Changeset 212818 in webkit for trunk/Source/JavaScriptCore/runtime/PropertySlot.h

Timestamp:

Feb 22, 2017, 1:23:08 AM (8 years ago)

Author:

Yusuke Suzuki

Message:

JSModuleNamespace object should have IC
​https://bugs.webkit.org/show_bug.cgi?id=160590

Reviewed by Saam Barati.

JSTests:

• modules/module-assert-access-binding.js: Added.
• modules/module-assert-access-namespace.js: Added.
• modules/namespace-empty.js: Added.

(from.string_appeared_here.access):
(i.shouldThrow):

• stress/module-namespace-access-change.js: Added.

(shouldBe):
(access):
(import.string_appeared_here.then):

• stress/module-namespace-access-non-constant.js: Added.

(shouldBe):
(import.string_appeared_here.then):

• stress/module-namespace-access-poly.js: Added.

(shouldBe):
(access):
(import.string_appeared_here.then):

• stress/module-namespace-access-transitive-exports.js: Added.

(shouldBe):
(import.string_appeared_here.then):

• stress/module-namespace-access.js: Added.

(shouldBe):
(import.string_appeared_here.then):

• stress/resources/module-namespace-access-transitive-exports-2.js: Added.

(export.cocoa):
(export.change):

• stress/resources/module-namespace-access-transitive-exports.js: Added.
• stress/resources/module-namespace-access.js: Added.

(export.cocoa):
(export.change):

Source/JavaScriptCore:

This patch optimizes accesses to module namespace objects.

1. Cache the resolutions for module namespace objects.

When constructing the module namespace object, we already resolves all the exports.
The module namespace object caches this result and leverage it in the later access in
getOwnPropertySlot. This avoids resolving bindings through resolveExport.

2. Introduce ModuleNamespaceLoad IC.

This patch adds new IC for module namespace objects. The mechanism is simple, getOwnPropertySlot
tells us about module namespace object resolution. The IC first checks whether the given object
is an expected module namespace object. If this check succeeds, we load the value from the module
environment.

3. Introduce DFG/FTL optimization.

After exploiting module namespace object accesses in (2), DFG can recognize this in ByteCodeParser.
DFG will convert it to CheckCell with the namespace object and GetClosureVar from the cached environment.
At that time, we have a chance to fold it to the constant.

This optimization improves the performance of accessing to module namespace objects.

Before

$ time ../../WebKitBuild/module-ic-tot/Release/bin/jsc -m module-assert-access-namespace.js
../../WebKitBuild/module-ic-tot/Release/bin/jsc -m 0.43s user 0.03s system 101% cpu 0.451 total
$ time ../../WebKitBuild/module-ic-tot/Release/bin/jsc -m module-assert-access-binding.js
../../WebKitBuild/module-ic-tot/Release/bin/jsc -m 0.08s user 0.02s system 103% cpu 0.104 total

After

$ time ../../WebKitBuild/module-ic/Release/bin/jsc -m module-assert-access-namespace.js
../../WebKitBuild/module-ic/Release/bin/jsc -m 0.11s user 0.01s system 106% cpu 0.109 total
$ time ../../WebKitBuild/module-ic/Release/bin/jsc -m module-assert-access-binding.js
../../WebKitBuild/module-ic/Release/bin/jsc -m module-assert-access-binding.j 0.08s user 0.02s system 102% cpu 0.105 total

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• bytecode/AccessCase.cpp:

(JSC::AccessCase::create):
(JSC::AccessCase::guardedByStructureCheck):
(JSC::AccessCase::canReplace):
(JSC::AccessCase::visitWeak):
(JSC::AccessCase::generateWithGuard):
(JSC::AccessCase::generateImpl):

• bytecode/AccessCase.h:
• bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::GetByIdStatus):
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
(JSC::GetByIdStatus::makesCalls):
(JSC::GetByIdStatus::dump):

• bytecode/GetByIdStatus.h:

(JSC::GetByIdStatus::isModuleNamespace):
(JSC::GetByIdStatus::takesSlowPath):
(JSC::GetByIdStatus::moduleNamespaceObject):
(JSC::GetByIdStatus::moduleEnvironment):
(JSC::GetByIdStatus::scopeOffset):

• bytecode/ModuleNamespaceAccessCase.cpp: Added.

(JSC::ModuleNamespaceAccessCase::ModuleNamespaceAccessCase):
(JSC::ModuleNamespaceAccessCase::create):
(JSC::ModuleNamespaceAccessCase::~ModuleNamespaceAccessCase):
(JSC::ModuleNamespaceAccessCase::clone):
(JSC::ModuleNamespaceAccessCase::emit):

• bytecode/ModuleNamespaceAccessCase.h: Added.

