Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(14)

Side by Side Diff: src/compiler/js-builtin-reducer.cc

Issue 2245533003: [turbofan] Add inlined Array.prototype.push support. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « src/compiler/js-builtin-reducer.h ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 the V8 project authors. All rights reserved. 1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/compiler/js-builtin-reducer.h" 5 #include "src/compiler/js-builtin-reducer.h"
6 6
7 #include "src/compilation-dependencies.h" 7 #include "src/compilation-dependencies.h"
8 #include "src/compiler/access-builder.h" 8 #include "src/compiler/access-builder.h"
9 #include "src/compiler/js-graph.h" 9 #include "src/compiler/js-graph.h"
10 #include "src/compiler/node-matchers.h" 10 #include "src/compiler/node-matchers.h"
(...skipping 227 matching lines...) Expand 10 before | Expand all | Expand 10 after
238 value = 238 value =
239 graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(), value); 239 graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(), value);
240 } 240 }
241 241
242 ReplaceWithValue(node, value, effect, control); 242 ReplaceWithValue(node, value, effect, control);
243 return Replace(value); 243 return Replace(value);
244 } 244 }
245 return NoChange(); 245 return NoChange();
246 } 246 }
247 247
248 // ES6 section 22.1.3.18 Array.prototype.push ( )
249 Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) {
250 Handle<Map> receiver_map;
251 // We need exactly target, receiver and value parameters.
252 if (node->op()->ValueInputCount() != 3) return NoChange();
253 Node* receiver = NodeProperties::GetValueInput(node, 1);
254 Node* effect = NodeProperties::GetEffectInput(node);
255 Node* control = NodeProperties::GetControlInput(node);
256 Node* value = NodeProperties::GetValueInput(node, 2);
257 if (GetMapWitness(node).ToHandle(&receiver_map) &&
258 CanInlineArrayResizeOperation(receiver_map)) {
259 // Install code dependencies on the {receiver} prototype maps and the
260 // global array protector cell.
261 dependencies()->AssumePropertyCell(factory()->array_protector());
262 dependencies()->AssumePrototypeMapsStable(receiver_map);
263
264 // TODO(turbofan): Perform type checks on the {value}. We are not guaranteed
265 // to learn from these checks in case they fail, as the witness (i.e. the
266 // map check from the LoadIC for a.push) might not be executed in baseline
267 // code (after we stored the value in the builtin and thereby changed the
268 // elements kind of a) before be decide to optimize this function again. We
269 // currently don't have a proper way to deal with this; the proper solution
270 // here is to learn on deopt, i.e. disable Array.prototype.push inlining
271 // for this function.
272 if (IsFastSmiElementsKind(receiver_map->elements_kind())) {
273 value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(),
274 value, effect, control);
275 } else if (IsFastDoubleElementsKind(receiver_map->elements_kind())) {
276 value = effect =
277 graph()->NewNode(simplified()->CheckNumber(), value, effect, control);
278 // Make sure we do not store signaling NaNs into double arrays.
279 value = graph()->NewNode(simplified()->NumberSilenceNaN(), value);
280 }
281
282 // Load the "length" property of the {receiver}.
283 Node* length = effect = graph()->NewNode(
284 simplified()->LoadField(
285 AccessBuilder::ForJSArrayLength(receiver_map->elements_kind())),
286 receiver, effect, control);
287
288 // Load the elements backing store of the {receiver}.
289 Node* elements = effect = graph()->NewNode(
290 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
291 effect, control);
292
293 // TODO(turbofan): Check if we need to grow the {elements} backing store.
294 // This will deopt if we cannot grow the array further, and we currently
295 // don't necessarily learn from it. See the comment on the value type check
296 // above.
297 GrowFastElementsFlags flags = GrowFastElementsFlag::kArrayObject;
298 if (IsFastDoubleElementsKind(receiver_map->elements_kind())) {
299 flags |= GrowFastElementsFlag::kDoubleElements;
300 }
301 elements = effect =
302 graph()->NewNode(simplified()->MaybeGrowFastElements(flags), receiver,
303 elements, length, length, effect, control);
304
305 // Append the value to the {elements}.
306 effect = graph()->NewNode(
307 simplified()->StoreElement(
308 AccessBuilder::ForFixedArrayElement(receiver_map->elements_kind())),
309 elements, length, value, effect, control);
310
311 ReplaceWithValue(node, value, effect, control);
312 return Replace(value);
313 }
314 return NoChange();
315 }
316
248 // ES6 section 20.2.2.1 Math.abs ( x ) 317 // ES6 section 20.2.2.1 Math.abs ( x )
249 Reduction JSBuiltinReducer::ReduceMathAbs(Node* node) { 318 Reduction JSBuiltinReducer::ReduceMathAbs(Node* node) {
250 JSCallReduction r(node); 319 JSCallReduction r(node);
251 if (r.InputsMatchOne(Type::PlainPrimitive())) { 320 if (r.InputsMatchOne(Type::PlainPrimitive())) {
252 // Math.abs(a:plain-primitive) -> NumberAbs(ToNumber(a)) 321 // Math.abs(a:plain-primitive) -> NumberAbs(ToNumber(a))
253 Node* input = ToNumber(r.GetJSCallInput(0)); 322 Node* input = ToNumber(r.GetJSCallInput(0));
254 Node* value = graph()->NewNode(simplified()->NumberAbs(), input); 323 Node* value = graph()->NewNode(simplified()->NumberAbs(), input);
255 return Replace(value); 324 return Replace(value);
256 } 325 }
257 return NoChange(); 326 return NoChange();
(...skipping 633 matching lines...) Expand 10 before | Expand all | Expand 10 after
891 960
892 Reduction JSBuiltinReducer::Reduce(Node* node) { 961 Reduction JSBuiltinReducer::Reduce(Node* node) {
893 Reduction reduction = NoChange(); 962 Reduction reduction = NoChange();
894 JSCallReduction r(node); 963 JSCallReduction r(node);
895 964
896 // Dispatch according to the BuiltinFunctionId if present. 965 // Dispatch according to the BuiltinFunctionId if present.
897 if (!r.HasBuiltinFunctionId()) return NoChange(); 966 if (!r.HasBuiltinFunctionId()) return NoChange();
898 switch (r.GetBuiltinFunctionId()) { 967 switch (r.GetBuiltinFunctionId()) {
899 case kArrayPop: 968 case kArrayPop:
900 return ReduceArrayPop(node); 969 return ReduceArrayPop(node);
970 case kArrayPush:
971 return ReduceArrayPush(node);
901 case kMathAbs: 972 case kMathAbs:
902 reduction = ReduceMathAbs(node); 973 reduction = ReduceMathAbs(node);
903 break; 974 break;
904 case kMathAcos: 975 case kMathAcos:
905 reduction = ReduceMathAcos(node); 976 reduction = ReduceMathAcos(node);
906 break; 977 break;
907 case kMathAcosh: 978 case kMathAcosh:
908 reduction = ReduceMathAcosh(node); 979 reduction = ReduceMathAcosh(node);
909 break; 980 break;
910 case kMathAsin: 981 case kMathAsin:
(...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after
1062 } 1133 }
1063 1134
1064 1135
1065 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const { 1136 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const {
1066 return jsgraph()->simplified(); 1137 return jsgraph()->simplified();
1067 } 1138 }
1068 1139
1069 } // namespace compiler 1140 } // namespace compiler
1070 } // namespace internal 1141 } // namespace internal
1071 } // namespace v8 1142 } // namespace v8
OLDNEW
« no previous file with comments | « src/compiler/js-builtin-reducer.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698