|
| 1 | +2021-06-03 Ross Kirsling <ross.kirsling@sony.com> |
| 2 | + |
| 3 | + [JSC] Implement JIT ICs for InByVal |
| 4 | + https://bugs.webkit.org/show_bug.cgi?id=226563 |
| 5 | + |
| 6 | + Reviewed by Saam Barati. |
| 7 | + |
| 8 | + Until now, InByVal has had few optimizations implemented: |
| 9 | + DFG would attempt to convert string index lookups to InById and int32 lookups to HasIndexedProperty, |
| 10 | + but there has been no inline caching nor any special handling for symbol lookups. |
| 11 | + |
| 12 | + This has become a more urgent problem now, as `#x in obj` (i.e. HasPrivateName / HasPrivateBrand) |
| 13 | + will need to mimic InByVal's inline caching strategy in order to be deemed performant enough to ship. |
| 14 | + |
| 15 | + This patch thus implements inline caching for InByVal at all JIT tiers. |
| 16 | + The result is a night-and-day difference for symbols, a nice boost for string indices, and no change for int32s: |
| 17 | + |
| 18 | + in-by-val-symbol 203.5572+-2.7647 ^ 19.1035+-0.7498 ^ definitely 10.6555x faster |
| 19 | + in-by-val-string-index 87.0368+-44.7766 45.9971+-32.0007 might be 1.8922x faster |
| 20 | + in-by-val-int32 110.9904+-1.7109 ? 111.3431+-1.7558 ? |
| 21 | + |
| 22 | + * JavaScriptCore.xcodeproj/project.pbxproj: |
| 23 | + * Sources.txt: |
| 24 | + * bytecode/CheckPrivateBrandStatus.cpp: |
| 25 | + (JSC::CheckPrivateBrandStatus::singleIdentifier const): |
| 26 | + * bytecode/DeleteByStatus.cpp: |
| 27 | + (JSC::DeleteByStatus::singleIdentifier const): |
| 28 | + * bytecode/GetByStatus.cpp: |
| 29 | + (JSC::GetByStatus::singleIdentifier const): |
| 30 | + * bytecode/ICStatusMap.h: |
| 31 | + * bytecode/ICStatusUtils.h: |
| 32 | + (JSC::singleIdentifierForICStatus): |
| 33 | + * bytecode/InByIdVariant.cpp: |
| 34 | + (JSC::InByIdVariant::InByIdVariant): |
| 35 | + (JSC::InByIdVariant::attemptToMerge): |
| 36 | + (JSC::InByIdVariant::dumpInContext const): |
| 37 | + * bytecode/InByIdVariant.h: |
| 38 | + (JSC::InByIdVariant::identifier const): |
| 39 | + (JSC::InByIdVariant::overlaps): |
| 40 | + * bytecode/InByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.cpp. |
| 41 | + (JSC::InByStatus::appendVariant): |
| 42 | + (JSC::InByStatus::shrinkToFit): |
| 43 | + (JSC::InByStatus::computeFor): |
| 44 | + (JSC::InByStatus::computeForStubInfo): |
| 45 | + (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): |
| 46 | + (JSC::InByStatus::merge): |
| 47 | + (JSC::InByStatus::filter): |
| 48 | + (JSC::InByStatus::markIfCheap): |
| 49 | + (JSC::InByStatus::finalize): |
| 50 | + (JSC::InByStatus::singleIdentifier const): |
| 51 | + (JSC::InByStatus::dump const): |
| 52 | + * bytecode/InByStatus.h: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.h. |
| 53 | + * bytecode/RecordedStatuses.cpp: |
| 54 | + (JSC::RecordedStatuses::addInByStatus): Renamed from addInByIdStatus. |
| 55 | + * bytecode/RecordedStatuses.h: |
| 56 | + * bytecode/SetPrivateBrandStatus.cpp: |
| 57 | + (JSC::SetPrivateBrandStatus::singleIdentifier const): |
| 58 | + * bytecode/StructureStubInfo.cpp: |
| 59 | + (JSC::StructureStubInfo::reset): |
| 60 | + * bytecode/StructureStubInfo.h: |
| 61 | + * dfg/DFGAbstractInterpreterInlines.h: |
| 62 | + (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): |
| 63 | + (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus): |
| 64 | + * dfg/DFGArgumentsEliminationPhase.cpp: |
| 65 | + * dfg/DFGByteCodeParser.cpp: |
