DFG int-to-double conversion should be revealed to CSE
https://bugs.webkit.org/show_bug.cgi?id=82135
Reviewed by Oliver Hunt.
This introduces the notion of an Int32ToDouble node, which is injected
into the graph anytime we know that we have a double use of a node that
was predicted integer. The Int32ToDouble simplifies double speculation
on integers by skipping the path that would unbox doubles, if we know
that the value is already proven to be an integer. It allows integer to
double conversions to be subjected to common subexpression elimination
(CSE) by allowing the CSE phase to see where these conversions are
occurring. Finally, it allows us to see when a constant is being used
as both a double and an integer. This is a bit odd, since it means that
sometimes a double use of a constant will not refer directly to the
constant. This should not cause problems, for now, but it may require
some canonizalization in the future if we want to support strength
reductions of double operations based on constants.
To allow injection of nodes into the graph, this change introduces the
DFG::InsertionSet, which is a way of lazily inserting elements into a
list. This allows the FixupPhase to remain O(N) despite performing
multiple injections in a single basic block. Without the InsertionSet,
each injection would require performing an insertion into a vector,
which is O(N), leading to O(N^2) performance overall. With the
InsertionSet, each injection simply records what insertion would have
been performed, and all insertions are performed at once (via
InsertionSet::execute) after processing of a basic block is completed.
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/PredictedType.h:
(JSC::isActionableIntMutableArrayPrediction):
(JSC):
(JSC::isActionableFloatMutableArrayPrediction):
(JSC::isActionableTypedMutableArrayPrediction):
(JSC::isActionableMutableArrayPrediction):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGCommon.h:
(JSC::DFG::useKindToString):
(DFG):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupBlock):
(FixupPhase):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
* dfg/DFGInsertionSet.h: Added.
(DFG):
(Insertion):
(JSC::DFG::Insertion::Insertion):
(JSC::DFG::Insertion::index):
(JSC::DFG::Insertion::element):
(InsertionSet):
(JSC::DFG::InsertionSet::InsertionSet):
(JSC::DFG::InsertionSet::append):
(JSC::DFG::InsertionSet::execute):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
(DFG):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
(JSC::DFG::IntegerOperand::IntegerOperand):
(JSC::DFG::DoubleOperand::DoubleOperand):
(JSC::DFG::JSValueOperand::JSValueOperand):
(JSC::DFG::StorageOperand::StorageOperand):
(JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
(JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
(JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
(JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
(JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@112040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 6579d82..b704996 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -29,6 +29,7 @@
#if ENABLE(DFG_JIT)
#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
#include "DFGPhase.h"
namespace JSC { namespace DFG {
@@ -42,11 +43,20 @@
void run()
{
- for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
- fixupNode(m_graph[m_compileIndex]);
+ for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex)
+ fixupBlock(m_graph.m_blocks[blockIndex].get());
}
private:
+ void fixupBlock(BasicBlock* block)
+ {
+ for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
+ m_compileIndex = block->at(m_indexInBlock);
+ fixupNode(m_graph[m_compileIndex]);
+ }
+ m_insertionSet.execute(*block);
