Changeset 137937 in webkit for trunk/Source/JavaScriptCore/bytecode/ArrayProfile.h

Timestamp:

Dec 17, 2012, 1:38:51 PM (13 years ago)

Author:

[email protected]

Message:

Rationalize array profiling for out-of-bounds and hole cases
​https://bugs.webkit.org/show_bug.cgi?id=105139

Reviewed by Geoffrey Garen.

This makes ArrayProfile track whether or not we had out-of-bounds, which allows
for more precise decision-making in the DFG.

Also cleaned up ExitKinds for out-of-bounds and hole cases to make it easier to
look at them in the profiler.

Slight speed-up (5-8%) on SunSpider/crypto-md5.

• bytecode/ArrayProfile.cpp:

(JSC::ArrayProfile::computeUpdatedPrediction):
(JSC::ArrayProfile::briefDescription):

• bytecode/ArrayProfile.h:

(JSC::ArrayProfile::ArrayProfile):
(JSC::ArrayProfile::addressOfOutOfBounds):
(JSC::ArrayProfile::expectedStructure):
(JSC::ArrayProfile::structureIsPolymorphic):
(JSC::ArrayProfile::outOfBounds):
(JSC::ArrayProfile::polymorphicStructure):

• bytecode/CodeBlock.cpp:

(JSC::dumpChain):

• bytecode/ExitKind.cpp:

(JSC::exitKindToString):
(JSC::exitKindIsCountable):

• bytecode/ExitKind.h:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• jit/JIT.h:
• jit/JITInlines.h:

(JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitSlow_op_put_by_val):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitSlow_op_put_by_val):

• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:

File:

• trunk/Source/JavaScriptCore/bytecode/ArrayProfile.h (modified) (6 diffs)

trunk/Source/JavaScriptCore/bytecode/ArrayProfile.h

@@ -122 +122 @@
         , m_lastSeenStructure(0)
         , m_expectedStructure(0)
-        , m_structureIsPolymorphic(false)
         , m_mayStoreToHole(false)
+        , m_outOfBounds(false)
         , m_mayInterceptIndexedAccesses(false)
         , m_usesOriginalArrayStructures(true)
@@ -134 +134 @@
         , m_lastSeenStructure(0)
         , m_expectedStructure(0)
-        , m_structureIsPolymorphic(false)
         , m_mayStoreToHole(false)
+        , m_outOfBounds(false)
         , m_mayInterceptIndexedAccesses(false)
         , m_usesOriginalArrayStructures(true)
@@ -147 +147 @@
     ArrayModes* addressOfArrayModes() { return &m_observedArrayModes; }
     bool* addressOfMayStoreToHole() { return &m_mayStoreToHole; }
+    bool* addressOfOutOfBounds() { return &m_outOfBounds; }
     
     void observeStructure(Structure* structure)
@@ -155 +156 @@
     void computeUpdatedPrediction(CodeBlock*, OperationInProgress = NoOperation);
     
-    Structure* expectedStructure() const { return m_expectedStructure; }
+    Structure* expectedStructure() const
+    {
+        if (structureIsPolymorphic())
+            return 0;
+        return m_expectedStructure;
+    }
     bool structureIsPolymorphic() const
     {
-        return m_structureIsPolymorphic;
+        return m_expectedStructure == polymorphicStructure();
     }
     bool hasDefiniteStructure() const
@@ -169 +175 @@
     
     bool mayStoreToHole() const { return m_mayStoreToHole; }
+    bool outOfBounds() const { return m_outOfBounds; }
     
     bool usesOriginalArrayStructures() const { return m_usesOriginalArrayStructures; }
@@ -176 +183 @@
 private:
     friend class LLIntOffsetsExtractor;
+    
+    static Structure* polymorphicStructure() { return static_cast<Structure*>(reinterpret_cast<void*>(1)); }
     
     unsigned m_bytecodeOffset;
     Structure* m_lastSeenStructure;
     Structure* m_expectedStructure;
-    bool m_structureIsPolymorphic;
     bool m_mayStoreToHole; // This flag may become overloaded to indicate other special cases that were encountered during array access, as it depends on indexing type. Since we currently have basically just one indexing type (two variants of ArrayStorage), this flag for now just means exactly what its name implies.
+    bool m_outOfBounds;
     bool m_mayInterceptIndexedAccesses;
     bool m_usesOriginalArrayStructures;