Changeset 295008 in webkit for trunk/Source/JavaScriptCore/jit


Ignore:
Timestamp:
May 28, 2022, 8:23:06 PM (3 years ago)
Author:
Yijia Huang
Message:

Shrink Structure to 96 Bytes when addresses can be encoded in 36-bits
​https://bugs.webkit.org/show_bug.cgi?id=240407

Reviewed by Yusuke Suzuki.

We have 2% RAMification regression on iOS, which needs a memory performance
improvement. To work towards resolving this regression, this patch is to
reduce JS object's structure size from 112 bytes to 96 bytes for iOS systems.

  1. We can reduce 36-bit addresses into 4 bytes when dealing with pointers that

have 16-byte alignment.

  1. StructureID can be removed from StructureIDBlob since we can directly compute

the id by encoding the Structure pointer.

CompactPtr and CompactRefPtr classes are introduced for pointers, which can
achieve 8 bytes in MacOS and 4 bytes in iOS.

  • PerformanceTests/JetStream2/RexBench/OfflineAssembler/LowLevelInterpreter64.asm:
  • PerformanceTests/JetStream2/RexBench/OfflineAssembler/LowLevelInterpreter64.js:
  • PerformanceTests/JetStream2/RexBench/OfflineAssembler/expected.js:
  • PerformanceTests/RexBench/OfflineAssembler/LowLevelInterpreter64.asm:
  • PerformanceTests/RexBench/OfflineAssembler/LowLevelInterpreter64.js:
  • PerformanceTests/RexBench/OfflineAssembler/expected.js:
  • Source/JavaScriptCore/CMakeLists.txt:
  • Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
  • Source/JavaScriptCore/bytecode/GetByValHistory.h:

(JSC::GetByValHistory::observe):

  • Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
  • Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

  • Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h:
  • Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

  • Source/JavaScriptCore/heap/ConservativeRoots.cpp:

(JSC::ConservativeRoots::genericAddPointer):
(JSC::ConservativeRoots::genericAddSpan):

  • Source/JavaScriptCore/heap/ConservativeRoots.h:
  • Source/JavaScriptCore/heap/HeapSnapshot.h:
  • Source/JavaScriptCore/heap/HeapUtil.h:

(JSC::HeapUtil::findGCObjectPointersForMarking):
(JSC::HeapUtil::isPointerGCObjectJSCell):
(JSC::HeapUtil::isValueGCObject):

  • Source/JavaScriptCore/heap/MarkedBlockSet.h:

(JSC::MarkedBlockSet::add):
(JSC::MarkedBlockSet::recomputeFilter):
(JSC::MarkedBlockSet::filter const):

  • Source/JavaScriptCore/heap/TinyBloomFilter.h:

(JSC::TinyBloomFilter<Bits>::TinyBloomFilter):
(JSC::TinyBloomFilter<Bits>::add):
(JSC::TinyBloomFilter<Bits>::ruleOut const):
(JSC::TinyBloomFilter<Bits>::reset):
(JSC::TinyBloomFilter::TinyBloomFilter): Deleted.
(JSC::TinyBloomFilter::add): Deleted.
(JSC::TinyBloomFilter::ruleOut const): Deleted.
(JSC::TinyBloomFilter::reset): Deleted.

  • Source/JavaScriptCore/jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
(JSC::AssemblyHelpers::emitEncodeStructure):

  • Source/JavaScriptCore/jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
(JSC::AssemblyHelpers::loadCompactPtr):
(JSC::AssemblyHelpers::branchCompactPtr):

  • Source/JavaScriptCore/jit/JITPropertyAccess.cpp:

(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::emit_op_put_to_scope):

  • Source/JavaScriptCore/runtime/ClassInfo.h:

(JSC::ClassInfo::offsetOfParentClass): Deleted.
(JSC::ClassInfo::isSubClassOf const): Deleted.

  • Source/JavaScriptCore/runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::processUnverifiedStackTraces):

  • Source/JavaScriptCore/runtime/Structure.cpp:

(JSC::Structure::Structure):

  • Source/JavaScriptCore/runtime/Structure.h:

(JSC::Structure::id const):
(JSC::Structure::typeInfoBlob const):
(JSC::Structure::classInfoForCells const):
(JSC::Structure::indexingModeIncludingHistoryOffset):
(JSC::Structure::objectInitializationBlob const): Deleted.
(JSC::Structure::idBlob const): Deleted.
(JSC::Structure::structureIDOffset): Deleted.

  • Source/JavaScriptCore/runtime/StructureInlines.h:

(JSC::Structure::get):
(JSC::Structure::add):

  • Source/JavaScriptCore/runtime/TypeInfoBlob.h: Renamed from Source/JavaScriptCore/runtime/StructureIDBlob.h.

