Attachment 357116 Details for Bug 192620 – WIP

[patch] WIP

bug-192620-20181212195820.patch (text/plain), 18.25 KB, created by Yusuke Suzuki on 2018-12-12 02:58:21 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2018-12-12 02:58:21 PST

Size: 18.25 KB

patch

obsolete

>Subversion Revision: 239102
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 31522434d77a3ffa3b1ef47ca56d57c52db43d66..bbaf27f75f6436b98d1d55b47034af2c7a9e366f 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,52 @@
>+2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [DFG][FTL] Add NewSymbol
>+        https://bugs.webkit.org/show_bug.cgi?id=192620
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This patch introduces NewSymbol DFG node into DFG and FTL tiers. The main goal of this patch is not optimize
>+        NewSymbol code faster. Rather than that, this patch intends to offer SpecSymbol type information into DFG's
>+        data flow to optimize generated code in FTL backend.
>+
>+        We add NewSymbol DFG node, which may take an argument. If an argument is not given, NewSymbol is for `Symbol()`.
>+        If an argument is given, ToString is emitted to this argument before passing it to NewSymbol. So NewSymbol node
>+        itself does not perform any type checks. Since `NewSymbol` will not exit except for OOM, we can just use ToString
>+        here.
>+
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
>+        * dfg/DFGClobberize.h:
>+        (JSC::DFG::clobberize):
>+        * dfg/DFGClobbersExitState.cpp:
>+        (JSC::DFG::clobbersExitState):
>+        * dfg/DFGDoesGC.cpp:
>+        (JSC::DFG::doesGC):
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGMayExit.cpp:
>+        * dfg/DFGNodeType.h:
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileNewSymbol):
>+        * dfg/DFGSpeculativeJIT.h:
>+        * dfg/DFGSpeculativeJIT32_64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
>+        * ftl/FTLCapabilities.cpp:
>+        (JSC::FTL::canCompile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNewSymbol):
>+
> 2018-12-11  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         [BigInt] Simplify boolean context evaluation by leveraging JSString::offsetOfLength() == JSBigInt::offsetOfLength()
>diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>index c8f66dde246ac8dcc5736cc65466ba812932b963..f592dd1848c611fb238bd0430c210f27686f10a5 100644
>--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>@@ -2424,6 +2424,11 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>         setForNode(node, node->structure());
>         break;
>     }
>+
>+    case NewSymbol: {
>+        setForNode(node, m_vm.symbolStructure.get());
>+        break;
>+    }
>             
>     case NewArray:
>         ASSERT(node->indexingMode() == node->indexingType()); // Copy on write arrays should only be created by NewArrayBuffer.
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index aa23167327c6de6814614a2a314b5b7a2f03d0b8..edb0c64e20d2569380035e66565156ae40a3ca30 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -65,6 +65,7 @@
> #include "StackAlignment.h"
> #include "StringConstructor.h"
> #include "StructureStubInfo.h"
>+#include "SymbolConstructor.h"
> #include "Watchdog.h"
> #include <wtf/CommaPrinter.h>
> #include <wtf/HashMap.h>
>@@ -3712,6 +3713,20 @@ bool ByteCodeParser::handleConstantInternalFunction(
>         return true;
>     }
> 
>+    if (function->classInfo() == SymbolConstructor::info() && kind == CodeForCall) {
>+        insertChecks();
>+
>+        Node* resultNode;
>+
>+        if (argumentCountIncludingThis <= 1)
>+            resultNode = addToGraph(NewSymbol);
>+        else
>+            resultNode = addToGraph(NewSymbol, addToGraph(ToString, get(virtualRegisterForArgument(1, registerOffset))));
>+
>+        set(result, resultNode);
>+        return true;
>+    }
>+
>     // FIXME: This should handle construction as well. https://bugs.webkit.org/show_bug.cgi?id=155591
>     if (function->classInfo() == ObjectConstructor::info() && kind == CodeForCall) {
>         insertChecks();
>diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
