From d389e49b5c0f3b41a97782257dfd91fb8a5d6551 Mon Sep 17 00:00:00 2001 From: bmeurer Date: Thu, 19 Jan 2017 13:03:07 -0800 Subject: [PATCH] [turbofan] Recognize a couple of collection.js intrinsics. Right now running the Map and Set builtins with I+TF would tank seriously because these builtins are still built on top of a couple of classic intrinsics that TurboFan doesn't understand. Middle-term the idea is to replace the Map and Set builtins with a CodeStubAssembler based solution, but for that might not be ready in time, so adding support for a couple of the critical intrinsics to mitigate the tankage a bit, namely - %_JSCollectionGetTable, - %_TheHole, and - %_StringGetRawHashField. Together these double the score on most of the existing performance tests for collections. R=yangguo@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2647733002 Cr-Commit-Position: refs/heads/master@{#42521} --- src/compiler/access-builder.cc | 15 ++++++++++--- src/compiler/access-builder.h | 3 +++ src/compiler/js-intrinsic-lowering.cc | 32 +++++++++++++++++++++++++++ src/compiler/js-intrinsic-lowering.h | 6 +++++ 4 files changed, 53 insertions(+), 3 deletions(-) diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc index 848d02b90f..d575d04ab9 100644 --- a/src/compiler/access-builder.cc +++ b/src/compiler/access-builder.cc @@ -103,6 +103,15 @@ FieldAccess AccessBuilder::ForJSObjectOffset( return access; } +// static +FieldAccess AccessBuilder::ForJSCollectionTable() { + FieldAccess access = {kTaggedBase, JSCollection::kTableOffset, + MaybeHandle(), MaybeHandle(), + Type::OtherInternal(), MachineType::TaggedPointer(), + kPointerWriteBarrier}; + return access; +} + // static FieldAccess AccessBuilder::ForJSFunctionPrototypeOrInitialMap() { FieldAccess access = { @@ -483,9 +492,9 @@ FieldAccess AccessBuilder::ForModuleRegularImports() { // static FieldAccess AccessBuilder::ForNameHashField() { - FieldAccess access = {kTaggedBase, Name::kHashFieldOffset, - Handle(), MaybeHandle(), - Type::Internal(), MachineType::Uint32(), + FieldAccess access = {kTaggedBase, Name::kHashFieldOffset, + Handle(), MaybeHandle(), + Type::Unsigned32(), MachineType::Uint32(), kNoWriteBarrier}; return access; } diff --git a/src/compiler/access-builder.h b/src/compiler/access-builder.h index 1f56a7fd11..6275f7a8fd 100644 --- a/src/compiler/access-builder.h +++ b/src/compiler/access-builder.h @@ -52,6 +52,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final static FieldAccess ForJSObjectOffset( int offset, WriteBarrierKind write_barrier_kind = kFullWriteBarrier); + // Provides access to JSCollecton::table() field. + static FieldAccess ForJSCollectionTable(); + // Provides access to JSFunction::prototype_or_initial_map() field. static FieldAccess ForJSFunctionPrototypeOrInitialMap(); diff --git a/src/compiler/js-intrinsic-lowering.cc b/src/compiler/js-intrinsic-lowering.cc index 2a7a3a3896..ab4d2b0c4b 100644 --- a/src/compiler/js-intrinsic-lowering.cc +++ b/src/compiler/js-intrinsic-lowering.cc @@ -48,6 +48,8 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) { return ReduceIsInstanceType(node, JS_ARRAY_TYPE); case Runtime::kInlineIsTypedArray: return ReduceIsInstanceType(node, JS_TYPED_ARRAY_TYPE); + case Runtime::kInlineIsJSProxy: + return ReduceIsInstanceType(node, JS_PROXY_TYPE); case Runtime::kInlineIsJSReceiver: return ReduceIsJSReceiver(node); case Runtime::kInlineIsSmi: @@ -74,6 +76,12 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) { return ReduceCall(node); case Runtime::kInlineGetSuperConstructor: return ReduceGetSuperConstructor(node); + case Runtime::kInlineJSCollectionGetTable: + return ReduceJSCollectionGetTable(node); + case Runtime::kInlineStringGetRawHashField: + return ReduceStringGetRawHashField(node); + case Runtime::kInlineTheHole: + return ReduceTheHole(node); default: break; } @@ -307,6 +315,30 @@ Reduction JSIntrinsicLowering::ReduceGetSuperConstructor(Node* node) { active_function_map, effect, control); } +Reduction JSIntrinsicLowering::ReduceJSCollectionGetTable(Node* node) { + Node* collection = NodeProperties::GetValueInput(node, 0); + Node* effect = NodeProperties::GetEffectInput(node); + Node* control = NodeProperties::GetControlInput(node); + return Change(node, + simplified()->LoadField(AccessBuilder::ForJSCollectionTable()), + collection, effect, control); +} + +Reduction JSIntrinsicLowering::ReduceStringGetRawHashField(Node* node) { + Node* string = NodeProperties::GetValueInput(node, 0); + Node* effect = NodeProperties::GetEffectInput(node); + Node* control = NodeProperties::GetControlInput(node); + return Change(node, + simplified()->LoadField(AccessBuilder::ForNameHashField()), + string, effect, control); +} + +Reduction JSIntrinsicLowering::ReduceTheHole(Node* node) { + Node* value = jsgraph()->TheHoleConstant(); + ReplaceWithValue(node, value); + return Replace(value); +} + Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op, Node* a, Node* b) { RelaxControls(node); diff --git a/src/compiler/js-intrinsic-lowering.h b/src/compiler/js-intrinsic-lowering.h index 2bc7cafa3d..efbda1f710 100644 --- a/src/compiler/js-intrinsic-lowering.h +++ b/src/compiler/js-intrinsic-lowering.h @@ -61,6 +61,12 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final Reduction ReduceCall(Node* node); Reduction ReduceGetSuperConstructor(Node* node); + // TODO(turbofan): collection.js support; drop once Maps and Sets are + // converted to proper CodeStubAssembler based builtins. + Reduction ReduceJSCollectionGetTable(Node* node); + Reduction ReduceStringGetRawHashField(Node* node); + Reduction ReduceTheHole(Node* node); + Reduction Change(Node* node, const Operator* op); Reduction Change(Node* node, const Operator* op, Node* a, Node* b); Reduction Change(Node* node, const Operator* op, Node* a, Node* b, Node* c);