Ignore:
Timestamp:
Feb 25, 2020, 5:38:46 PM (5 years ago)
Author:
Justin Michaud
Message:

Inline Cache delete by id/val
​https://bugs.webkit.org/show_bug.cgi?id=207522

JSTests:

Reviewed by Keith Miller and Filip Pizlo.

  • microbenchmarks/delete-property-from-prototype-chain.js:

(delete.C.prototype.z):

  • microbenchmarks/delete-property-inline-cache-polymorphic.js: Added.

(C):
(noInline.C.foo):
(noInline.foo.F):
(noInline.F):

  • microbenchmarks/delete-property-inline-cache.js: Added.

(C):
(noInline.C.D):
(noInline.D.foo):
(noInline.foo.E):
(noInline.E.F):
(noInline.F):

  • microbenchmarks/delete-property-keeps-cacheable-structure.js:
  • stress/delete-property-check-structure-transition.js:

(sd): Deleted.
(testDeleteIsNotUncacheable): Deleted.
(): Deleted.
(testCanFlatten): Deleted.
(testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo): Deleted.
(testDeleteWithInlineCache.noInline.doTest): Deleted.
(testDeleteWithInlineCache): Deleted.

  • stress/delete-property-inline-cache.js: Added.

(assert):
(assert_eq):
(assert_neq):
(assert_throws):
(noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById.makeFoo):
(noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById):
(noInline.testCacheableDeleteById.testCacheableDeleteByVal.makeFoo2):
(noInline.testCacheableDeleteById.testCacheableDeleteByVal):
(noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById.makeFoo3):
(noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById):
(noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss.makeFoo4):
(noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss):
(noInline.testCacheableDeleteByIdMiss.testDeleteIndex.makeFoo5):
(noInline.testCacheableDeleteByIdMiss.testDeleteIndex):
(noInline.testDeleteIndex.testPolymorphicDelByVal.makeFoo6):
(noInline.testDeleteIndex.testPolymorphicDelByVal):
(noInline.testPolymorphicDelByVal.testBigintDeleteByVal.makeFoo7):
(noInline.testPolymorphicDelByVal.testBigintDeleteByVal):
(noInline.testBigintDeleteByVal.testSymbolDeleteByVal.makeFoo8):
(noInline.testBigintDeleteByVal.testSymbolDeleteByVal):
(noInline.testSymbolDeleteByVal.testObjDeleteByVal.makeFoo9):
(noInline.testSymbolDeleteByVal.testObjDeleteByVal):
(noInline.testObjDeleteByVal.testStrict.makeFoo10):
(noInline.testObjDeleteByVal.testStrict):
(noInline.testStrict.testOverride.arr.j):
(noInline.testStrict.testOverride):
(noInline.testOverride.testNonObject.deleteIt):
(noInline.testOverride.testNonObject):
(noInline.testNonObject.testNonObjectStrict.deleteIt):
(noInline.testNonObject.testNonObjectStrict):
(noInline.testNonObjectStrict.testExceptionUnwind.mutateThem):
(noInline.testNonObjectStrict.testExceptionUnwind.noInline.deleteIt):
(noInline.testNonObjectStrict.testExceptionUnwind):
(noInline.testExceptionUnwind.testTDZ):
(noInline.testTDZ):

Source/JavaScriptCore:

Reviewed by Keith Miller and Filip Pizlo.

We add inline caching for deleteById/val for baseline only. We also fix a concurrency bug in ICStats used for testing.
We add three new access cases (no inline code is emitted at this time):

  • Delete is a cached delete of an existing property
  • DeleteMiss is a delete of a property that does not exist
  • DeleteNonConfigurable is a delete of a property that exists, but should not be deleted.

There are no conditions required for these caches, since the structure id must change and the prototype does not matter.
This gives the following microbenchmark results:

delete-property-keeps-cacheable-structure (neutral)
delete-property-inline-cache definitely 3.9096x faster
delete-property-inline-cache-polymorphic definitely 1.5239x faster
delete-property-from-prototype-chain (neutral)

  • API/JSCallbackObject.h:
  • API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::deleteProperty):
(JSC::JSCallbackObject<Parent>::deletePropertyByIndex):

  • API/JSObjectRef.cpp:

(JSObjectDeletePropertyForKey):
(JSObjectDeleteProperty):

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/AccessCase.cpp:

(JSC::AccessCase::create):
(JSC::AccessCase::createTransition):
(JSC::AccessCase::createDelete):
(JSC::AccessCase::requiresIdentifierNameMatch const):
(JSC::AccessCase::requiresInt32PropertyCheck const):
(JSC::AccessCase::needsScratchFPR const):
(JSC::AccessCase::forEachDependentCell const):
(JSC::AccessCase::doesCalls const):
(JSC::AccessCase::canReplace const):
(JSC::AccessCase::dump const):
(JSC::AccessCase::propagateTransitions const):
(JSC::AccessCase::generateImpl):

