• Benedikt Meurer's avatar
    [turbofan] Inline Map and Set iterators into optimized code. · 1287688c
    Benedikt Meurer authored
    This CL inlines the following builtins into TurboFan
    
      - %MapIteratorPrototype%.next
      - %SetIteratorPrototype%.next
    
    following the design that we are using for Array iteration already
    (different instance types for the different kinds of iterators). Details
    can be found in the relevant design document at:
    
      https://docs.google.com/document/d/13z1fvRVpe_oEroplXEEX0a3WK94fhXorHjcOMsDmR-8
    
    The key to great performance here is to ensure that the inlined code
    allows escape analysis and scalar replacement of aggregates to remove
    the allocations for the iterator itself as well as the iterator results
    and potential key/value arrays in the simple case of a for-of loop (and
    by extension also in other constructs that reduce to for-of loops
    internally), i.e.:
    
      const s = new Set;
      // ... do something with s
      for (const x of s) {
        // ...
      }
    
    Here the for-of loop shouldn't perform any allocations of helper
    objects.
    
    Drive-by-fix: Replace the ExistsJSMapWithness in JSBuiltinReducer with a more
    general HasInstanceTypeWitness, similar to what's in JSCallReducer. Also
    migrate the {Map,Set}.prototype.size getter inlining to the
    JSBuiltinReducer, so that everything is in a single place.
    
    R=jgruber@chromium.org
    
    Bug: v8:6344, v8:6571, chromium:740122
    Change-Id: I09cb506fe26ed3e10d7dcb2f95ec4415e639582d
    Reviewed-on: https://chromium-review.googlesource.com/570159Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#46655}
    1287688c
js-builtin-reducer.cc 124 KB