Skip to content

Commit 5ed23f1

Browse files
webkit-commit-queueConstellation
webkit-commit-queue
authored and
Constellation
committed
Unreviewed, reverting 268130@main.
https://bugs.webkit.org/show_bug.cgi?id=261793 0.3~% SP3 regression Reverted changeset: "[JSC] Stop generating slow path for DataIC Baseine JIT" https://bugs.webkit.org/show_bug.cgi?id=261595 https://commits.webkit.org/268130@main Canonical link: https://commits.webkit.org/268168@main
1 parent ad8e8db commit 5ed23f1

17 files changed

Lines changed: 973 additions & 553 deletions

‎Source/JavaScriptCore/bytecode/CodeBlock.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -775,7 +775,7 @@ void CodeBlock::setupWithUnlinkedBaselineCode(Ref<BaselineJITCode> jitCode)
775775
unsigned index = bitwise_cast<uintptr_t>(entry.pointer());
776776
BaselineUnlinkedStructureStubInfo& unlinkedStubInfo = jitCode->m_unlinkedStubInfos[index];
777777
StructureStubInfo& stubInfo = baselineJITData->m_stubInfos[index];
778-
stubInfo.initializeFromUnlinkedStructureStubInfo(vm(), unlinkedStubInfo);
778+
stubInfo.initializeFromUnlinkedStructureStubInfo(unlinkedStubInfo);
779779
baselineJITData->at(i) = &stubInfo;
780780
break;
781781
}

‎Source/JavaScriptCore/bytecode/InlineAccess.cpp‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -446,18 +446,25 @@ void InlineAccess::rewireStubAsJumpInAccess(CodeBlock* codeBlock, StructureStubI
446446

447447
void InlineAccess::resetStubAsJumpInAccess(CodeBlock* codeBlock, StructureStubInfo& stubInfo)
448448
{
449-
if (JITCode::isBaselineCode(codeBlock->jitType()))
450-
rewireStubAsJumpInAccess(codeBlock, stubInfo, CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(codeBlock->vm(), stubInfo.accessType).code().template retagged<JITStubRoutinePtrTag>() });
451-
else
452-
rewireStubAsJumpInAccess(codeBlock, stubInfo, stubInfo.slowPathStartLocation);
449+
if (codeBlock->useDataIC()) {
450+
stubInfo.m_codePtr = stubInfo.slowPathStartLocation;
451+
stubInfo.m_inlineAccessBaseStructureID.clear(); // Clear out the inline access code.
452+
return;
453+
}
454+
455+
CCallHelpers::emitJITCodeOver(stubInfo.startLocation.retagged<JSInternalPtrTag>(), scopedLambda<void(CCallHelpers&)>([&](CCallHelpers& jit) {
456+
// We don't need a nop sled here because nobody should be jumping into the middle of an IC.
457+
auto jump = jit.jump();
458+
auto slowPathStartLocation = stubInfo.slowPathStartLocation;
459+
jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
460+
linkBuffer.link(jump, slowPathStartLocation);
461+
});
462+
}), "InlineAccess: linking constant jump");
453463
}
454464

455465
void InlineAccess::resetStubAsJumpInAccessNotUsingInlineAccess(CodeBlock* codeBlock, StructureStubInfo& stubInfo)
456466
{
457-
if (JITCode::isBaselineCode(codeBlock->jitType()))
458-
rewireStubAsJumpInAccessNotUsingInlineAccess(codeBlock, stubInfo, CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(codeBlock->vm(), stubInfo.accessType).code().template retagged<JITStubRoutinePtrTag>() });
459-
else
460-
rewireStubAsJumpInAccessNotUsingInlineAccess(codeBlock, stubInfo, stubInfo.slowPathStartLocation);
467+
rewireStubAsJumpInAccessNotUsingInlineAccess(codeBlock, stubInfo, stubInfo.slowPathStartLocation);
461468
}
462469

463470
} // namespace JSC

‎Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp‎

Lines changed: 9 additions & 429 deletions
Large diffs are not rendered by default.

