Changeset 207166 in webkit


Ignore:
Timestamp:
Oct 11, 2016 2:33:11 PM (8 years ago)
Author:
Yusuke Suzuki
Message:

[DOMJIT] DOMJIT::Patchpoint should have a way to receive constant folded arguments
​https://bugs.webkit.org/show_bug.cgi?id=163224

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

We use the GetGlobalObject DFG node to retrieve a global object from a DOM node.
This global object is necessary to check whether the world is normal before entering
the fast path of looking up the DOM wrapper cache.
We can sometimes constant-fold this GetGlobalObject. For example, if we performed
CheckStructure, the structure can offer the information about the possible result
of GetGlobalObject. By using this constant-folded global object, we can drop some
checks.

This patch introduces the way to tell the constant-folded values to DOMJIT::Patchpoint.
We pass DOMJIT::Value instead of DOMJIT::Reg as a parameter of DOMJIT::PatchpointParams.
This DOMJIT::Value is a pair of DOMJIT::Reg and JSValue. If the given parameter has a
constant value, this JSValue is filled with it.

  • JavaScriptCore.xcodeproj/project.pbxproj:
  • dfg/DFGDOMJITPatchpointParams.h:

(JSC::DFG::DOMJITPatchpointParams::DOMJITPatchpointParams):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOM):
(JSC::DFG::SpeculativeJIT::compileCheckDOM):

  • domjit/DOMJITPatchpointParams.h:

(JSC::DOMJIT::PatchpointParams::at):
(JSC::DOMJIT::PatchpointParams::operator[]):
(JSC::DOMJIT::PatchpointParams::PatchpointParams):

  • domjit/DOMJITValue.h: Copied from Source/JavaScriptCore/dfg/DFGDOMJITPatchpointParams.h.

(JSC::DOMJIT::Value::Value):
(JSC::DOMJIT::Value::isGPR):
(JSC::DOMJIT::Value::isFPR):
(JSC::DOMJIT::Value::isJSValueRegs):
(JSC::DOMJIT::Value::gpr):
(JSC::DOMJIT::Value::fpr):
(JSC::DOMJIT::Value::jsValueRegs):
(JSC::DOMJIT::Value::reg):
(JSC::DOMJIT::Value::value):

  • ftl/FTLDOMJITPatchpointParams.h:

(JSC::FTL::DOMJITPatchpointParams::DOMJITPatchpointParams):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
(JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):

Source/WebCore:

  • domjit/DOMJITHelpers.h:

(WebCore::DOMJITHelpers::toWrapper):

  • domjit/JSNodeDOMJIT.cpp:

(WebCore::createCallDOMForOffsetAccess):

Location:
trunk/Source
Files:
10 edited
1 copied

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r207164 r207166  
     12016-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [DOMJIT] DOMJIT::Patchpoint should have a way to receive constant folded arguments
     4        https://bugs.webkit.org/show_bug.cgi?id=163224
     5
     6        Reviewed by Filip Pizlo.
     7
     8        We use the GetGlobalObject DFG node to retrieve a global object from a DOM node.
     9        This global object is necessary to check whether the world is normal before entering
     10        the fast path of looking up the DOM wrapper cache.
     11        We can sometimes constant-fold this GetGlobalObject. For example, if we performed
     12        CheckStructure, the structure can offer the information about the possible result
     13        of GetGlobalObject. By using this constant-folded global object, we can drop some
     14        checks.
     15
     16        This patch introduces the way to tell the constant-folded values to DOMJIT::Patchpoint.
     17        We pass DOMJIT::Value instead of DOMJIT::Reg as a parameter of DOMJIT::PatchpointParams.
     18        This DOMJIT::Value is a pair of DOMJIT::Reg and JSValue. If the given parameter has a
     19        constant value, this JSValue is filled with it.
     20
     21        * JavaScriptCore.xcodeproj/project.pbxproj:
     22        * dfg/DFGDOMJITPatchpointParams.h:
     23        (JSC::DFG::DOMJITPatchpointParams::DOMJITPatchpointParams):
     24        * dfg/DFGSpeculativeJIT.cpp:
     25        (JSC::DFG::SpeculativeJIT::compileCallDOM):
     26        (JSC::DFG::SpeculativeJIT::compileCheckDOM):
     27        * domjit/DOMJITPatchpointParams.h:
     28        (JSC::DOMJIT::PatchpointParams::at):
     29        (JSC::DOMJIT::PatchpointParams::operator[]):
     30        (JSC::DOMJIT::PatchpointParams::PatchpointParams):
     31        * domjit/DOMJITValue.h: Copied from Source/JavaScriptCore/dfg/DFGDOMJITPatchpointParams.h.
     32        (JSC::DOMJIT::Value::Value):
     33        (JSC::DOMJIT::Value::isGPR):
     34        (JSC::DOMJIT::Value::isFPR):
     35        (JSC::DOMJIT::Value::isJSValueRegs):
     36        (JSC::DOMJIT::Value::gpr):
     37        (JSC::DOMJIT::Value::fpr):
     38        (JSC::DOMJIT::Value::jsValueRegs):
     39        (JSC::DOMJIT::Value::reg):
     40        (JSC::DOMJIT::Value::value):
     41        * ftl/FTLDOMJITPatchpointParams.h:
     42        (JSC::FTL::DOMJITPatchpointParams::DOMJITPatchpointParams):
     43        * ftl/FTLLowerDFGToB3.cpp:
     44        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
     45        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
     46
    1472016-10-10  Filip Pizlo  <fpizlo@apple.com>
    248

