Changeset 128146 in webkit
- Timestamp:
- Sep 10, 2012 10:05:53 PM (12 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 12 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r128141 r128146 1 2012-09-10 Mark Hahnenberg <mhahnenberg@apple.com> 2 3 Remove m_classInfo from JSCell 4 https://bugs.webkit.org/show_bug.cgi?id=96311 5 6 Reviewed by Oliver Hunt. 7 8 Now that no one is using the ClassInfo in JSCell, we can remove it for the greater good. This is a 1.5% win on v8v7 and 9 a 1.7% win on kraken, and is an overall performance progression. 10 11 * dfg/DFGSpeculativeJIT.h: 12 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Had to rearrange the order of when we take things off the free list 13 and when we store the Structure in the object because we would clobber the free list otherwise. This made it not okay for 14 the structure argument and the scratch register to alias one another. Also removed the store of the ClassInfo pointer in the 15 object. Yay! 16 (SpeculativeJIT): 17 * dfg/DFGSpeculativeJIT32_64.cpp: Since it's no longer okay for for the scratch register and structure register to alias 18 one another as stated above, had to add an extra temporary for passing the Structure. 19 (JSC::DFG::SpeculativeJIT::compile): 20 * dfg/DFGSpeculativeJIT64.cpp: Ditto. 21 (JSC::DFG::SpeculativeJIT::compile): 22 * jit/JITInlineMethods.h: 23 (JSC::JIT::emitAllocateBasicJSObject): Similar changes to DFG's inline allocation except that it removed the object from 24 the free list first, so no changes were necessary there. 25 * llint/LowLevelInterpreter.asm: Change the constants for amount of inline storage to match PropertyOffset.h and remove 26 the store of the ClassInfo pointer during inline allocation. 27 * llint/LowLevelInterpreter32_64.asm: 28 * llint/LowLevelInterpreter64.asm: 29 * runtime/JSCell.h: Remove the m_classInfo field and associated methods. 30 (JSCell): 31 * runtime/JSObject.h: 32 (JSObject): 33 * runtime/PropertyOffset.h: Expand the number of inline storage properties to take up the extra space that we're freeing 34 with the removal of the ClassInfo pointer. 35 (JSC): 36 * runtime/Structure.h: 37 (JSC): 38 (JSC::JSCell::JSCell): 39 (JSC::JSCell::finishCreation): 40 1 41 2012-09-10 Geoffrey Garen <ggaren@apple.com> 2 42 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
r128096 r128146 2162 2162 void compileNewFunctionExpression(Node&); 2163 2163 bool compileRegExpExec(Node&); 2164 2164 2165 // It is NOT okay for the structure and the scratch register to be the same thing because if they are then the Structure will 2166 // get clobbered. 2165 2167 template <typename ClassType, bool destructor, typename StructureType> 2166 2168 void emitAllocateBasicJSObject(StructureType structure, GPRReg resultGPR, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath) … … 2177 2179 // The object is half-allocated: we have what we know is a fresh object, but 2178 2180 // it's still on the GC's free list. 2179 2180 // Ditch the structure by placing it into the structure slot, so that we can reuse2181 // scratchGPR.2182 m_jit.storePtr(structure, MacroAssembler::Address(resultGPR, JSObject::structureOffset()));2183 2184 // Now that we have scratchGPR back, remove the object from the free list2185 2181 m_jit.loadPtr(MacroAssembler::Address(resultGPR), scratchGPR); 2186 2182 m_jit.storePtr(scratchGPR, &allocator->m_freeList.head); 2187 2188 // Initialize the object's classInfo pointer2189 m_jit.storePtr( MacroAssembler::TrustedImmPtr(&ClassType::s_info), MacroAssembler::Address(resultGPR, JSCell::classInfoOffset()));2183 2184 // Initialize the object's Structure. 2185 m_jit.storePtr(structure, MacroAssembler::Address(resultGPR, JSCell::structureOffset())); 2190 2186 2191 2187 // Initialize the object's property storage pointer. … … 2193 2189 } 2194 2190 2195 // It is acceptable to have structure be equal to scratch, so long as you're fine2196 // with the structure GPR being clobbered.2197 2191 template<typename T> 2198 2192 void emitAllocateJSFinalObject(T structure, GPRReg resultGPR, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath) -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
