OLD | NEW |
1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/compiler/js-builtin-reducer.h" | 5 #include "src/compiler/js-builtin-reducer.h" |
6 | 6 |
7 #include "src/compilation-dependencies.h" | 7 #include "src/compilation-dependencies.h" |
8 #include "src/compiler/access-builder.h" | 8 #include "src/compiler/access-builder.h" |
9 #include "src/compiler/js-graph.h" | 9 #include "src/compiler/js-graph.h" |
10 #include "src/compiler/node-matchers.h" | 10 #include "src/compiler/node-matchers.h" |
(...skipping 227 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
238 value = | 238 value = |
239 graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(), value); | 239 graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(), value); |
240 } | 240 } |
241 | 241 |
242 ReplaceWithValue(node, value, effect, control); | 242 ReplaceWithValue(node, value, effect, control); |
243 return Replace(value); | 243 return Replace(value); |
244 } | 244 } |
245 return NoChange(); | 245 return NoChange(); |
246 } | 246 } |
247 | 247 |
| 248 // ES6 section 22.1.3.18 Array.prototype.push ( ) |
| 249 Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) { |
| 250 Handle<Map> receiver_map; |
| 251 // We need exactly target, receiver and value parameters. |
| 252 if (node->op()->ValueInputCount() != 3) return NoChange(); |
| 253 Node* receiver = NodeProperties::GetValueInput(node, 1); |
| 254 Node* effect = NodeProperties::GetEffectInput(node); |
| 255 Node* control = NodeProperties::GetControlInput(node); |
| 256 Node* value = NodeProperties::GetValueInput(node, 2); |
| 257 if (GetMapWitness(node).ToHandle(&receiver_map) && |
| 258 CanInlineArrayResizeOperation(receiver_map)) { |
| 259 // Install code dependencies on the {receiver} prototype maps and the |
| 260 // global array protector cell. |
| 261 dependencies()->AssumePropertyCell(factory()->array_protector()); |
| 262 dependencies()->AssumePrototypeMapsStable(receiver_map); |
| 263 |
| 264 // TODO(turbofan): Perform type checks on the {value}. We are not guaranteed |
| 265 // to learn from these checks in case they fail, as the witness (i.e. the |
| 266 // map check from the LoadIC for a.push) might not be executed in baseline |
| 267 // code (after we stored the value in the builtin and thereby changed the |
| 268 // elements kind of a) before be decide to optimize this function again. We |
| 269 // currently don't have a proper way to deal with this; the proper solution |
| 270 // here is to learn on deopt, i.e. disable Array.prototype.push inlining |
| 271 // for this function. |
| 272 if (IsFastSmiElementsKind(receiver_map->elements_kind())) { |
| 273 value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(), |
| 274 value, effect, control); |
| 275 } else if (IsFastDoubleElementsKind(receiver_map->elements_kind())) { |
| 276 value = effect = |
| 277 graph()->NewNode(simplified()->CheckNumber(), value, effect, control); |
| 278 // Make sure we do not store signaling NaNs into double arrays. |
| 279 value = graph()->NewNode(simplified()->NumberSilenceNaN(), value); |
| 280 } |
| 281 |
| 282 // Load the "length" property of the {receiver}. |
| 283 Node* length = effect = graph()->NewNode( |
| 284 simplified()->LoadField( |
| 285 AccessBuilder::ForJSArrayLength(receiver_map->elements_kind())), |
| 286 receiver, effect, control); |
| 287 |
| 288 // Load the elements backing store of the {receiver}. |
| 289 Node* elements = effect = graph()->NewNode( |
| 290 simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver, |
| 291 effect, control); |
| 292 |
| 293 // TODO(turbofan): Check if we need to grow the {elements} backing store. |
