Changeset 186795 in webkit for trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h

Timestamp:

Jul 13, 2015, 4:27:30 PM (10 years ago)

Author:

[email protected]

Message:

Object cycles should not prevent allocation elimination/sinking
​https://bugs.webkit.org/show_bug.cgi?id=143073

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch introduces a new allocation sinking phase that is able to
sink cycles, in DFGAllocationCycleSinkingPhase.cpp. This phase
supersedes the old allocation sinking phase in
DFGObjectAllocationSinkingPhase.cpp, as that previous phase was never
able to sink allocation cycles while the new phase sometimes can; see
DFGAllocationCycleSinkingPhase.cpp for details.

For now, the new sinking phase is kept behind a
JSC_enableAllocationCycleSinking flag that reverts to the old sinking
phase when false (i.e., by default). This also removes the old
JSC_enableObjectAllocationSinking flag. run-javascriptcore-tests
defaults to using the new sinking phase.

• dfg/DFGGraph.h:

(JSC::DFG::Graph::addStructureSet): Allow empty structure sets

• dfg/DFGLazyNode.cpp:

(JSC::DFG::LazyNode::dump): Prettier dump

• dfg/DFGNode.h:

(JSC::DFG::Node::cellOperand): Move to opInfo for MaterializeCreateActivation
(JSC::DFG::Node::hasStructureSet): Add MaterializeNewObject
(JSC::DFG::Node::objectMaterializationData): Move to opInfo2

• dfg/DFGOSRAvailabilityAnalysisPhase.cpp: Remove unused header
• dfg/DFGObjectAllocationSinkingPhase.cpp:

(JSC::DFG::ObjectAllocationSinkingPhase::ObjectAllocationSinkingPhase): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::run): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::performSinking): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::resolve): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize): Deleted.

• dfg/DFGObjectAllocationSinkingPhase.h:
• dfg/DFGPromotedHeapLocation.h: Add a hash and a helper function to PromotedLocationDescriptor

(JSC::DFG::PromotedLocationDescriptor::PromotedLocationDescriptor):
(JSC::DFG::PromotedLocationDescriptor::operator bool):
(JSC::DFG::PromotedLocationDescriptor::neededForMaterialization):
(JSC::DFG::PromotedLocationDescriptorHash::hash):
(JSC::DFG::PromotedLocationDescriptorHash::equal):

• dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validateSSA): Assert that most nodes never see a phantom allocation

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeNewObject): Use the new structureSet() operand
(JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation): Node has a new child

• ftl/FTLOSRExitCompiler.cpp: Handle materialization cycles

(JSC::FTL::compileStub):

• ftl/FTLOperations.cpp: Handle materialization cycles

(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):

• ftl/FTLOperations.h: Handle materialization cycles
• tests/stress/correctly-sink-object-even-though-it-dies.js: Added.

(clobber):
(foo):

• tests/stress/eliminate-object-read-over-call.js: Added.

(clobber):
(foo):

• tests/stress/materialize-object-on-edge.js: Added.

(call):
(foo):

• tests/stress/object-sinking-stress.js: Added.

(foo):

• tests/stress/sink-object-cycle.js: Added.

(clobber):
(foo):

• tests/stress/sink-object-past-put.js: Added.

(clobber):
(foo):

• tests/stress/sinkable-new-object-in-loop.js: Added.

(foo):

LayoutTests:

Add a few microbenchmarks that show performance improvement when
sinking or elimininating object cycles.

• js/regress/elidable-new-object-cycle-expected.txt: Added.
• js/regress/elidable-new-object-cycle.html: Added.
• js/regress/script-tests/elidable-new-object-cycle.js: Added.

(sumOfArithSeries):
(foo):

• js/regress/script-tests/sinkable-closure-cycle.js: Added.

(factorial.f):
(factorial):

• js/regress/script-tests/sinkable-new-object-cycle.js: Added.

(sumOfArithSeries):
(verify):
(foo):

• js/regress/sinkable-closure-cycle-expected.txt: Added.
• js/regress/sinkable-closure-cycle.html: Added.
• js/regress/sinkable-new-object-cycle-expected.txt: Added.
• js/regress/sinkable-new-object-cycle.html: Added.

File:

• trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -33 +33 @@
 class Graph;
 
-// Sinks object allocations down to their uses. This will sink the allocations over OSR exits, by
-// replacing all stores to those objects with store hints so that OSR exit can materialize the
-// object. This may sink allocations past returns, creating control flow paths along which the
-// objects are not allocated at all. Replaces all uses of the objects' fields with SSA data flow.
+// Eliminates allocations allocations that are never used except
+// locally. This will insert phantom allocations and store hints so
+// that OSR exit can materialize the objects. Replaces all uses of the
+// objects' fields with SSA data flow. This phase is able to handle cyclic allocation graphs.
 
 bool performObjectAllocationSinking(Graph&);
@@ -45 +45 @@
 
 #endif // DFGObjectAllocationSinkingPhase_h
-