<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[208860] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/208860">208860</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-11-17 13:37:05 -0800 (Thu, 17 Nov 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Speculatively disable eager object zero-fill on not-x86 to let the bots decide if that's a problem
https://bugs.webkit.org/show_bug.cgi?id=164885
Reviewed by Mark Lam.
This adds a useGCFences() function that we use to guard all eager object zero-fill and the
related fences. It currently returns true only on x86().
The goal here is to get the bots to tell us if this code is responsible for perf issues on
any non-x86 platforms. We have a few different paths that we can pursue if this turns out
to be the case. Eager zero-fill is merely the easiest way to optimize out some fences, but
we could get rid of it and instead teach B3 how to think about fences.
* assembler/CPU.h:
(JSC::useGCFences):
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessCase::generateImpl):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
(JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
(JSC::FTL::DFG::LowerDFGToB3::setButterfly):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::mutatorFence):
(JSC::AssemblyHelpers::storeButterfly):
(JSC::AssemblyHelpers::emitInitializeInlineStorage):
(JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreassemblerCPUh">trunk/Source/JavaScriptCore/assembler/CPU.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp">trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelpersh">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (208859 => 208860)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-11-17 21:23:45 UTC (rev 208859)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-11-17 21:37:05 UTC (rev 208860)
</span><span class="lines">@@ -1,3 +1,38 @@
</span><ins>+2016-11-17 Filip Pizlo <fpizlo@apple.com>
+
+ Speculatively disable eager object zero-fill on not-x86 to let the bots decide if that's a problem
+ https://bugs.webkit.org/show_bug.cgi?id=164885
+
+ Reviewed by Mark Lam.
+
+ This adds a useGCFences() function that we use to guard all eager object zero-fill and the
+ related fences. It currently returns true only on x86().
+
+ The goal here is to get the bots to tell us if this code is responsible for perf issues on
+ any non-x86 platforms. We have a few different paths that we can pursue if this turns out
+ to be the case. Eager zero-fill is merely the easiest way to optimize out some fences, but
+ we could get rid of it and instead teach B3 how to think about fences.
+
+ * assembler/CPU.h:
+ (JSC::useGCFences):
+ * bytecode/PolymorphicAccess.cpp:
+ (JSC::AccessCase::generateImpl):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+ (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+ (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+ (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+ (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+ (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+ (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::mutatorFence):
+ (JSC::AssemblyHelpers::storeButterfly):
+ (JSC::AssemblyHelpers::emitInitializeInlineStorage):
+ (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
+
</ins><span class="cx"> 2016-11-17 Keith Miller <keith_miller@apple.com>
</span><span class="cx">
</span><span class="cx"> Add rotate to Wasm
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreassemblerCPUh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/assembler/CPU.h (208859 => 208860)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/assembler/CPU.h 2016-11-17 21:23:45 UTC (rev 208859)
+++ trunk/Source/JavaScriptCore/assembler/CPU.h 2016-11-17 21:37:05 UTC (rev 208860)
</span><span class="lines">@@ -85,5 +85,10 @@
</span><span class="cx"> return isX86_64() && Options::useArchitectureSpecificOptimizations();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+inline bool useGCFences()
+{
+ return isX86();
+}
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (208859 => 208860)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp 2016-11-17 21:23:45 UTC (rev 208859)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp 2016-11-17 21:37:05 UTC (rev 208860)
</span><span class="lines">@@ -1283,8 +1283,10 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- for (size_t offset = oldSize; offset < newSize; offset += sizeof(void*))
- jit.storePtr(CCallHelpers::TrustedImmPtr(0), CCallHelpers::Address(scratchGPR, -static_cast<ptrdiff_t>(offset + sizeof(JSValue) + sizeof(void*))));
</del><ins>+ if (useGCFences()) {
+ for (size_t offset = oldSize; offset < newSize; offset += sizeof(void*))
+ jit.storePtr(CCallHelpers::TrustedImmPtr(0), CCallHelpers::Address(scratchGPR, -static_cast<ptrdiff_t>(offset + sizeof(JSValue) + sizeof(void*))));
+ }
</ins><span class="cx"> } else {
</span><span class="cx"> // Handle the case where we are allocating out-of-line using an operation.
