Skip to content

Commit d042d9b

Browse files
kmiller68kmiller68
committed
[JSC] Split PropertyInlineCache into subclasses
https://bugs.webkit.org/show_bug.cgi?id=309568 rdar://172190152 Reviewed by Yusuke Suzuki. Split the monolithic PropertyInlineCache class into a base class with two subclasses: HandlerPropertyInlineCache (used by Baseline JIT and DFG) and RepatchingPropertyInlineCache (used by FTL and 32-bit DFG). The useHandlerIC boolean field is replaced by a PropertyInlineCacheType enum and WTF type trait infrastructure, enabling dynamicDowncast<> and is<> checks throughout. Mode-specific fields — m_slowOperation and m_inlinedHandler for handler ICs; startLocation, m_slowPathCallLocation, m_stub, and inlineCodeSize() for repatching ICs — are moved to the appropriate subclass. DFG::CommonData now holds two separate Bags (m_handlerPropertyInlineCaches and m_repatchingPropertyInlineCaches) instead of a single m_propertyInlineCaches bag, and FTL::State::addPropertyInlineCache() selects which bag to use based on the useHandlerICInFTL option. I also added a FIXME to move the various regs (m_baseGPR, m_extraGPR, etc) to RepatchingPropertyInlineCache and have HandlerPropertyInlineCache use fixed values. This is slightly non-trivial because the different AccessTypes use different registers for each of the values. Canonical link: https://commits.webkit.org/309143@main
1 parent 1d17af2 commit d042d9b

15 files changed

Lines changed: 359 additions & 290 deletions

‎Source/JavaScriptCore/bytecode/CodeBlock.cpp‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1152,7 +1152,11 @@ inline void CodeBlock::forEachPropertyInlineCache(Func func)
11521152
#if ENABLE(JIT)
11531153
if (JSC::JITCode::isOptimizingJIT(jitType())) {
11541154
#if ENABLE(DFG_JIT)
1155-
for (auto* propertyCache : jitCode()->dfgCommon()->m_propertyInlineCaches) {
1155+
for (auto* propertyCache : jitCode()->dfgCommon()->m_handlerPropertyInlineCaches) {
1156+
if (func(*propertyCache) == IterationStatus::Done)
1157+
return;
1158+
}
1159+
for (auto* propertyCache : jitCode()->dfgCommon()->m_repatchingPropertyInlineCaches) {
11561160
if (func(*propertyCache) == IterationStatus::Done)
11571161
return;
11581162
}

‎Source/JavaScriptCore/bytecode/InlineAccess.cpp‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
2121
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
2222
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23-
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2424
*/
2525

2626
#include "config.h"
@@ -149,7 +149,7 @@ void InlineAccess::dumpCacheSizesAndCrash()
149149
}
150150

151151

152-
ALWAYS_INLINE static bool linkCodeInline(const char* name, CCallHelpers& jit, PropertyInlineCache& propertyCache)
152+
ALWAYS_INLINE static bool linkCodeInline(const char* name, CCallHelpers& jit, RepatchingPropertyInlineCache& propertyCache)
153153
{
154154
if (jit.m_assembler.buffer().codeSize() <= propertyCache.inlineCodeSize()) {
155155
bool needsBranchCompaction = true;
@@ -179,11 +179,12 @@ bool InlineAccess::generateSelfPropertyAccess(PropertyInlineCache& propertyCache
179179
if (!hasConstantIdentifier(propertyCache.accessType))
180180
return false;
181181

182-
if (propertyCache.useHandlerIC)
182+
auto* repatchingIC = dynamicDowncast<RepatchingPropertyInlineCache>(propertyCache);
183+
if (!repatchingIC)
183184
return false;
184185

185186
CCallHelpers jit;
186-
187+
187188
GPRReg base = propertyCache.m_baseGPR;
188189
JSValueRegs value = propertyCache.valueRegs();
189190

@@ -198,11 +199,11 @@ bool InlineAccess::generateSelfPropertyAccess(PropertyInlineCache& propertyCache
198199
jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR());
199200
storage = value.payloadGPR();
200201
}
201-
202+
202203
jit.loadValue(
203204
MacroAssembler::Address(storage, offsetRelativeToBase(offset)), value);
204205

205-
return linkCodeInline("property access", jit, propertyCache);
206+
return linkCodeInline("property access", jit, *repatchingIC);
206207
}
207208

208209
ALWAYS_INLINE static GPRReg getScratchRegister(PropertyInlineCache& propertyCache)
@@ -236,7 +237,7 @@ bool InlineAccess::canGenerateSelfPropertyReplace(PropertyInlineCache& propertyC
236237
if (!hasConstantIdentifier(propertyCache.accessType))
237238
return false;
238239

239-
if (propertyCache.useHandlerIC)
240+
if (propertyCache.isHandlerIC())
240241
return false;
241242

242243
if (isInlineOffset(offset))
@@ -250,11 +251,12 @@ bool InlineAccess::generateSelfPropertyReplace(PropertyInlineCache& propertyCach
250251
if (!hasConstantIdentifier(propertyCache.accessType))
251252
return false;
252253