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r207004 r207166  
    21162116                E3EF88751B66DF23003F26CB /* JSPropertyNameIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
    21172117                E3FF75331D9CEA1800C7E16D /* DOMJITGetterSetter.h in Headers */ = {isa = PBXBuildFile; fileRef = E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */; settings = {ATTRIBUTES = (Private, ); }; };
     2118                E3FFC8531DAD7D1500DEA53E /* DOMJITValue.h in Headers */ = {isa = PBXBuildFile; fileRef = E3FFC8521DAD7D1000DEA53E /* DOMJITValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
    21182119                E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
    21192120                E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    44254426                E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNameIterator.h; sourceTree = "<group>"; };
    44264427                E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITGetterSetter.h; sourceTree = "<group>"; };
     4428                E3FFC8521DAD7D1000DEA53E /* DOMJITValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITValue.h; sourceTree = "<group>"; };
    44274429                E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
    44284430                E49DC15112EF272200184A1F /* SourceProviderCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCache.h; sourceTree = "<group>"; };
    … …  
    71997201                                E37AD83B1DA4928000F3D412 /* DOMJITReg.h */,
    72007202                                E3CB1E241DA7540A00FA1E56 /* DOMJITSlowPathCalls.h */,
     7203                                E3FFC8521DAD7D1000DEA53E /* DOMJITValue.h */,
    72017204                        );
    72027205                        path = domjit;
    … …  
    75137516                                0F338DFE1BED51270013C88F /* AirSimplifyCFG.h in Headers */,
    75147517                                0F3B3A281544C997003ED0FF /* DFGCFGSimplificationPhase.h in Headers */,
     7518                                E3FFC8531DAD7D1500DEA53E /* DOMJITValue.h in Headers */,
    75157519                                0F9D36951AE9CC33000D4DFB /* DFGCleanUpPhase.h in Headers */,
    75167520                                A77A424017A0BBFD00A8DB81 /* DFGClobberize.h in Headers */,

  • trunk/Source/JavaScriptCore/dfg/DFGDOMJITPatchpointParams.h

    r206899 r207166  
    3636class DOMJITPatchpointParams : public DOMJIT::PatchpointParams {
    3737public:
    38     DOMJITPatchpointParams(SpeculativeJIT* jit, Vector<DOMJIT::Reg>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
     38    DOMJITPatchpointParams(SpeculativeJIT* jit, Vector<DOMJIT::Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
    3939        : DOMJIT::PatchpointParams(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
    4040        , m_jit(jit)

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r206899 r207166  
    71357135    Vector<GPRReg> gpScratch;
    71367136    Vector<FPRReg> fpScratch;
    7137     Vector<DOMJIT::Reg> regs;
     7137    Vector<DOMJIT::Value> regs;
    71387138
    71397139    // FIXME: patchpoint should have a way to tell this can reuse "base" register.
    … …  
    71447144
    71457145    regs.append(result.regs());
    7146     regs.append(globalObject.gpr());
    7147     regs.append(base.gpr());
     7146    regs.append(DOMJIT::Value(globalObject.gpr(), m_state.forNode(m_jit.graph().varArgChild(node, 0)).value()));
     7147    regs.append(DOMJIT::Value(base.gpr(), m_state.forNode(m_jit.graph().varArgChild(node, 1)).value()));
    71487148#if USE(JSVALUE64)
    71497149    regs.append(static_cast<GPRReg>(GPRInfo::tagMaskRegister));
    … …  
    71667166    Vector<GPRReg> gpScratch;
    71677167    Vector<FPRReg> fpScratch;
    7168     Vector<DOMJIT::Reg> regs;
     7168    Vector<DOMJIT::Value> regs;
    71697169
    71707170    SpeculateCellOperand base(this, node->child1());
    71717171    GPRReg baseGPR = base.gpr();
    7172     regs.append(baseGPR);
     7172    regs.append(DOMJIT::Value(baseGPR, m_state.forNode(node->child1()).value()));
    71737173
    71747174    Vector<GPRTemporary> gpTempraries;

