Changeset 164620 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

Timestamp:

Feb 24, 2014, 6:02:50 PM (11 years ago)

Author:

[email protected]

Message:

FTL should do polymorphic PutById inlining
​https://bugs.webkit.org/show_bug.cgi?id=129210

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg and Oliver Hunt.

This makes PutByIdStatus inform us about polymorphic cases by returning an array of
PutByIdVariants. The DFG now has a node called MultiPutByOffset that indicates a
selection of multiple inlined PutByIdVariants.

MultiPutByOffset is almost identical to MultiGetByOffset, which we added in
​http://trac.webkit.org/changeset/164207.

This also does some FTL refactoring to make MultiPutByOffset share code with some nodes
that generate similar code.

1% speed-up on V8v7 due to splay improving by 6.8%. Splay does the thing where it
sometimes swaps field insertion order, creating fake polymorphism.

• CMakeLists.txt:
• GNUmakefile.list.am:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
• JavaScriptCore.xcodeproj/project.pbxproj:
• bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeFromLLInt):
(JSC::PutByIdStatus::computeFor):
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::dump):

• bytecode/PutByIdStatus.h:

(JSC::PutByIdStatus::PutByIdStatus):
(JSC::PutByIdStatus::isSimple):
(JSC::PutByIdStatus::numVariants):
(JSC::PutByIdStatus::variants):
(JSC::PutByIdStatus::at):
(JSC::PutByIdStatus::operator[]):

• bytecode/PutByIdVariant.cpp: Added.

(JSC::PutByIdVariant::dump):
(JSC::PutByIdVariant::dumpInContext):

• bytecode/PutByIdVariant.h: Added.

(JSC::PutByIdVariant::PutByIdVariant):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::kind):
(JSC::PutByIdVariant::isSet):
(JSC::PutByIdVariant::operator!):
(JSC::PutByIdVariant::structure):
(JSC::PutByIdVariant::oldStructure):
(JSC::PutByIdVariant::newStructure):
(JSC::PutByIdVariant::structureChain):
(JSC::PutByIdVariant::offset):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::emitPrototypeChecks):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::emitPutById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::checkStructureElimination):
(JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
(JSC::DFG::CSEPhase::putStructureStoreElimination):
(JSC::DFG::CSEPhase::getByOffsetLoadElimination):
(JSC::DFG::CSEPhase::putByOffsetStoreElimination):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGGraph.h:
• dfg/DFGNode.cpp:

(JSC::DFG::MultiPutByOffsetData::writesStructures):
(JSC::DFG::MultiPutByOffsetData::reallocatesStorage):

• dfg/DFGNode.h:

(JSC::DFG::Node::convertToPutByOffset):
(JSC::DFG::Node::hasMultiPutByOffsetData):
(JSC::DFG::Node::multiPutByOffsetData):

• dfg/DFGNodeType.h:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compilePutStructure):
(JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage):
(JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage):
(JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::loadProperty):
(JSC::FTL::LowerDFGToLLVM::storeProperty):
(JSC::FTL::LowerDFGToLLVM::addressOfProperty):
(JSC::FTL::LowerDFGToLLVM::storageForTransition):
(JSC::FTL::LowerDFGToLLVM::allocatePropertyStorage):
(JSC::FTL::LowerDFGToLLVM::reallocatePropertyStorage):
(JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):

• tests/stress/fold-multi-put-by-offset-to-put-by-offset.js: Added.
• tests/stress/multi-put-by-offset-reallocation-butterfly-cse.js: Added.
• tests/stress/multi-put-by-offset-reallocation-cases.js: Added.

LayoutTests:

Reviewed by Mark Hahnenberg and Oliver Hunt.

Add a microbenchmark for polymorphic PutById.

• js/regress/polymorphic-put-by-id-expected.txt: Added.
• js/regress/polymorphic-put-by-id.html: Added.
• js/regress/script-tests/polymorphic-put-by-id.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -1641 +1641 @@
             set.addAll(node->multiGetByOffsetData().variants[i].structureSet());
         
-        filter(value, set);
+        filter(node->child1(), set);
         forNode(node).makeHeapTop();
         break;
@@ -1649 +1649 @@
         break;
     }
-            
+        
+    case MultiPutByOffset: {
+        AbstractValue& value = forNode(node->child1());
+        ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
+
+        if (Structure* structure = value.bestProvenStructure()) {
+            bool done = false;
+            for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+                const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+                if (variant.oldStructure() != structure)
+                    continue;
+                
+                if (variant.kind() == PutByIdVariant::Replace) {
+                    filter(node->child1(), structure);
+                    m_state.setFoundConstants(true);
+                    m_state.setHaveStructures(true);
+                    done = true;
+                    break;
+                }
+                
+                ASSERT(variant.kind() == PutByIdVariant::Transition);
+                clobberStructures(clobberLimit);
+                forNode(node->child1()).set(m_graph, variant.newStructure());
+                m_state.setFoundConstants(true);
+                m_state.setHaveStructures(true);
+                done = true;
+                break;
+            }
+            if (done)
+                break;
+        }
+        
+        clobberStructures(clobberLimit);
+        
+        StructureSet newSet;
+        for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+            const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+            if (variant.kind() == PutByIdVariant::Replace) {
+                if (value.m_currentKnownStructure.contains(variant.structure()))
+                    newSet.addAll(variant.structure());
+                continue;
+            }
+            ASSERT(variant.kind() == PutByIdVariant::Transition);
+            if (value.m_currentKnownStructure.contains(variant.oldStructure()))
+                newSet.addAll(variant.newStructure());
+        }
+        
+        // Use filter(value, set) as a way of setting the structure set. This works because
+        // we would have already made the set be TOP before this. Filtering top is another 
+        // way of setting.
+        filter(node->child1(), newSet);
+        break;
+    }
+    
     case CheckFunction: {
         JSValue value = forNode(node->child1()).value();
@@ -1686 +1739 @@
                 m_graph.identifiers()[node->identifierNumber()],
                 node->op() == PutByIdDirect);
-            if (status.isSimpleReplace()) {
-                filter(node->child1(), structure);
-                m_state.setFoundConstants(true);
-                m_state.setHaveStructures(true);
-                break;
-            }
-            if (status.isSimpleTransition()) {
-                clobberStructures(clobberLimit);
-                forNode(node->child1()).set(m_graph, status.newStructure());
-                m_state.setHaveStructures(true);
-                m_state.setFoundConstants(true);
-                break;
+            if (status.isSimple() && status.numVariants() == 1) {
+                if (status[0].kind() == PutByIdVariant::Replace) {
+                    filter(node->child1(), structure);
+                    m_state.setFoundConstants(true);
+                    m_state.setHaveStructures(true);
+                    break;
+                }
+                if (status[0].kind() == PutByIdVariant::Transition) {
+                    clobberStructures(clobberLimit);
+                    forNode(node->child1()).set(m_graph, status[0].newStructure());
+                    m_state.setHaveStructures(true);
+                    m_state.setFoundConstants(true);
+                    break;
+                }
             }
         }