Context Navigation

← Previous Change
Next Change →

JSDataView.cpp

Timestamp:

Feb 25, 2020, 5:38:46 PM (5 years ago)

Author:

Justin Michaud

Message:

Inline Cache delete by id/val
https://bugs.webkit.org/show_bug.cgi?id=207522

JSTests:

Reviewed by Keith Miller and Filip Pizlo.

microbenchmarks/delete-property-from-prototype-chain.js:

(delete.C.prototype.z):

microbenchmarks/delete-property-inline-cache-polymorphic.js: Added.

(C):
(noInline.C.foo):
(noInline.foo.F):
(noInline.F):

microbenchmarks/delete-property-inline-cache.js: Added.

(C):
(noInline.C.D):
(noInline.D.foo):
(noInline.foo.E):
(noInline.E.F):
(noInline.F):

microbenchmarks/delete-property-keeps-cacheable-structure.js:
stress/delete-property-check-structure-transition.js:

(sd): Deleted.
(testDeleteIsNotUncacheable): Deleted.
(): Deleted.
(testCanFlatten): Deleted.
(testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo): Deleted.
(testDeleteWithInlineCache.noInline.doTest): Deleted.
(testDeleteWithInlineCache): Deleted.

stress/delete-property-inline-cache.js: Added.

(assert):
(assert_eq):
(assert_neq):
(assert_throws):
(noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById.makeFoo):
(noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById):
(noInline.testCacheableDeleteById.testCacheableDeleteByVal.makeFoo2):
(noInline.testCacheableDeleteById.testCacheableDeleteByVal):
(noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById.makeFoo3):
(noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById):
(noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss.makeFoo4):
(noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss):
(noInline.testCacheableDeleteByIdMiss.testDeleteIndex.makeFoo5):
(noInline.testCacheableDeleteByIdMiss.testDeleteIndex):
(noInline.testDeleteIndex.testPolymorphicDelByVal.makeFoo6):
(noInline.testDeleteIndex.testPolymorphicDelByVal):
(noInline.testPolymorphicDelByVal.testBigintDeleteByVal.makeFoo7):
(noInline.testPolymorphicDelByVal.testBigintDeleteByVal):
(noInline.testBigintDeleteByVal.testSymbolDeleteByVal.makeFoo8):
(noInline.testBigintDeleteByVal.testSymbolDeleteByVal):
(noInline.testSymbolDeleteByVal.testObjDeleteByVal.makeFoo9):
(noInline.testSymbolDeleteByVal.testObjDeleteByVal):
(noInline.testObjDeleteByVal.testStrict.makeFoo10):
(noInline.testObjDeleteByVal.testStrict):
(noInline.testStrict.testOverride.arr.j):
(noInline.testStrict.testOverride):
(noInline.testOverride.testNonObject.deleteIt):
(noInline.testOverride.testNonObject):
(noInline.testNonObject.testNonObjectStrict.deleteIt):
(noInline.testNonObject.testNonObjectStrict):
(noInline.testNonObjectStrict.testExceptionUnwind.mutateThem):
(noInline.testNonObjectStrict.testExceptionUnwind.noInline.deleteIt):
(noInline.testNonObjectStrict.testExceptionUnwind):
(noInline.testExceptionUnwind.testTDZ):
(noInline.testTDZ):

Source/JavaScriptCore:

Reviewed by Keith Miller and Filip Pizlo.

We add inline caching for deleteById/val for baseline only. We also fix a concurrency bug in ICStats used for testing.
We add three new access cases (no inline code is emitted at this time):

Delete is a cached delete of an existing property
DeleteMiss is a delete of a property that does not exist
DeleteNonConfigurable is a delete of a property that exists, but should not be deleted.

There are no conditions required for these caches, since the structure id must change and the prototype does not matter.
This gives the following microbenchmark results:

delete-property-keeps-cacheable-structure (neutral)
delete-property-inline-cache definitely 3.9096x faster
delete-property-inline-cache-polymorphic definitely 1.5239x faster
delete-property-from-prototype-chain (neutral)

API/JSCallbackObject.h:
API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::deleteProperty):
(JSC::JSCallbackObject<Parent>::deletePropertyByIndex):

API/JSObjectRef.cpp:

(JSObjectDeletePropertyForKey):
(JSObjectDeleteProperty):

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
bytecode/AccessCase.cpp:

(JSC::AccessCase::create):
(JSC::AccessCase::createTransition):
(JSC::AccessCase::createDelete):
(JSC::AccessCase::requiresIdentifierNameMatch const):
(JSC::AccessCase::requiresInt32PropertyCheck const):
(JSC::AccessCase::needsScratchFPR const):
(JSC::AccessCase::forEachDependentCell const):
(JSC::AccessCase::doesCalls const):
(JSC::AccessCase::canReplace const):
(JSC::AccessCase::dump const):
(JSC::AccessCase::propagateTransitions const):
(JSC::AccessCase::generateImpl):

bytecode/AccessCase.h:

(JSC::AccessCase::structure const):
(JSC::AccessCase::newStructure const):

bytecode/PolymorphicAccess.cpp:

(WTF::printInternal):

bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::reset):

bytecode/StructureStubInfo.h:
debugger/DebuggerScope.cpp:

(JSC::DebuggerScope::deleteProperty):

debugger/DebuggerScope.h:
dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::addDelById):
(JSC::DFG::JITCompiler::addDelByVal):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById): Deleted.
(JSC::DFG::SpeculativeJIT::compileDeleteByVal): Deleted.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteById):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal):

jit/ICStats.h:
jit/JIT.cpp:

(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::link):

jit/JIT.h:
jit/JITInlineCacheGenerator.cpp:

(JSC::JITDelByValGenerator::JITDelByValGenerator):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByValGenerator::finalize):
(JSC::JITDelByIdGenerator::JITDelByIdGenerator):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::finalize):

jit/JITInlineCacheGenerator.h:

(JSC::JITDelByValGenerator::JITDelByValGenerator):
(JSC::JITDelByValGenerator::slowPathJump const):
(JSC::JITDelByIdGenerator::JITDelByIdGenerator):
(JSC::JITDelByIdGenerator::slowPathJump const):

jit/JITOperations.cpp:
jit/JITOperations.h:
jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):

jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):

jit/Repatch.cpp:

(JSC::tryCachePutByID):
(JSC::tryCacheDelBy):
(JSC::repatchDelBy):
(JSC::resetPutByID):
(JSC::resetDelBy):

jit/Repatch.h:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

runtime/CacheableIdentifierInlines.h:

(JSC::CacheableIdentifier::CacheableIdentifier):

runtime/ClassInfo.h:
runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::deleteProperty):

runtime/ClonedArguments.h:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/DeletePropertySlot.h: Added.

(JSC::DeletePropertySlot::DeletePropertySlot):
(JSC::DeletePropertySlot::setConfigurableMiss):
(JSC::DeletePropertySlot::setNonconfigurable):
(JSC::DeletePropertySlot::setHit):
(JSC::DeletePropertySlot::isCacheableDelete const):
(JSC::DeletePropertySlot::isDeleteHit const):
(JSC::DeletePropertySlot::isConfigurableDeleteMiss const):
(JSC::DeletePropertySlot::isNonconfigurable const):
(JSC::DeletePropertySlot::cachedOffset const):
(JSC::DeletePropertySlot::disableCaching):
(JSC::DeletePropertySlot::isCacheable const):

runtime/ErrorConstructor.cpp:

(JSC::ErrorConstructor::deleteProperty):

runtime/ErrorConstructor.h:
runtime/ErrorInstance.cpp:

(JSC::ErrorInstance::deleteProperty):

runtime/ErrorInstance.h:
runtime/GenericArguments.h:
runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::put):
(JSC::GenericArguments<Type>::deleteProperty):

runtime/GetterSetter.h:
runtime/JSArray.cpp:

(JSC::JSArray::deleteProperty):

runtime/JSArray.h:
runtime/JSCJSValue.h:
runtime/JSCell.cpp:

(JSC::JSCell::deleteProperty):

runtime/JSCell.h:
runtime/JSDataView.cpp:

(JSC::JSDataView::deleteProperty):

runtime/JSDataView.h:
runtime/JSFunction.cpp:

(JSC::JSFunction::deleteProperty):

runtime/JSFunction.h:
runtime/JSGenericTypedArrayView.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::addFunction):

runtime/JSLexicalEnvironment.cpp:

(JSC::JSLexicalEnvironment::deleteProperty):

runtime/JSLexicalEnvironment.h:
runtime/JSModuleEnvironment.cpp:

(JSC::JSModuleEnvironment::deleteProperty):

runtime/JSModuleEnvironment.h:
runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::deleteProperty):

runtime/JSModuleNamespaceObject.h:
runtime/JSONObject.cpp:

(JSC::Walker::walk):

runtime/JSObject.cpp:

(JSC::JSObject::deleteProperty):
(JSC::JSObject::deletePropertyByIndex):
(JSC::validateAndApplyPropertyDescriptor):

runtime/JSObject.h:
runtime/JSProxy.cpp:

(JSC::JSProxy::deleteProperty):

runtime/JSProxy.h:
runtime/JSSymbolTableObject.cpp:

(JSC::JSSymbolTableObject::deleteProperty):

runtime/JSSymbolTableObject.h:
runtime/ProxyObject.cpp:

(JSC::ProxyObject::deleteProperty):

runtime/ProxyObject.h:
runtime/RegExpObject.cpp:

(JSC::RegExpObject::deleteProperty):

runtime/RegExpObject.h:
runtime/StrictEvalActivation.cpp:

(JSC::StrictEvalActivation::deleteProperty):

runtime/StrictEvalActivation.h:
runtime/StringObject.cpp:

(JSC::StringObject::deleteProperty):

runtime/StringObject.h:
runtime/Structure.cpp:

(JSC::Structure::removePropertyTransition):
(JSC::Structure::removePropertyTransitionFromExistingStructureImpl):
(JSC::Structure::removePropertyTransitionFromExistingStructure):
(JSC::Structure::removePropertyTransitionFromExistingStructureConcurrently):
(JSC::Structure::removeNewPropertyTransition):
(JSC::Structure::dump const):

runtime/Structure.h:
runtime/StructureInlines.h:

(JSC::Structure::hasIndexingHeader const):
(JSC::Structure::mayHaveIndexingHeader const):

tools/JSDollarVM.cpp:

(JSC::functionHasOwnLengthProperty):
(JSC::JSDollarVM::finishCreation):

Source/WebCore:

Reviewed by Keith Miller and Filip Pizlo.

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::deleteProperty):

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::deleteProperty):

bindings/js/JSRemoteDOMWindowCustom.cpp:

(WebCore::JSRemoteDOMWindow::deleteProperty):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateDeleteProperty):
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorHelperMethods):

bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:

(WebCore::JSTestEnabledBySettingPrototype::finishCreation):

bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::JSTestGenerateIsReachablePrototype::finishCreation):

bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:

(WebCore::JSTestNamedDeleterNoIdentifier::deleteProperty):

bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h:
bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:

(WebCore::JSTestNamedDeleterThrowingException::deleteProperty):

bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h:
bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:

(WebCore::JSTestNamedDeleterWithIdentifier::deleteProperty):

bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h:
bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:

(WebCore::JSTestNamedDeleterWithIndexedGetter::deleteProperty):

bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h:
bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::JSTestNodePrototype::finishCreation):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObjConstructor::initializeProperties):
(WebCore::JSTestObjPrototype::finishCreation):

bridge/NP_jsobject.cpp:
bridge/objc/WebScriptObject.mm:

(-[WebScriptObject removeWebScriptKey:]):

bridge/objc/objc_runtime.h:
bridge/objc/objc_runtime.mm:

(JSC::Bindings::ObjcFallbackObjectImp::deleteProperty):

bridge/runtime_array.cpp:

(JSC::RuntimeArray::deleteProperty):

bridge/runtime_array.h:
bridge/runtime_object.cpp:

(JSC::Bindings::RuntimeObject::deleteProperty):

bridge/runtime_object.h:

Source/WebKit:

Reviewed by Keith Miller and Filip Pizlo.

WebProcess/Plugins/Netscape/JSNPObject.cpp:

(WebKit::JSNPObject::deleteProperty):

WebProcess/Plugins/Netscape/JSNPObject.h:
WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::removeProperty):

Source/WebKitLegacy/mac:

Reviewed by Keith Miller and Filip Pizlo.

Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::removeProperty):

Source/WTF:

Reviewed by Keith Miller and Filip Pizlo.

wtf/Spectrum.h:

(WTF::Spectrum::add):
(WTF::Spectrum::get const):
(WTF::Spectrum::buildList const):
(WTF::Spectrum::clear):
(WTF::Spectrum::removeIf):
(WTF::Spectrum::begin): Deleted.
(WTF::Spectrum::end): Deleted.

File:

: 1 edited

trunk/Source/JavaScriptCore/runtime/JSDataView.cpp (modified) (2 diffs)

Legend:

: Unmodified
: Added
: Removed

trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

-              r251425
+              r257399
 bool JSDataView::deleteProperty(
     JSCell* cell, JSGlobalObject* globalObject, PropertyName propertyName)
+    JSCell* cell, JSGlobalObject* globalObject, PropertyName propertyName, DeletePropertySlot& slot)
+{
     VM& vm = globalObject->vm();
 …
         return false;
     return Base::deleteProperty(thisObject, globalObject, propertyName);
+    return Base::deleteProperty(thisObject, globalObject, propertyName, slot);
+}

Note: See TracChangeset for help on using the changeset viewer.

Context Navigation

Changeset 257399 in webkit for trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

Legend:

trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

Download in other formats: