Changeset 293746 in webkit

Timestamp:

May 3, 2022, 4:27:42 PM (4 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Extend Structure heap size from 1GB to 4GB
​https://bugs.webkit.org/show_bug.cgi?id=240028

Reviewed by Saam Barati.

1GB was much smaller compared to StructureIDTable (which allowed 7GB).
This patch extends 1GB to 4GB, that's maximum limit of the current encoding scheme (we can
extend it further to 64GB if we introduce shift based on alignment, but currently not used).
We use this 4GB on platforms which has enough virtual address space.

• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• Source/JavaScriptCore/jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitNonNullDecodeStructureID):

• Source/JavaScriptCore/runtime/JSCConfig.h:

Canonical link: ​https://commits.webkit.org/250234@main

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)
• ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)
• jit/AssemblyHelpers.cpp (modified) (3 diffs)
• jit/AssemblyHelpers.h (modified) (1 diff)
• runtime/JSCConfig.h (modified) (1 diff)
• tools/IntegrityInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2022-05-03  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Extend Structure heap size from 1GB to 4GB
+        https://bugs.webkit.org/show_bug.cgi?id=240028
+
+        Reviewed by Saam Barati.
+
+        1GB was much smaller compared to StructureIDTable (which allowed 7GB).
+        This patch extends 1GB to 4GB, that's maximum limit of the current encoding scheme (we can
+        extend it further to 64GB if we introduce shift based on alignment, but currently not used).
+        We use this 4GB on platforms which has enough virtual address space.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitNonNullDecodeStructureID):
+        * runtime/JSCConfig.h:
+
 2022-05-03  Philippe Normand  <pnormand@igalia.com> and Pavel Feldman <pavel.feldman@gmail.com> and Yury Semikhatsky <yurys@chromium.org>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -14861 +14861 @@
     m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID() - JSFunction::rareDataTag), structureGPR);
     slowCases.append(m_jit.branchTest32(CCallHelpers::Zero, structureGPR));
-    m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
+    m_jit.emitNonNullDecodeZeroExtendedStructureID(structureGPR, structureGPR);
     m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);
     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
@@ -14910 +14910 @@
     m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID() - JSFunction::rareDataTag), structureGPR);
     slowCases.append(m_jit.branchTest32(CCallHelpers::Zero, structureGPR));
-    m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
+    m_jit.emitNonNullDecodeZeroExtendedStructureID(structureGPR, structureGPR);
     m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);
     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -21018 +21018 @@
         return m_out.shl(m_out.zeroExtPtr(structureID), m_out.constIntPtr(StructureID::encodeShiftAmount));
 #else
-        LValue maskedStructureID = m_out.bitAnd(structureID, m_out.constInt32(StructureID::structureIDMask));
+        LValue maskedStructureID = structureID;
+        if constexpr (structureHeapAddressSize < 4 * GB)
+            maskedStructureID = m_out.bitAnd(structureID, m_out.constInt32(StructureID::structureIDMask));
         return m_out.add(m_out.constIntPtr(g_jscConfig.startOfStructureHeap), m_out.zeroExtPtr(maskedStructureID));
 #endif

trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

@@ -404 +404 @@
 }
 
-void AssemblyHelpers::emitNonNullDecodeStructureID(RegisterID source, RegisterID dest)
+void AssemblyHelpers::emitNonNullDecodeZeroExtendedStructureID(RegisterID source, RegisterID dest)
 {
 #if ENABLE(STRUCTURE_ID_WITH_SHIFT)
@@ -410 +410 @@
 #elif CPU(ADDRESS64)
     // This could use BFI on arm64 but that only helps if the start of structure heap is encodable as a mov and not as an immediate in the add so it's probably not super important.
-    and32(TrustedImm32(StructureID::structureIDMask), source, dest);
-    add64(TrustedImm64(g_jscConfig.startOfStructureHeap), dest);
+    if constexpr (structureHeapAddressSize >= 4 * GB) {
+        ASSERT(structureHeapAddressSize == 4 * GB);
+        move(source, dest);
+        add64(TrustedImm64(g_jscConfig.startOfStructureHeap), dest);
+    } else {
+        and32(TrustedImm32(StructureID::structureIDMask), source, dest);
+        add64(TrustedImm64(g_jscConfig.startOfStructureHeap), dest);
+    }
 #else // not CPU(ADDRESS64)
     move(source, dest);
@@ -420 +426 @@
 {
     load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
-    emitNonNullDecodeStructureID(dest, dest);
+    emitNonNullDecodeZeroExtendedStructureID(dest, dest);
 }
 

trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

@@ -1611 +1611 @@
     }
     
-    void emitNonNullDecodeStructureID(RegisterID source, RegisterID dest);
+    void emitNonNullDecodeZeroExtendedStructureID(RegisterID source, RegisterID dest);
     void emitLoadStructure(VM&, RegisterID source, RegisterID dest);
     void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, JumpList& slowPath);

trunk/Source/JavaScriptCore/runtime/JSCConfig.h

@@ -47 +47 @@
 constexpr uintptr_t structureHeapAddressSize = 512 * MB;
 #else
-constexpr uintptr_t structureHeapAddressSize = 1 * GB;
+constexpr uintptr_t structureHeapAddressSize = 4 * GB;
 #endif
 

trunk/Source/JavaScriptCore/tools/IntegrityInlines.h

@@ -79 +79 @@
     UNUSED_PARAM(structureID);
 #if CPU(ADDRESS64) && !ENABLE(STRUCTURE_ID_WITH_SHIFT)
-    ASSERT(structureID.bits() <= structureHeapAddressSize + StructureID::nukedStructureIDBit);
+    ASSERT(static_cast<uintptr_t>(structureID.bits()) <= structureHeapAddressSize + StructureID::nukedStructureIDBit);
 #endif
 }