Changeset 252725 in webkit

Timestamp:

Nov 20, 2019, 6:00:20 PM (7 years ago)

Author:

sbarati@apple.com

Message:

Baseline JIT should fill in StructureStubInfo's propertyIsInt32 and the slow path should update the array profile more frequently
​https://bugs.webkit.org/show_bug.cgi?id=204432

Reviewed by Tadeu Zagallo.

When I added inline caching for get by val, I removed code which updated the
ArrayProfile with some frequency. This patch adds code that does that back,
which recovers some of the JetStream2 regressions we are seeing.

• jit/JITOperations.cpp:
• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITOperations.cpp (modified) (2 diffs)
• jit/JITPropertyAccess.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-11-20  Saam Barati  <sbarati@apple.com>
+
+        Baseline JIT should fill in StructureStubInfo's propertyIsInt32 and the slow path should update the array profile more frequently
+        https://bugs.webkit.org/show_bug.cgi?id=204432
+
+        Reviewed by Tadeu Zagallo.
+
+        When I added inline caching for get by val, I removed code which updated the
+        ArrayProfile with some frequency. This patch adds code that does that back,
+        which recovers some of the JetStream2 regressions we are seeing.
+
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+
 2019-11-20  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -2008 +2008 @@
     JSValue subscript = JSValue::decode(encodedSubscript);
 
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
     if (baseValue.isCell() && subscript.isInt32()) {
-        if (stubInfo->considerCaching(vm, callFrame->codeBlock(), baseValue.structureOrNull()))
-            repatchArrayGetByVal(globalObject, callFrame->codeBlock(), baseValue, subscript, *stubInfo);
+        Structure* structure = baseValue.asCell()->structure(vm);
+        if (stubInfo->considerCaching(vm, codeBlock, structure)) {
+            if (profile) {
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                profile->computeUpdatedPrediction(locker, codeBlock, structure);
+            }
+            repatchArrayGetByVal(globalObject, codeBlock, baseValue, subscript, *stubInfo);
+        }
     }
 
@@ -2021 +2029 @@
                 LOG_IC((ICEvent::OperationGetByValOptimize, baseValue.classInfoOrNull(vm), propertyName, baseValue == slot.slotBase())); 
                 
-                CodeBlock* codeBlock = callFrame->codeBlock();
                 if (stubInfo->considerCaching(vm, codeBlock, baseValue.structureOrNull()))
                     repatchGetBy(globalObject, codeBlock, baseValue, propertyName, slot, *stubInfo, GetByKind::NormalByVal);

trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -71 +71 @@
         m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),
         JSValueRegs(regT0), JSValueRegs(regT1), JSValueRegs(regT0));
+    if (isOperandConstantInt(property))
+        gen.stubInfo()->propertyIsInt32 = true;
     gen.generateFastPath(*this);
     addSlowCase(gen.slowPathJump());