‎Source/JavaScriptCore/bytecode/InlineCacheCompiler.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,8 +284,6 @@ class InlineCacheCompiler {
284284

285285
AccessGenerationResult regenerate(const GCSafeConcurrentJSLocker&, PolymorphicAccess&, CodeBlock*);
286286

287-
static MacroAssemblerCodeRef<JITThunkPtrTag> generateSlowPathCode(VM&, AccessType);
288-
289287
private:
290288
CallSiteIndex callSiteIndexForExceptionHandlingOrOriginal();
291289
const ScalarRegisterSet& liveRegistersToPreserveAtExceptionHandlingCallSite();

‎Source/JavaScriptCore/bytecode/StructureStubInfo.cpp‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -530,14 +530,15 @@ static CodePtr<OperationPtrTag> slowOperationFromUnlinkedStructureStubInfo(const
530530
return { };
531531
}
532532

533-
void StructureStubInfo::initializeFromUnlinkedStructureStubInfo(VM& vm, const BaselineUnlinkedStructureStubInfo& unlinkedStubInfo)
533+
void StructureStubInfo::initializeFromUnlinkedStructureStubInfo(const BaselineUnlinkedStructureStubInfo& unlinkedStubInfo)
534534
{
535535
accessType = unlinkedStubInfo.accessType;
536536
doneLocation = unlinkedStubInfo.doneLocation;
537+
slowPathStartLocation = unlinkedStubInfo.slowPathStartLocation;
537538
m_identifier = unlinkedStubInfo.m_identifier;
538539
callSiteIndex = CallSiteIndex(BytecodeIndex(unlinkedStubInfo.bytecodeIndex.offset()));
539540
codeOrigin = CodeOrigin(unlinkedStubInfo.bytecodeIndex);
540-
m_codePtr = InlineCacheCompiler::generateSlowPathCode(vm, accessType).code().template retagged<JITStubRoutinePtrTag>();
541+
m_codePtr = slowPathStartLocation;
541542
propertyIsInt32 = unlinkedStubInfo.propertyIsInt32;
542543
canBeMegamorphic = unlinkedStubInfo.canBeMegamorphic;
543544
isEnumerator = unlinkedStubInfo.isEnumerator;
@@ -546,7 +547,12 @@ void StructureStubInfo::initializeFromUnlinkedStructureStubInfo(VM& vm, const Ba
546547
if (unlinkedStubInfo.canBeMegamorphic)
547548
bufferingCountdown = 1;
548549

549-
usedRegisters = RegisterSetBuilder::stubUnavailableRegisters().buildScalarRegisterSet();
550+
auto usedJSRs = RegisterSetBuilder::stubUnavailableRegisters();
551+
if (accessType == AccessType::GetById && unlinkedStubInfo.bytecodeIndex.checkpoint()) {
552+
// For iterator_next, we can't clobber the "dontClobberJSR" register either.
553+
usedJSRs.add(BaselineJITRegisters::GetById::dontClobberJSR, IgnoreVectors);
554+
}
555+
usedRegisters = usedJSRs.buildScalarRegisterSet();
550556

551557
m_slowOperation = slowOperationFromUnlinkedStructureStubInfo(unlinkedStubInfo);
552558

‎Source/JavaScriptCore/bytecode/StructureStubInfo.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ class StructureStubInfo {
130130
void deref();
131131
void aboutToDie();
132132

133-
void initializeFromUnlinkedStructureStubInfo(VM&, const BaselineUnlinkedStructureStubInfo&);
133+
void initializeFromUnlinkedStructureStubInfo(const BaselineUnlinkedStructureStubInfo&);
134134
void initializeFromDFGUnlinkedStructureStubInfo(const DFG::UnlinkedStructureStubInfo&);
135135

