Changeset 38763 in webkit for trunk/JavaScriptCore/jit/JIT.cpp

Timestamp:

Nov 25, 2008, 3:07:30 PM (17 years ago)

Author:

[email protected]

Message:

2008-11-24 Gavin Barraclough <​[email protected]>

Reviewed by Geoff Garen.

Polymorpic caching for get by id chain. Similar to the polymorphic caching already implemented
for self and proto accesses (implemented by allowing multiple trampolines to be JIT genertaed,
and linked together) - the get by id chain caching is implemented as a genericization of the
proto list caching, allowing cached access lists to contain a mix of proto and proto chain
accesses (since in JS style inheritance hierarchies you may commonly see a mix of properties
being overridden on the direct prototype, or higher up its prototype chain).

In order to allow this patch to compile there is a fix to appease gcc 4.2 compiler issues
(removing the jumps between fall-through cases in privateExecute).

This patch also removes redundant immediate checking from the reptach code, and fixes a related
memory leak (failure to deallocate trampolines).

~2% progression on v8 tests (bulk on the win on deltablue)

• bytecode/Instruction.h: (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::): (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set): (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList): (JSC::PolymorphicAccessStructureList::derefStructures):
• interpreter/Interpreter.cpp: (JSC::countPrototypeChainEntriesAndCheckForProxies): (JSC::Interpreter::tryCacheGetByID): (JSC::Interpreter::privateExecute): (JSC::Interpreter::tryCTICacheGetByID): (JSC::Interpreter::cti_op_get_by_id_self_fail): (JSC::getPolymorphicAccessStructureListSlot): (JSC::Interpreter::cti_op_get_by_id_proto_list):
• interpreter/Interpreter.h:
• jit/JIT.cpp: (JSC::JIT::privateCompileGetByIdProto): (JSC::JIT::privateCompileGetByIdSelfList): (JSC::JIT::privateCompileGetByIdProtoList): (JSC::JIT::privateCompileGetByIdChainList): (JSC::JIT::privateCompileGetByIdChain): (JSC::JIT::privateCompilePatchGetArrayLength):
• jit/JIT.h: (JSC::JIT::compileGetByIdChainList):

File:

• trunk/JavaScriptCore/jit/JIT.cpp (modified) (14 diffs)

trunk/JavaScriptCore/jit/JIT.cpp

@@ -3156 +3156 @@
 
     // Check eax is an object of the right Structure.
-    __ testl_i32r(JSImmediate::TagMask, X86::eax);
-    JmpSrc failureCases1 = __ jne();
-    JmpSrc failureCases2 = checkStructure(X86::eax, structure);
+    JmpSrc failureCases1 = checkStructure(X86::eax, structure);
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
     __ cmpl_i32m(reinterpret_cast<uint32_t>(prototypeStructure), prototypeStructureAddress);
-    JmpSrc failureCases3 = __ jne();
+    JmpSrc failureCases2 = __ jne();
 
     // Checks out okay! - getDirectOffset
@@ -3176 +3174 @@
     X86Assembler::link(code, failureCases1, slowCaseBegin);
     X86Assembler::link(code, failureCases2, slowCaseBegin);
-    X86Assembler::link(code, failureCases3, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
@@ -3245 +3242 @@
 
     structure->ref();
-    polymorphicStructures->list[currentIndex].set(structure, 0, cachedOffset, 0/*code*/);
+    polymorphicStructures->list[currentIndex].set(cachedOffset, code, structure);
 
     // Finally repatch the jump to slow case back in the hot path to jump here instead.
@@ -3261 +3258 @@
 
     // Check eax is an object of the right Structure.
-    __ testl_i32r(JSImmediate::TagMask, X86::eax);
-    JmpSrc failureCases1 = __ jne();
-    JmpSrc failureCases2 = checkStructure(X86::eax, structure);
+    JmpSrc failureCases1 = checkStructure(X86::eax, structure);
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-    __ cmpl_i32m(reinterpret_cast<uint32_t>(prototypeStructure), static_cast<void*>(prototypeStructureAddress));
-    JmpSrc failureCases3 = __ jne();
+    __ cmpl_i32m(reinterpret_cast<uint32_t>(prototypeStructure), prototypeStructureAddress);
+    JmpSrc failureCases2 = __ jne();
 
     // Checks out okay! - getDirectOffset
@@ -3281 +3276 @@
     X86Assembler::link(code, failureCases1, lastProtoBegin);
     X86Assembler::link(code, failureCases2, lastProtoBegin);
-    X86Assembler::link(code, failureCases3, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
@@ -3289 +3283 @@
     structure->ref();
     prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(structure, prototypeStructure, cachedOffset, code);
+    prototypeStructures->list[currentIndex].set(cachedOffset, code, structure, prototypeStructure);
 
     // Finally repatch the jump to slow case back in the hot path to jump here instead.
@@ -3295 +3289 @@
     X86Assembler::repatchBranchOffset(jmpLocation, code);
 }
-#endif
-
-void JIT::privateCompileGetByIdChain(Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, void* returnAddress, CallFrame* callFrame)
-{
-#if USE(CTI_REPATCH_PIC)
-    StructureStubInfo& info = m_codeBlock->getStubInfo(returnAddress);
-
-    // We don't want to repatch more than once - in future go to cti_op_put_by_id_generic.
-    ctiRepatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_generic));
-
+
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
+{
     ASSERT(count);
     
@@ -3310 +3297 @@
 
     // Check eax is an object of the right Structure.
-    __ testl_i32r(JSImmediate::TagMask, X86::eax);
-    bucketsOfFail.append(__ jne());
     bucketsOfFail.append(checkStructure(X86::eax, structure));
 
@@ -3323 +3308 @@
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-        __ cmpl_i32m(reinterpret_cast<uint32_t>(currStructure), static_cast<void*>(prototypeStructureAddress));
+        __ cmpl_i32m(reinterpret_cast<uint32_t>(currStructure), prototypeStructureAddress);
+        bucketsOfFail.append(__ jne());
+    }
+    ASSERT(protoObject);
+
+    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
+    __ movl_mr(static_cast<void*>(protoPropertyStorage), X86::edx);
+    __ movl_mr(cachedOffset * sizeof(JSValue*), X86::edx, X86::eax);
+    JmpSrc success = __ jmp();
+
+    void* code = __ executableCopy();
+
+    // Use the repatch information to link the failure cases back to the original slow case routine.
+    void* lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+
+    for (unsigned i = 0; i < bucketsOfFail.size(); ++i)
+        X86Assembler::link(code, bucketsOfFail[i], lastProtoBegin);
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + repatchOffsetGetByIdPropertyMapOffset;
+    X86Assembler::link(code, success, reinterpret_cast<void*>(successDest));
+
+    // Track the stub we have created so that it will be deleted later.
+    structure->ref();
+    chain->ref();
+    prototypeStructures->list[currentIndex].set(cachedOffset, code, structure, chain);
+
+    // Finally repatch the jump to slow case back in the hot path to jump here instead.
+    intptr_t jmpLocation = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + repatchOffsetGetByIdBranchToSlowCase;
+    X86Assembler::repatchBranchOffset(jmpLocation, code);
+}
+#endif
+
+void JIT::privateCompileGetByIdChain(Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, void* returnAddress, CallFrame* callFrame)
+{
+#if USE(CTI_REPATCH_PIC)
+    StructureStubInfo& info = m_codeBlock->getStubInfo(returnAddress);
+
+    // We don't want to repatch more than once - in future go to cti_op_put_by_id_generic.
+    ctiRepatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_list));
+
+    ASSERT(count);
+    
+    Vector<JmpSrc> bucketsOfFail;
+
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(X86::eax, structure));
+
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+        __ cmpl_i32m(reinterpret_cast<uint32_t>(currStructure), prototypeStructureAddress);
         bucketsOfFail.append(__ jne());
     }
@@ -3370 +3412 @@
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-        __ cmpl_i32m(reinterpret_cast<uint32_t>(currStructure), static_cast<void*>(prototypeStructureAddress));
+        __ cmpl_i32m(reinterpret_cast<uint32_t>(currStructure), prototypeStructureAddress);
         bucketsOfFail.append(__ jne());
     }
@@ -3383 +3425 @@
 
     for (unsigned i = 0; i < bucketsOfFail.size(); ++i)
-        X86Assembler::link(code, bucketsOfFail[i], reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_chain_fail));
+        X86Assembler::link(code, bucketsOfFail[i], reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
 
     m_codeBlock->getStubInfo(returnAddress).stubRoutine = code;
@@ -3769 +3811 @@
 
     // Check eax is an array
-    __ testl_i32r(JSImmediate::TagMask, X86::eax);
+    __ cmpl_i32m(reinterpret_cast<unsigned>(m_interpreter->m_jsArrayVptr), X86::eax);
     JmpSrc failureCases1 = __ jne();
-    __ cmpl_i32m(reinterpret_cast<unsigned>(m_interpreter->m_jsArrayVptr), X86::eax);
-    JmpSrc failureCases2 = __ jne();
 
     // Checks out okay! - get the length from the storage
@@ -3779 +3819 @@
 
     __ cmpl_i32r(JSImmediate::maxImmediateInt, X86::ecx);
-    JmpSrc failureCases3 = __ ja();
+    JmpSrc failureCases2 = __ ja();
 
     __ addl_rr(X86::ecx, X86::ecx);
@@ -3792 +3832 @@
     X86Assembler::link(code, failureCases1, slowCaseBegin);
     X86Assembler::link(code, failureCases2, slowCaseBegin);
-    X86Assembler::link(code, failureCases3, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.