[webkit-changes] [WebKit/WebKit] e5a934: [JSC] Make StructureTransitionTable link half-weak

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: e5a9344fbb6d6e72bf8250e8215b50da8528ffe5
      https://github.com/WebKit/WebKit/commit/e5a9344fbb6d6e72bf8250e8215b50da8528ffe5
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-04-10 (Mon, 10 Apr 2023)

  Changed paths:
    A JSTests/microbenchmarks/object-assign-multiple.js
    M Source/JavaScriptCore/builtins/BuiltinExecutables.cpp
    M Source/JavaScriptCore/builtins/BuiltinExecutables.h
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/CodeBlock.h
    M Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
    M Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
    M Source/JavaScriptCore/heap/Heap.cpp
    M Source/JavaScriptCore/heap/Heap.h
    M Source/JavaScriptCore/runtime/ArgList.h
    M Source/JavaScriptCore/runtime/ErrorInstance.cpp
    M Source/JavaScriptCore/runtime/ErrorInstance.h
    M Source/JavaScriptCore/runtime/FunctionExecutable.h
    M Source/JavaScriptCore/runtime/FunctionExecutableInlines.h
    M Source/JavaScriptCore/runtime/GlobalExecutable.cpp
    M Source/JavaScriptCore/runtime/GlobalExecutable.h
    M Source/JavaScriptCore/runtime/InferredValue.h
    M Source/JavaScriptCore/runtime/InferredValueInlines.h
    M Source/JavaScriptCore/runtime/JSFinalizationRegistry.cpp
    M Source/JavaScriptCore/runtime/JSFinalizationRegistry.h
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp
    M Source/JavaScriptCore/runtime/JSWeakObjectRef.h
    M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
    M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h
    M Source/JavaScriptCore/runtime/Structure.cpp
    M Source/JavaScriptCore/runtime/Structure.h
    M Source/JavaScriptCore/runtime/StructureInlines.h
    M Source/JavaScriptCore/runtime/StructureRareData.cpp
    M Source/JavaScriptCore/runtime/StructureRareData.h
    M Source/JavaScriptCore/runtime/StructureTransitionTable.h
    M Source/JavaScriptCore/runtime/SymbolTable.h
    M Source/JavaScriptCore/runtime/SymbolTableInlines.h
    M Source/JavaScriptCore/runtime/WeakMapImpl.h
    M Source/JavaScriptCore/runtime/WeakMapImplInlines.h
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h

  Log Message:
  -----------
  [JSC] Make StructureTransitionTable link half-weak
https://bugs.webkit.org/show_bug.cgi?id=255137
rdar://107739562

Reviewed by Mark Lam.

This patch optimizes Object.assign by doing two things.

1. Add putOwnDataPropertyBatching. We batch the property additions by just tracing structure transitions.
   This offers a chance to remove unnecessary intermediate butterfly allocations.
2. We found that now the hottest code in Object.assign is Structure transition itself. This patch optimizes
   this by rearchitect structure transition table mechanism. Previously we were having Weak<Structure> for
   single transition. But this is (1) too costly, Weak is generic and not so efficient abstraction. Every
   access to this field becomes double-pointer loading. And (2) too aggressive. Most of Structure lives for
   a long time while instances die quickly. We should allow keeping this structure chain alive at least during
   Eden collections. To make both work, this patch changes this link "half-weak". During Eden collection, we
   always mark it. But in full collection, we ignore this link, and GC End phase clears it if this Structure
   is collected. This way allows us to have good balance of Structure book-keeping, plain simple field access
   for structure transition, and not doing GC End phase clearing for Structures in each Eden GC.

Object.assign gets 30% better.
                                         ToT                     Patched

    object-assign-multiple        134.7853+-0.4586     ^    103.1172+-0.1968        ^ definitely 1.3071x faster

* JSTests/microbenchmarks/object-assign-multiple.js: Added.
(extend1):
(test):
* Source/JavaScriptCore/builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::finalizeUnconditionally):
* Source/JavaScriptCore/builtins/BuiltinExecutables.h:
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finalizeUnconditionally):
* Source/JavaScriptCore/bytecode/CodeBlock.h:
* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:
(JSC::UnlinkedFunctionExecutable::finalizeUnconditionally):
* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h:
* Source/JavaScriptCore/heap/Heap.cpp:
(JSC::Heap::finalizeMarkedUnconditionalFinalizers):
(JSC::Heap::finalizeUnconditionalFinalizers):
* Source/JavaScriptCore/heap/Heap.h:
* Source/JavaScriptCore/runtime/ArgList.h:
* Source/JavaScriptCore/runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/ErrorInstance.h:
* Source/JavaScriptCore/runtime/FunctionExecutable.h:
* Source/JavaScriptCore/runtime/FunctionExecutableInlines.h:
(JSC::FunctionExecutable::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/GlobalExecutable.cpp:
(JSC::GlobalExecutable::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/GlobalExecutable.h:
* Source/JavaScriptCore/runtime/InferredValue.h:
* Source/JavaScriptCore/runtime/InferredValueInlines.h:
(JSC::InferredValue<JSCellType>::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/JSFinalizationRegistry.cpp:
(JSC::JSFinalizationRegistry::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/JSFinalizationRegistry.h:
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::putOwnDataPropertyBatching):
* Source/JavaScriptCore/runtime/JSObject.h:
* Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp:
(JSC::JSWeakObjectRef::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/JSWeakObjectRef.h:
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::objectAssignFast):
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::StructureTransitionTable::setSingleTransition):
(JSC::StructureTransitionTable::contains const):
(JSC::StructureTransitionTable::add):
(JSC::Structure::addNewPropertyTransition):
(JSC::Structure::removeNewPropertyTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::nonPropertyTransitionSlow):
(JSC::Structure::visitChildrenImpl):
(JSC::Structure::setBrandTransition):
(JSC::Structure::finalizeUnconditionally):
(): Deleted.
(JSC::singleSlotTransitionWeakOwner): Deleted.
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::shouldDoCacheableDictionaryTransitionForAdd):
(JSC::Structure::transitionCountEstimate const):
* Source/JavaScriptCore/runtime/StructureInlines.h:
(JSC::Structure::addPropertyTransitionToExistingStructureImpl):
(JSC::StructureTransitionTable::trySingleTransition const):
(JSC::StructureTransitionTable::get const):
(JSC::StructureTransitionTable::finalizeUnconditionally):
(JSC::StructureTransitionTable::singleTransition const): Deleted.
* Source/JavaScriptCore/runtime/StructureRareData.cpp:
(JSC::StructureRareData::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/StructureRareData.h:
* Source/JavaScriptCore/runtime/StructureTransitionTable.h:
(JSC::StructureTransitionTable::~StructureTransitionTable):
(JSC::StructureTransitionTable::setMap):
(JSC::StructureTransitionTable::StructureTransitionTable): Deleted.
(JSC::StructureTransitionTable::weakImpl const): Deleted.
* Source/JavaScriptCore/runtime/SymbolTable.h:
* Source/JavaScriptCore/runtime/SymbolTableInlines.h:
(JSC::SymbolTable::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/WeakMapImpl.h:
* Source/JavaScriptCore/runtime/WeakMapImplInlines.h:
(JSC::WeakMapImpl<WeakMapBucket>::finalizeUnconditionally):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp:
(JSC::JSWebAssemblyModule::finalizeUnconditionally):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h:

Canonical link: https://commits.webkit.org/262809@main