  • bytecode/AccessCase.h:

(JSC::AccessCase::structure const):
(JSC::AccessCase::newStructure const):

  • bytecode/PolymorphicAccess.cpp:

(WTF::printInternal):

  • bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::reset):

  • bytecode/StructureStubInfo.h:
  • debugger/DebuggerScope.cpp:

(JSC::DebuggerScope::deleteProperty):

  • debugger/DebuggerScope.h:
  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

  • dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::addDelById):
(JSC::DFG::JITCompiler::addDelByVal):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById): Deleted.
(JSC::DFG::SpeculativeJIT::compileDeleteByVal): Deleted.

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteById):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal):

  • jit/ICStats.h:
  • jit/JIT.cpp:

(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::link):

  • jit/JIT.h:
  • jit/JITInlineCacheGenerator.cpp:

(JSC::JITDelByValGenerator::JITDelByValGenerator):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByValGenerator::finalize):
(JSC::JITDelByIdGenerator::JITDelByIdGenerator):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::finalize):

  • jit/JITInlineCacheGenerator.h:

(JSC::JITDelByValGenerator::JITDelByValGenerator):
(JSC::JITDelByValGenerator::slowPathJump const):
(JSC::JITDelByIdGenerator::JITDelByIdGenerator):
(JSC::JITDelByIdGenerator::slowPathJump const):

  • jit/JITOperations.cpp:
  • jit/JITOperations.h:
  • jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):

  • jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):

  • jit/Repatch.cpp:

(JSC::tryCachePutByID):
(JSC::tryCacheDelBy):
(JSC::repatchDelBy):
(JSC::resetPutByID):
(JSC::resetDelBy):

  • jit/Repatch.h:
  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

  • runtime/CacheableIdentifierInlines.h:

(JSC::CacheableIdentifier::CacheableIdentifier):

  • runtime/ClassInfo.h:
  • runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::deleteProperty):

  • runtime/ClonedArguments.h:
  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/DeletePropertySlot.h: Added.

(JSC::DeletePropertySlot::DeletePropertySlot):
(JSC::DeletePropertySlot::setConfigurableMiss):
(JSC::DeletePropertySlot::setNonconfigurable):
(JSC::DeletePropertySlot::setHit):
(JSC::DeletePropertySlot::isCacheableDelete const):
(JSC::DeletePropertySlot::isDeleteHit const):
(JSC::DeletePropertySlot::isConfigurableDeleteMiss const):
(JSC::DeletePropertySlot::isNonconfigurable const):
(JSC::DeletePropertySlot::cachedOffset const):
(JSC::DeletePropertySlot::disableCaching):
(JSC::DeletePropertySlot::isCacheable const):

  • runtime/ErrorConstructor.cpp:

(JSC::ErrorConstructor::deleteProperty):

  • runtime/ErrorConstructor.h:
  • runtime/ErrorInstance.cpp:

(JSC::ErrorInstance::deleteProperty):

  • runtime/ErrorInstance.h:
  • runtime/GenericArguments.h:
  • runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::put):
(JSC::GenericArguments<Type>::deleteProperty):

  • runtime/GetterSetter.h:
  • runtime/JSArray.cpp:

(JSC::JSArray::deleteProperty):

  • runtime/JSArray.h:
  • runtime/JSCJSValue.h:
  • runtime/JSCell.cpp:

(JSC::JSCell::deleteProperty):

  • runtime/JSCell.h:
  • runtime/JSDataView.cpp:

(JSC::JSDataView::deleteProperty):

  • runtime/JSDataView.h:
  • runtime/JSFunction.cpp:

(JSC::JSFunction::deleteProperty):

  • runtime/JSFunction.h:
  • runtime/JSGenericTypedArrayView.h:
  • runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::addFunction):

  • runtime/JSLexicalEnvironment.cpp:

(JSC::JSLexicalEnvironment::deleteProperty):

  • runtime/JSLexicalEnvironment.h:
  • runtime/JSModuleEnvironment.cpp:

(JSC::JSModuleEnvironment::deleteProperty):

  • runtime/JSModuleEnvironment.h:
  • runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::deleteProperty):

  • runtime/JSModuleNamespaceObject.h:
  • runtime/JSONObject.cpp:

(JSC::Walker::walk):

  • runtime/JSObject.cpp:

(JSC::JSObject::deleteProperty):
(JSC::JSObject::deletePropertyByIndex):
(JSC::validateAndApplyPropertyDescriptor):

  • runtime/JSObject.h:
  • runtime/JSProxy.cpp:

(JSC::JSProxy::deleteProperty):

  • runtime/JSProxy.h:
  • runtime/JSSymbolTableObject.cpp:

(JSC::JSSymbolTableObject::deleteProperty):

  • runtime/JSSymbolTableObject.h:
  • runtime/ProxyObject.cpp:

(JSC::ProxyObject::deleteProperty):

  • runtime/ProxyObject.h:
  • runtime/RegExpObject.cpp:

(JSC::RegExpObject::deleteProperty):

  • runtime/RegExpObject.h:
  • runtime/StrictEvalActivation.cpp:

(JSC::StrictEvalActivation::deleteProperty):

  • runtime/StrictEvalActivation.h:
  • runtime/StringObject.cpp:

(JSC::StringObject::deleteProperty):

  • runtime/StringObject.h:
  • runtime/Structure.cpp:

(JSC::Structure::removePropertyTransition):
(JSC::Structure::removePropertyTransitionFromExistingStructureImpl):
(JSC::Structure::removePropertyTransitionFromExistingStructure):
(JSC::Structure::removePropertyTransitionFromExistingStructureConcurrently):
(JSC::Structure::removeNewPropertyTransition):
(JSC::Structure::dump const):

  • runtime/Structure.h:
  • runtime/StructureInlines.h:

(JSC::Structure::hasIndexingHeader const):
(JSC::Structure::mayHaveIndexingHeader const):

  • tools/JSDollarVM.cpp:

(JSC::functionHasOwnLengthProperty):
(JSC::JSDollarVM::finishCreation):

Source/WebCore:

Reviewed by Keith Miller and Filip Pizlo.

  • bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::deleteProperty):

  • bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::deleteProperty):

  • bindings/js/JSRemoteDOMWindowCustom.cpp:

(WebCore::JSRemoteDOMWindow::deleteProperty):

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateDeleteProperty):
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorHelperMethods):

  • bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:

(WebCore::JSTestEnabledBySettingPrototype::finishCreation):

  • bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::JSTestGenerateIsReachablePrototype::finishCreation):

  • bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:

(WebCore::JSTestNamedDeleterNoIdentifier::deleteProperty):

  • bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:

(WebCore::JSTestNamedDeleterThrowingException::deleteProperty):

  • bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:

(WebCore::JSTestNamedDeleterWithIdentifier::deleteProperty):

  • bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:

(WebCore::JSTestNamedDeleterWithIndexedGetter::deleteProperty):

  • bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h:
  • bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::JSTestNodePrototype::finishCreation):

  • bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObjConstructor::initializeProperties):
(WebCore::JSTestObjPrototype::finishCreation):

  • bridge/NP_jsobject.cpp:
  • bridge/objc/WebScriptObject.mm:

(-[WebScriptObject removeWebScriptKey:]):

  • bridge/objc/objc_runtime.h:
  • bridge/objc/objc_runtime.mm:

(JSC::Bindings::ObjcFallbackObjectImp::deleteProperty):

  • bridge/runtime_array.cpp:

(JSC::RuntimeArray::deleteProperty):

  • bridge/runtime_array.h:
  • bridge/runtime_object.cpp:

(JSC::Bindings::RuntimeObject::deleteProperty):

  • bridge/runtime_object.h:

Source/WebKit:

Reviewed by Keith Miller and Filip Pizlo.

  • WebProcess/Plugins/Netscape/JSNPObject.cpp:

(WebKit::JSNPObject::deleteProperty):

  • WebProcess/Plugins/Netscape/JSNPObject.h:
  • WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::removeProperty):

Source/WebKitLegacy/mac:

Reviewed by Keith Miller and Filip Pizlo.

  • Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::removeProperty):

Source/WTF:

Reviewed by Keith Miller and Filip Pizlo.

  • wtf/Spectrum.h:

(WTF::Spectrum::add):
(WTF::Spectrum::get const):
(WTF::Spectrum::buildList const):
(WTF::Spectrum::clear):
(WTF::Spectrum::removeIf):
(WTF::Spectrum::begin): Deleted.
(WTF::Spectrum::end): Deleted.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/debugger/DebuggerScope.h

    r253588 r257399  
    5252    static bool getOwnPropertySlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);
    5353    static bool put(JSCell*, JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&);
    54     static bool deleteProperty(JSCell*, JSGlobalObject*, PropertyName);
     54    static bool deleteProperty(JSCell*, JSGlobalObject*, PropertyName, DeletePropertySlot&);
    5555    static void getOwnPropertyNames(JSObject*, JSGlobalObject*, PropertyNameArray&, EnumerationMode);
    5656    static bool defineOwnProperty(JSObject*, JSGlobalObject*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
Note: See TracChangeset for help on using the changeset viewer.