AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Make backing store load eliminatable for %ArrayIteratorPrototype%.next().

Browse Source 
Place the LoadField for the backing store of the [[IteratedObject]]
before the diamond to make it possible to eliminate this LoadField
in LoadElimination later, when used in `for..of` or destructing.

This further improves the performance of `for..of` in the micro
benchmark on the tracking bug from

  console.timeEnd: forOf, 191.726000
  console.timeEnd: traditional, 107.572000
  console.timeEnd: forOf, 137.288000
  console.timeEnd: traditional, 102.976000
  console.timeEnd: forOf, 137.506000
  console.timeEnd: traditional, 103.089000

to around

  console.timeEnd: forOf, 195.238000
  console.timeEnd: traditional, 107.078000
  console.timeEnd: forOf, 128.980000
  console.timeEnd: traditional, 103.106000
  console.timeEnd: forOf, 128.525000
  console.timeEnd: traditional, 103.072000

so roughly another ~7% improvement (with untrusted code mitigations
turned off).

Bug: v8:8070
Change-Id: I34831c503384f0cc44b95317dd84403f2ed8ecd5
Reviewed-on: https://chromium-review.googlesource.com/1188138
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55390}
This commit is contained in:
Benedikt Meurer 2018-08-24 10:53:03 +02:00 committed by Commit Bot
parent 89bea4c050
commit f310c28bba
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/compiler/js-call-reducer.cc
View File

@ -5024,6 +5024,16 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
Node* index = effect = graph()->NewNode(simplified()->LoadField(index_access),
iterator, effect, control);
// Load the elements of the {iterated_object}. While it feels
// counter-intuitive to place the elements pointer load before
// the condition below, as it might not be needed (if the {index}
// is out of bounds for the {iterated_object}), it's better this
// way as it allows the LoadElimination to eliminate redundant
// reloads of the elements pointer.
Node* elements = effect = graph()->NewNode(
simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
iterated_object, effect, control);
// Load the length of the {iterated_object}. Due to the map checks we
// already know something about the length here, which we can leverage
// to generate Word32 operations below without additional checking.
@ -5058,10 +5068,6 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
DCHECK(iteration_kind == IterationKind::kEntries ||
iteration_kind == IterationKind::kValues);
Node* elements = etrue = graph()->NewNode(
simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
iterated_object, etrue, if_true);
if (IsFixedTypedArrayElementsKind(elements_kind)) {
Node* base_ptr = etrue = graph()->NewNode(
simplified()->LoadField(