temp, m_out.constInt32(27));
+ temp = m_out.bitNot(temp);
+ key = m_out.add(key, temp);
+ // key ^= (key >> 31);
+ temp = key;
+ temp = m_out.lShr(temp, m_out.constInt32(31));
+ key = m_out.bitXor(key, temp);
+ key = m_out.castToInt32(key);
+
+ return key;
+ }
+
+ LValue mapHashString(LValue string)
+ {
+ LBasicBlock nonEmptyStringCase = m_out.newBlock();
+ LBasicBlock slowCase = m_out.newBlock();
+ LBasicBlock continuation = m_out.newBlock();
+
+ LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
+ m_out.branch(
+ m_out.equal(stringImpl, m_out.constIntPtr(0)), unsure(slowCase), unsure(nonEmptyStringCase));
+
+ LBasicBlock lastNext = m_out.appendTo(nonEmptyStringCase, slowCase);
+ LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
+ ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash);
+ m_out.branch(m_out.equal(hash, m_out.constInt32(0)),
+ unsure(slowCase), unsure(continuation));
+
+ m_out.appendTo(slowCase, continuation);
+ ValueFromBlock slowResult = m_out.anchor(
+ vmCall(Int32, m_out.operation(operationMapHash), m_callFrame, string));
+ m_out.jump(continuation);
+
+ m_out.appendTo(continuation, lastNext);
+ return m_out.phi(Int32, slowResult, nonEmptyStringHashResult);
+ }
+
</ins><span class="cx"> void compileMapHash()
</span><span class="cx"> {
</span><ins>+ switch (m_node->child1().useKind()) {
+ case BooleanUse:
+ case Int32Use:
+ case SymbolUse:
+ case ObjectUse: {
+ LValue key = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+ speculate(m_node->child1());
+ setInt32(wangsInt64Hash(key));
+ return;
+ }
+
+ case CellUse: {
+ LBasicBlock isString = m_out.newBlock();
+ LBasicBlock notString = m_out.newBlock();
+ LBasicBlock continuation = m_out.newBlock();
+
+ LValue value = lowCell(m_node->child1());
+ LValue isStringValue = m_out.equal(m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType), m_out.constInt32(StringType));
+ m_out.branch(
+ isStringValue, unsure(isString), unsure(notString));
+
+ LBasicBlock lastNext = m_out.appendTo(isString, notString);
+ ValueFromBlock stringResult = m_out.anchor(mapHashString(value));
+ m_out.jump(continuation);
+
+ m_out.appendTo(notString, continuation);
+ ValueFromBlock notStringResult = m_out.anchor(wangsInt64Hash(value));
+ m_out.jump(continuation);
+
+ m_out.appendTo(continuation, lastNext);
+ setInt32(m_out.phi(Int32, stringResult, notStringResult));
+ return;
+ }
+
+ case StringUse: {
+ LValue string = lowString(m_node->child1());
+ setInt32(mapHashString(string));
+ return;
+ }
+
+ default:
+ RELEASE_ASSERT(m_node->child1().useKind() == UntypedUse);
+ break;
+ }
+
</ins><span class="cx"> LValue value = lowJSValue(m_node->child1());
</span><span class="cx">
</span><span class="cx"> LBasicBlock isCellCase = m_out.newBlock();
</span><span class="lines">@@ -6365,7 +6478,7 @@
</span><span class="cx"> LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
</span><span class="cx"> ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash);
</span><span class="cx"> m_out.branch(m_out.equal(hash, m_out.constInt32(0)),
</span><del>- rarely(slowCase), usually(continuation));
</del><ins>+ unsure(slowCase), unsure(continuation));
</ins><span class="cx">
</span><span class="cx"> m_out.appendTo(notCell, isNumberCase);
</span><span class="cx"> m_out.branch(
</span><span class="lines">@@ -6376,45 +6489,7 @@
</span><span class="cx"> isInt32(value), unsure(straightHash), unsure(slowCase));
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(straightHash, slowCase);
</span><del>- // key += ~(key << 32);
- LValue key = value;
- LValue temp = key;
- temp = m_out.shl(temp, m_out.constInt32(32));
- temp = m_out.bitNot(temp);
- key = m_out.add(key, temp);
- // key ^= (key >> 22);
- temp = key;
- temp = m_out.lShr(temp, m_out.constInt32(22));
- key = m_out.bitXor(key, temp);
- // key += ~(key << 13);
- temp = key;
- temp = m_out.shl(temp, m_out.constInt32(13));
- temp = m_out.bitNot(temp);
- key = m_out.add(key, temp);
- // key ^= (key >> 8);
- temp = key;
- temp = m_out.lShr(temp, m_out.constInt32(8));
- key = m_out.bitXor(key, temp);
- // key += (key << 3);
- temp = key;
- temp = m_out.shl(temp, m_out.constInt32(3));
- key = m_out.add(key, temp);
- // key ^= (key >> 15);
- temp = key;
- temp = m_out.lShr(temp, m_out.constInt32(15));
- key = m_out.bitXor(key, temp);
- // key += ~(key << 27);
- temp = key;
- temp = m_out.shl(temp, m_out.constInt32(27));
- temp = m_out.bitNot(temp);
- key = m_out.add(key, temp);
- // key ^= (key >> 31);
- temp = key;
- temp = m_out.lShr(temp, m_out.constInt32(31));
- key = m_out.bitXor(key, temp);
- key = m_out.castToInt32(key);
-
- ValueFromBlock fastResult = m_out.anchor(key);
</del><ins>+ ValueFromBlock fastResult = m_out.anchor(wangsInt64Hash(value));
</ins><span class="cx"> m_out.jump(continuation);
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(slowCase, continuation);
</span></span></pre>
</div>
</div>
</body>
</html>