+ }
+
void fixupNode(Node& node)
{
if (!node.shouldGenerate())
@@ -152,11 +162,130 @@
break;
}
+ case CompareEq:
+ case CompareLess:
+ case CompareLessEq:
+ case CompareGreater:
+ case CompareGreaterEq:
+ case CompareStrictEq: {
+ if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()]))
+ break;
+ if (!Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
+ break;
+ fixDoubleEdge(0);
+ fixDoubleEdge(1);
+ break;
+ }
+
+ case LogicalNot: {
+ if (m_graph[node.child1()].shouldSpeculateInteger())
+ break;
+ if (!m_graph[node.child1()].shouldSpeculateNumber())
+ break;
+ fixDoubleEdge(0);
+ break;
+ }
+
+ case Branch: {
+ if (m_graph[node.child1()].shouldSpeculateInteger())
+ break;
+ if (!m_graph[node.child1()].shouldSpeculateNumber())
+ break;
+ fixDoubleEdge(0);
+ break;
+ }
+
+ case SetLocal: {
+ if (m_graph.isCaptured(node.local()))
+ break;
+ if (!node.variableAccessData()->shouldUseDoubleFormat())
+ break;
+ fixDoubleEdge(0);
+ break;
+ }
+
+ case ArithAdd:
+ case ValueAdd: {
+ if (m_graph.addShouldSpeculateInteger(node))
+ break;
+ if (!Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
+ break;
+ fixDoubleEdge(0);
+ fixDoubleEdge(1);
+ break;
+ }
+
+ case ArithSub: {
+ if (m_graph.addShouldSpeculateInteger(node)
+ && node.canSpeculateInteger())
+ break;
+ fixDoubleEdge(0);
+ fixDoubleEdge(1);
+ break;
+ }
+
+ case ArithNegate: {
+ if (m_graph.negateShouldSpeculateInteger(node))
+ break;
+ fixDoubleEdge(0);
+ break;
+ }
+
+ case ArithMin:
+ case ArithMax:
+ case ArithMul:
+ case ArithDiv:
+ case ArithMod: {
+ if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
+ && node.canSpeculateInteger())
+ break;
+ fixDoubleEdge(0);
+ fixDoubleEdge(1);
+ break;
+ }
+
+ case ArithAbs: {
+ if (m_graph[node.child1()].shouldSpeculateInteger()
+ && node.canSpeculateInteger())
+ break;
+ fixDoubleEdge(0);
+ break;
+ }
+
+ case ArithSqrt: {
+ fixDoubleEdge(0);
+ break;
+ }
+
+ case PutByVal: {
+ if (!m_graph[node.child1()].prediction() || !m_graph[node.child2()].prediction())
+ break;
+ if (!m_graph[node.child2()].shouldSpeculateInteger())
+ break;
+ if (isActionableIntMutableArrayPrediction(m_graph[node.child1()].prediction())) {
+ if (m_graph[node.child3()].isConstant())
+ break;
+ if (m_graph[node.child3()].shouldSpeculateInteger())
+ break;
+ fixDoubleEdge(2);
+ break;
+ }
+ if (isActionableFloatMutableArrayPrediction(m_graph[node.child1()].prediction())) {
+ fixDoubleEdge(2);
+ break;
+ }
+ break;
+ }
+
default:
break;
}
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+ if (!(node.flags() & NodeHasVarArgs)) {
+ dataLog("new children: ");
+ node.dumpChildren(WTF::dataFile());
+ }
dataLog("\n");
#endif
}
@@ -179,7 +308,39 @@
edge = newEdge;
}
+ void fixDoubleEdge(unsigned childIndex)
+ {
+ Node& source = m_graph[m_compileIndex];
+ Edge& edge = source.children.child(childIndex);
+
+ if (!m_graph[edge].shouldSpeculateInteger()) {
+ edge.setUseKind(DoubleUse);
+ return;
+ }
+
+ NodeIndex resultIndex = (NodeIndex)m_graph.size();
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+ dataLog("(replacing @%u->@%u with @%u->@%u) ",
+ m_compileIndex, edge.index(), m_compileIndex, resultIndex);
+#endif
+
+ // Fix the edge up here because it's a reference that will be clobbered by
+ // the append() below.
+ NodeIndex oldIndex = edge.index();
+ edge = Edge(resultIndex, DoubleUse);
+
+ m_graph.append(Node(Int32ToDouble, source.codeOrigin, oldIndex));
+ m_insertionSet.append(m_indexInBlock, resultIndex);
+
+ Node& int32ToDouble = m_graph[resultIndex];
+ int32ToDouble.predict(PredictDouble);
+ int32ToDouble.ref();
+ }
+
+ unsigned m_indexInBlock;
NodeIndex m_compileIndex;
+ InsertionSet<NodeIndex> m_insertionSet;
};
void performFixup(Graph& graph)