  • trunk/Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h

    r206899 r207166  
    2929
    3030#include "CCallHelpers.h"
    31 #include "DOMJITReg.h"
    3231#include "DOMJITSlowPathCalls.h"
     32#include "DOMJITValue.h"
    3333#include "JITOperations.h"
    3434#include "RegisterSet.h"
    … …  
    4242
    4343    unsigned size() const { return m_regs.size(); }
    44     const Reg& at(unsigned index) const { return m_regs[index]; }
    45     const Reg& operator[](unsigned index) const { return at(index); }
     44    const Value& at(unsigned index) const { return m_regs[index]; }
     45    const Value& operator[](unsigned index) const { return at(index); }
    4646
    4747    GPRReg gpScratch(unsigned index) const { return m_gpScratch[index]; }
    4848    FPRReg fpScratch(unsigned index) const { return m_fpScratch[index]; }
    4949
    50     PatchpointParams(Vector<Reg>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
     50    PatchpointParams(Vector<Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
    5151        : m_regs(WTFMove(regs))
    5252        , m_gpScratch(WTFMove(gpScratch))
    … …  
    6666#undef JSC_DEFINE_CALL_OPERATIONS
    6767
    68     Vector<Reg> m_regs;
     68    Vector<Value> m_regs;
    6969    Vector<GPRReg> m_gpScratch;
    7070    Vector<FPRReg> m_fpScratch;

  • trunk/Source/JavaScriptCore/domjit/DOMJITValue.h

    r207165 r207166  
    2626#pragma once
    2727
    28 #if ENABLE(DFG_JIT)
     28#include "DOMJITReg.h"
    2929
    30 #include "DOMJITPatchpointParams.h"
     30#if ENABLE(JIT)
    3131
    32 namespace JSC { namespace DFG {
    33    
    34 class SpeculativeJIT;
     32namespace JSC { namespace DOMJIT {
    3533
    36 class DOMJITPatchpointParams : public DOMJIT::PatchpointParams {
     34class Value {
    3735public:
    38     DOMJITPatchpointParams(SpeculativeJIT* jit, Vector<DOMJIT::Reg>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
    39         : DOMJIT::PatchpointParams(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
    40         , m_jit(jit)
     36    Value(Reg reg)
     37        : m_reg(reg)
    4138    {
    4239    }
    4340
     41    Value(Reg reg, JSValue value)
     42        : m_reg(reg)
     43        , m_value(value)
     44    {
     45    }
     46
     47    bool isGPR() const { return m_reg.isGPR(); }
     48    bool isFPR() const { return m_reg.isFPR(); }
     49    bool isJSValueRegs() const { return m_reg.isJSValueRegs(); }
     50    GPRReg gpr() const { return m_reg.gpr(); }
     51    FPRReg fpr() const { return m_reg.fpr(); }
     52    JSValueRegs jsValueRegs() const { return m_reg.jsValueRegs(); }
     53
     54    Reg reg() const
     55    {
     56        return m_reg;
     57    }
     58
     59    JSValue value() const
     60    {
     61        return m_value;
     62    }
     63
    4464private:
    45 #define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) void addSlowPathCallImpl(CCallHelpers::JumpList, CCallHelpers&, OperationType, ResultType, std::tuple<__VA_ARGS__> args) const override;
    46     DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
    47 #undef JSC_DEFINE_CALL_OPERATIONS
    48 
    49     SpeculativeJIT* m_jit;
     65    Reg m_reg;
     66    JSValue m_value;
    5067};
    5168

  • trunk/Source/JavaScriptCore/ftl/FTLDOMJITPatchpointParams.h

    r206899 r207166  
    3737class DOMJITPatchpointParams : public DOMJIT::PatchpointParams {
    3838public:
    39     DOMJITPatchpointParams(State& state, const B3::StackmapGenerationParams& params, DFG::Node* node, Box<CCallHelpers::JumpList> exceptions, Vector<DOMJIT::Reg>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
     39    DOMJITPatchpointParams(State& state, const B3::StackmapGenerationParams& params, DFG::Node* node, Box<CCallHelpers::JumpList> exceptions, Vector<DOMJIT::Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
    4040        : DOMJIT::PatchpointParams(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
    4141        , m_state(state)

