Bug 154844 – [DFG] Drop comparison based on speculative types and constants

• Component: JavaScriptCore
• Status: NEW

[Yusuke Suzuki]

For example,

if (Int32Speculated < 0x1FFFFFFFFFFFFF)
    return Int32Speculated;
return 0x1FFFFFFFFFFFFF;

Since 0x1FFFFFFFFFFFFF is out of range of Int32, if the Int32Speculated is ensured that is Int32 (by edge filtering), this condition should be dropped.
And it should be considered as follows in DFG.

return Int32Speculated;

This case actually happens in @toLength builtin function. We cap length values with 0x1FFFFFFFFFFFFF.
Currently, since 0x1FFFFFFFFFFFFF is double represented value, the result of @toLength is speculated as double.
It leads using double for iteration condition in Array.prototype.{forEach...}

[Yusuke Suzuki]

Created attachment 274395 [details]
Patch

WIP: super super initial conceptual one. This fixes speculation of the returned value of @toLength (this was polluted due to  branch). The patch is not cleaned up / generalized yet. But octane TypeScript bench shows stable 1.2% ~ improvements. And array-prototype-xxx regress tests show slight improvements. But array-prototype-reduceRight shows 42% improvement.

[Yusuke Suzuki]

Of course, this patch still lacks a lot of careful treatments for doubles. (NaN, Infinity etc.).

[Yusuke Suzuki]

Ideally, we would like to perform this folding in constant folding phase. But it's too late because Double polluted results are already propagated at that time.

[Yusuke Suzuki]

Created attachment 276459 [details]
Patch

WIP, it shows 5-7% (And 67% for array-prototype-reduceRight) perf win for array-prototype-xxx