>index 95404f3f920dd99d6311875feb82a9ba393b2b64..166e4195a5f21ac5b7192db9976bb9b25b729949 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
>+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
>@@ -1531,6 +1531,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
> 
>     case NewObject:
>     case NewRegexp:
>+    case NewSymbol:
>     case NewStringObject:
>     case PhantomNewObject:
>     case MaterializeNewObject:
>diff --git a/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp b/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
>index facdbfb40f6f1ebbebb5f0fedad221e30da0c826..fddd5187086d99c31861f64c9833f0db4719c603 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
>@@ -58,6 +58,7 @@ bool clobbersExitState(Graph& graph, Node* node)
>     case Arrayify:
>     case NewObject:
>     case NewRegexp:
>+    case NewSymbol:
>     case NewStringObject:
>     case PhantomNewObject:
>     case MaterializeNewObject:
>diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>index 64e2f5efecad64b3013d4189e2849cb153498f69..808932f993acfd02671d2fda56abb49c9fd3890a 100644
>--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>@@ -350,6 +350,7 @@ bool doesGC(Graph& graph, Node* node)
>     case NewArrayBuffer:
>     case NewRegexp:
>     case NewStringObject:
>+    case NewSymbol:
>     case MakeRope:
>     case NewFunction:
>     case NewGeneratorFunction:
>diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>index 5b0de12fa5067183c6b886f11fc0cb04980cb91c..593ddf2e0a16f3cd024a78a10fb63109ebaffae8 100644
>--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>@@ -1274,6 +1274,12 @@ class FixupPhase : public Phase {
>             break;
>         }
> 
>+        case NewSymbol: {
>+            if (node->child1())
>+                fixEdge<KnownStringUse>(node->child1());
>+            break;
>+        }
>+
>         case NewArrayWithSpread: {
>             watchHavingABadTime(node);
>             
>diff --git a/Source/JavaScriptCore/dfg/DFGMayExit.cpp b/Source/JavaScriptCore/dfg/DFGMayExit.cpp
>index 11d90d1db1fe39205307c989f890731fd2fa5556..5cbfae8625c8e0bcfe8763447bc9bf1e4b552870 100644
>--- a/Source/JavaScriptCore/dfg/DFGMayExit.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGMayExit.cpp
>@@ -124,6 +124,7 @@ ExitMode mayExitImpl(Graph& graph, Node* node, StateType& state)
>     case NewAsyncFunction:
>     case NewAsyncGeneratorFunction:
>     case NewStringObject:
>+    case NewSymbol:
>     case NewRegexp:
>     case ToNumber:
>     case RegExpExecNonGlobalOrSticky:
>diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
>index 40f62645769f191f17bf6bfe1b831b1cabf77b19..3817fb2aa21f07d61d214c39d44ca72c02fbd2f0 100644
>--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
>+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
>@@ -336,6 +336,8 @@ namespace JSC { namespace DFG {
>     macro(NewArrayBuffer, NodeResultJS) \
>     macro(NewTypedArray, NodeResultJS | NodeMustGenerate) \
>     macro(NewRegexp, NodeResultJS) \
>+    macro(NewSymbol, NodeResultJS) \
>+    macro(NewStringObject, NodeResultJS) \
>     /* Rest Parameter */\
>     macro(GetRestLength, NodeResultInt32) \
>     macro(CreateRest, NodeResultJS | NodeMustGenerate) \
>@@ -380,7 +382,6 @@ namespace JSC { namespace DFG {
>     macro(CallStringConstructor, NodeResultJS | NodeMustGenerate) \
>     macro(NumberToStringWithRadix, NodeResultJS | NodeMustGenerate) \
>     macro(NumberToStringWithValidRadixConstant, NodeResultJS) \
>-    macro(NewStringObject, NodeResultJS) \
>     macro(MakeRope, NodeResultJS) \
>     macro(InByVal, NodeResultBoolean | NodeMustGenerate) \
>     macro(InById, NodeResultBoolean | NodeMustGenerate) \
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>index be992af6f638f396687b22f84d6aa30f09fbd818..81f16c5d3a918545b4a885ec7f8352b2714288fc 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
>@@ -2230,6 +2230,22 @@ JSString* JIT_OPERATION operationSingleCharacterString(ExecState* exec, int32_t
>     return jsSingleCharacterString(exec, static_cast<UChar>(character));
> }
> 
