DFG::VarargsForwardingPhase should eliminate getting argument length

[Saam Barati]

I'm measuring around a 1-3% speedup on ARES's ML test by doing this.

[Saam Barati]

Created attachment 334251 [details]
WIP

[Saam Barati]

Created attachment 334252 [details]
WIP

[Saam Barati]

Created attachment 334302 [details]
patch

[Radar WebKit Bug Importer]

<rdar://problem/37723649>

[Keith Miller]

Comment on attachment 334302 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334302&action=review

r=me.

> Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp:202
> +                if (node->child1()->op() == GetButterfly
> +                    && candidateButterflies.contains(node->child1().node())
> +                    && node->child2() == candidate
> +                    && node->storageAccessData().offset == clonedArgumentsLengthPropertyOffset) {
> +                    ASSERT(node->child1()->child1() == candidate);

Might be worth a static_assert that clonedArgumentsLengthPropertyOffset is out of line.

[Saam Barati]

Comment on attachment 334302 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334302&action=review

>> Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp:202
>> +                    ASSERT(node->child1()->child1() == candidate);
> 
> Might be worth a static_assert that clonedArgumentsLengthPropertyOffset is out of line.

I'll add a debug assert. Unfortunately, isOutOfLineOffset isn't constexpr.

[Saam Barati]

Created attachment 334338 [details]
patch for landing

[WebKit Commit Bot]

Comment on attachment 334338 [details]
patch for landing

Clearing flags on attachment: 334338

Committed r228860: <https://trac.webkit.org/changeset/228860>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.