Changeset 222382 in webkit for trunk/Source/JavaScriptCore


Ignore:
Timestamp:
Sep 22, 2017, 3:25:58 AM (8 years ago)
Author:
Yusuke Suzuki
Message:

Unreviewed, rolling out r222380.
​https://bugs.webkit.org/show_bug.cgi?id=177352

Octane/box2d shows 8% regression (Requested by yusukesuzuki on
#webkit).

Reverted changeset:

"[DFG][FTL] Profile array vector length for array allocation"
​https://bugs.webkit.org/show_bug.cgi?id=177051
​http://trac.webkit.org/changeset/222380

Patch by Commit Queue <​[email protected]> on 2017-09-22

Location:
trunk/Source/JavaScriptCore
Files:
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r222380 r222382  
     12017-09-22  Commit Queue  <[email protected]>
     2
     3        Unreviewed, rolling out r222380.
     4        https://bugs.webkit.org/show_bug.cgi?id=177352
     5
     6        Octane/box2d shows 8% regression (Requested by yusukesuzuki on
     7        #webkit).
     8
     9        Reverted changeset:
     10
     11        "[DFG][FTL] Profile array vector length for array allocation"
     12        https://bugs.webkit.org/show_bug.cgi?id=177051
     13        http://trac.webkit.org/changeset/222380
     14
    1152017-09-21  Yusuke Suzuki  <[email protected]>
    216

  • trunk/Source/JavaScriptCore/bytecode/ArrayAllocationProfile.cpp

    r222380 r222382  
    3131namespace JSC {
    3232
    33 void ArrayAllocationProfile::updateProfile()
     33void ArrayAllocationProfile::updateIndexingType()
    3434{
    3535    // This is awkwardly racy but totally sound even when executed concurrently. The
    … …  
    5050    if (!lastArray)
    5151        return;
    52     if (LIKELY(Options::useArrayAllocationProfiling())) {
     52    if (LIKELY(Options::useArrayAllocationProfiling()))
    5353        m_currentIndexingType = leastUpperBoundOfIndexingTypes(m_currentIndexingType, lastArray->indexingType());
    54         m_largestSeenVectorLength = std::min(std::max(m_largestSeenVectorLength, lastArray->getVectorLength()), BASE_CONTIGUOUS_VECTOR_LEN_MAX);
    55     }
    56     m_lastArray = nullptr;
     54    m_lastArray = 0;
    5755}
    5856

  • trunk/Source/JavaScriptCore/bytecode/ArrayAllocationProfile.h

    r222380 r222382  
    3333class ArrayAllocationProfile {
    3434public:
     35    ArrayAllocationProfile()
     36        : m_currentIndexingType(ArrayWithUndecided)
     37        , m_lastArray(0)
     38    {
     39    }
     40   
    3541    IndexingType selectIndexingType()
    3642    {
    3743        JSArray* lastArray = m_lastArray;
    3844        if (lastArray && UNLIKELY(lastArray->indexingType() != m_currentIndexingType))
    39             updateProfile();
     45            updateIndexingType();
    4046        return m_currentIndexingType;
    41     }
    42 
    43     // vector length hint becomes [0, BASE_CONTIGUOUS_VECTOR_LEN_MAX].
    44     unsigned vectorLengthHint()
    45     {
    46         JSArray* lastArray = m_lastArray;
    47         if (lastArray && (m_largestSeenVectorLength != BASE_CONTIGUOUS_VECTOR_LEN_MAX) && UNLIKELY(lastArray->getVectorLength() > m_largestSeenVectorLength))
    48             updateProfile();
    49         return m_largestSeenVectorLength;
    5047    }
    5148   
    … …  
    5653    }
    5754   
    58     JS_EXPORT_PRIVATE void updateProfile();
     55    JS_EXPORT_PRIVATE void updateIndexingType();
    5956   
    6057    static IndexingType selectIndexingTypeFor(ArrayAllocationProfile* profile)
    … …  
    7471private:
    7572   
    76     IndexingType m_currentIndexingType { ArrayWithUndecided };
    77     unsigned m_largestSeenVectorLength { 0 };
    78     JSArray* m_lastArray { nullptr };
     73    IndexingType m_currentIndexingType;
     74    JSArray* m_lastArray;
    7975};
    8076