136136
DECLARE_VISIT_AGGREGATE;
@@ -537,6 +537,7 @@ struct UnlinkedStructureStubInfo {
537537
bool isEnumerator : 1 { false };
538538
CacheableIdentifier m_identifier; // This only comes from already marked one. Thus, we do not mark it via GC.
539539
CodeLocationLabel<JSInternalPtrTag> doneLocation;
540+
CodeLocationLabel<JITStubRoutinePtrTag> slowPathStartLocation;
540541
};
541542

542543
struct BaselineUnlinkedStructureStubInfo : UnlinkedStructureStubInfo {

‎Source/JavaScriptCore/dfg/DFGInlineCacheWrapperInlines.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ void InlineCacheWrapper<GeneratorType>::finalize(LinkBuffer& fastPath, LinkBuffe
3838
m_generator.reportSlowPathCall(m_slowPath->label(), m_slowPath->call());
3939
if (m_generator.m_unlinkedStubInfo) {
4040
m_generator.m_unlinkedStubInfo->doneLocation = fastPath.locationOf<JSInternalPtrTag>(m_generator.m_done);
41-
static_cast<DFG::UnlinkedStructureStubInfo*>(m_generator.m_unlinkedStubInfo)->slowPathStartLocation = fastPath.locationOf<JITStubRoutinePtrTag>(m_generator.m_slowPathBegin);
41+
m_generator.m_unlinkedStubInfo->slowPathStartLocation = fastPath.locationOf<JITStubRoutinePtrTag>(m_generator.m_slowPathBegin);
4242
} else
4343
m_generator.finalize(fastPath, slowPath);
4444
}

‎Source/JavaScriptCore/dfg/DFGJITCode.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ class JITCode;
5252
class JITCompiler;
5353

5454
struct UnlinkedStructureStubInfo : JSC::UnlinkedStructureStubInfo {
55-
CodeLocationLabel<JITStubRoutinePtrTag> slowPathStartLocation;
5655
CodeOrigin codeOrigin;
5756
ScalarRegisterSet usedRegisters;
5857
CallSiteIndex callSiteIndex;

‎Source/JavaScriptCore/jit/BaselineJITRegisters.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,8 @@ namespace GetById {
120120
static constexpr GPRReg globalObjectGPR { preferredArgumentGPR<SlowOperation, 1>() };
121121
static constexpr GPRReg stubInfoGPR { preferredArgumentGPR<SlowOperation, 2>() };
122122
static constexpr GPRReg scratch1GPR { globalObjectGPR };
123-
static_assert(noOverlap(baseJSR, stubInfoGPR, globalObjectGPR), "Required for DataIC");
123+
static constexpr JSValueRegs dontClobberJSR { JSRInfo::jsRegT54 };
124+
static_assert(noOverlap(baseJSR, stubInfoGPR, globalObjectGPR, dontClobberJSR), "Required for DataIC");
124125
static_assert(noOverlap(resultJSR, stubInfoGPR));
125126
}
126127

‎Source/JavaScriptCore/jit/JIT.cpp‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -488,6 +488,18 @@ void JIT::privateCompileLinkPass()
488488

489489
void JIT::privateCompileSlowCases()
490490
{
491+
m_getByIdIndex = 0;
492+
m_getByValIndex = 0;
493+
m_getByIdWithThisIndex = 0;
494+
m_getByValWithThisIndex = 0;
495+
m_putByIdIndex = 0;
496+
m_putByValIndex = 0;
497+
m_inByIdIndex = 0;
498+
m_inByValIndex = 0;
499+
m_delByIdIndex = 0;
500+
m_delByValIndex = 0;
501+
m_instanceOfIndex = 0;
502+
m_privateBrandAccessIndex = 0;
491503
m_callLinkInfoIndex = 0;
492504

