Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable FTL on Windows #19073

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Conversation

iangrunert
Copy link
Contributor

@iangrunert iangrunert commented Oct 13, 2023

Enable FTL on Windows
https://bugs.webkit.org/show_bug.cgi?id=145366

Reviewed by NOBODY (OOPS!).

Enabling webassembly at build time and disabling at runtime, as
FTL makes assumptions that webassembly is enabled. Should be able
to apply a cleaner patch once https://bugs.webkit.org/show_bug.cgi?id=222315
lands (awaiting PR review).

The BBQ JIT won't work on Windows even after the changes for
enabling webassembly on Windows land - it requires changes to GPR
assignment so it can use callee saves. With two fewer GPRs to
work with it runs out of GPRs to assign when running benchmarks.

Currently segfaulting during JetStream2 when running stanford
crypto-aes (on most but not all runs, it occasionally works).

FTL is disabled on Windows for EnumeratorNextUpdateIndexAndMode.
It crashes on Windows with a segfault on a simple test with
JSC_useConcurrentJIT=false. If converted from UGPRPair return
type back to JSValue it works - so either something in the FTL
lowering, or the register allocator is having problems due to the
extra return register required.

```
function getMappedArguments() { return arguments; }

function forIn(object) {
    var keys = [];
    for (var key in object)
        keys.push(key);
    return keys;
}

noInline(forIn);

(function() {
    var mappedArguments = getMappedArguments(0, 1, 2);
    for (var i = 0; i < 1e4; ++i) {
        forIn(mappedArguments);
    }
    print('done');
})();
```

* Source/JavaScriptCore/b3/B3LowerToAir.cpp:
* Source/JavaScriptCore/b3/air/AirCCallSpecial.cpp: (JSC::B3::Air::CCallSpecial::generate):
* Source/JavaScriptCore/b3/air/AirCCallingConvention.cpp:
* Source/JavaScriptCore/b3/air/AirCode.h: (JSC::B3::Air::Code::regsInPriorityOrder const):
(JSC::B3::Air::Code::regsInPriorityOrderImpl):
* Source/JavaScriptCore/b3/air/AirPrintSpecial.h:
* Source/JavaScriptCore/b3/air/opcode_generator.rb:
* Source/JavaScriptCore/b3/air/testair.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_3.cpp: (correctSqrt):
(testStorePartial8BitRegisterOnX86):
* Source/JavaScriptCore/b3/testb3_4.cpp: (testLoadFromFramePointer):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub):
* Source/JavaScriptCore/ftl/FTLOperations.h:
* Source/JavaScriptCore/ftl/FTLOutput.cpp: (JSC::FTL::Output::baseIndex):
* Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp: (JSC::FTL::SlowPathCallContext::SlowPathCallContext):
* Source/JavaScriptCore/jit/RegisterSet.cpp: (JSC::RegisterSetBuilder::ftlCalleeSaveRegisters):
* Source/JavaScriptCore/llint/LLIntData.cpp: (JSC::LLInt::initialize):
* Source/JavaScriptCore/llint/LLIntThunks.cpp: (JSC::LLInt::untaggedPtr):
(JSC::LLInt::inPlaceInterpreterEntryThunk):
(JSC::LLInt::inPlaceInterpreterEntryThunkSIMD):
* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:
* Source/JavaScriptCore/llint/WebAssembly.asm:
* Source/JavaScriptCore/offlineasm/x86.rb:
* Source/JavaScriptCore/runtime/Options.cpp: (JSC::Options::notifyOptionsChanged):
* Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::addI64TruncUF64):
(JSC::Wasm::B3IRGenerator::addI64TruncUF32):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp: (JSC::Wasm::BBQJIT::RegisterBinding::none):
(JSC::Wasm::BBQJIT::addI32Rotl):
(JSC::Wasm::BBQJIT::addI64Rotl):
(JSC::Wasm::BBQJIT::addF32ConvertUI32):
(JSC::Wasm::BBQJIT::addF32ConvertUI64):
(JSC::Wasm::BBQJIT::addF64ConvertUI32):
(JSC::Wasm::BBQJIT::addF64ConvertUI64):
(JSC::Wasm::BBQJIT::addF32Copysign):
(JSC::Wasm::BBQJIT::addF64Copysign):
(JSC::Wasm::BBQJIT::addF32Abs):
(JSC::Wasm::BBQJIT::addF64Abs):
(JSC::Wasm::BBQJIT::addF32Neg):
(JSC::Wasm::BBQJIT::addF64Neg):
* Source/JavaScriptCore/wasm/WasmCallee.h:
* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp: (JSC::LLInt::WASM_IPINT_EXTERN_CPP_DECL):
* Source/cmake/OptionsJSCOnly.cmake:
* Source/cmake/OptionsWin.cmake:

7ea2d98

Misc iOS, tvOS & watchOS macOS Linux Windows
βœ… πŸ§ͺ style ❌ πŸ›  ios ❌ πŸ›  mac   πŸ›  wpe βœ… πŸ›  wincairo
❌ πŸ›  ios-sim ❌ πŸ›  mac-AS-debug   πŸ§ͺ wpe-wk2
βœ… πŸ§ͺ webkitperl ❌ πŸ§ͺ ios-wk2 ❌ πŸ§ͺ api-mac ❌ πŸ›  gtk
❌ πŸ§ͺ ios-wk2-wpt ❌ πŸ§ͺ mac-wk1 ❌ πŸ§ͺ gtk-wk2
❌ πŸ›  πŸ§ͺ jsc ❌ πŸ§ͺ api-ios ❌ πŸ§ͺ mac-wk2 ❌ πŸ§ͺ api-gtk
❌ πŸ›  πŸ§ͺ jsc-arm64 ❌ πