Attachment 348706 Details for Bug 189151 – Patch

[patch] Patch

bug-189151-20180901144242.patch (text/plain), 6.63 KB, created by Yusuke Suzuki on 2018-08-31 22:42:43 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2018-08-31 22:42:43 PDT

Size: 6.63 KB

patch

obsolete

>Subversion Revision: 235579
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 4d5e2e36ff39eb349b80e45070cd2547f9139fdc..4aa6b0d9438e73a136c0f4f28f3c665438827337 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,26 @@
>+2018-08-31  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [DFG] DFG should handle String#toString
>+        https://bugs.webkit.org/show_bug.cgi?id=189151
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        String#toString and String#valueOf can be easily handled in DFG by using Check and ToString nodes.
>+        Since both operations (actually String#toString and String#valueOf are the same function instance)
>+        only accept String and StringObject, we emit Check(StringOrStringObjectUse) to make the other types
>+        OSR exits. And we put ToString node for an argument. This ToString node will be correctly lowered
>+        to Identity or ToString with an appropriate check in the fixup phase.
>+
>+        It improves simple microbenchmarks by 38 - 46%.
>+
>+                                              baseline                  patched
>+
>+            string-object-value-of        21.7000+-3.6626     ^     14.8482+-0.3012        ^ definitely 1.4615x faster
>+            string-object-to-string       20.4092+-0.7659     ^     14.7324+-0.2914        ^ definitely 1.3853x faster
>+
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
>+
> 2018-08-31  Mark Lam  <mark.lam@apple.com>
> 
>         Fix exception check accounting in constructJSWebAssemblyCompileError().
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index d1e6d1951aad3ab18f86b465051f999fc1cb96d6..0a346aa1bd87cb425270a507900ea0786c612958 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -2691,6 +2691,14 @@ bool ByteCodeParser::handleIntrinsicCall(Node* callee, int resultOperand, Intrin
>         return true;
>     }
> 
>+    case StringPrototypeValueOfIntrinsic: {
>+        insertChecks();
>+        Node* value = get(virtualRegisterForArgument(0, registerOffset));
>+        addToGraph(Check, Edge(value, StringOrStringObjectUse));
>+        set(VirtualRegister(resultOperand), addToGraph(ToString, value));
>+        return true;
>+    }
>+
>     case StringPrototypeReplaceIntrinsic: {
>         if (argumentCountIncludingThis != 3)
>             return false;
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 613d70088fdf876bd057cc042d70d2bc037c12f7..84c29c8cfa8057de1e03bab286c4ebb3e597f00b 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,25 @@
>+2018-08-31  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [DFG] DFG should handle String#toString
>+        https://bugs.webkit.org/show_bug.cgi?id=189151
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * microbenchmarks/string-object-to-string.js: Added.
>+        (test):
>+        * microbenchmarks/string-object-value-of.js: Added.
>+        (test):
>+        * stress/string-to-string.js: Added.
>+        (shouldBe):
>+        (test1):
>+        (test2):
>+        (test3):
>+        * stress/string-value-of.js: Added.
>+        (shouldBe):
>+        (test1):
>+        (test2):
>+        (test3):
>+
> 2018-08-31  Mark Lam  <mark.lam@apple.com>
> 
>         Fix exception check accounting in constructJSWebAssemblyCompileError().
>diff --git a/JSTests/microbenchmarks/string-object-to-string.js b/JSTests/microbenchmarks/string-object-to-string.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..8d866550df94cd23a38ed2aa4b6d636491da70cd
>--- /dev/null
>+++ b/JSTests/microbenchmarks/string-object-to-string.js
>@@ -0,0 +1,15 @@
>+const chars = 'abcdefghijklmnopqrstuvwxyz';
>+var prim = '';
>+for (var i = 0; i < 32768; i++) {
>+    prim += chars.charAt(~~(Math.random() * 26));
>+}
>+const obj = new String(prim);
>+
>+function test(obj)
>+{
>+    return obj.toString();
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e6; ++i)
>+    test(obj);
>diff --git a/JSTests/microbenchmarks/string-object-value-of.js b/JSTests/microbenchmarks/string-object-value-of.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..b71eb9c579836a800445f805c8cf4df1d3ac4f40
>--- /dev/null
>+++ b/JSTests/microbenchmarks/string-object-value-of.js
>@@ -0,0 +1,15 @@
>+const chars = 'abcdefghijklmnopqrstuvwxyz';
>+var prim = '';
>+for (var i = 0; i < 32768; i++) {
>+    prim += chars.charAt(~~(Math.random() * 26));
>+}
>+const obj = new String(prim);
>+
>+function test(obj)
>+{
>+    return obj.valueOf();
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 1e6; ++i)
>+    test(obj);
>diff --git a/JSTests/stress/string-to-string.js b/JSTests/stress/string-to-string.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..ba0e7e3d60ad6575dcaa370cc958f9daa6e476cc
>--- /dev/null
>+++ b/JSTests/stress/string-to-string.js
>@@ -0,0 +1,38 @@
>+function shouldBe(actual, expected) {
>+    if (actual !== expected)
>+        throw new Error('bad value: ' + actual);
>+}
>+
>+function test1(string)
>+{
>+    return string.toString();
>+}
>+noInline(test1);
>+
>+function test2(string)
>+{
>+    return string.toString();
>+}
>+noInline(test2);
>+
>+function test3(string)
>+{
>+    return string.toString();
>+}
>+noInline(test3);
>+
>+var string = "Hello";
>+var stringObject = new String(string);
>+
>+for (var i = 0; i < 1e6; ++i) {
>+    shouldBe(test1(string), string);
>+    shouldBe(test2(stringObject), string);
>+    if (i & 1)
>+        shouldBe(test3(string), string);
>+    else
>+        shouldBe(test3(stringObject), string);
>+}
>+
>+shouldBe(test1({}), `[object Object]`);
>+shouldBe(test2({}), `[object Object]`);
>+shouldBe(test3({}), `[object Object]`);
>diff --git a/JSTests/stress/string-value-of.js b/JSTests/stress/string-value-of.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..4f6d2fd5ec6970b5eefee5e09db66a4a83d18c28
>--- /dev/null
>+++ b/JSTests/stress/string-value-of.js
>@@ -0,0 +1,39 @@
>+function shouldBe(actual, expected) {
>+    if (actual !== expected)
>+        throw new Error('bad value: ' + actual);
>+}
>+
>+function test1(string)
>+{
>+    return string.valueOf();
>+}
>+noInline(test1);
>+
>+function test2(string)
>+{
>+    return string.valueOf();
>+}
>+noInline(test2);
>+
>+function test3(string)
>+{
>+    return string.valueOf();
>+}
>+noInline(test3);
>+
>+var string = "Hello";
>+var stringObject = new String(string);
>+
>+for (var i = 0; i < 1e6; ++i) {
>+    shouldBe(test1(string), string);
>+    shouldBe(test2(stringObject), string);
>+    if (i & 1)
>+        shouldBe(test3(string), string);
>+    else
>+        shouldBe(test3(stringObject), string);
>+}
>+
>+var object = {};
>+shouldBe(test1(object), object);
>+shouldBe(test2(object), object);
>+shouldBe(test3(object), object);

Actions: View | Formatted Diff | Diff

Attachments on bug 189151: 348495 | 348629 | 348706 | 349041