>+Symbol* JIT_OPERATION operationNewSymbol(ExecState* exec)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    return Symbol::create(vm);
>+}
>+
>+Symbol* JIT_OPERATION operationNewSymbolWithDescription(ExecState* exec, JSString* description)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    return Symbol::create(exec, description);
>+}
>+
> JSCell* JIT_OPERATION operationNewStringObject(ExecState* exec, JSString* string, Structure* structure)
> {
>     VM& vm = exec->vm();
>diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
>index e455609a1f599eceea0186b3f6dbeb1a618bef41..4e35634db7346cc597fcf878fe5077b77728c2a5 100644
>--- a/Source/JavaScriptCore/dfg/DFGOperations.h
>+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
>@@ -219,6 +219,8 @@ EncodedJSValue JIT_OPERATION operationParseIntStringNoRadix(ExecState*, JSString
> EncodedJSValue JIT_OPERATION operationParseIntString(ExecState*, JSString*, int32_t);
> EncodedJSValue JIT_OPERATION operationParseIntGeneric(ExecState*, EncodedJSValue, int32_t);
> 
>+Symbol* JIT_OPERATION operationNewSymbol(ExecState*);
>+Symbol* JIT_OPERATION operationNewSymbolWithDescription(ExecState*, JSString*);
> JSCell* JIT_OPERATION operationNewStringObject(ExecState*, JSString*, Structure*);
> JSString* JIT_OPERATION operationToStringOnCell(ExecState*, JSCell*);
> JSString* JIT_OPERATION operationToString(ExecState*, EncodedJSValue);
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index e8299eb873c5061abb4a45f0dc1b17d239025a30..72e15faabe3c35d67a722a1c403eccf2a2491f6a 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -1019,6 +1019,10 @@ class PredictionPropagationPhase : public Phase {
>             setPrediction(SpecStringObject);
>             break;
>         }
>+        case NewSymbol: {
>+            setPrediction(SpecSymbol);
>+            break;
>+        }
>             
>         case CreateDirectArguments: {
>             setPrediction(SpecDirectArguments);
>diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>index 07cf01f38eb6ef13a3a2c4d06f85e5d73aa804a0..dc751e50c37386fb5aa6b2a45e390b7d5f3c32f7 100644
>--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>@@ -315,6 +315,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node, bool igno
>     case NewArrayWithSpread:
>     case Spread:
>     case NewRegexp:
>+    case NewSymbol:
>     case ProfileType:
>     case ProfileControlFlow:
>     case CheckTypeInfoFlags:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 465bf3fb0fd87c4a08e5f5d96fa98f3338a4ab62..738faa956493bff5c3a68efca831a5fd655e4a66 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -9647,6 +9647,31 @@ void SpeculativeJIT::compileNewStringObject(Node* node)
>     cellResult(resultGPR, node);
> }
> 
>+void SpeculativeJIT::compileNewSymbol(Node* node)
>+{
>+    if (!node->child1()) {
>+        flushRegisters();
>+        GPRFlushedCallResult result(this);
>+        GPRReg resultGPR = result.gpr();
>+        callOperation(operationNewSymbol, resultGPR);
>+        m_jit.exceptionCheck();
>+        cellResult(resultGPR, node);
>+        return;
>+    }
>+
>+    // Known String.
>+    SpeculateCellOperand operand(this, node->child1());
>+
>+    GPRReg stringGPR = operand.gpr();
>+
>+    flushRegisters();
>+    GPRFlushedCallResult result(this);
>+    GPRReg resultGPR = result.gpr();
>+    callOperation(operationNewSymbolWithDescription, resultGPR, stringGPR);
>+    m_jit.exceptionCheck();
>+    cellResult(resultGPR, node);
>+}
>+
> void SpeculativeJIT::compileNewTypedArrayWithSize(Node* node)
> {
>     JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index a20e39a83afe8cbb2929271d3ce25afe33e7ea87..8177e4a434c10211c3f61a65bd90695914f4145d 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -1253,6 +1253,7 @@ class SpeculativeJIT {
>     void compileNumberToStringWithValidRadixConstant(Node*);
>     void compileNumberToStringWithValidRadixConstant(Node*, int32_t radix);
>     void compileNewStringObject(Node*);
>+    void compileNewSymbol(Node*);
>     
>     void compileNewTypedArrayWithSize(Node*);
>     
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>index bcf7c72488e87650af6bcf42ab57fcc17325893b..0c973fcbcd6f74133300d158c66445e44ab6c01c 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>@@ -3105,6 +3105,11 @@ void SpeculativeJIT::compile(Node* node)
