Changeset 219899 in webkit for trunk/Source/JavaScriptCore/b3

Timestamp:

Jul 25, 2017, 7:23:01 PM (8 years ago)

Author:

[email protected]

Message:

WebAssembly: generate smaller binaries
​https://bugs.webkit.org/show_bug.cgi?id=174818

Reviewed by Filip Pizlo.

This patch reduces generated code size for WebAssembly in 2 ways:

1. Use the ZR register when storing zero on ARM64.
2. Synthesize wasm context lazily.

This leads to a modest size reduction on both x86-64 and ARM64 for
large WebAssembly games, without any performance loss on WasmBench
and TitzerBench.

The reason this works is that these games, using Emscripten,
generate 100k+ tiny functions, and our JIT allocation granule
rounds all allocations up to 32 bytes. There are plenty of other
simple gains to be had, I've filed a follow-up bug at
webkit.org/b/174819

We should further avoid the per-function cost of tiering, which
represents the bulk of code generated for small functions.

• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::storeZero64):

• assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::storeZero64):

• b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createStore): this doesn't make sense
for x86 because it constrains register reuse and codegen in a way
that doesn't affect ARM64 because it has a dedicated zero
register.

• b3/air/AirOpcode.opcodes: add the storeZero64 opcode.
• wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::instanceValue):
(JSC::Wasm::B3IRGenerator::restoreWasmContext):
(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::B3IRGenerator::materializeWasmContext): Deleted.

Location:

trunk/Source/JavaScriptCore/b3

Files:

• B3LowerToAir.cpp (modified) (1 diff)
• air/AirOpcode.opcodes (modified) (1 diff)

trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp

@@ -1019 +1019 @@
     Inst createStore(Air::Kind move, Value* value, const Arg& dest)
     {
-        if (imm(value) && isValidForm(move.opcode, Arg::Imm, dest.kind()))
-            return Inst(move, m_value, imm(value), dest);
+        if (auto imm_value = imm(value)) {
+            if (isARM64() && imm_value.value() == 0) {
+                switch (move.opcode) {
+                default:
+                    break;
+                case Air::Move32:
+                    if (isValidForm(StoreZero32, dest.kind()) && dest.isValidForm(Width32))
+                        return Inst(StoreZero32, m_value, dest);
+                    break;
+                case Air::Move:
+                    if (isValidForm(StoreZero64, dest.kind()) && dest.isValidForm(Width64))
+                        return Inst(StoreZero64, m_value, dest);
+                    break;
+                }
+            }
+            if (isValidForm(move.opcode, Arg::Imm, dest.kind()))
+                return Inst(move, m_value, imm_value, dest);
+        }
 
         return Inst(move, m_value, tmp(value), dest);

trunk/Source/JavaScriptCore/b3/air/AirOpcode.opcodes

@@ -650 +650 @@
     Addr, Addr, Tmp
 
+# FIXME: StoreZero32 and StoreZero64 are hacks on ARM64, we can do better: https://bugs.webkit.org/show_bug.cgi?id=174821
 StoreZero32 D:G:32
+    Addr
+    Index
+
+64: StoreZero64 D:G:64
     Addr
     Index