• Benedikt Meurer's avatar
    [turbofan] Refactor the JSCreateArray lowering to support more cases. · 279a83e4
    Benedikt Meurer authored
    Array (subclass) constructor calls with 0 parameters are now properly
    turned into inline allocations, also Array (subclass) constructor calls
    with exactly one parameter, which is either known to not be a Number
    or which is a known integer in the valid loop unrolling range.
    
    Also refactor the general JSCreateArray lowering logic to properly
    support Array subclasses, i.e. deal with inobject properties and
    initial maps correctly.
    
    This boosts performance of those cases significantly (and will allow
    us to reduce the complexity of the Array constructor significantly
    long-term). For example the simple case
    
      new Array("a", "b", "c", "d", "e", "f", "g")
    
    is now around 10x faster than before.
    
    Bug: v8:6399
    Change-Id: I70661971398524ee0c6a349ee559b98a962a6266
    Reviewed-on: https://chromium-review.googlesource.com/703134
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#48325}
    279a83e4
js-create-lowering.cc 74.4 KB