Changeset 265000 in webkit for trunk/Source/JavaScriptCore/jit/Repatch.cpp

Timestamp:

Jul 28, 2020, 12:28:16 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] add IC support for op_get_private_name
​https://bugs.webkit.org/show_bug.cgi?id=213545

Reviewed by Saam Barati.

JSTests:

Add a crashtest for a crash in an earlier edition of the GPN IC patch.

• stress/get-private-name-cache-failure.js: Added.

Source/JavaScriptCore:

The baseline JIT now supports a fast path for op_private_name,
using a variant of GetByVal IC.

The generated AccessCase has the following qualities:

• Always "direct", relying only on the current structure for cachebility
• Never impure (DOM properties are not supported at this time, ProxyObjects are treated as JSObjects)

Based on the microbenchmark reviewed on ​https://bugs.webkit.org/show_bug.cgi?id=213544, this sees
an improvement of roughly 50% on average.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):

• bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::reset):

• bytecode/StructureStubInfo.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):

• jit/ICStats.h:
• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

• jit/JIT.h:
• jit/JITInlineCacheGenerator.cpp:

(JSC::JITGetByValGenerator::JITGetByValGenerator):

• jit/JITInlineCacheGenerator.h:
• jit/JITOperations.cpp:

(JSC::getPrivateName):

• jit/JITOperations.h:
• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):

• jit/Repatch.cpp:

(JSC::appropriateOptimizingGetByFunction):
(JSC::appropriateGetByFunction):
(JSC::tryCacheGetBy):

• jit/Repatch.h:

File:

• trunk/Source/JavaScriptCore/jit/Repatch.cpp (modified) (6 diffs)

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -163 +163 @@
     case GetByKind::NormalByVal:
         return operationGetByValOptimize;
+    case GetByKind::PrivateName:
+        return operationGetPrivateNameOptimize;
     }
     RELEASE_ASSERT_NOT_REACHED();
@@ -180 +182 @@
     case GetByKind::NormalByVal:
         return operationGetByValGeneric;
+    case GetByKind::PrivateName:
+        return operationGetPrivateName;
     }
     RELEASE_ASSERT_NOT_REACHED();
@@ -199 +203 @@
             return GiveUpOnCache;
         JSCell* baseCell = baseValue.asCell();
+        const bool isPrivate = kind == GetByKind::PrivateName;
 
         std::unique_ptr<AccessCase> newCase;
@@ -254 +259 @@
             bool loadTargetFromProxy = false;
             if (baseCell->type() == PureForwardingProxyType) {
+                if (isPrivate)
+                    return GiveUpOnCache;
                 baseValue = jsCast<JSProxy*>(baseCell)->target();
                 baseCell = baseValue.asCell();
@@ -309 +316 @@
                     return GiveUpOnCache;
 
-                // If a kind is GetByKind::Direct, we do not need to investigate prototype chains further.
+                // If a kind is GetByKind::Direct or GetByKind::PrivateName, we do not need to investigate prototype chains further.
                 // Cacheability just depends on the head structure.
-                if (kind != GetByKind::Direct) {
+                if (kind != GetByKind::Direct && !isPrivate) {
                     auto cacheStatus = prepareChainForCaching(globalObject, baseCell, slot);
                     if (!cacheStatus)
@@ -375 +382 @@
                 newCase = IntrinsicGetterAccessCase::create(vm, codeBlock, propertyName, slot.cachedOffset(), structure, conditionSet, getter, WTFMove(prototypeAccessChain));
             else {
-                if (slot.isCacheableValue() || slot.isUnset()) {
+                if (isPrivate) {
+                    RELEASE_ASSERT(!slot.isUnset());
+                    constexpr bool isProxy = false;
+                    if (!slot.isCacheable())
+                        return GiveUpOnCache;
+                    newCase = ProxyableAccessCase::create(vm, codeBlock, AccessCase::Load, propertyName, offset, structure,
+                        conditionSet, isProxy, slot.watchpointSet(), WTFMove(prototypeAccessChain));
+                } else if (slot.isCacheableValue() || slot.isUnset()) {
                     newCase = ProxyableAccessCase::create(vm, codeBlock, slot.isUnset() ? AccessCase::Miss : AccessCase::Load,
                         propertyName, offset, structure, conditionSet, loadTargetFromProxy, slot.watchpointSet(), WTFMove(prototypeAccessChain));