nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dfg-convert-this-polymorphi...

10 lines
277 B
Plaintext
Raw Permalink Normal View History

ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding https://bugs.webkit.org/show_bug.cgi?id=111674 Source/JavaScriptCore: Reviewed by Oliver Hunt. This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup convert them to either Identity(Object:@child) if the child is predicted object, or Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other. The goal of this is to ensure that the optimization fixpoint doesn't create Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up but I'm hoping this will be a step towards reducing the need to rerun the fixpoint so as to ultimately reduce compile times. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::executeEffects): * dfg/DFGAssemblyHelpers.h: (AssemblyHelpers): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (FixupPhase): (JSC::DFG::FixupPhase::observeUseKindOnNode): (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable): * dfg/DFGGraph.h: (JSC::DFG::Graph::globalThisObjectFor): (Graph): * dfg/DFGNode.h: (Node): (JSC::DFG::Node::convertToIdentity): (JSC::DFG::Node::convertToWeakConstant): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): LayoutTests: Reviewed by Oliver Hunt. * fast/js/dfg-convert-this-object-then-exit-on-other-expected.txt: Added. * fast/js/dfg-convert-this-object-then-exit-on-other.html: Added. * fast/js/dfg-convert-this-other-then-exit-on-object-expected.txt: Added. * fast/js/dfg-convert-this-other-then-exit-on-object.html: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other-expected.txt: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other.html: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string-expected.txt: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string.html: Added. * fast/js/jsc-test-list: * fast/js/script-tests/dfg-convert-this-object-then-exit-on-other.js: Added. (foo): * fast/js/script-tests/dfg-convert-this-other-then-exit-on-object.js: Added. (foo): * fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js: Added. (foo): * fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js: Added. (foo): Canonical link: https://commits.webkit.org/130055@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@145052 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-03-07 09:04:57 +00:00
Tests that a convert_this optimized for the case where this is an object with polymorphic structure behaves correctly when you then pass a string.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
REGRESSION(149636, merged in 153145): ToThis conversion doesn't work in the DFG https://bugs.webkit.org/show_bug.cgi?id=120781 Reviewed by Mark Hahnenberg. Roll this back in with a build fix. - Use some method table hacks to detect if the CheckStructure optimization is valid for to_this. - Introduce a FinalObjectUse and use it for ToThis->Identity conversion. This looks like it might be perf-neutral on the major benchmarks, but it introduces some horrible performance cliffs. For example if you add methods to the Array prototype, you'll get horrible performance cliffs. As in virtual calls to C++ every time you call a JS function even if it's inlined. LongSpider/3d-cube appears to hit this. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGRepatch.cpp: (JSC::DFG::emitPutTransitionStub): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateFinalObject): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::isCell): Canonical link: https://commits.webkit.org/138810@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@155201 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-09-06 19:01:21 +00:00
Passed some tests silently.
ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding https://bugs.webkit.org/show_bug.cgi?id=111674 Source/JavaScriptCore: Reviewed by Oliver Hunt. This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup convert them to either Identity(Object:@child) if the child is predicted object, or Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other. The goal of this is to ensure that the optimization fixpoint doesn't create Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up but I'm hoping this will be a step towards reducing the need to rerun the fixpoint so as to ultimately reduce compile times. * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::executeEffects): * dfg/DFGAssemblyHelpers.h: (AssemblyHelpers): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (FixupPhase): (JSC::DFG::FixupPhase::observeUseKindOnNode): (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable): * dfg/DFGGraph.h: (JSC::DFG::Graph::globalThisObjectFor): (Graph): * dfg/DFGNode.h: (Node): (JSC::DFG::Node::convertToIdentity): (JSC::DFG::Node::convertToWeakConstant): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): LayoutTests: Reviewed by Oliver Hunt. * fast/js/dfg-convert-this-object-then-exit-on-other-expected.txt: Added. * fast/js/dfg-convert-this-object-then-exit-on-other.html: Added. * fast/js/dfg-convert-this-other-then-exit-on-object-expected.txt: Added. * fast/js/dfg-convert-this-other-then-exit-on-object.html: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other-expected.txt: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other.html: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string-expected.txt: Added. * fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string.html: Added. * fast/js/jsc-test-list: * fast/js/script-tests/dfg-convert-this-object-then-exit-on-other.js: Added. (foo): * fast/js/script-tests/dfg-convert-this-other-then-exit-on-object.js: Added. (foo): * fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js: Added. (foo): * fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js: Added. (foo): Canonical link: https://commits.webkit.org/130055@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@145052 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-03-07 09:04:57 +00:00
TEST COMPLETE