493505
unsigned bytecodeCountHavingSlowCase = 0;
@@ -534,6 +546,22 @@ void JIT::privateCompileSlowCases()
534546
DEFINE_SLOWCASE_OP(op_construct_varargs)
535547
DEFINE_SLOWCASE_OP(op_construct)
536548
DEFINE_SLOWCASE_OP(op_eq)
549+
DEFINE_SLOWCASE_OP(op_try_get_by_id)
550+
DEFINE_SLOWCASE_OP(op_in_by_id)
551+
DEFINE_SLOWCASE_OP(op_in_by_val)
552+
DEFINE_SLOWCASE_OP(op_has_private_name)
553+
DEFINE_SLOWCASE_OP(op_has_private_brand)
554+
DEFINE_SLOWCASE_OP(op_get_by_id)
555+
DEFINE_SLOWCASE_OP(op_get_by_id_with_this)
556+
DEFINE_SLOWCASE_OP(op_get_by_id_direct)
557+
DEFINE_SLOWCASE_OP(op_get_by_val)
558+
DEFINE_SLOWCASE_OP(op_get_by_val_with_this)
559+
DEFINE_SLOWCASE_OP(op_enumerator_get_by_val)
560+
DEFINE_SLOWCASE_OP(op_enumerator_put_by_val)
561+
DEFINE_SLOWCASE_OP(op_get_private_name)
562+
DEFINE_SLOWCASE_OP(op_set_private_brand)
563+
DEFINE_SLOWCASE_OP(op_check_private_brand)
564+
DEFINE_SLOWCASE_OP(op_instanceof)
537565
DEFINE_SLOWCASE_OP(op_less)
538566
DEFINE_SLOWCASE_OP(op_lesseq)
539567
DEFINE_SLOWCASE_OP(op_greater)
@@ -559,6 +587,12 @@ void JIT::privateCompileSlowCases()
559587
DEFINE_SLOWCASE_OP(op_negate)
560588
DEFINE_SLOWCASE_OP(op_neq)
561589
DEFINE_SLOWCASE_OP(op_new_object)
590+
DEFINE_SLOWCASE_OP(op_put_by_id)
591+
DEFINE_SLOWCASE_OP(op_put_by_val_direct)
592+
DEFINE_SLOWCASE_OP(op_put_by_val)
593+
DEFINE_SLOWCASE_OP(op_put_private_name)
594+
DEFINE_SLOWCASE_OP(op_del_by_val)
595+
DEFINE_SLOWCASE_OP(op_del_by_id)
562596
DEFINE_SLOWCASE_OP(op_sub)
563597
DEFINE_SLOWCASE_OP(op_put_to_scope)
564598

@@ -612,6 +646,14 @@ void JIT::privateCompileSlowCases()
612646
}
613647

614648
RELEASE_ASSERT(bytecodeCountHavingSlowCase == m_bytecodeCountHavingSlowCase);
649+
RELEASE_ASSERT(m_getByIdIndex == m_getByIds.size());
650+
RELEASE_ASSERT(m_getByIdWithThisIndex == m_getByIdsWithThis.size());
651+
RELEASE_ASSERT(m_getByValWithThisIndex == m_getByValsWithThis.size());
652+
RELEASE_ASSERT(m_putByIdIndex == m_putByIds.size());
653+
RELEASE_ASSERT(m_putByValIndex == m_putByVals.size());
654+
RELEASE_ASSERT(m_inByIdIndex == m_inByIds.size());
655+
RELEASE_ASSERT(m_instanceOfIndex == m_instanceOfs.size());
656+
RELEASE_ASSERT(m_privateBrandAccessIndex == m_privateBrandAccesses.size());
615657
RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
616658

617659
#ifndef NDEBUG
@@ -916,8 +958,10 @@ RefPtr<BaselineJITCode> JIT::link(LinkBuffer& patchBuffer)
916958
#endif
917959

918960
auto finalizeICs = [&] (auto& generators) {
919-
for (auto& gen : generators)
961+
for (auto& gen : generators) {
920962
gen.m_unlinkedStubInfo->doneLocation = patchBuffer.locationOf<JSInternalPtrTag>(gen.m_done);
963+
gen.m_unlinkedStubInfo->slowPathStartLocation = patchBuffer.locationOf<JITStubRoutinePtrTag>(gen.m_slowPathBegin);
964+
}
921965
};
922966

923967
finalizeICs(m_getByIds);

0 commit comments

Comments
 (0)