Changeset 265600 in webkit for trunk/Source/JavaScriptCore/jit/Repatch.cpp

Timestamp:

Aug 12, 2020, 9:50:12 PM (5 years ago)

Author:

[email protected]

Message:

Inline cache Replace and Setters on PureForwardingProxy
​https://bugs.webkit.org/show_bug.cgi?id=215250

Reviewed by Yusuke Suzuki.

JSTests:

• microbenchmarks/property-replace-and-setter-on-js-proxy.js: Added.

(assert):
(foo):

Source/JavaScriptCore:

We didn't used to cache any Puts on PureForwardingProxy. This patch
implements Replace and JS/Custom Setters on PureForwardingProxy. We don't support
Transition puts because in our current implementation different global objects
will never share the same structure.

This patch also aligns how our runtime and the ICs invoke Customs when the
passed in |this| value is a JSProxy. For custom accessors, our runtime passes
in the JSProxy, where our ICs used to pass in the target of the JSProxy, for
the receiver value. For custom values, the IC behavior and the runtime were
already aligned in passing in the property owner, which is the JSProxy's
target. This patch aligns our IC behavior to match our runtime behavior.

This patch also renames some of the registers in the IC code to clear
up what they're used for.

This is a 2.5x speedup on the microbenchmark I've added, and a 15-20% speedup
on JetStream2's 3d-cube-SP.

• bytecode/AccessCase.cpp:

(JSC::AccessCase::generateWithGuard):
(JSC::AccessCase::generateImpl):

• bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::create):

• bytecode/GetterSetterAccessCase.h:
• jit/JITOperations.cpp:
• jit/Repatch.cpp:

(JSC::tryCachePutByID):

• runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::originalStructureBeforePut):
(JSC::CommonSlowPaths::putDirectWithReify):

File:

• trunk/Source/JavaScriptCore/jit/Repatch.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -592 +592 @@
             return GiveUpOnCache;
 
+        JSCell* baseCell = baseValue.asCell();
+
+        bool isProxy = false;
+        if (baseCell->type() == PureForwardingProxyType) {
+            baseCell = jsCast<JSProxy*>(baseCell)->target();
+            baseValue = baseCell;
+            isProxy = true;
+
+            // We currently only cache Replace and JS/Custom Setters on JSProxy. We don't
+            // cache transitions because global objects will never share the same structure
+            // in our current implementation.
+            bool isCacheableProxy = (slot.isCacheablePut() && slot.type() == PutPropertySlot::ExistingProperty)
+                || slot.isCacheableSetter()
+                || slot.isCacheableCustom();
+            if (!isCacheableProxy)
+                return GiveUpOnCache;
+        }
+
         std::unique_ptr<AccessCase> newCase;
-        JSCell* baseCell = baseValue.asCell();
 
         if (slot.base() == baseValue && slot.isCacheablePut()) {
@@ -609 +626 @@
                 if (stubInfo.cacheType() == CacheType::Unset
                     && InlineAccess::canGenerateSelfPropertyReplace(stubInfo, slot.cachedOffset())
-                    && !oldStructure->needImpurePropertyWatchpoint()) {
+                    && !oldStructure->needImpurePropertyWatchpoint()
+                    && !isProxy) {
                     
                     bool generatedCodeInline = InlineAccess::generateSelfPropertyReplace(stubInfo, oldStructure, slot.cachedOffset());
@@ -620 +638 @@
                 }
 
-                newCase = AccessCase::create(vm, codeBlock, AccessCase::Replace, propertyName, slot.cachedOffset(), oldStructure);
+                newCase = ProxyableAccessCase::create(vm, codeBlock, AccessCase::Replace, propertyName, slot.cachedOffset(), oldStructure, ObjectPropertyConditionSet(), isProxy);
             } else {
+                ASSERT(!isProxy);
                 ASSERT(slot.type() == PutPropertySlot::NewProperty);
 
@@ -707 +726 @@
                 newCase = GetterSetterAccessCase::create(
                     vm, codeBlock, slot.isCustomAccessor() ? AccessCase::CustomAccessorSetter : AccessCase::CustomValueSetter, oldStructure, propertyName,
-                    invalidOffset, conditionSet, WTFMove(prototypeAccessChain), slot.customSetter(), slot.base() != baseValue ? slot.base() : nullptr);
+                    invalidOffset, conditionSet, WTFMove(prototypeAccessChain), isProxy, slot.customSetter(), slot.base() != baseValue ? slot.base() : nullptr);
             } else {
+                ASSERT(slot.isCacheableSetter());
                 ObjectPropertyConditionSet conditionSet;
                 std::unique_ptr<PolyProtoAccessChain> prototypeAccessChain;
@@ -743 +763 @@
 
                 newCase = GetterSetterAccessCase::create(
-                    vm, codeBlock, AccessCase::Setter, oldStructure, propertyName, offset, conditionSet, WTFMove(prototypeAccessChain));
+                    vm, codeBlock, AccessCase::Setter, oldStructure, propertyName, offset, conditionSet, WTFMove(prototypeAccessChain), isProxy);
             }
         }