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r222380 r222382  
    25692569    // Don't count these either, for similar reasons.
    25702570    for (unsigned i = m_arrayAllocationProfiles.size(); i--;)
    2571         m_arrayAllocationProfiles[i].updateProfile();
     2571        m_arrayAllocationProfiles[i].updateIndexingType();
    25722572}
    25732573

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r222380 r222382  
    44004400            data.numConstants = numConstants;
    44014401            data.indexingType = profile->selectIndexingType();
    4402             data.vectorLengthHint = std::max<unsigned>(profile->vectorLengthHint(), numConstants);
    44034402
    44044403            // If this statement has never executed, we'll have the wrong indexing type in the profile.
    … …  
    44104409            }
    44114410           
    4412             m_graph.m_newArrayBufferData.append(WTFMove(data));
     4411            m_graph.m_newArrayBufferData.append(data);
    44134412            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(NewArrayBuffer, OpInfo(&m_graph.m_newArrayBufferData.last())));
    44144413            NEXT_OPCODE(op_new_array_buffer);

  • trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

    r222380 r222382  
    322322            out.print(anotherComma, pointerDumpInContext(freeze(m_codeBlock->constantBuffer(node->startConstant())[i]), context));
    323323        out.print("]");
    324         out.print(comma, "vectorLengthHint = ", node->vectorLengthHint());
    325324    }
    326325    if (node->hasLazyJSValue())

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r222380 r222382  
    100100    unsigned startConstant;
    101101    unsigned numConstants;
    102     unsigned vectorLengthHint;
    103102    IndexingType indexingType;
    104103};
    … …  
    11161115    {
    11171116        return newArrayBufferData()->numConstants;
    1118     }
    1119 
    1120     unsigned vectorLengthHint()
    1121     {
    1122         return newArrayBufferData()->vectorLengthHint;
    11231117    }
    11241118   

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r222380 r222382  
    13121312}
    13131313
    1314 char* JIT_OPERATION operationNewArrayWithSizeAndHint(ExecState* exec, Structure* arrayStructure, int32_t size, int32_t vectorLengthHint, Butterfly* butterfly)
    1315 {
    1316     VM& vm = exec->vm();
    1317     NativeCallFrameTracer tracer(&vm, exec);
    1318     auto scope = DECLARE_THROW_SCOPE(vm);
    1319 
    1320     if (UNLIKELY(size < 0))
    1321         return bitwise_cast<char*>(throwException(exec, scope, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer."))));
    1322 
    1323     JSArray* result;
    1324     if (butterfly)
    1325         result = JSArray::createWithButterfly(vm, nullptr, arrayStructure, butterfly);
    1326     else {
    1327         result = JSArray::tryCreate(vm, arrayStructure, size, vectorLengthHint);
    1328         ASSERT(result);
    1329     }
    1330     return bitwise_cast<char*>(result);
    1331 }
    1332 
    13331314char* JIT_OPERATION operationNewArrayBuffer(ExecState* exec, Structure* arrayStructure, size_t start, size_t size)
    13341315{

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r222380 r222382  
    8282char* JIT_OPERATION operationNewEmptyArray(ExecState*, Structure*) WTF_INTERNAL;
    8383char* JIT_OPERATION operationNewArrayWithSize(ExecState*, Structure*, int32_t, Butterfly*) WTF_INTERNAL;
    84 char* JIT_OPERATION operationNewArrayWithSizeAndHint(ExecState*, Structure*, int32_t, int32_t, Butterfly*) WTF_INTERNAL;
    8584char* JIT_OPERATION operationNewInt8ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
    8685char* JIT_OPERATION operationNewInt8ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r222380 r222382  
    42394239        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(indexingType)) {
    42404240            unsigned numElements = node->numConstants();
    4241             unsigned vectorLengthHint = node->vectorLengthHint();
    4242             ASSERT(vectorLengthHint >= numElements);
    42434241           
    42444242            GPRTemporary result(this);
    … …  
    42484246            GPRReg storageGPR = storage.gpr();
    42494247
    4250             emitAllocateRawObject(resultGPR, m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), storageGPR, numElements, vectorLengthHint);
     4248            emitAllocateRawObject(resultGPR, m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), storageGPR, numElements, numElements);
    42514249           
    42524250            DFG_ASSERT(m_jit.graph(), node, indexingType & IsArray);