</span><span class="cx"> RegisterSet extraRegistersToPreserve;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (208859 => 208860)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2016-11-17 21:23:45 UTC (rev 208859)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2016-11-17 21:37:05 UTC (rev 208860)
</span><span class="lines">@@ -7411,11 +7411,13 @@
</span><span class="cx"> m_jit.emitAllocate(scratchGPR1, allocator, scratchGPR2, scratchGPR3, slowPath);
</span><span class="cx"> m_jit.addPtr(JITCompiler::TrustedImm32(size + sizeof(IndexingHeader)), scratchGPR1);
</span><span class="cx">
</span><del>- for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(size); offset += sizeof(void*))
- m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
-
- m_jit.mutatorFence();
</del><ins>+ if (useGCFences()) {
+ for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(size); offset += sizeof(void*))
+ m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
</ins><span class="cx">
</span><ins>+ m_jit.mutatorFence();
+ }
+
</ins><span class="cx"> addSlowPathGenerator(
</span><span class="cx"> slowPathCall(slowPath, this, operationAllocatePropertyStorageWithInitialCapacity, scratchGPR1));
</span><span class="cx">
</span><span class="lines">@@ -7466,8 +7468,10 @@
</span><span class="cx">
</span><span class="cx"> m_jit.addPtr(JITCompiler::TrustedImm32(newSize + sizeof(IndexingHeader)), scratchGPR1);
</span><span class="cx">
</span><del>- for (ptrdiff_t offset = oldSize; offset < static_cast<ptrdiff_t>(newSize); offset += sizeof(void*))
- m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
</del><ins>+ if (useGCFences()) {
+ for (ptrdiff_t offset = oldSize; offset < static_cast<ptrdiff_t>(newSize); offset += sizeof(void*))
+ m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
+ }
</ins><span class="cx">
</span><span class="cx"> addSlowPathGenerator(
</span><span class="cx"> slowPathCall(slowPath, this, operationAllocatePropertyStorage, scratchGPR1, newSize / sizeof(JSValue)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (208859 => 208860)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-11-17 21:23:45 UTC (rev 208859)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-11-17 21:37:05 UTC (rev 208860)
</span><span class="lines">@@ -8134,11 +8134,13 @@
</span><span class="cx">
</span><span class="cx"> ValueFromBlock haveButterfly = m_out.anchor(fastButterflyValue);
</span><span class="cx">
</span><del>- splatWords(
- fastButterflyValue,
- m_out.constInt32(-structure->outOfLineCapacity() - 1),
- m_out.constInt32(-1),
- m_out.int64Zero, m_heaps.properties.atAnyNumber());
</del><ins>+ if (useGCFences()) {
+ splatWords(
+ fastButterflyValue,
+ m_out.constInt32(-structure->outOfLineCapacity() - 1),
+ m_out.constInt32(-1),
+ m_out.int64Zero, m_heaps.properties.atAnyNumber());
+ }
</ins><span class="cx">
</span><span class="cx"> m_out.store32(vectorLength, fastButterflyValue, m_heaps.Butterfly_vectorLength);
</span><span class="cx">
</span><span class="lines">@@ -9013,10 +9015,12 @@
</span><span class="cx">
</span><span class="cx"> LValue result = allocatePropertyStorageWithSizeImpl(initialOutOfLineCapacity);
</span><span class="cx">
</span><del>- splatWords(
- result,
- m_out.constInt32(-initialOutOfLineCapacity - 1), m_out.constInt32(-1),
- m_out.int64Zero, m_heaps.properties.atAnyNumber());
</del><ins>+ if (useGCFences()) {
+ splatWords(
+ result,
+ m_out.constInt32(-initialOutOfLineCapacity - 1), m_out.constInt32(-1),
+ m_out.int64Zero, m_heaps.properties.atAnyNumber());
+ }
</ins><span class="cx">
</span><span class="cx"> setButterfly(result, object);
</span><span class="cx"> return result;
</span><span class="lines">@@ -9046,10 +9050,12 @@
</span><span class="cx"> m_out.storePtr(loaded, m_out.address(m_heaps.properties.atAnyNumber(), result, offset));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- splatWords(
- result,
- m_out.constInt32(-newSize - 1), m_out.constInt32(-oldSize - 1),
- m_out.int64Zero, m_heaps.properties.atAnyNumber());
</del><ins>+ if (useGCFences()) {
+ splatWords(
+ result,
+ m_out.constInt32(-newSize - 1), m_out.constInt32(-oldSize - 1),