>         compileNewStringObject(node);
>         break;
>     }
>+
>+    case NewSymbol: {
>+        compileNewSymbol(node);
>+        break;
>+    }
>         
>     case NewArray: {
>         compileNewArray(node);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index 066274490093fec2b0f2f886372adc041d058782..25215e3edfd85f09414c0e7f11bf5619f96d1600 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -3347,6 +3347,11 @@ void SpeculativeJIT::compile(Node* node)
>         compileNewStringObject(node);
>         break;
>     }
>+
>+    case NewSymbol: {
>+        compileNewSymbol(node);
>+        break;
>+    }
>         
>     case NewArray: {
>         compileNewArray(node);
>diff --git a/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp b/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
>index 68b063eb6dea20ea24d5fad50f22c1116e438ebe..6af45b06cb4e307ef62c82cd90f14ac092019cc6 100644
>--- a/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
>@@ -325,9 +325,10 @@ class StoreBarrierInsertionPhase : public Phase {
>             case NewArrayBuffer:
>             case NewTypedArray:
>             case NewRegexp:
>+            case NewStringObject:
>+            case NewSymbol:
>             case MaterializeNewObject:
>             case MaterializeCreateActivation:
>-            case NewStringObject:
>             case MakeRope:
>             case CreateActivation:
>             case CreateDirectArguments:
>diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>index 0a3569fe8876545768bc6c6e688ad1bc448a6af5..c91d1557c3f3af7b5ab329479da3d47655db0fa4 100644
>--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>@@ -74,6 +74,7 @@ inline CapabilityLevel canCompile(Node* node)
>     case GetButterfly:
>     case NewObject:
>     case NewStringObject:
>+    case NewSymbol:
>     case NewArray:
>     case NewArrayWithSpread:
>     case Spread:
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 72eb9363edbbe575dbbedc6cc8d5a31f053e748b..a46880e0618afe2c42eb9ba94347fd32ad89d0d8 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -869,6 +869,9 @@ class LowerDFGToB3 {
>         case NewStringObject:
>             compileNewStringObject();
>             break;
>+        case NewSymbol:
>+            compileNewSymbol();
>+            break;
>         case NewArray:
>             compileNewArray();
>             break;
>@@ -5535,7 +5538,16 @@ class LowerDFGToB3 {
>         m_out.appendTo(continuation, lastNext);
>         setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
>     }
>-    
>+
>+    void compileNewSymbol()
>+    {
>+        if (!m_node->child1()) {
>+            setJSValue(vmCall(pointerType(), m_out.operation(operationNewSymbol), m_callFrame));
>+            return;
>+        }
>+        setJSValue(vmCall(pointerType(), m_out.operation(operationNewSymbolWithDescription), m_callFrame, lowString(m_node->child1())));
>+    }
>+
>     void compileNewArray()
>     {
>         // First speculate appropriately on all of the children. Do this unconditionally up here
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index c6b86c9c26d5b33f88bf9cc998a05ced901d2265..a9872713fe1ea6d244c0847f427cab94d116998b 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [DFG][FTL] Add NewSymbol
>+        https://bugs.webkit.org/show_bug.cgi?id=192620
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * microbenchmarks/symbol-creation.js: Added.
>+        (test):
>+
> 2018-12-10  Mark Lam  <mark.lam@apple.com>
> 
>         PropertyAttribute needs a CustomValue bit.
>diff --git a/JSTests/microbenchmarks/symbol-creation.js b/JSTests/microbenchmarks/symbol-creation.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..baf260b0b0765ce562ce2f2facf50f295dcf257d
>--- /dev/null
>+++ b/JSTests/microbenchmarks/symbol-creation.js
>@@ -0,0 +1,8 @@
>+function test()
>+{
>+    return Symbol();
>+}
>+noInline(test);
>+
>+for (var i = 0; i < 4e5; ++i)
>+    test();

Actions: View | Formatted Diff | Diff

Attachments on bug 192620: 357116 | 357123