Changeset 77050 in webkit

Timestamp:

Jan 28, 2011 11:37:58 PM (13 years ago)

Author:

eric@webkit.org

Message:

2011-01-28 Eric Seidel <​eric@webkit.org>

Reviewed by Darin Adler.

HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40%
​https://bugs.webkit.org/show_bug.cgi?id=48719

It's unclear exactly what the Peacekeeper benchmark is testing,
because I haven't found a way to run it myself.

However, I constructed a benchmark which shows at least one possible slow point.
The HTML5 spec talks about creating a new document for every time we use
the fragment parsing algorithm. Document() it turns out, it a huge bloated
mess, and the constructor and destructor do a huge amount of work.
To avoid constructing (or destructing) documents for each innerHTML call,
this patch adds a shared dummy document used by all innerHTML calls.

• benchmarks/parser/tiny-innerHTML.html: Added.

2011-01-28 Eric Seidel <​eric@webkit.org>

Reviewed by Darin Adler.

HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40%
​https://bugs.webkit.org/show_bug.cgi?id=48719

It's unclear exactly what the Peacekeeper benchmark is testing,
because I haven't found a way to run it myself.

However, I constructed a benchmark which shows at least one possible slow point.
The HTML5 spec talks about creating a new document for every time we use
the fragment parsing algorithm. Document() it turns out, it a huge bloated
mess, and the constructor and destructor do a huge amount of work.
To avoid constructing (or destructing) documents for each innerHTML call,
this patch adds a shared dummy document used by all innerHTML calls.

This patch brings us from 7x slower than Safari 5 on tiny-innerHTML
to only 1.5x slower than Safari 5. I'm sure there is more work to do here.

Saving a shared Document like this is error prone. Currently
DummyDocumentFactory::releaseDocument() calls removeAllChildren()
in an attempt to clear the Document's state. However it's possible
that that call is not sufficient and we'll have future bugs here.

• html/parser/HTMLTreeBuilder.cpp: (WebCore::DummyDocumentFactory::createDummyDocument): (WebCore::DummyDocumentFactory::releaseDocument): (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext): (WebCore::HTMLTreeBuilder::FragmentParsingContext::document): (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished):
• html/parser/HTMLTreeBuilder.h:

Location:

trunk

Files:

• PerformanceTests/Parser/ChangeLog (modified) (1 diff)
• PerformanceTests/Parser/resources/performance-test.js (added)
• PerformanceTests/Parser/tiny-innerHTML.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/HTMLTreeBuilder.cpp (modified) (5 diffs)
• Source/WebCore/html/parser/HTMLTreeBuilder.h (modified) (1 diff)

trunk/PerformanceTests/Parser/ChangeLog

@@ +1 @@
+2011-01-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40%
+        https://bugs.webkit.org/show_bug.cgi?id=48719
+
+        It's unclear exactly what the Peacekeeper benchmark is testing,
+        because I haven't found a way to run it myself.
+
+        However, I constructed a benchmark which shows at least one possible slow point.
+        The HTML5 spec talks about creating a new document for every time we use
+        the fragment parsing algorithm.  Document() it turns out, it a huge bloated
+        mess, and the constructor and destructor do a huge amount of work.
+        To avoid constructing (or destructing) documents for each innerHTML call,
+        this patch adds a shared dummy document used by all innerHTML calls.
+
+        * benchmarks/parser/tiny-innerHTML.html: Added.
+
 2010-12-31  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-01-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTML5 TreeBuilder regressed a Peacekeeper DOM test by 40%
+        https://bugs.webkit.org/show_bug.cgi?id=48719
+
+        It's unclear exactly what the Peacekeeper benchmark is testing,
+        because I haven't found a way to run it myself.
+
+        However, I constructed a benchmark which shows at least one possible slow point.
+        The HTML5 spec talks about creating a new document for every time we use
+        the fragment parsing algorithm.  Document() it turns out, it a huge bloated
+        mess, and the constructor and destructor do a huge amount of work.
+        To avoid constructing (or destructing) documents for each innerHTML call,
+        this patch adds a shared dummy document used by all innerHTML calls.
+
+        This patch brings us from 7x slower than Safari 5 on tiny-innerHTML
+        to only 1.5x slower than Safari 5.  I'm sure there is more work to do here.
+
+        Saving a shared Document like this is error prone.  Currently
+        DummyDocumentFactory::releaseDocument() calls removeAllChildren()
+        in an attempt to clear the Document's state. However it's possible
+        that that call is not sufficient and we'll have future bugs here.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::DummyDocumentFactory::createDummyDocument):
+        (WebCore::DummyDocumentFactory::releaseDocument):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::document):
+        (WebCore::HTMLTreeBuilder::FragmentParsingContext::finished):
+        * html/parser/HTMLTreeBuilder.h:
+
 2011-01-28  Johnny Ding  <jnd@chromium.org>
 

trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp

@@ -396 +396 @@
 }
 
+// NOTE: HTML5 requires that we use a dummy document when parsing
+// document fragments.  However, creating a new Document element
+// for each fragment is very slow (Document() does too much work, and
+// innerHTML is a common call).  So we use a shared dummy document.
+// This sharing works because there can only ever be one fragment
+// parser at any time.  Fragment parsing is synchronous and done
+// only from the main thread.  It should be impossible for javascript
+// (or anything else) to ever hold a reference to the dummy document.
+// See https://bugs.webkit.org/show_bug.cgi?id=48719
+class DummyDocumentFactory {
+    WTF_MAKE_NONCOPYABLE(DummyDocumentFactory); WTF_MAKE_FAST_ALLOCATED;
+public:
+    // Use an explicit create/release here to ASSERT this sharing is safe.
+    static HTMLDocument* createDummyDocument();
+    static void releaseDocument(HTMLDocument*);
+
+private:
+    static HTMLDocument* s_sharedDummyDocument;
+    static int s_sharedDummyDocumentMutex;
+};
+
+HTMLDocument* DummyDocumentFactory::createDummyDocument()
+{
+    if (!s_sharedDummyDocument) {
+        s_sharedDummyDocument = HTMLDocument::create(0, KURL()).releaseRef();
+        s_sharedDummyDocumentMutex = 0;
+    }
+    ASSERT(!s_sharedDummyDocumentMutex);
+    ASSERT(!s_sharedDummyDocument->hasChildNodes());
+    s_sharedDummyDocumentMutex++;
+    return s_sharedDummyDocument;
+}
+
+void DummyDocumentFactory::releaseDocument(HTMLDocument* dummyDocument)
+{
+    ASSERT(s_sharedDummyDocument == dummyDocument);
+    s_sharedDummyDocumentMutex--;
+    ASSERT(!s_sharedDummyDocumentMutex);
+    dummyDocument->removeAllChildren();
+}
+
+HTMLDocument* DummyDocumentFactory::s_sharedDummyDocument = 0;
+int DummyDocumentFactory::s_sharedDummyDocumentMutex = 0;
+
 HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext()
     : m_fragment(0)
@@ -404 +448 @@
 
 HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext(DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission scriptingPermission)
-    : m_dummyDocumentForFragmentParsing(HTMLDocument::create(0, KURL(), fragment->document()->baseURI()))
+    : m_dummyDocumentForFragmentParsing(DummyDocumentFactory::createDummyDocument())
     , m_fragment(fragment)
     , m_contextElement(contextElement)
@@ -410 +454 @@
 {
     m_dummyDocumentForFragmentParsing->setCompatibilityMode(fragment->document()->compatibilityMode());
+    // Setting the baseURL should work the same as it would have had we passed
+    // it during HTMLDocument() construction, since the new document is empty.
+    m_dummyDocumentForFragmentParsing->setURL(fragment->document()->baseURI());
 }
 
@@ -415 +462 @@
 {
     ASSERT(m_fragment);
-    return m_dummyDocumentForFragmentParsing.get();
+    return m_dummyDocumentForFragmentParsing;
 }
 
@@ -421 +468 @@
 {
     // Populate the DocumentFragment with the parsed content now that we're done.
-    ContainerNode* root = m_dummyDocumentForFragmentParsing.get();
+    ContainerNode* root = m_dummyDocumentForFragmentParsing;
     if (m_contextElement)
         root = m_dummyDocumentForFragmentParsing->documentElement();
     m_fragment->takeAllChildrenFrom(root);
+    ASSERT(!m_dummyDocumentForFragmentParsing->hasChildNodes());
+    DummyDocumentFactory::releaseDocument(m_dummyDocumentForFragmentParsing);
+    m_dummyDocumentForFragmentParsing = 0;
 }
 

trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h

@@ -221 +221 @@
 
     private:
-        RefPtr<Document> m_dummyDocumentForFragmentParsing;
+        // Use a shared dummy document to avoid expensive Document creation.
+        // Hold a raw pointer to the document since there is no need to ref it.
+        HTMLDocument* m_dummyDocumentForFragmentParsing;
         DocumentFragment* m_fragment;
         Element* m_contextElement;