| 66 | + (JSC::DFG::ByteCodeParser::handleInById): |
| 67 | + (JSC::DFG::ByteCodeParser::parseBlock): |
| 68 | + * dfg/DFGClobberize.h: |
| 69 | + (JSC::DFG::clobberize): |
| 70 | + * dfg/DFGClobbersExitState.cpp: |
| 71 | + (JSC::DFG::clobbersExitState): |
| 72 | + * dfg/DFGDoesGC.cpp: |
| 73 | + (JSC::DFG::doesGC): |
| 74 | + * dfg/DFGFixupPhase.cpp: |
| 75 | + (JSC::DFG::FixupPhase::fixupNode): |
| 76 | + * dfg/DFGGraph.cpp: |
| 77 | + (JSC::DFG::Graph::dump): |
| 78 | + * dfg/DFGJITCompiler.cpp: |
| 79 | + (JSC::DFG::JITCompiler::link): |
| 80 | + * dfg/DFGJITCompiler.h: |
| 81 | + (JSC::DFG::JITCompiler::addInByVal): |
| 82 | + * dfg/DFGMayExit.cpp: |
| 83 | + * dfg/DFGNode.h: |
| 84 | + (JSC::DFG::Node::hasInByStatus): Renamed from hasInByIdStatus. |
| 85 | + (JSC::DFG::Node::inByStatus): Renamed from inByIdStatus. |
| 86 | + * dfg/DFGNodeType.h: |
| 87 | + * dfg/DFGObjectAllocationSinkingPhase.cpp: |
| 88 | + * dfg/DFGPredictionPropagationPhase.cpp: |
| 89 | + * dfg/DFGSafeToExecute.h: |
| 90 | + (JSC::DFG::safeToExecute): |
| 91 | + * dfg/DFGSpeculativeJIT.cpp: |
| 92 | + (JSC::DFG::SpeculativeJIT::compileInByVal): |
| 93 | + * dfg/DFGSpeculativeJIT32_64.cpp: |
| 94 | + (JSC::DFG::SpeculativeJIT::compile): |
| 95 | + * dfg/DFGSpeculativeJIT64.cpp: |
| 96 | + (JSC::DFG::SpeculativeJIT::compile): |
| 97 | + * dfg/DFGVarargsForwardingPhase.cpp: |
| 98 | + * ftl/FTLCapabilities.cpp: |
| 99 | + (JSC::FTL::canCompile): |
| 100 | + * ftl/FTLLowerDFGToB3.cpp: |
| 101 | + (JSC::FTL::DFG::LowerDFGToB3::compileNode): |
| 102 | + (JSC::FTL::DFG::LowerDFGToB3::compileInBy): |
| 103 | + (JSC::FTL::DFG::LowerDFGToB3::compileInById): |
| 104 | + (JSC::FTL::DFG::LowerDFGToB3::compileInByVal): |
| 105 | + * jit/ICStats.h: |
| 106 | + * jit/JIT.cpp: |
| 107 | + (JSC::JIT::privateCompileMainPass): |
| 108 | + (JSC::JIT::privateCompileSlowCases): |
| 109 | + (JSC::JIT::link): |
| 110 | + * jit/JIT.h: |
| 111 | + * jit/JITInlineCacheGenerator.cpp: |
| 112 | + (JSC::JITInByValGenerator::JITInByValGenerator): |
| 113 | + (JSC::JITInByValGenerator::generateFastPath): |
| 114 | + (JSC::JITInByValGenerator::finalize): |
| 115 | + (JSC::JITInByIdGenerator::JITInByIdGenerator): |
| 116 | + * jit/JITInlineCacheGenerator.h: |
| 117 | + (JSC::JITDelByIdGenerator::slowPathJump const): |
| 118 | + (JSC::JITInByValGenerator::JITInByValGenerator): |
| 119 | + (JSC::JITInByValGenerator::slowPathJump const): |
| 120 | + * jit/JITOperations.cpp: |
| 121 | + (JSC::JSC_DEFINE_JIT_OPERATION): |
| 122 | + * jit/JITOperations.h: |
| 123 | + * jit/JITPropertyAccess.cpp: |
| 124 | + (JSC::JIT::emit_op_in_by_val): |
| 125 | + (JSC::JIT::emitSlow_op_in_by_val): |
| 126 | + * jit/JITPropertyAccess32_64.cpp: |
| 127 | + (JSC::JIT::emit_op_in_by_val): |
| 128 | + (JSC::JIT::emitSlow_op_in_by_val): |
| 129 | + * jit/Repatch.cpp: |
| 130 | + (JSC::tryCacheInBy): Renamed from tryCacheInByID. |
| 131 | + (JSC::repatchInBy): Renamed from repatchInByID. |
| 132 | + (JSC::resetInBy): Renamed from resetInByID. |
| 133 | + * jit/Repatch.h: |
| 134 | + * llint/LLIntSlowPaths.cpp: |
| 135 | + (JSC::LLInt::LLINT_SLOW_PATH_DECL): |
| 136 | + * llint/LLIntSlowPaths.h: |
| 137 | + * llint/LowLevelInterpreter.asm: |
| 138 | + * runtime/CommonSlowPaths.cpp: |
| 139 | + * runtime/CommonSlowPaths.h: |
| 140 | + |
1 | 141 | 2021-06-03 Mark Lam <mark.lam@apple.com> |
2 | 142 |
|
3 | 143 | Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException. |
|
0 commit comments