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r207017 r207166  
    87408740        OSRExitDescriptor* exitDescriptor = appendOSRExitDescriptor(jsValueValue(cell), m_node->child1().node());
    87418741        patchpoint->appendColdAnys(buildExitArguments(exitDescriptor, origin.forExit, jsValueValue(cell)));
     8742        JSValue child1Constant = m_state.forNode(m_node->child1()).value();
    87428743
    87438744        patchpoint->setGenerator(
    … …  
    87458746                Vector<GPRReg> gpScratch;
    87468747                Vector<FPRReg> fpScratch;
    8747                 Vector<DOMJIT::Reg> regs;
    8748 
    8749                 regs.append(params[0].gpr());
     8748                Vector<DOMJIT::Value> regs;
     8749
     8750                regs.append(DOMJIT::Value(params[0].gpr(), child1Constant));
    87508751
    87518752                for (unsigned i = 0; i < domJIT->numGPScratchRegisters; ++i)
    … …  
    87868787        State* state = &m_ftlState;
    87878788        Node* node = m_node;
     8789        JSValue child1Constant = m_state.forNode(m_graph.varArgChild(m_node, 0)).value();
     8790        JSValue child2Constant = m_state.forNode(m_graph.varArgChild(m_node, 1)).value();
    87888791        patchpoint->setGenerator(
    87898792            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
    … …  
    87928795                Vector<GPRReg> gpScratch;
    87938796                Vector<FPRReg> fpScratch;
    8794                 Vector<DOMJIT::Reg> regs;
     8797                Vector<DOMJIT::Value> regs;
    87958798
    87968799                // FIXME: patchpoint should have a way to tell this can reuse "base" register.
    87978800                // Teaching DFG about DOMJIT::Patchpoint clobber information is nice.
    87988801                regs.append(JSValueRegs(params[0].gpr()));
    8799                 regs.append(params[1].gpr());
    8800                 regs.append(params[2].gpr());
     8802                regs.append(DOMJIT::Value(params[1].gpr(), child1Constant));
     8803                regs.append(DOMJIT::Value(params[2].gpr(), child2Constant));
    88018804
    88028805                for (unsigned i = 0; i < domJIT->numGPScratchRegisters; ++i)

  • trunk/Source/WebCore/ChangeLog

    r207162 r207166  
     12016-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        [DOMJIT] DOMJIT::Patchpoint should have a way to receive constant folded arguments
     4        https://bugs.webkit.org/show_bug.cgi?id=163224
     5
     6        Reviewed by Filip Pizlo.
     7
     8        * domjit/DOMJITHelpers.h:
     9        (WebCore::DOMJITHelpers::toWrapper):
     10        * domjit/JSNodeDOMJIT.cpp:
     11        (WebCore::createCallDOMForOffsetAccess):
     12
    1132016-10-11  Alex Christensen  <achristensen@webkit.org>
    214

  • trunk/Source/WebCore/domjit/DOMJITHelpers.h

    r207013 r207166  
    6060
    6161template<typename WrappedType, typename ToJSFunction>
    62 void toWrapper(CCallHelpers& jit, const JSC::DOMJIT::PatchpointParams& params, GPRReg wrapped, GPRReg globalObject, JSValueRegs result, ToJSFunction function)
     62void toWrapper(CCallHelpers& jit, const JSC::DOMJIT::PatchpointParams& params, GPRReg wrapped, GPRReg globalObject, JSValueRegs result, ToJSFunction function, JSC::JSValue globalObjectConstant)
    6363{
    6464    ASSERT(wrapped != result.payloadGPR());
    … …  
    6666    GPRReg payloadGPR = result.payloadGPR();
    6767    CCallHelpers::JumpList slowCases;
    68     slowCases.append(branchIfNotWorldIsNormal(jit, globalObject));
     68
     69    if (globalObjectConstant) {
     70        if (!JSC::jsCast<JSDOMGlobalObject*>(globalObjectConstant)->worldIsNormal()) {
     71            slowCases.append(jit.jump());
     72            params.addSlowPathCall(slowCases, jit, function, result, globalObject, wrapped);
     73            return;
     74        }
     75    } else
     76        slowCases.append(branchIfNotWorldIsNormal(jit, globalObject));
     77
    6978    tryLookUpWrapperCache<WrappedType>(jit, slowCases, wrapped, payloadGPR);
    7079    jit.boxCell(payloadGPR, result);

  • trunk/Source/WebCore/domjit/JSNodeDOMJIT.cpp

    r207013 r207166  
    7171        nullCases.append(jit.branchTestPtr(CCallHelpers::Zero, scratch));
    7272
    73         DOMJITHelpers::toWrapper<WrappedNode>(jit, params, scratch, globalObject, result, toWrapperSlow<WrappedNode>);
     73        DOMJITHelpers::toWrapper<WrappedNode>(jit, params, scratch, globalObject, result, toWrapperSlow<WrappedNode>, params[1].value());
    7474        CCallHelpers::Jump done = jit.jump();
    7575
Note: See TracChangeset for help on using the changeset viewer.