r128096 r128146 3297 3297 SpeculateCellOperand callee(this, node.child1()); 3298 3298 GPRTemporary result(this); 3299 GPRTemporary structure(this); 3299 3300 GPRTemporary scratch(this); 3300 3301 3301 3302 GPRReg calleeGPR = callee.gpr(); 3302 3303 GPRReg resultGPR = result.gpr(); 3304 GPRReg structureGPR = structure.gpr(); 3303 3305 GPRReg scratchGPR = scratch.gpr(); 3304 3306 3305 3307 // Load the inheritorID. If the inheritorID is not set, go to slow path. 3306 m_jit.loadPtr(MacroAssembler::Address(calleeGPR, JSFunction::offsetOfCachedInheritorID()), s cratchGPR);3308 m_jit.loadPtr(MacroAssembler::Address(calleeGPR, JSFunction::offsetOfCachedInheritorID()), structureGPR); 3307 3309 MacroAssembler::JumpList slowPath; 3308 slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, s cratchGPR));3309 3310 emitAllocateJSFinalObject(s cratchGPR, resultGPR, scratchGPR, slowPath);3310 slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, structureGPR)); 3311 3312 emitAllocateJSFinalObject(structureGPR, resultGPR, scratchGPR, slowPath); 3311 3313 3312 3314 addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR)); -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
r128096 r128146 3290 3290 SpeculateCellOperand callee(this, node.child1()); 3291 3291 GPRTemporary result(this); 3292 GPRTemporary structure(this); 3292 3293 GPRTemporary scratch(this); 3293 3294 3294 3295 GPRReg calleeGPR = callee.gpr(); 3295 3296 GPRReg resultGPR = result.gpr(); 3297 GPRReg structureGPR = structure.gpr(); 3296 3298 GPRReg scratchGPR = scratch.gpr(); 3297 3299 3298 3300 // Load the inheritorID. If the inheritorID is not set, go to slow path. 3299 m_jit.loadPtr(MacroAssembler::Address(calleeGPR, JSFunction::offsetOfCachedInheritorID()), s cratchGPR);3301 m_jit.loadPtr(MacroAssembler::Address(calleeGPR, JSFunction::offsetOfCachedInheritorID()), structureGPR); 3300 3302 MacroAssembler::JumpList slowPath; 3301 slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, s cratchGPR));3302 3303 emitAllocateJSFinalObject(s cratchGPR, resultGPR, scratchGPR, slowPath);3303 slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, structureGPR)); 3304 3305 emitAllocateJSFinalObject(structureGPR, resultGPR, scratchGPR, slowPath); 3304 3306 3305 3307 addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR)); -
trunk/Source/JavaScriptCore/jit/JITInlineMethods.h
r124476 r128146 423 423 storePtr(structure, Address(result, JSCell::structureOffset())); 424 424 425 // initialize the object's classInfo pointer426 storePtr(TrustedImmPtr(&ClassType::s_info), Address(result, JSCell::classInfoOffset()));427 428 425 // initialize the object's property storage pointer 429 426 storePtr(TrustedImmPtr(0), Address(result, ClassType::offsetOfOutOfLineStorage())); -
trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
r128015 r128146 87 87 # Property storage constants 88 88 if JSVALUE64 89 const InlineStorageCapacity = 589 const InlineStorageCapacity = 6 90 90 else 91 const InlineStorageCapacity = 691 const InlineStorageCapacity = 7 92 92 end 93 93 … … 311 311 end 312 312 313 macro allocateBasicJSObject(sizeClassIndex, classInfoOffset,structure, result, scratch1, scratch2, slowCase)313 macro allocateBasicJSObject(sizeClassIndex, structure, result, scratch1, scratch2, slowCase) 314 314 if ALWAYS_ALLOCATE_SLOW 315 315 jmp slowCase … … 339 339 340 340 # Initialize the object. 341 loadp classInfoOffset[scratch1], scratch2342 storep scratch2, [result]343 341 storep structure, JSCell::m_structure[result] 344 342 storep 0, JSObject::m_outOfLineStorage[result] -
trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
r128096 r128146 353 353 loadp JSFunction::m_cachedInheritorID[t0], t2 354 354 btpz t2, .opCreateThisSlow 355 allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo,t2, t0, t1, t3, .opCreateThisSlow)355 allocateBasicJSObject(JSFinalObjectSizeClassIndex, t2, t0, t1, t3, .opCreateThisSlow) 356 356 loadi 4[PC], t1 357 357 storei CellTag, TagOffset[cfr, t1, 8] … … 385 385 loadp CodeBlock::m_globalObject[t0], t0 386 386 loadp JSGlobalObject::m_emptyObjectStructure[t0], t1 387 allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo,t1, t0, t2, t3, .opNewObjectSlow)387 allocateBasicJSObject(JSFinalObjectSizeClassIndex, t1, t0, t2, t3, .opNewObjectSlow) 388 388 loadi 4[PC], t1 389 389 storei CellTag, TagOffset[cfr, t1, 8] -
trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
r128096 r128146 237 237 loadp JSFunction::m_cachedInheritorID[t0], t2 238 238 btpz t2, .opCreateThisSlow 239 allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo,t2, t0, t1, t3, .opCreateThisSlow)239 allocateBasicJSObject(JSFinalObjectSizeClassIndex, t2, t0, t1, t3, .opCreateThisSlow) 240 240 loadis 8[PB, PC, 8], t1 241 241 storep t0, [cfr, t1, 8] … … 268 268 loadp CodeBlock::m_globalObject[t0], t0 269 269 loadp JSGlobalObject::m_emptyObjectStructure[t0], t1 270 allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo,t1, t0, t2, t3, .opNewObjectSlow)270 allocateBasicJSObject(JSFinalObjectSizeClassIndex, t1, t0, t2, t3, .opNewObjectSlow) 271 271 loadis 8[PB, PC, 8], t1 272 272 storep t0, [cfr, t1, 8] -
trunk/Source/JavaScriptCore/runtime/JSCell.h
r128084 r128146 110 110 // Object operations, with the toObject operation included. 111 111 const ClassInfo* classInfo() const; 112 const ClassInfo* validatedClassInfo() const;113 112 const MethodTable* methodTable() const; 114 113 static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&); … … 135 134 } 136 135 137 static ptrdiff_t classInfoOffset()138 {139 return OBJECT_OFFSETOF(JSCell, m_classInfo);140 }141 142 136 void* structureAddress() 143 137 { … … 172 166 friend class LLIntOffsetsExtractor; 173 167 174 const ClassInfo* m_classInfo;175 168 WriteBarrier<Structure> m_structure; 176 169 }; -
trunk/Source/JavaScriptCore/runtime/JSObject.h
r127202 r128146 347 347 348 348 StorageBarrier m_outOfLineStorage; 349 #if USE(JSVALUE32_64)350 void* m_padding;351 #endif352 349 }; 353 350 -
trunk/Source/JavaScriptCore/runtime/PropertyOffset.h
r123905 r128146 35 35 36 36 #if USE(JSVALUE32_64) 37 #define INLINE_STORAGE_CAPACITY 7 38 #else 37 39 #define INLINE_STORAGE_CAPACITY 6 38 #else39 #define INLINE_STORAGE_CAPACITY 540 40 #endif 41 41 -
trunk/Source/JavaScriptCore/runtime/Structure.h
r128141 r128146 555 555 } 556 556 557 inline const ClassInfo* JSCell::validatedClassInfo() const558 {559 #if ENABLE(GC_VALIDATION)560 ASSERT(m_structure.unvalidatedGet()->classInfo() == m_classInfo);561 #else562 ASSERT(m_structure->classInfo() == m_classInfo);563 #endif564 return m_classInfo;565 }566 567 557 ALWAYS_INLINE void SlotVisitor::internalAppend(JSCell* cell) 568 558 { … … 604 594 605 595 inline JSCell::JSCell(JSGlobalData& globalData, Structure* structure) 606 : m_classInfo(structure->classInfo()) 607 , m_structure(globalData, this, structure) 596 : m_structure(globalData, this, structure) 608 597 { 609 598 } … … 617 606 #endif 618 607 m_structure.setEarlyValue(globalData, this, structure); 619 m_classInfo = structure->classInfo();620 608 // Very first set of allocations won't have a real structure. 621 609 ASSERT(m_structure || !globalData.structureStructure);
Note: See TracChangeset
for help on using the changeset viewer.