Changeset 208811 in webkit

Timestamp:

Nov 16, 2016 2:24:45 PM (7 years ago)

Author:

fpizlo@apple.com

Message:

Slight Octane regression from concurrent GC's eager object zero-fill
​https://bugs.webkit.org/show_bug.cgi?id=164823

Reviewed by Geoffrey Garen.

During concurrent GC, we need to eagerly zero-fill objects we allocate prior to
executing the end-of-allocation fence. This causes some regressions. This is an attempt
to fix those regressions by making them conditional on whether the mutator is fenced.

This is a slight speed-up on raytrace and boyer, and hopefully it will fix the
regression.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::splatWordsIfMutatorIsFenced):
(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
(JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
(JSC::FTL::DFG::LowerDFGToB3::setButterfly):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (7 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Slight Octane regression from concurrent GC's eager object zero-fill
+        https://bugs.webkit.org/show_bug.cgi?id=164823
+
+        Reviewed by Geoffrey Garen.
+        
+        During concurrent GC, we need to eagerly zero-fill objects we allocate prior to
+        executing the end-of-allocation fence. This causes some regressions. This is an attempt
+        to fix those regressions by making them conditional on whether the mutator is fenced.
+        
+        This is a slight speed-up on raytrace and boyer, and hopefully it will fix the
+        regression.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::splatWordsIfMutatorIsFenced):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+        (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+
 2016-11-16  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -8135 +8135 @@
                 ValueFromBlock haveButterfly = m_out.anchor(fastButterflyValue);
                 
-                splatWords(
+                splatWordsIfMutatorIsFenced(
                     fastButterflyValue,
                     m_out.constInt32(-structure->outOfLineCapacity() - 1),
@@ -8961 +8961 @@
     }
     
+    void splatWordsIfMutatorIsFenced(LValue base, LValue begin, LValue end, LValue value, const AbstractHeap& heap)
+    {
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        m_out.branch(
+            m_out.load8ZeroExt32(m_out.absolute(vm().heap.addressOfMutatorShouldBeFenced())),
+            rarely(slowPath), usually(continuation));
+        
+        m_out.appendTo(slowPath, continuation);
+        
+        splatWords(base, begin, end, value, heap);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
     void splatWords(LValue base, LValue begin, LValue end, LValue value, const AbstractHeap& heap)
     {
@@ -9014 +9033 @@
         LValue result = allocatePropertyStorageWithSizeImpl(initialOutOfLineCapacity);
 
-        splatWords(
+        splatWordsIfMutatorIsFenced(
             result,
             m_out.constInt32(-initialOutOfLineCapacity - 1), m_out.constInt32(-1),
@@ -9047 +9066 @@
         }
         
-        splatWords(
+        splatWordsIfMutatorIsFenced(
             result,
             m_out.constInt32(-newSize - 1), m_out.constInt32(-oldSize - 1),
@@ -9927 +9946 @@
     {
         LValue result = allocateCell(allocator, structure, slowPath);
-        splatWords(
+        splatWordsIfMutatorIsFenced(
             result,
             m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
@@ -12586 +12605 @@
             rarely(slowPath), usually(continuation));
         
-        m_out.appendTo(slowPath);
+        m_out.appendTo(slowPath, continuation);
         
         m_out.fence(&m_heaps.root, nullptr);
@@ -12613 +12632 @@
             rarely(slowPath), usually(fastPath));
 
-        m_out.appendTo(fastPath);
+        m_out.appendTo(fastPath, slowPath);
         
         m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
         m_out.jump(continuation);
         
-        m_out.appendTo(slowPath);
+        m_out.appendTo(slowPath, continuation);
         
         m_out.fence(&m_heaps.root, nullptr);