Bug 185065 – [JSC] Add SameValue DFG node

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

It seems like Object.is has very poor performance; even polyfill performs much better than the built-in method (2x). Also for comparison "===" performs ~10x.

See the following benchmarks:
https://jsperf.com/string-object-is-performance
https://jsperf.com/object-is-vs-polyfill

You can see similar issue fixed for V8 here:
https://bugs.chromium.org/p/v8/issues/detail?id=7007

[Radar WebKit Bug Importer]

<rdar://problem/39781064>

[Yusuke Suzuki]

Created attachment 339081 [details]
Patch

WIP: 64bit works.

[Yusuke Suzuki]

Created attachment 339084 [details]
Patch

[Yusuke Suzuki]

Created attachment 339085 [details]
Patch

[Yusuke Suzuki]

Ping?

[Saam Barati]

Comment on attachment 339085 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=339085&action=review

> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2643
> +        if (argumentCountIncludingThis != 3)

Why not < instead of !=?

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:6383
> +        m_jit.compareDouble(CCallHelpers::DoubleNotEqualOrUnordered, arg1FPR, arg1FPR, tempGPR);

Since this code branches internally, it feels like we should only do it if the doubles aren’t bitwise equal

[Yusuke Suzuki]

Comment on attachment 339085 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=339085&action=review

>> Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:2643
>> +        if (argumentCountIncludingThis != 3)
> 
> Why not < instead of !=?

Fixed.

>> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:6383
>> +        m_jit.compareDouble(CCallHelpers::DoubleNotEqualOrUnordered, arg1FPR, arg1FPR, tempGPR);
> 
> Since this code branches internally, it feels like we should only do it if the doubles aren’t bitwise equal

OK, fixed.

[Yusuke Suzuki]

Committed r231224: <https://trac.webkit.org/changeset/231224>

[Ryan Haddad]

The test added with this change is failing on the 32-bit JSC bot:

stress/object-is.js.default: Exception: Error: bad value: true
stress/object-is.js.default: [e-mail]:3:24
stress/object-is.js.default: global [e-mail]:67:13
stress/object-is.js.default: ERROR: Unexpected exit code: 3
FAIL: stress/object-is.js.default

https://build.webkit.org/builders/Apple%20High%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/1808

[Yusuke Suzuki]

Committed r231284: <https://trac.webkit.org/changeset/231284>