Changeset 277758 in webkit


Ignore:
Timestamp:
May 19, 2021, 3:30:16 PM (4 years ago)
Author:
mark.lam@apple.com
Message:

Ripping out broken Baseline JIT rare case profiling.
​https://bugs.webkit.org/show_bug.cgi?id=225983

Reviewed by Saam Barati and Robin Morisset.

The profiling has been broken in recent times. Fixing it to work does not appear
to improve performance. Ripping out the profiling appears to not hurt performance.
However, ripping out the profiling appears to save on code size generated for the
Baseline JIT.

Base New Diff

BaselineJIT: 73299112 (69.903481 MB) 65910128 (62.856796 MB) 0.90x (reduction)

DFG: 36850540 (35.143414 MB) 36374400 (34.689331 MB) 0.99x

Thunk: 23128652 (22.057201 MB) 22892292 (21.831791 MB) 0.99x

InlineCache: 22210972 (21.182034 MB) 22083508 (21.060474 MB) 0.99x

FTL: 6065064 (5.784096 MB) 6128080 (5.844193 MB) 1.01x

Wasm: 2305124 (2.198338 MB) 2309732 (2.202732 MB) 1.00x

YarrJIT: 1522712 (1.452171 MB) 1536104 (1.464943 MB) 1.01x

CSSJIT: 0 0

Uncategorized: 0 0

Cumulative diff since the start of this effort to put more code in JIT thunks:

Base New Diff

BaselineJIT: 89089964 (84.962811 MB) 65910128 (62.856796 MB) 0.74x (reduction)

DFG: 39117360 (37.305222 MB) 36374400 (34.689331 MB) 0.93x (reduction)

Thunk: 23230968 (22.154778 MB) 22892292 (21.831791 MB) 0.99x

InlineCache: 22027416 (21.006981 MB) 22083508 (21.060474 MB) 1.00x

FTL: 6575772 (6.271145 MB) 6128080 (5.844193 MB) 0.93x (reduction)

Wasm: 2302724 (2.196049 MB) 2309732 (2.202732 MB) 1.00x

YarrJIT: 1538956 (1.467663 MB) 1536104 (1.464943 MB) 1.00x

CSSJIT: 0 0

Uncategorized: 0 0

Benchmarking was done with Speedometer2 and JetSteam2 on an M1 Mac.

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::JITData::size const):
(JSC::CodeBlock::dumpValueProfiles):
(JSC::CodeBlock::setRareCaseProfiles): Deleted.
(JSC::CodeBlock::rareCaseProfileForBytecodeIndex): Deleted.
(JSC::CodeBlock::rareCaseProfileCountForBytecodeIndex): Deleted.

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
(JSC::CodeBlock::couldTakeSlowCase): Deleted.

  • bytecode/ValueProfile.h:

(JSC::RareCaseProfile::RareCaseProfile): Deleted.
(JSC::getRareCaseProfileBytecodeIndex): Deleted.

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):
(JSC::DFG::ByteCodeParser::parseBlock):

  • jit/JIT.cpp:

(JSC::JIT::privateCompileSlowCases):

Location:
trunk/Source/JavaScriptCore
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r277757 r277758  
     12021-05-19  Mark Lam  <mark.lam@apple.com>
     2
     3        Ripping out broken Baseline JIT rare case profiling.
     4        https://bugs.webkit.org/show_bug.cgi?id=225983
     5
     6        Reviewed by Saam Barati and Robin Morisset.
     7
     8        The profiling has been broken in recent times.  Fixing it to work does not appear
     9        to improve performance.  Ripping out the profiling appears to not hurt performance.
     10        However, ripping out the profiling appears to save on code size generated for the
     11        Baseline JIT.
     12
     13                        Base                     New                      Diff
     14
     15           BaselineJIT: 73299112 (69.903481 MB)  65910128 (62.856796 MB)  0.90x (reduction)
     16                   DFG: 36850540 (35.143414 MB)  36374400 (34.689331 MB)  0.99x
     17                 Thunk: 23128652 (22.057201 MB)  22892292 (21.831791 MB)  0.99x
     18           InlineCache: 22210972 (21.182034 MB)  22083508 (21.060474 MB)  0.99x
     19                   FTL: 6065064 (5.784096 MB)    6128080 (5.844193 MB)    1.01x
     20                  Wasm: 2305124 (2.198338 MB)    2309732 (2.202732 MB)    1.00x
     21               YarrJIT: 1522712 (1.452171 MB)    1536104 (1.464943 MB)    1.01x
     22                CSSJIT: 0                        0
     23         Uncategorized: 0                        0
     24
     25        Cumulative diff since the start of this effort to put more code in JIT thunks:
     26
     27                        Base                     New                      Diff
     28
     29           BaselineJIT: 89089964 (84.962811 MB)  65910128 (62.856796 MB)  0.74x (reduction)
     30                   DFG: 39117360 (37.305222 MB)  36374400 (34.689331 MB)  0.93x (reduction)
     31                 Thunk: 23230968 (22.154778 MB)  22892292 (21.831791 MB)  0.99x
     32           InlineCache: 22027416 (21.006981 MB)  22083508 (21.060474 MB)  1.00x
     33                   FTL: 6575772 (6.271145 MB)    6128080 (5.844193 MB)    0.93x (reduction)
     34                  Wasm: 2302724 (2.196049 MB)    2309732 (2.202732 MB)    1.00x
     35               YarrJIT: 1538956 (1.467663 MB)    1536104 (1.464943 MB)    1.00x
     36                CSSJIT: 0                        0
     37         Uncategorized: 0                        0
     38
     39        Benchmarking was done with Speedometer2 and JetSteam2 on an M1 Mac.
     40
     41        * bytecode/CodeBlock.cpp:
     42        (JSC::CodeBlock::JITData::size const):
     43        (JSC::CodeBlock::dumpValueProfiles):
     44        (JSC::CodeBlock::setRareCaseProfiles): Deleted.
     45        (JSC::CodeBlock::rareCaseProfileForBytecodeIndex): Deleted.
     46        (JSC::CodeBlock::rareCaseProfileCountForBytecodeIndex): Deleted.
     47        * bytecode/CodeBlock.h:
     48        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
     49        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
     50        * bytecode/ValueProfile.h:
     51        (JSC::RareCaseProfile::RareCaseProfile): Deleted.
     52        (JSC::getRareCaseProfileBytecodeIndex): Deleted.
     53        * dfg/DFGByteCodeParser.cpp:
     54        (JSC::DFG::ByteCodeParser::makeSafe):
     55        (JSC::DFG::ByteCodeParser::parseBlock):
     56        * jit/JIT.cpp:
     57        (JSC::JIT::privateCompileSlowCases):
     58
    1592021-05-19  Yusuke Suzuki  <ysuzuki@apple.com>
    260

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r277727 r277758  
    10411041    size += m_byValInfos.estimatedAllocationSizeInBytes();
    10421042    size += m_callLinkInfos.estimatedAllocationSizeInBytes();
    1043     size += m_rareCaseProfiles.size() * sizeof(decltype(*m_rareCaseProfiles.data()));
    10441043    size += m_switchJumpTables.size() * sizeof(decltype(*m_switchJumpTables.data()));
    10451044    size += m_stringSwitchJumpTables.size() * sizeof(decltype(*m_stringSwitchJumpTables.data()));
    … …  
    17631762    }
    17641763    return nullptr;
    1765 }
    1766 
    1767 void CodeBlock::setRareCaseProfiles(FixedVector<RareCaseProfile>&& rareCaseProfiles)
    1768 {
    1769     ConcurrentJSLocker locker(m_lock);
    1770     ensureJITData(locker).m_rareCaseProfiles = WTFMove(rareCaseProfiles);
    1771 }
    1772 
    1773 RareCaseProfile* CodeBlock::rareCaseProfileForBytecodeIndex(const ConcurrentJSLocker&, BytecodeIndex bytecodeIndex)
    1774 {
    1775     if (auto* jitData = m_jitData.get()) {
    1776         return tryBinarySearch<RareCaseProfile, BytecodeIndex>(
    1777             jitData->m_rareCaseProfiles, jitData->m_rareCaseProfiles.size(), bytecodeIndex,
    1778             getRareCaseProfileBytecodeIndex);
    1779     }
    1780     return nullptr;
    1781 }
    1782 
    1783 unsigned CodeBlock::rareCaseProfileCountForBytecodeIndex(const ConcurrentJSLocker& locker, BytecodeIndex bytecodeIndex)
    1784 {
    1785     RareCaseProfile* profile = rareCaseProfileForBytecodeIndex(locker, bytecodeIndex);
    1786     if (profile)
    1787         return profile->m_counter;
    1788     return 0;
    17891764}
    17901765
    … …  
    31383113        dataLogF("\n");
    31393114    });
    3140     dataLog("RareCaseProfile for ", *this, ":\n");
    3141     if (auto* jitData = m_jitData.get()) {
    3142         for (RareCaseProfile* profile : jitData->m_rareCaseProfiles)
    3143             dataLogF("   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
    3144     }
    31453115}
    31463116#endif // ENABLE(VERBOSE_VALUE_PROFILE)

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r277727 r277758  
    282282        SentinelLinkedList<CallLinkInfo, PackedRawSentinelNode<CallLinkInfo>> m_incomingCalls;
    283283        SentinelLinkedList<PolymorphicCallNode, PackedRawSentinelNode<PolymorphicCallNode>> m_incomingPolymorphicCalls;
    284         FixedVector<RareCaseProfile> m_rareCaseProfiles;
    285284        FixedVector<SimpleJumpTable> m_switchJumpTables;
    286285        FixedVector<StringJumpTable> m_stringSwitchJumpTables;
    … …  
    348347    void setCalleeSaveRegisters(RegisterSet);
    349348    void setCalleeSaveRegisters(RegisterAtOffsetList&&);
    350 
    351     void setRareCaseProfiles(FixedVector<RareCaseProfile>&&);
    352     RareCaseProfile* rareCaseProfileForBytecodeIndex(const ConcurrentJSLocker&, BytecodeIndex);
    353     unsigned rareCaseProfileCountForBytecodeIndex(const ConcurrentJSLocker&, BytecodeIndex);
    354 
    355     bool likelyToTakeSlowCase(BytecodeIndex bytecodeIndex)
    356     {
    357         if (!hasBaselineJITProfiling())
    358             return false;
    359         ConcurrentJSLocker locker(m_lock);
    360         unsigned value = rareCaseProfileCountForBytecodeIndex(locker, bytecodeIndex);
    361         return value >= Options::likelyToTakeSlowCaseMinimumCount();
    362     }
    363 
    364     bool couldTakeSlowCase(BytecodeIndex bytecodeIndex)
    365     {
    366         if (!hasBaselineJITProfiling())
    367             return false;
    368         ConcurrentJSLocker locker(m_lock);
    369         unsigned value = rareCaseProfileCountForBytecodeIndex(locker, bytecodeIndex);
    370         return value >= Options::couldTakeSlowCaseMinimumCount();
    371     }
    372349
    373350    // We call this when we want to reattempt compiling something with the baseline JIT. Ideally

  • trunk/Source/JavaScriptCore/bytecode/ValueProfile.h

    r276102 r277758  
    11/*
    2  * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    159159};
    160160
    161 // This is a mini value profile to catch pathologies. It is a counter that gets
    162 // incremented when we take the slow path on any instruction.
    163 struct RareCaseProfile {
    164     RareCaseProfile(BytecodeIndex bytecodeIndex)
    165         : m_bytecodeIndex(bytecodeIndex)
    166     {
    167     }
    168     RareCaseProfile() = default;
    169    
    170     BytecodeIndex m_bytecodeIndex { };
    171     uint32_t m_counter { 0 };
    172 };
    173 
    174 inline BytecodeIndex getRareCaseProfileBytecodeIndex(RareCaseProfile* rareCaseProfile)
    175 {
    176     return rareCaseProfile->m_bytecodeIndex;
    177 }
    178 
    179161struct ValueProfileAndVirtualRegister : public ValueProfile {
    180162    VirtualRegister m_operand;

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r277117 r277758  
    10661066        default:
    10671067            break;
    1068         }
    1069        
    1070         if (m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)) {
    1071             switch (node->op()) {
    1072             case UInt32ToNumber:
    1073             case ArithAdd:
    1074             case ArithSub:
    1075             case ValueAdd:
    1076             case ValueMod:
    1077             case ArithMod: // for ArithMod "MayOverflow" means we tried to divide by zero, or we saw double.
    1078                 node->mergeFlags(NodeMayOverflowInt32InBaseline);
    1079                 break;
    1080                
    1081             default:
    1082                 break;
    1083             }
    10841068        }
    10851069       
    … …  
    54365420                || !cachedStructure
    54375421                || cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis
    5438                 || m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
    54395422                || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)
    54405423                || (op1->op() == GetLocal && op1->variableAccessData()->structureCheckHoistingFailed())) {

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r277757 r277758  
    516516    m_callLinkInfoIndex = 0;
    517517
    518     FixedVector<RareCaseProfile> rareCaseProfiles;
    519     if (shouldEmitProfiling())
    520         rareCaseProfiles = FixedVector<RareCaseProfile>(m_bytecodeCountHavingSlowCase);
    521    
    522518    unsigned bytecodeCountHavingSlowCase = 0;
    523519    for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
    … …  
    530526        const Instruction* currentInstruction = m_codeBlock->instructions().at(m_bytecodeIndex).ptr();
    531527       
    532         RareCaseProfile* rareCaseProfile = nullptr;
    533         if (shouldEmitProfiling())
    534             rareCaseProfile = &rareCaseProfiles.at(bytecodeCountHavingSlowCase);
    535 
    536528        if (JITInternal::verbose)
    537529            dataLogLn("Baseline JIT emitting slow code for ", m_bytecodeIndex, " at offset ", (long)debugOffset());
    … …  
    648640        RELEASE_ASSERT_WITH_MESSAGE(firstTo.offset() == (iter - 1)->to.offset(), "Too many jumps linked in slow case codegen.");
    649641       
    650         if (shouldEmitProfiling())
    651             add32(TrustedImm32(1), AbsoluteAddress(&rareCaseProfile->m_counter));
    652 
    653642        emitJumpSlowToHot(jump(), 0);
    654643        ++bytecodeCountHavingSlowCase;
    … …  
    663652    RELEASE_ASSERT(m_privateBrandAccessIndex == m_privateBrandAccesses.size());
    664653    RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
    665 
    666     if (shouldEmitProfiling())
    667         m_codeBlock->setRareCaseProfiles(WTFMove(rareCaseProfiles));
    668654
    669655#ifndef NDEBUG
Note: See TracChangeset for help on using the changeset viewer.