Changeset 285971 in webkit

Timestamp:

Nov 17, 2021, 6:47:45 PM (5 years ago)

Author:

sbarati@apple.com

Message:

Run the memmove fast path in JSGenericTypedArrayView<Adaptor>::set when using a combination of Uint8 and Uint8Clamped
​https://bugs.webkit.org/show_bug.cgi?id=233271
<rdar://85259288>

Reviewed by Yusuke Suzuki.

JSTests:

• microbenchmarks/typed-array-set-uint8-and-uint8clamped.js: Added.

Source/JavaScriptCore:

We have a fast path for running memmove when both the thing being
copied from and the thing being copied to have the same typed array
type. However, when copying from a Uint8Array into a Uint8ClampedArray,
or vice versa, we were going down the slow path. In this case,
we can still take the fast path, since we're guaranteed that storing
into a Uint8ClampedArray from a Uint8Array will never actually need
to clamp values. And when storing from a Uint8ClampedArray into a
Uint8Array, the values can trivially be copied over.

This patch is a 100x speedup on the attached microbenchmark.

• runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::set):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/typed-array-set-uint8-and-uint8clamped.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-17  Saam Barati  <sbarati@apple.com>
+
+        Run the memmove fast path in JSGenericTypedArrayView<Adaptor>::set when using a combination of Uint8 and Uint8Clamped
+        https://bugs.webkit.org/show_bug.cgi?id=233271
+        <rdar://85259288>
+
+        Reviewed by Yusuke Suzuki.
+
+        * microbenchmarks/typed-array-set-uint8-and-uint8clamped.js: Added.
+
 2021-11-15  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-17  Saam Barati  <sbarati@apple.com>
+
+        Run the memmove fast path in JSGenericTypedArrayView<Adaptor>::set when using a combination of Uint8 and Uint8Clamped
+        https://bugs.webkit.org/show_bug.cgi?id=233271
+        <rdar://85259288>
+
+        Reviewed by Yusuke Suzuki.
+
+        We have a fast path for running memmove when both the thing being
+        copied from and the thing being copied to have the same typed array
+        type. However, when copying from a Uint8Array into a Uint8ClampedArray,
+        or vice versa, we were going down the slow path. In this case,
+        we can still take the fast path, since we're guaranteed that storing
+        into a Uint8ClampedArray from a Uint8Array will never actually need
+        to clamp values. And when storing from a Uint8ClampedArray into a
+        Uint8Array, the values can trivially be copied over.
+
+        This patch is a 100x speedup on the attached microbenchmark.
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+
 2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

@@ -256 +256 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    const ClassInfo* ci = object->classInfo(vm);
-    if (ci->typedArrayStorageType == Adaptor::typeValue) {
-        // The super fast case: we can just memmove since we're the same type.
-        JSGenericTypedArrayView* other = jsCast<JSGenericTypedArrayView*>(object);
+    auto memmoveFastPath = [&] (auto* other) {
+        // The super fast case: we can just memmove since we're the same underlying storage type.
         length = std::min(length, other->length());
         
@@ -268 +266 @@
             return false;
 
+        RELEASE_ASSERT((std::is_same_v<decltype(typedVector()), decltype(other->typedVector())>));
         memmove(typedVector() + offset, other->typedVector() + objectOffset, length * elementSize);
         return true;
+    };
+
+    const ClassInfo* ci = object->classInfo(vm);
+    if (ci->typedArrayStorageType == Adaptor::typeValue)
+        return memmoveFastPath(jsCast<JSGenericTypedArrayView*>(object));
+
+    auto isSomeUint8 = [] (TypedArrayType type) {
+        return type == TypedArrayType::TypeUint8 || type == TypedArrayType::TypeUint8Clamped;
+    };
+    if (isSomeUint8(ci->typedArrayStorageType) && isSomeUint8(Adaptor::typeValue)) {
+        if (ci->typedArrayStorageType == TypedArrayType::TypeUint8)
+            return memmoveFastPath(jsCast<JSGenericTypedArrayView<Uint8Adaptor>*>(object));
+        return memmoveFastPath(jsCast<JSGenericTypedArrayView<Uint8ClampedAdaptor>*>(object));
     }