| 294 // This will deopt if we cannot grow the array further, and we currently |
| 295 // don't necessarily learn from it. See the comment on the value type check |
| 296 // above. |
| 297 GrowFastElementsFlags flags = GrowFastElementsFlag::kArrayObject; |
| 298 if (IsFastDoubleElementsKind(receiver_map->elements_kind())) { |
| 299 flags |= GrowFastElementsFlag::kDoubleElements; |
| 300 } |
| 301 elements = effect = |
| 302 graph()->NewNode(simplified()->MaybeGrowFastElements(flags), receiver, |
| 303 elements, length, length, effect, control); |
| 304 |
| 305 // Append the value to the {elements}. |
| 306 effect = graph()->NewNode( |
| 307 simplified()->StoreElement( |
| 308 AccessBuilder::ForFixedArrayElement(receiver_map->elements_kind())), |
| 309 elements, length, value, effect, control); |
| 310 |
| 311 ReplaceWithValue(node, value, effect, control); |
| 312 return Replace(value); |
| 313 } |
| 314 return NoChange(); |
| 315 } |
| 316 |
248 // ES6 section 20.2.2.1 Math.abs ( x ) | 317 // ES6 section 20.2.2.1 Math.abs ( x ) |
249 Reduction JSBuiltinReducer::ReduceMathAbs(Node* node) { | 318 Reduction JSBuiltinReducer::ReduceMathAbs(Node* node) { |
250 JSCallReduction r(node); | 319 JSCallReduction r(node); |
251 if (r.InputsMatchOne(Type::PlainPrimitive())) { | 320 if (r.InputsMatchOne(Type::PlainPrimitive())) { |
252 // Math.abs(a:plain-primitive) -> NumberAbs(ToNumber(a)) | 321 // Math.abs(a:plain-primitive) -> NumberAbs(ToNumber(a)) |
253 Node* input = ToNumber(r.GetJSCallInput(0)); | 322 Node* input = ToNumber(r.GetJSCallInput(0)); |
254 Node* value = graph()->NewNode(simplified()->NumberAbs(), input); | 323 Node* value = graph()->NewNode(simplified()->NumberAbs(), input); |
255 return Replace(value); | 324 return Replace(value); |
256 } | 325 } |
257 return NoChange(); | 326 return NoChange(); |
(...skipping 633 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
891 | 960 |
892 Reduction JSBuiltinReducer::Reduce(Node* node) { | 961 Reduction JSBuiltinReducer::Reduce(Node* node) { |
893 Reduction reduction = NoChange(); | 962 Reduction reduction = NoChange(); |
894 JSCallReduction r(node); | 963 JSCallReduction r(node); |
895 | 964 |
896 // Dispatch according to the BuiltinFunctionId if present. | 965 // Dispatch according to the BuiltinFunctionId if present. |
897 if (!r.HasBuiltinFunctionId()) return NoChange(); | 966 if (!r.HasBuiltinFunctionId()) return NoChange(); |
898 switch (r.GetBuiltinFunctionId()) { | 967 switch (r.GetBuiltinFunctionId()) { |
899 case kArrayPop: | 968 case kArrayPop: |
900 return ReduceArrayPop(node); | 969 return ReduceArrayPop(node); |
| 970 case kArrayPush: |
| 971 return ReduceArrayPush(node); |
901 case kMathAbs: | 972 case kMathAbs: |
902 reduction = ReduceMathAbs(node); | 973 reduction = ReduceMathAbs(node); |
903 break; | 974 break; |
904 case kMathAcos: | 975 case kMathAcos: |
905 reduction = ReduceMathAcos(node); | 976 reduction = ReduceMathAcos(node); |
906 break; | 977 break; |
907 case kMathAcosh: | 978 case kMathAcosh: |
908 reduction = ReduceMathAcosh(node); | 979 reduction = ReduceMathAcosh(node); |
909 break; | 980 break; |
910 case kMathAsin: | 981 case kMathAsin: |
(...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1062 } | 1133 } |
1063 | 1134 |
1064 | 1135 |
1065 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const { | 1136 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const { |
1066 return jsgraph()->simplified(); | 1137 return jsgraph()->simplified(); |
1067 } | 1138 } |
1068 | 1139 |
1069 } // namespace compiler | 1140 } // namespace compiler |
1070 } // namespace internal | 1141 } // namespace internal |
1071 } // namespace v8 | 1142 } // namespace v8 |
OLD | NEW |