Optimize instanceof further...

src/hydrogen.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4829 matching lines @@
   VISIT_FOR_VALUE(expr->left());
   VISIT_FOR_VALUE(expr->right());
 
   HValue* right = Pop();
   HValue* left = Pop();
   Token::Value op = expr->op();
 
   TypeInfo info = oracle()->CompareType(expr, TypeFeedbackOracle::RESULT);
   HInstruction* instr = NULL;
   if (op == Token::INSTANCEOF) {
-    instr = new HInstanceOf(left, right);
+    // Check to see if the rhs of the instanceof is a global function not
+    // residing in new space. If it is the assumption used for optimization is

[Mads Ager (chromium), 2011/01/04 17:25:58]

Simplify to: If it is we assume that the function will stay the same?

[Søren Thygesen Gjesse, 2011/01/05 09:28:00]

Done.

+    // that the function most likely will stay the same.
+    Handle<JSFunction> target = Handle<JSFunction>::null();
+    Variable* var = expr->right()->AsVariableProxy()->AsVariable();
+    bool global_function = (var != NULL) && var->is_global() && !var->is_this();
+    CompilationInfo* info = graph()->info();
+    if (global_function &&
+        info->has_global_object() &&
+        !info->global_object()->IsAccessCheckNeeded()) {
+      Handle<String> name = var->name();
+      Handle<GlobalObject> global(info->global_object());
+      Handle<JSGlobalPropertyCell> cell = Handle<JSGlobalPropertyCell>::null();

[Mads Ager (chromium), 2011/01/04 17:25:58]

Do you need the cell declaration out here? Can't you move it into the if where
you actually fetch the value?

[Søren Thygesen Gjesse, 2011/01/05 09:28:00]

Don't need the cell at all, can just use lookup.GetValue.

+      LookupResult lookup;
+      global->Lookup(*name, &lookup);
+      if (lookup.IsProperty() && lookup.type() == NORMAL) {
+        cell = Handle<JSGlobalPropertyCell>(global->GetPropertyCell(&lookup));
+        if (cell->value()->IsJSFunction()) {
+          Handle<JSFunction> candidate(JSFunction::cast(cell->value()));
+          // If the function is in new space we assume it's more likely to
+          // change and thus prefer the general IC code.
+          if (!Heap::InNewSpace(*candidate)) {
+            target = candidate;
+          }
+        }
+      }
+    }
+
+    // If the traget is not null we have found a known global function that is

[Mads Ager (chromium), 2011/01/04 17:25:58]

traget -> target

[Søren Thygesen Gjesse, 2011/01/05 09:28:00]

Done.

+    // assumed to stay the same for this instanceof.
+    if (target.is_null()) {
+      instr = new HInstanceOf(left, right);
+    } else {
+      AddInstruction(new HCheckFunction(right, target));
+      instr = new HInstanceOfKnownGlobal(left, target);
+    }
   } else if (op == Token::IN) {
     BAILOUT("Unsupported comparison: in");
   } else if (info.IsNonPrimitive()) {
     switch (op) {
       case Token::EQ:
       case Token::EQ_STRICT: {
         AddInstruction(HCheckInstanceType::NewIsJSObjectOrJSFunction(left));
         AddInstruction(HCheckInstanceType::NewIsJSObjectOrJSFunction(right));
         instr = new HCompareJSObjectEq(left, right);
         break;
@@ skipping 816 matching lines @@
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify();
   if (chunk_ != NULL) chunk_->Verify();
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal