Changeset 292372 in webkit for trunk/Source/JavaScriptCore/dfg/DFGThunks.cpp

Timestamp:

Apr 4, 2022, 9:10:35 PM (3 years ago)

Author:

[email protected]

Message:

[JSC] Store CodeBlock in caller side
​https://bugs.webkit.org/show_bug.cgi?id=238535

Reviewed by Saam Barati.

This patch changes the calling convention of JS functions. Now, we need to store CodeBlock to the stack in the caller side instead.
This helps LLInt, unlinked Baseline, and DFG since we no longer need to load CodeBlock from callee via costly dependent loads: unlinked
ones cannot embed CodeBlock raw pointer into the machine code itself. So we needed to load it from callee. But now, caller puts the
right CodeBlock pointer into the stack so we do not need that code. And in most cases, caller already knows CodeBlock since it is tied
to actually used machine code pointer.
OSR entry also materializes CodeBlock in the stack in the OSR entry side instead of doing it in the callee side.

This contributes to 0.3% progression in Speedometer2.

• assembler/CPU.h:

(JSC::prologueStackPointerDelta):

• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::setMonomorphicCallee):
(JSC::CallLinkInfo::clearCallee):
(JSC::CallLinkInfo::revertCallToStub):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::setStub):
(JSC::OptimizingCallLinkInfo::emitDirectFastPath):
(JSC::OptimizingCallLinkInfo::emitDirectTailCallFastPath):
(JSC::OptimizingCallLinkInfo::initializeDirectCall):
(JSC::OptimizingCallLinkInfo::setDirectCallTarget):

• bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::offsetOfCodeBlock):

• bytecode/Repatch.cpp:

(JSC::linkMonomorphicCall):
(JSC::linkDirectCall):
(JSC::linkPolymorphicCall):

• bytecode/RepatchInlines.h:

(JSC::virtualForWithFunction):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileEntry):

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):
(JSC::DFG::prepareCatchOSREntry):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):

• dfg/DFGThunks.cpp:

(JSC::DFG::osrEntryThunkGenerator):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLink.cpp:

(JSC::FTL::link):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

• interpreter/CallFrame.h:
• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::calleeFrameCodeBlockBeforeCall):
(JSC::AssemblyHelpers::calleeFrameCodeBlockBeforeTailCall):
(JSC::AssemblyHelpers::prologueStackPointerDelta): Deleted.

• jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

• jit/JIT.cpp:

(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue): Deleted.

• jit/JIT.h:
• jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

• jit/JITOperations.h:
• jit/ThunkGenerators.cpp:

(JSC::virtualThunkFor):
(JSC::boundFunctionCallGenerator):
(JSC::remoteFunctionCallGenerator):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• llint/WebAssembly.asm:
• runtime/FunctionExecutable.h:
• runtime/JSCast.h:
• runtime/VM.cpp:

(JSC::VM::getRemoteFunction):

• wasm/WasmOperations.cpp:

(JSC::Wasm::doOSREntry):

File:

• trunk/Source/JavaScriptCore/dfg/DFGThunks.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGThunks.cpp

@@ -38 +38 @@
 #include "LinkBuffer.h"
 #include "MacroAssembler.h"
+#include "ProbeContext.h"
 
 namespace JSC { namespace DFG {
@@ -149 +150 @@
     jit.getEffectiveAddress(MacroAssembler::BaseIndex(GPRInfo::callFrameRegister, GPRInfo::regT2, MacroAssembler::TimesEight), MacroAssembler::stackPointerRegister);
     
+    // Copying locals and header from scratch buffer to the new CallFrame. This also replaces
     MacroAssembler::Label loop = jit.label();
     jit.subPtr(MacroAssembler::TrustedImm32(1), GPRInfo::regT1);
@@ -161 +163 @@
 
     ok.link(&jit);
+
+#if ASSERT_ENABLED
+    jit.probeDebug([](Probe::Context& ctx) {
+        CodeBlock* codeBlock = ctx.fp<CallFrame*>()->codeBlock();
+        RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlock->jitType()));
+    });
+#endif
+
     jit.restoreCalleeSavesFromEntryFrameCalleeSavesBuffer(vm.topEntryFrame);
     jit.emitMaterializeTagCheckRegisters();