• Benedikt Meurer's avatar
    [turbofan] Make backing store load eliminatable for %ArrayIteratorPrototype%.next(). · f310c28b
    Benedikt Meurer authored
    Place the LoadField for the backing store of the [[IteratedObject]]
    before the diamond to make it possible to eliminate this LoadField
    in LoadElimination later, when used in `for..of` or destructing.
    
    This further improves the performance of `for..of` in the micro
    benchmark on the tracking bug from
    
      console.timeEnd: forOf, 191.726000
      console.timeEnd: traditional, 107.572000
      console.timeEnd: forOf, 137.288000
      console.timeEnd: traditional, 102.976000
      console.timeEnd: forOf, 137.506000
      console.timeEnd: traditional, 103.089000
    
    to around
    
      console.timeEnd: forOf, 195.238000
      console.timeEnd: traditional, 107.078000
      console.timeEnd: forOf, 128.980000
      console.timeEnd: traditional, 103.106000
      console.timeEnd: forOf, 128.525000
      console.timeEnd: traditional, 103.072000
    
    so roughly another ~7% improvement (with untrusted code mitigations
    turned off).
    
    Bug: v8:8070
    Change-Id: I34831c503384f0cc44b95317dd84403f2ed8ecd5
    Reviewed-on: https://chromium-review.googlesource.com/1188138Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#55390}
    f310c28b
js-call-reducer.cc 308 KB