253-
ASSERT(canGenerateSelfPropertyReplace(propertyCache, offset));
254-
255-
if (propertyCache.useHandlerIC)
254+
auto* repatchingIC = dynamicDowncast<RepatchingPropertyInlineCache>(propertyCache);
255+
if (!repatchingIC)
256256
return false;
257257

258+
ASSERT(canGenerateSelfPropertyReplace(propertyCache, offset));
259+
258260
CCallHelpers jit;
259261

260262
GPRReg base = propertyCache.m_baseGPR;
@@ -277,7 +279,7 @@ bool InlineAccess::generateSelfPropertyReplace(PropertyInlineCache& propertyCach
277279
jit.storeValue(
278280
value, MacroAssembler::Address(storage, offsetRelativeToBase(offset)));
279281

280-
return linkCodeInline("property replace", jit, propertyCache);
282+
return linkCodeInline("property replace", jit, *repatchingIC);
281283
}
282284

283285
bool InlineAccess::isCacheableArrayLength(PropertyInlineCache& propertyCache, JSArray* array)
@@ -287,7 +289,7 @@ bool InlineAccess::isCacheableArrayLength(PropertyInlineCache& propertyCache, JS
287289
if (!hasConstantIdentifier(propertyCache.accessType))
288290
return false;
289291

290-
if (propertyCache.useHandlerIC)
292+
if (propertyCache.isHandlerIC())
291293
return propertyCache.preconfiguredCacheType == CacheType::ArrayLength;
292294

293295
if (!hasFreeRegister(propertyCache))
@@ -303,8 +305,8 @@ bool InlineAccess::generateArrayLength(PropertyInlineCache& propertyCache, JSArr
303305
if (!hasConstantIdentifier(propertyCache.accessType))
304306
return false;
305307

306-
// ArrayLength fast path does not need any modification.
307-
if (propertyCache.useHandlerIC)
308+
auto* repatchingIC = dynamicDowncast<RepatchingPropertyInlineCache>(propertyCache);
309+
if (!repatchingIC)
308310
return false;
309311

310312
CCallHelpers jit;
@@ -321,15 +323,15 @@ bool InlineAccess::generateArrayLength(PropertyInlineCache& propertyCache, JSArr
321323
jit.load32(CCallHelpers::Address(value.payloadGPR(), ArrayStorage::lengthOffset()), value.payloadGPR());
322324
jit.boxInt32(value.payloadGPR(), value);
323325

324-
return linkCodeInline("array length", jit, propertyCache);
326+
return linkCodeInline("array length", jit, *repatchingIC);
325327
}
326328

327329
bool InlineAccess::isCacheableStringLength(PropertyInlineCache& propertyCache)
328330
{
329331
if (!hasConstantIdentifier(propertyCache.accessType))
330332
return false;
331333

332-
if (propertyCache.useHandlerIC)
334+
if (propertyCache.isHandlerIC())
333335
return propertyCache.preconfiguredCacheType == CacheType::StringLength;
334336

335337
return hasFreeRegister(propertyCache);
@@ -342,7 +344,8 @@ bool InlineAccess::generateStringLength(PropertyInlineCache& propertyCache)
342344
if (!hasConstantIdentifier(propertyCache.accessType))
343345
return false;
344346

345-
if (propertyCache.useHandlerIC)
347+
auto* repatchingIC = dynamicDowncast<RepatchingPropertyInlineCache>(propertyCache);
348+
if (!repatchingIC)
346349
return false;
347350

348351
CCallHelpers jit;
@@ -367,7 +370,7 @@ bool InlineAccess::generateStringLength(PropertyInlineCache& propertyCache)
367370
done.link(&jit);
368371
jit.boxInt32(value.payloadGPR(), value);
369372

370-
return linkCodeInline("string length", jit, propertyCache);
373+
return linkCodeInline("string length", jit, *repatchingIC);
371374
}
372375

373376

@@ -378,7 +381,8 @@ bool InlineAccess::generateSelfInAccess(PropertyInlineCache& propertyCache, Stru
378381
if (!hasConstantIdentifier(propertyCache.accessType))
379382
return false;
380383

381-
if (propertyCache.useHandlerIC)
384+
auto* repatchingIC = dynamicDowncast<RepatchingPropertyInlineCache>(propertyCache);
385+
if (!repatchingIC)
382386
return false;
383387

384388
GPRReg base = propertyCache.m_baseGPR;
@@ -390,7 +394,7 @@ bool InlineAccess::generateSelfInAccess(PropertyInlineCache& propertyCache, Stru
390394
MacroAssembler::TrustedImm32(std::bit_cast<uint32_t>(structure->id()))).linkThunk(propertyCache.slowPathStartLocation, &jit);
391395
jit.boxBoolean(true, value);
392396

393-
return linkCodeInline("in access", jit, propertyCache);
397+
return linkCodeInline("in access", jit, *repatchingIC);
394398
}
395399

396400
} // namespace JSC

0 commit comments

Comments
 (0)