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r222380 r222382  
    41904190                    weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous))),
    41914191                    weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithDouble)))));
    4192             arrayResult = allocateJSArray(resultLength, resultLength, structure, indexingType, false, false);
     4192            arrayResult = allocateJSArray(resultLength, structure, indexingType, false, false);
    41934193        }
    41944194
    … …  
    51155115        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
    51165116            unsigned numElements = m_node->numConstants();
    5117             unsigned vectorLengthHint = m_node->vectorLengthHint();
    5118            
    5119             ASSERT(vectorLengthHint >= numElements);
     5117           
    51205118            ArrayValues arrayValues =
    5121                 allocateUninitializedContiguousJSArray(numElements, vectorLengthHint, structure);
     5119                allocateUninitializedContiguousJSArray(m_out.constInt32(numElements), structure);
    51225120           
    51235121            JSValue* data = codeBlock()->constantBuffer(m_node->startConstant());
    … …  
    51585156            setJSValue(
    51595157                allocateJSArray(
    5160                     publicLength, publicLength, weakPointer(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), m_out.constInt32(indexingType)).array);
     5158                    publicLength, weakPointer(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), m_out.constInt32(indexingType)).array);
    51615159            mutatorFence();
    51625160            return;
    … …  
    1144411442    };
    1144511443
    11446     ArrayValues allocateJSArray(LValue publicLength, LValue vectorLength, LValue structure, LValue indexingType, bool shouldInitializeElements = true, bool shouldLargeArraySizeCreateArrayStorage = true)
     11444    ArrayValues allocateJSArray(LValue publicLength, LValue structure, LValue indexingType, bool shouldInitializeElements = true, bool shouldLargeArraySizeCreateArrayStorage = true)
    1144711445    {
    1144811446        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
    … …  
    1146311461       
    1146411462        LBasicBlock lastNext = m_out.insertNewBlocksBefore(fastCase);
    11465 
    11466         if (vectorLength->hasInt32() && structure->hasIntPtr()) {
    11467             unsigned vectorLengthConst = static_cast<unsigned>(vectorLength->asInt32());
    11468             if (vectorLengthConst <= MAX_STORAGE_VECTOR_LENGTH) {
    11469                 vectorLength = m_out.constInt32(
    11470                     Butterfly::optimalContiguousVectorLength(
    11471                         bitwise_cast<Structure*>(structure->asIntPtr())->outOfLineCapacity(), vectorLengthConst));
    11472             }
    11473         } else {
    11474             // We don't compute the optimal vector length for new Array(blah) where blah is not
    11475             // statically known, since the compute effort of doing it here is probably not worth it.
    11476         }
    1147711463       
    1147811464        ValueFromBlock noButterfly = m_out.anchor(m_out.intPtrZero);
    … …  
    1148711473       
    1148811474        m_out.appendTo(fastCase, largeCase);
     11475
     11476        LValue vectorLength = nullptr;
     11477        if (publicLength->hasInt32() && structure->hasIntPtr()) {
     11478            unsigned publicLengthConst = static_cast<unsigned>(publicLength->asInt32());
     11479            if (publicLengthConst <= MAX_STORAGE_VECTOR_LENGTH) {
     11480                vectorLength = m_out.constInt32(
     11481                    Butterfly::optimalContiguousVectorLength(
     11482                        bitwise_cast<Structure*>(structure->asIntPtr())->outOfLineCapacity(), publicLengthConst));
     11483            }
     11484        }
     11485       
     11486        if (!vectorLength) {
     11487            // We don't compute the optimal vector length for new Array(blah) where blah is not
     11488            // statically known, since the compute effort of doing it here is probably not worth it.
     11489            vectorLength = publicLength;
     11490        }
    1148911491           
    1149011492        LValue payloadSize =
    … …  
    1153211534            [=, &vm] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
    1153311535                return createLazyCallGenerator(vm,
    11534                     operationNewArrayWithSizeAndHint, locations[0].directGPR(),
    11535                     locations[1].directGPR(), locations[2].directGPR(), locations[3].directGPR(), locations[4].directGPR());
     11536                    operationNewArrayWithSize, locations[0].directGPR(),
     11537                    locations[1].directGPR(), locations[2].directGPR(), locations[3].directGPR());
    1153611538            },
    11537             structureValue, publicLength, vectorLength, butterflyValue);
     11539            structureValue, publicLength, butterflyValue);
    1153811540        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
    1153911541        ValueFromBlock slowButterfly = m_out.anchor(
    … …  
    1154711549    }
    1154811550   
    11549     ArrayValues allocateUninitializedContiguousJSArrayInternal(LValue publicLength, LValue vectorLength, RegisteredStructure structure)
     11551    ArrayValues allocateUninitializedContiguousJSArray(LValue publicLength, RegisteredStructure structure)
    1155011552    {
    1155111553        bool shouldInitializeElements = false;
    1155211554        bool shouldLargeArraySizeCreateArrayStorage = false;
    1155311555        return allocateJSArray(
    11554             publicLength, vectorLength, weakStructure(structure), m_out.constInt32(structure->indexingType()), shouldInitializeElements,
     11556            publicLength, weakStructure(structure), m_out.constInt32(structure->indexingType()), shouldInitializeElements,
    1155511557            shouldLargeArraySizeCreateArrayStorage);
    11556     }
    11557 
    11558     ArrayValues allocateUninitializedContiguousJSArray(LValue publicLength, RegisteredStructure structure)
    11559     {
    11560         return allocateUninitializedContiguousJSArrayInternal(publicLength, publicLength, structure);
    11561     }
    11562 
    11563     ArrayValues allocateUninitializedContiguousJSArray(unsigned publicLength, unsigned vectorLength, RegisteredStructure structure)
    11564     {
    11565         ASSERT(vectorLength >= publicLength);
    11566         return allocateUninitializedContiguousJSArrayInternal(m_out.constInt32(publicLength), m_out.constInt32(vectorLength), structure);
    1156711558    }
    1156811559   

