Changeset 186795 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h

Timestamp:

Jul 13, 2015, 4:27:30 PM (10 years ago)

Author:

[email protected]

Message:

Object cycles should not prevent allocation elimination/sinking
​https://bugs.webkit.org/show_bug.cgi?id=143073

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch introduces a new allocation sinking phase that is able to
sink cycles, in DFGAllocationCycleSinkingPhase.cpp. This phase
supersedes the old allocation sinking phase in
DFGObjectAllocationSinkingPhase.cpp, as that previous phase was never
able to sink allocation cycles while the new phase sometimes can; see
DFGAllocationCycleSinkingPhase.cpp for details.

For now, the new sinking phase is kept behind a
JSC_enableAllocationCycleSinking flag that reverts to the old sinking
phase when false (i.e., by default). This also removes the old
JSC_enableObjectAllocationSinking flag. run-javascriptcore-tests
defaults to using the new sinking phase.

• dfg/DFGGraph.h:

(JSC::DFG::Graph::addStructureSet): Allow empty structure sets

• dfg/DFGLazyNode.cpp:

(JSC::DFG::LazyNode::dump): Prettier dump

• dfg/DFGNode.h:

(JSC::DFG::Node::cellOperand): Move to opInfo for MaterializeCreateActivation
(JSC::DFG::Node::hasStructureSet): Add MaterializeNewObject
(JSC::DFG::Node::objectMaterializationData): Move to opInfo2

• dfg/DFGOSRAvailabilityAnalysisPhase.cpp: Remove unused header
• dfg/DFGObjectAllocationSinkingPhase.cpp:

(JSC::DFG::ObjectAllocationSinkingPhase::ObjectAllocationSinkingPhase): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::run): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::performSinking): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::resolve): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize): Deleted.
(JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize): Deleted.

• dfg/DFGObjectAllocationSinkingPhase.h:
• dfg/DFGPromotedHeapLocation.h: Add a hash and a helper function to PromotedLocationDescriptor

(JSC::DFG::PromotedLocationDescriptor::PromotedLocationDescriptor):
(JSC::DFG::PromotedLocationDescriptor::operator bool):
(JSC::DFG::PromotedLocationDescriptor::neededForMaterialization):
(JSC::DFG::PromotedLocationDescriptorHash::hash):
(JSC::DFG::PromotedLocationDescriptorHash::equal):

• dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validateSSA): Assert that most nodes never see a phantom allocation

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeNewObject): Use the new structureSet() operand
(JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation): Node has a new child

• ftl/FTLOSRExitCompiler.cpp: Handle materialization cycles

(JSC::FTL::compileStub):

• ftl/FTLOperations.cpp: Handle materialization cycles

(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):

• ftl/FTLOperations.h: Handle materialization cycles
• tests/stress/correctly-sink-object-even-though-it-dies.js: Added.

(clobber):
(foo):

• tests/stress/eliminate-object-read-over-call.js: Added.

(clobber):
(foo):

• tests/stress/materialize-object-on-edge.js: Added.

(call):
(foo):

• tests/stress/object-sinking-stress.js: Added.

(foo):

• tests/stress/sink-object-cycle.js: Added.

(clobber):
(foo):

• tests/stress/sink-object-past-put.js: Added.

(clobber):
(foo):

• tests/stress/sinkable-new-object-in-loop.js: Added.

(foo):

LayoutTests:

Add a few microbenchmarks that show performance improvement when
sinking or elimininating object cycles.

• js/regress/elidable-new-object-cycle-expected.txt: Added.
• js/regress/elidable-new-object-cycle.html: Added.
• js/regress/script-tests/elidable-new-object-cycle.js: Added.

(sumOfArithSeries):
(foo):

• js/regress/script-tests/sinkable-closure-cycle.js: Added.

(factorial.f):
(factorial):

• js/regress/script-tests/sinkable-new-object-cycle.js: Added.

(sumOfArithSeries):
(verify):
(foo):

• js/regress/sinkable-closure-cycle-expected.txt: Added.
• js/regress/sinkable-closure-cycle.html: Added.
• js/regress/sinkable-new-object-cycle-expected.txt: Added.
• js/regress/sinkable-new-object-cycle.html: Added.

File:

• trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h

@@ -58 +58 @@
     {
     }
-    
+
+    PromotedLocationDescriptor(WTF::HashTableDeletedValueType)
+        : m_kind(InvalidPromotedLocationKind)
+        , m_info(1)
+    {
+    }
+
     bool operator!() const { return m_kind == InvalidPromotedLocationKind; }
+
+    explicit operator bool() const { return !!*this; }
     
     PromotedLocationKind kind() const { return m_kind; }
@@ -86 +94 @@
     {
         return m_kind == InvalidPromotedLocationKind && m_info;
+    }
+
+    bool neededForMaterialization() const
+    {
+        switch (kind()) {
+        case NamedPropertyPLoc:
+        case ClosureVarPLoc:
+            return false;
+
+        default:
+            return true;
+        }
     }
     
@@ -93 +113 @@
     PromotedLocationKind m_kind;
     unsigned m_info;
+};
+
+struct PromotedLocationDescriptorHash {
+    static unsigned hash(const PromotedLocationDescriptor& key) { return key.hash(); }
+    static bool equal(const PromotedLocationDescriptor& a, const PromotedLocationDescriptor& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
 };
 
@@ -177 +203 @@
 };
 
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::PromotedLocationDescriptor> {
+    typedef JSC::DFG::PromotedLocationDescriptorHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::PromotedLocationDescriptor> : SimpleClassHashTraits<JSC::DFG::PromotedLocationDescriptor> {
+    static const bool emptyValueIsZero = false;
+};
+
 } // namespace WTF