Changeset 95484 in webkit for trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

Timestamp:

Sep 19, 2011, 3:27:38 PM (14 years ago)

Author:

[email protected]

Message:

DFG speculation failures should act as additional value profiles
​https://bugs.webkit.org/show_bug.cgi?id=68335

Reviewed by Oliver Hunt.

This adds slow-case counters to the old JIT. It also ensures that
negative zero in multiply is handled carefully. The old JIT
previously took slow path if the result of a multiply was zero,
which, without any changes, would cause the DFG to think that
every such multiply produced a double result.

This also fixes a bug in the old JIT's handling of decrements. It
would take the slow path if the result was zero, but not if it
underflowed.

By itself, this would be a 1% slow-down on V8 and Kraken. But then
I wrote optimizations in the DFG that take advantage of this new
information. It's no longer the case that every multiply needs to
do a check for negative zero; it only happens if the negative
zero is ignored.

This results in a 12% speed-up on v8-crypto, for a 1.4% geomean
speed-up in V8. It's mostly neutral on Kraken. I can see an
0.5% slow-down and it appears to be significant.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::resetRareCaseProfiles):
(JSC::CodeBlock::dumpValueProfiles):

• bytecode/CodeBlock.h:
• bytecode/ValueProfile.h:

(JSC::RareCaseProfile::RareCaseProfile):
(JSC::getRareCaseProfileBytecodeOffset):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::toInt32):
(JSC::DFG::ByteCodeParser::makeSafe):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::GPRTemporary::GPRTemporary):

• dfg/DFGJITCodeGenerator.h:
• dfg/DFGNode.h:
• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateNode):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::clobbersWorld):
(JSC::DFG::Propagator::performNodeCSE):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):

• jit/JIT.cpp:

(JSC::JIT::privateCompileSlowCases):

• jit/JIT.h:

(JSC::JIT::linkDummySlowCase):

• jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_post_dec):
(JSC::JIT::emit_op_pre_dec):
(JSC::JIT::compileBinaryArithOp):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitSlow_op_add):

• jit/JITInlineMethods.h:

(JSC::JIT::addSlowCase):

File:

• trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1985 +1985 @@
 #endif
 
+#if ENABLE(VALUE_PROFILER)
+void CodeBlock::resetRareCaseProfiles()
+{
+    for (unsigned i = 0; i < numberOfSlowCaseProfiles(); ++i)
+        slowCaseProfile(i)->m_counter = 0;
+    for (unsigned i = 0; i < numberOfSpecialFastCaseProfiles(); ++i)
+        specialFastCaseProfile(i)->m_counter = 0;
+}
+#endif
+
 #if ENABLE(VERBOSE_VALUE_PROFILE)
 void CodeBlock::dumpValueProfiles()
@@ -2003 +2013 @@
         fprintf(stderr, "\n");
     }
+    fprintf(stderr, "SlowCaseProfile for %p:\n", this);
+    for (unsigned i = 0; i < numberOfSlowCaseProfiles(); ++i) {
+        SlowCaseProfile* profile = slowCaseProfile(i);
+        fprintf(stderr, "   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
+    }
 }
 #endif