(JSC::TypeInfoBlob::TypeInfoBlob):
(JSC::TypeInfoBlob::operator=):
(JSC::TypeInfoBlob::indexingModeIncludingHistory const):
(JSC::TypeInfoBlob::fencedIndexingModeIncludingHistory):
(JSC::TypeInfoBlob::setIndexingModeIncludingHistory):
(JSC::TypeInfoBlob::type const):
(JSC::TypeInfoBlob::inlineTypeFlags const):
(JSC::TypeInfoBlob::typeInfo const):
(JSC::TypeInfoBlob::blob const):
(JSC::TypeInfoBlob::indexingModeIncludingHistoryOffset):

  • Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp:

(JSC::WebAssemblyFunction::jsCallEntrypointSlow):

  • Source/WTF/WTF.xcodeproj/project.pbxproj:
  • Source/WTF/wtf/CMakeLists.txt:
  • Source/WTF/wtf/CompactPtr.h: Added.

(WTF::CompactPtr::CompactPtr):
(WTF::CompactPtr::operator* const):
(WTF::CompactPtr::operator-> const):
(WTF::CompactPtr::operator! const):
(WTF::CompactPtr::operator bool const):
(WTF::CompactPtr::operator=):
(WTF::CompactPtr::get const):
(WTF::CompactPtr::set):
(WTF::CompactPtr::exchange):
(WTF::CompactPtr::swap):
(WTF::CompactPtr::encode):
(WTF::CompactPtr::encode const):
(WTF::CompactPtr::decode const):
(WTF::GetPtrHelper<CompactPtr<T>>::getPtr):
(WTF::CompactPtrTraits::exchange):
(WTF::CompactPtrTraits::swap):
(WTF::CompactPtrTraits::unwrap):
(WTF::CompactPtrTraits::hashTableDeletedValue):
(WTF::CompactPtrTraits::isHashTableDeletedValue):

  • Source/WTF/wtf/CompactRefPtr.h: Copied from Source/JavaScriptCore/heap/HeapSnapshot.h.
  • Source/WTF/wtf/text/StringImpl.cpp:
  • Source/WTF/wtf/text/StringImpl.h:
  • Tools/TestWebKitAPI/CMakeLists.txt:
  • Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • Tools/TestWebKitAPI/Tests/WTF/AlignedRefLogger.h: Copied from Source/JavaScriptCore/heap/TinyBloomFilter.h.

(TestWebKitAPI::DerivedAlignedRefLogger::DerivedAlignedRefLogger):

  • Tools/TestWebKitAPI/Tests/WTF/CompactPtr.cpp: Added.

(TestWebKitAPI::TEST):

  • Tools/TestWebKitAPI/Tests/WTF/CompactRefPtr.cpp: Added.

(TestWebKitAPI::TEST):
(TestWebKitAPI::f1):
(TestWebKitAPI::returnConstRefCountedRef):
(TestWebKitAPI::returnRefCountedRef):
(TestWebKitAPI::CompactRefPtrCheckingAlignedRefLogger::CompactRefPtrCheckingAlignedRefLogger):
(TestWebKitAPI::loggerName):
(TestWebKitAPI::CompactRefPtrCheckingAlignedRefLogger::ref):
(TestWebKitAPI::CompactRefPtrCheckingAlignedRefLogger::deref):

  • Tools/TestWebKitAPI/Tests/WTF/JSONValue.cpp:

(TestWebKitAPI::TEST):

  • Websites/browserbench.org/JetStream2.0/RexBench/OfflineAssembler/LowLevelInterpreter64.asm:
  • Websites/browserbench.org/JetStream2.0/RexBench/OfflineAssembler/LowLevelInterpreter64.js:
  • Websites/browserbench.org/JetStream2.0/RexBench/OfflineAssembler/expected.js:

Canonical link: ​https://commits.webkit.org/251103@main

Location:
trunk/Source/JavaScriptCore/jit
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r294794 r295008  
    333333    const Structure* structurePtr = reinterpret_cast<const Structure*>(structure.m_value);
    334334#if USE(JSVALUE64)
    335     jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
     335    jit.store32(TrustedImm32(structurePtr->id().bits()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
     336    jit.store32(TrustedImm32(structurePtr->typeInfoBlob()), MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()));
    336337    if (ASSERT_ENABLED) {
    337338        Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id().bits()));
    … …  
    353354#else
    354355    // Do a 32-bit wide store to initialize the cell's fields.
    355     jit.store32(TrustedImm32(structurePtr->objectInitializationBlob()), MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()));
     356    jit.store32(TrustedImm32(structurePtr->typeInfoBlob()), MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()));
    356357    jit.storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
    357358#endif
    … …  
    427428    load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
    428429    emitNonNullDecodeZeroExtendedStructureID(dest, dest);
     430}
     431
     432void AssemblyHelpers::emitEncodeStructureID(RegisterID source, RegisterID dest)
     433{
     434#if ENABLE(STRUCTURE_ID_WITH_SHIFT)
     435    urshift64(source, TrustedImm32(StructureID::encodeShiftAmount), dest);
     436#elif CPU(ADDRESS64)
     437    move(source, dest);
     438    static_assert(StructureID::structureIDMask <= UINT32_MAX);
     439    and64(TrustedImm32(static_cast<uint32_t>(StructureID::structureIDMask)), dest);
     440#else
     441    move(source, dest);
     442#endif
    429443}
    430444

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

    r294965 r295008  
    16141614    void emitLoadStructure(VM&, RegisterID source, RegisterID dest);
    16151615    void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, JumpList& slowPath);
     1616    void emitEncodeStructureID(RegisterID source, RegisterID dest);
    16161617
    16171618    void emitStoreStructureWithTypeInfo(TrustedImmPtr structure, RegisterID dest, RegisterID)
    … …  
    16221623    void emitStoreStructureWithTypeInfo(RegisterID structure, RegisterID dest, RegisterID scratch)
    16231624    {
    1624 #if USE(JSVALUE64)
    1625         load64(MacroAssembler::Address(structure, Structure::structureIDOffset()), scratch);
    1626         store64(scratch, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
    1627 #else
     1625        // Store the StructureID
     1626#if USE(JSVALUE64)
     1627        emitEncodeStructureID(structure, scratch);
     1628        store32(scratch, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
     1629#else
     1630        storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
     1631#endif
    16281632        // Store all the info flags using a single 32-bit wide load and store.
    16291633        load32(MacroAssembler::Address(structure, Structure::indexingModeIncludingHistoryOffset()), scratch);
    16301634        store32(scratch, MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()));
    1631 
    1632         // Store the StructureID
    1633         storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
    1634 #endif
    16351635    }
    16361636
    … …  
    19151915            storeTrustedValue(JSValue(), Address(butterflyGPR, -sizeof(IndexingHeader) - (i + 1) * sizeof(EncodedJSValue)));
    19161916    }
    1917    
     1917
     1918    void loadCompactPtr(Address address, GPRReg dest)
     1919    {
     1920#if HAVE(36BIT_ADDRESS)
     1921        load32(address, dest);
     1922        lshift64(TrustedImm32(4), dest);
     1923#else
     1924        loadPtr(address, dest);
     1925#endif
     1926    }
     1927
     1928    Jump branchCompactPtr(RelationalCondition cond, GPRReg left, Address right, GPRReg scratch)
     1929    {
     1930#if HAVE(36BIT_ADDRESS)
     1931        ASSERT(left != scratch);
     1932        load32(right, scratch);
     1933        lshift64(TrustedImm32(4), scratch);
     1934        return branchPtr(cond, left, Address(scratch));
     1935#else
     1936        UNUSED_PARAM(scratch);
     1937        return branchPtr(cond, left, right);
     1938#endif
     1939    }
     1940
    19181941#if USE(JSVALUE64)
    19191942    void wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch);

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r294873 r295008  
    17411741            jit.loadPtr(Address(metadataGPR, OpGetFromScope::Metadata::offsetOfStructure()), scratchGPR);
    17421742            slowCase.append(jit.branchTestPtr(Zero, scratchGPR));
    1743             jit.load32(Address(scratchGPR, Structure::structureIDOffset()), scratchGPR);
     1743            jit.emitEncodeStructureID(scratchGPR, scratchGPR);
    17441744            slowCase.append(jit.branch32(NotEqual, Address(scopeGPR, JSCell::structureIDOffset()), scratchGPR));
    17451745
    … …  
    19141914            emitGetVirtualRegisterPayload(scope, scopeGPR);
    19151915            addSlowCase(branchTestPtr(Zero, scratchGPR1));
    1916             load32(Address(scratchGPR1, Structure::structureIDOffset()), scratchGPR1);
     1916            emitEncodeStructureID(scratchGPR1, scratchGPR1);
    19171917            addSlowCase(branch32(NotEqual, Address(scopeGPR, JSCell::structureIDOffset()), scratchGPR1));
    19181918
Note: See TracChangeset for help on using the changeset viewer.