(JSC::ModuleNamespaceAccessCase::moduleNamespaceObject):
(JSC::ModuleNamespaceAccessCase::moduleEnvironment):
(JSC::ModuleNamespaceAccessCase::scopeOffset):

• bytecode/PolymorphicAccess.cpp:

(WTF::printInternal):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
(JSC::DFG::ByteCodeParser::handleGetById):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::loadValue):

• jit/Repatch.cpp:

(JSC::tryCacheGetByID):

• runtime/AbstractModuleRecord.cpp:

(JSC::AbstractModuleRecord::getModuleNamespace):

• runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::finishCreation):
(JSC::JSModuleNamespaceObject::visitChildren):
(JSC::getValue):
(JSC::JSModuleNamespaceObject::getOwnPropertySlot):
(JSC::JSModuleNamespaceObject::getOwnPropertyNames):

• runtime/JSModuleNamespaceObject.h:

(JSC::isJSModuleNamespaceObject):
(JSC::JSModuleNamespaceObject::create): Deleted.
(JSC::JSModuleNamespaceObject::createStructure): Deleted.
(JSC::JSModuleNamespaceObject::moduleRecord): Deleted.

• runtime/JSModuleRecord.h:

(JSC::JSModuleRecord::moduleEnvironment): Deleted.

• runtime/PropertySlot.h:

(JSC::PropertySlot::PropertySlot):
(JSC::PropertySlot::domJIT):
(JSC::PropertySlot::moduleNamespaceSlot):
(JSC::PropertySlot::setValueModuleNamespace):
(JSC::PropertySlot::setCacheableCustom):

File:

• trunk/Source/JavaScriptCore/runtime/PropertySlot.h (modified) (9 diffs)

trunk/Source/JavaScriptCore/runtime/PropertySlot.h

@@ -24 +24 @@
 #include "PropertyName.h"
 #include "PropertyOffset.h"
+#include "ScopeOffset.h"
 #include <wtf/Assertions.h>
 
@@ -33 +34 @@
 class GetterSetter;
 class JSObject;
+class JSModuleEnvironment;
 
 // ECMA 262-3 8.6.1
@@ -87 +89 @@
     };
 
+    enum class AdditionalDataType : uint8_t {
+        None,
+        DOMJIT, // Annotated with DOMJIT information.
+        ModuleNamespace, // ModuleNamespaceObject's environment access.
+    };
+
     explicit PropertySlot(const JSValue thisValue, InternalMethodType internalMethodType)
         : m_offset(invalidOffset)
@@ -95 +103 @@
         , m_propertyType(TypeUnset)
         , m_internalMethodType(internalMethodType)
+        , m_additionalDataType(AdditionalDataType::None)
         , m_isTaintedByOpaqueObject(false)
     {
@@ -164 +173 @@
     DOMJIT::GetterSetter* domJIT() const
     {
-        return m_domJIT;
+        if (m_additionalDataType == AdditionalDataType::DOMJIT)
+            return m_additionalData.domJIT;
+        return nullptr;
+    }
+
+    struct ModuleNamespaceSlot {
+        JSModuleEnvironment* environment;
+        unsigned scopeOffset;
+    };
+
+    std::optional<ModuleNamespaceSlot> moduleNamespaceSlot() const
+    {
+        if (m_additionalDataType == AdditionalDataType::ModuleNamespace)
+            return m_additionalData.moduleNamespaceSlot;
+        return std::nullopt;
     }
 
@@ -207 +230 @@
     }
 
+    void setValueModuleNamespace(JSObject* slotBase, unsigned attributes, JSValue value, JSModuleEnvironment* environment, ScopeOffset scopeOffset)
+    {
+        setValue(slotBase, attributes, value);
+        m_additionalDataType = AdditionalDataType::ModuleNamespace;
+        m_additionalData.moduleNamespaceSlot.environment = environment;
+        m_additionalData.moduleNamespaceSlot.scopeOffset = scopeOffset.offset();
+    }
+
     void setCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue)
     {
@@ -221 +252 @@
     }
     
-    void setCacheableCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue, DOMJIT::GetterSetter* domJIT = nullptr)
+    void setCacheableCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue)
     {
         ASSERT(attributes == attributesForStructure(attributes));
@@ -233 +264 @@
         m_propertyType = TypeCustom;
         m_offset = !invalidOffset;
-        m_domJIT = domJIT;
+    }
+
+    void setCacheableCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue, DOMJIT::GetterSetter* domJIT)
+    {
+        setCacheableCustom(slotBase, attributes, getValue);
+        if (domJIT) {
+            m_additionalDataType = AdditionalDataType::DOMJIT;
+            m_additionalData.domJIT = domJIT;
+        }
     }
 
@@ -329 +368 @@
     PropertyType m_propertyType;
     InternalMethodType m_internalMethodType;
-    DOMJIT::GetterSetter* m_domJIT { nullptr };
+    AdditionalDataType m_additionalDataType;
+    union {
+        DOMJIT::GetterSetter* domJIT;
+        ModuleNamespaceSlot moduleNamespaceSlot;
+    } m_additionalData;
     bool m_isTaintedByOpaqueObject;
 };