AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Try to convert value to Smi in StoreField/StoreElement.

Browse Source 
If the value can be converted, we can skip the write barrier.

Change-Id: I88ac7f3756ddfaf4b8e58dc36a9b26faf544f0d9
Reviewed-on: https://chromium-review.googlesource.com/957033
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51845}
This commit is contained in:
Georg Neis 2018-03-09 14:34:08 +01:00 committed by Commit Bot
parent fd29e1d841
commit b19d2851bf
3 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/compiler/js-call-reducer.cc
View File

@ -2117,10 +2117,11 @@ Node* JSCallReducer::DoFilterPostCallbackWork(ElementsKind kind, Node** control,
simplified()->LoadField(AccessBuilder::ForJSObjectElements()), a, etrue,
if_true);
// We know that {to} is in Unsigned31 range here, being smaller than
// {original_length} at all times.
DCHECK(TypeCache::Get().kFixedDoubleArrayLengthType->Is(
TypeCache::Get().kFixedArrayLengthType));
Node* checked_to = etrue = graph()->NewNode(
common()->TypeGuard(Type::Unsigned31()), to, etrue, if_true);
common()->TypeGuard(TypeCache::Get().kFixedArrayLengthType), to, etrue,
if_true);
Node* elements_length = etrue = graph()->NewNode(
simplified()->LoadField(AccessBuilder::ForFixedArrayLength()), elements,
etrue, if_true);

4
src/compiler/js-native-context-specialization.cc
View File

@ -2728,6 +2728,10 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
}
Node* new_length_and_hash = graph()->NewNode(
simplified()->NumberBitwiseOr(), jsgraph()->Constant(new_length), hash);
// TDOO(jarin): Fix the typer to infer tighter bound for NumberBitwiseOr.
new_length_and_hash = effect =
graph()->NewNode(common()->TypeGuard(Type::SignedSmall()),
new_length_and_hash, effect, control);
// Allocate and initialize the new properties.
AllocationBuilder a(jsgraph(), effect, control);

11
src/compiler/simplified-lowering.cc
View File

@ -126,6 +126,7 @@ UseInfo CheckedUseInfoAsFloat64FromHint(NumberOperationHint hint,
UseInfo TruncatingUseInfoFromRepresentation(MachineRepresentation rep) {
switch (rep) {
case MachineRepresentation::kTaggedSigned:
return UseInfo::TaggedSigned();
case MachineRepresentation::kTaggedPointer:
case MachineRepresentation::kTagged:
return UseInfo::AnyTagged();
@ -2551,6 +2552,11 @@ class RepresentationSelector {
MachineRepresentation field_representation =
access.machine_type.representation();
// Convert to Smi if possible, such that we can avoid a write barrier.
if (field_representation == MachineRepresentation::kTagged &&
TypeOf(value_node)->Is(Type::SignedSmall())) {
field_representation = MachineRepresentation::kTaggedSigned;
}
WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
access.base_is_tagged, field_representation, access.offset,
access.type, input_info->representation(), value_node);
@ -2584,6 +2590,11 @@ class RepresentationSelector {
MachineRepresentation element_representation =
access.machine_type.representation();
// Convert to Smi if possible, such that we can avoid a write barrier.
if (element_representation == MachineRepresentation::kTagged &&
TypeOf(value_node)->Is(Type::SignedSmall())) {
element_representation = MachineRepresentation::kTaggedSigned;
}
WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
access.base_is_tagged, element_representation, access.type,
input_info->representation(), value_node);