  • trunk/Source/JavaScriptCore/runtime/ArrayConventions.h

    r222380 r222382  
    7878#define BASE_CONTIGUOUS_VECTOR_LEN 3U
    7979#define BASE_CONTIGUOUS_VECTOR_LEN_EMPTY 5U
    80 #define BASE_CONTIGUOUS_VECTOR_LEN_MIN 3U
    81 #define BASE_CONTIGUOUS_VECTOR_LEN_MAX 25U
    8280#define BASE_ARRAY_STORAGE_VECTOR_LEN 4U
    8381

  • trunk/Source/JavaScriptCore/runtime/JSArray.h

    r222380 r222382  
    5555public:
    5656    static JSArray* tryCreate(VM&, Structure*, unsigned initialLength = 0);
    57     static JSArray* tryCreate(VM&, Structure*, unsigned initialLength, unsigned vectorLengthHint);
    5857    static JSArray* create(VM&, Structure*, unsigned initialLength = 0);
    5958    static JSArray* createWithButterfly(VM&, GCDeferralContext*, Structure*, Butterfly*);
    … …  
    217216    VM&, JSCell* intendedOwner, unsigned initialLength);
    218217
    219 inline JSArray* JSArray::tryCreate(VM& vm, Structure* structure, unsigned initialLength, unsigned vectorLengthHint)
    220 {
    221     ASSERT(vectorLengthHint >= initialLength);
     218inline JSArray* JSArray::tryCreate(VM& vm, Structure* structure, unsigned initialLength)
     219{
    222220    unsigned outOfLineStorage = structure->outOfLineCapacity();
    223221
    … …  
    231229            || hasContiguous(indexingType));
    232230
    233         if (UNLIKELY(vectorLengthHint > MAX_STORAGE_VECTOR_LENGTH))
     231        if (UNLIKELY(initialLength > MAX_STORAGE_VECTOR_LENGTH))
    234232            return nullptr;
    235233
    236         unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, vectorLengthHint);
     234        unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, initialLength);
    237235        void* temp = vm.jsValueGigacageAuxiliarySpace.tryAllocate(nullptr, Butterfly::totalSize(0, outOfLineStorage, true, vectorLength * sizeof(EncodedJSValue)));
    238236        if (!temp)
    … …  
    259257}
    260258
    261 inline JSArray* JSArray::tryCreate(VM& vm, Structure* structure, unsigned initialLength)
    262 {
    263     return tryCreate(vm, structure, initialLength, initialLength);
    264 }
    265 
    266259inline JSArray* JSArray::create(VM& vm, Structure* structure, unsigned initialLength)
    267260{
Note: See TracChangeset for help on using the changeset viewer.