Changeset 90601 in webkit

Timestamp:

Jul 7, 2011, 4:48:39 PM (15 years ago)

Author:

commit-queue@webkit.org

Message:

DFG JIT does not implement get_by_id prototype caching.
​https://bugs.webkit.org/show_bug.cgi?id=64077

Patch by Filip Pizlo <​fpizlo@apple.com> on 2011-07-07
Reviewed by Gavin Barraclough.

• dfg/DFGRepatch.cpp:

(JSC::DFG::emitRestoreScratch):
(JSC::DFG::linkRestoreScratch):
(JSC::DFG::tryCacheGetByID):

• runtime/JSObject.h:

(JSC::JSObject::addressOfPropertyAtOffset):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGRepatch.cpp (modified) (3 diffs)
• runtime/JSObject.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement get_by_id prototype caching.
+        https://bugs.webkit.org/show_bug.cgi?id=64077
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitRestoreScratch):
+        (JSC::DFG::linkRestoreScratch):
+        (JSC::DFG::tryCacheGetByID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::addressOfPropertyAtOffset):
+
 2011-07-07  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGRepatch.cpp

@@ -57 +57 @@
 }
 
+static void emitRestoreScratch(MacroAssembler& stubJit, bool needToRestoreScratch, GPRReg scratchGPR, MacroAssembler::Jump& success, MacroAssembler::Jump& fail, MacroAssembler::Jump failureCase1, MacroAssembler::Jump failureCase2)
+{
+    if (needToRestoreScratch) {
+        stubJit.pop(scratchGPR);
+        
+        success = stubJit.jump();
+        
+        // link failure cases here, so we can pop scratchGPR, and then jump back.
+        failureCase1.link(&stubJit);
+        failureCase2.link(&stubJit);
+        
+        stubJit.pop(scratchGPR);
+        
+        fail = stubJit.jump();
+        return;
+    }
+    
+    success = stubJit.jump();
+}
+
+static void linkRestoreScratch(LinkBuffer& patchBuffer, bool needToRestoreScratch, StructureStubInfo& stubInfo, MacroAssembler::Jump& success, MacroAssembler::Jump& fail, MacroAssembler::Jump failureCase1, MacroAssembler::Jump failureCase2)
+{
+    CodeLocationLabel slowCaseBegin = stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase);
+    
+    patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
+        
+    patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
+    
+    if (needToRestoreScratch) {
+        patchBuffer.link(fail, slowCaseBegin);
+        return;
+    }
+    
+    // link failure cases directly back to normal path
+    patchBuffer.link(failureCase1, slowCaseBegin);
+    patchBuffer.link(failureCase2, slowCaseBegin);
+}
+            
 static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot, StructureStubInfo& stubInfo)
 {
@@ -89 +127 @@
         MacroAssembler::Jump success, fail;
         
-        if (needToRestoreScratch) {
-            stubJit.pop(scratchGPR);
-            
-            success = stubJit.jump();
-            
-            // link failure cases here, so we can pop scratchGPR, and then jump back.
-            failureCase1.link(&stubJit);
-            failureCase2.link(&stubJit);
-            
-            stubJit.pop(scratchGPR);
-            
-            fail = stubJit.jump();
-        } else
-            success = stubJit.jump();
+        emitRestoreScratch(stubJit, needToRestoreScratch, scratchGPR, success, fail, failureCase1, failureCase2);
         
         LinkBuffer patchBuffer(*globalData, &stubJit, codeBlock->executablePool());
         
-        CodeLocationLabel slowCaseBegin = stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase);
-        
-        patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
-        
-        if (needToRestoreScratch)
-            patchBuffer.link(fail, slowCaseBegin);
-        else {
-            // link failure cases directly back to normal path
-            patchBuffer.link(failureCase1, slowCaseBegin);
-            patchBuffer.link(failureCase2, slowCaseBegin);
-        }
+        linkRestoreScratch(patchBuffer, needToRestoreScratch, stubInfo, success, fail, failureCase1, failureCase2);
         
         CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
@@ -151 +166 @@
     }
     
-    // FIXME: should support prototype & chain accesses!
+    if (structure->isDictionary())
+        return false;
+    
+    // Optimize accesses on the direct prototype
+    if (slot.slotBase() == structure->prototypeForLookup(exec)) {
+        if (slot.cachedPropertyType() != PropertySlot::Value)
+            return false;
+        
+        ASSERT(slot.slotBase().isObject());
+        
+        JSObject* slotBaseObject = asObject(slot.slotBase());
+        size_t offset = slot.cachedOffset();
+        
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject(*globalData);
+            offset = slotBaseObject->structure()->get(*globalData, propertyName);
+        }
+        
+        ASSERT(!structure->isDictionary());
+        ASSERT(!slotBaseObject->structure()->isDictionary());
+        
+        ASSERT(asObject(structure->prototypeForLookup(exec)) == slotBaseObject);
+        
+        GPRReg baseGPR = static_cast<GPRReg>(stubInfo.baseGPR);
+        GPRReg resultGPR = static_cast<GPRReg>(stubInfo.valueGPR);
+        GPRReg scratchGPR = static_cast<GPRReg>(stubInfo.u.unset.scratchGPR);
+        bool needToRestoreScratch = false;
+        
+        MacroAssembler stubJit;
+        
+        if (scratchGPR == InvalidGPRReg) {
+            scratchGPR = JITCodeGenerator::selectScratchGPR(baseGPR, resultGPR);
+            stubJit.push(scratchGPR);
+            needToRestoreScratch = true;
+        }
+        
+        MacroAssembler::Jump failureCase1 = stubJit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(structure));
+        
+        stubJit.move(MacroAssembler::TrustedImmPtr(slotBaseObject), scratchGPR);
+        MacroAssembler::Jump failureCase2 = stubJit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(scratchGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(slotBaseObject->structure()));
+        
+        if (slotBaseObject->structure()->isUsingInlineStorage())
+            stubJit.loadPtr(MacroAssembler::Address(scratchGPR, JSObject::offsetOfInlineStorage() + offset * sizeof(JSValue)), resultGPR);
+        else
+            stubJit.loadPtr(slotBaseObject->addressOfPropertyAtOffset(offset), resultGPR);
+        
+        MacroAssembler::Jump success, fail;
+        
+        emitRestoreScratch(stubJit, needToRestoreScratch, scratchGPR, success, fail, failureCase1, failureCase2);
+        
+        LinkBuffer patchBuffer(*globalData, &stubJit, codeBlock->executablePool());
+        
+        linkRestoreScratch(patchBuffer, needToRestoreScratch, stubInfo, success, fail, failureCase1, failureCase2);
+        
+        CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+        stubInfo.stubRoutine = entryLabel;
+        
+        CodeLocationLabel hotPathBegin = stubInfo.hotPathBegin;
+        RepatchBuffer repatchBuffer(codeBlock);
+        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), entryLabel);
+        repatchBuffer.relink(stubInfo.callReturnLocation, operationGetById);
+        
+        stubInfo.initGetByIdProto(*globalData, codeBlock->ownerExecutable(), structure, slotBaseObject->structure());
+        return true;
+    }
+    
+    // FIXME: should support chain accesses!
     return false;
 }

trunk/Source/JavaScriptCore/runtime/JSObject.h

@@ -220 +220 @@
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
         bool isUsingInlineStorage() const { return static_cast<const void*>(m_propertyStorage) == static_cast<const void*>(this + 1); }
+        
+        void* addressOfPropertyAtOffset(size_t offset)
+        {
+            return static_cast<void*>(&m_propertyStorage[offset]);
+        }
 
         static const unsigned baseExternalStorageCapacity = 16;