+ m_out.int64Zero, m_heaps.properties.atAnyNumber());
+ }
</ins><span class="cx">
</span><span class="cx"> setButterfly(result, object);
</span><span class="cx">
</span><span class="lines">@@ -9926,12 +9932,14 @@
</span><span class="cx"> LValue allocator, Structure* structure, LValue butterfly, LBasicBlock slowPath)
</span><span class="cx"> {
</span><span class="cx"> LValue result = allocateCell(allocator, structure, slowPath);
</span><del>- splatWords(
- result,
- m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
- m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8 + structure->inlineCapacity()),
- m_out.int64Zero,
- m_heaps.properties.atAnyNumber());
</del><ins>+ if (useGCFences()) {
+ splatWords(
+ result,
+ m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
+ m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8 + structure->inlineCapacity()),
+ m_out.int64Zero,
+ m_heaps.properties.atAnyNumber());
+ }
</ins><span class="cx"> m_out.storePtr(butterfly, result, m_heaps.JSObject_butterfly);
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="lines">@@ -12571,7 +12579,7 @@
</span><span class="cx">
</span><span class="cx"> void mutatorFence()
</span><span class="cx"> {
</span><del>- if (isX86()) {
</del><ins>+ if (isX86() || !useGCFences()) {
</ins><span class="cx"> m_out.fence(&m_heaps.root, nullptr);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="lines">@@ -12595,7 +12603,7 @@
</span><span class="cx">
</span><span class="cx"> void setButterfly(LValue butterfly, LValue object)
</span><span class="cx"> {
</span><del>- if (isX86()) {
</del><ins>+ if (isX86() || !useGCFences()) {
</ins><span class="cx"> m_out.fence(&m_heaps.root, nullptr);
</span><span class="cx"> m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
</span><span class="cx"> m_out.fence(&m_heaps.root, nullptr);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h (208859 => 208860)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h 2016-11-17 21:23:45 UTC (rev 208859)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h 2016-11-17 21:37:05 UTC (rev 208860)
</span><span class="lines">@@ -1363,7 +1363,7 @@
</span><span class="cx">
</span><span class="cx"> void mutatorFence()
</span><span class="cx"> {
</span><del>- if (isX86())
</del><ins>+ if (isX86() || !useGCFences())
</ins><span class="cx"> return;
</span><span class="cx"> Jump ok = jumpIfMutatorFenceNotNeeded();
</span><span class="cx"> storeFence();
</span><span class="lines">@@ -1372,7 +1372,7 @@
</span><span class="cx">
</span><span class="cx"> void storeButterfly(GPRReg butterfly, GPRReg object)
</span><span class="cx"> {
</span><del>- if (isX86()) {
</del><ins>+ if (isX86() || !useGCFences()) {
</ins><span class="cx"> storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="lines">@@ -1618,6 +1618,8 @@
</span><span class="cx">
</span><span class="cx"> void emitInitializeInlineStorage(GPRReg baseGPR, unsigned inlineCapacity)
</span><span class="cx"> {
</span><ins>+ if (!useGCFences())
+ return;
</ins><span class="cx"> for (unsigned i = 0; i < inlineCapacity; ++i)
</span><span class="cx"> storeTrustedValue(JSValue(), Address(baseGPR, JSObject::offsetOfInlineStorage() + i * sizeof(EncodedJSValue)));
</span><span class="cx"> }
</span><span class="lines">@@ -1624,6 +1626,8 @@
</span><span class="cx">
</span><span class="cx"> void emitInitializeInlineStorage(GPRReg baseGPR, GPRReg inlineCapacity)
</span><span class="cx"> {
</span><ins>+ if (!useGCFences())
+ return;
</ins><span class="cx"> Jump empty = branchTest32(Zero, inlineCapacity);
</span><span class="cx"> Label loop = label();
</span><span class="cx"> sub32(TrustedImm32(1), inlineCapacity);
</span><span class="lines">@@ -1634,6 +1638,8 @@
</span><span class="cx">
</span><span class="cx"> void emitInitializeOutOfLineStorage(GPRReg butterflyGPR, unsigned outOfLineCapacity)
</span><span class="cx"> {
</span><ins>+ if (!useGCFences())
+ return;
</ins><span class="cx"> for (unsigned i = 0; i < outOfLineCapacity; ++i)
</span><span class="cx"> storeTrustedValue(JSValue(), Address(butterflyGPR, -sizeof(IndexingHeader) - (i + 1) * sizeof(EncodedJSValue)));
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>