Bug 142651

Summary: Introduce SymbolType into SpeculativeTypes
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, darin, fpizlo, ggaren, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 140435    
Bug Blocks: 145000, 145001    
Attachments:
Description Flags
Patch none

Description Yusuke Suzuki 2015-03-12 21:38:22 PDT 
Currently, Symbol is classified as SpecCellOther.
But this is too conservative analysis and there's room to optimize it.

Introducing SpecSymbol and analyzing this type in DFG/FTL brings faster Symbol comparison and lookups with it.
It will encourage some applications that uses Symbol as an unique key, like React.js.
Comment 1 Yusuke Suzuki 2015-04-29 11:47:10 PDT 
CellOther is used for non-user-visible Cell objects.
So current status (categorizing Symbol into CellOther type) is not correct.
Comment 2 Yusuke Suzuki 2015-05-14 07:30:55 PDT 
Let's introduce SpecSymbol at first.
In the separated patch, I'll introduce SymbolUse.
Comment 3 Yusuke Suzuki 2015-05-14 08:27:06 PDT 
Created attachment 253121 [details]
Patch
Comment 4 Yusuke Suzuki 2015-05-14 09:02:49 PDT 
Comment on attachment 253121 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=253121&action=review

> Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:454
> +                if (m_state.forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol))

ToPrimitive is used in string concatnation. It is tested in tests/stress/dfg-to-primitive-pass-symbol.js
Comment 5 WebKit Commit Bot 2015-05-14 10:39:06 PDT 
Comment on attachment 253121 [details]
Patch

Clearing flags on attachment: 253121

Committed r184340: <http://trac.webkit.org/changeset/184340>
Comment 6 WebKit Commit Bot 2015-05-14 10:39:11 PDT 
All reviewed patches have been landed.  Closing bug.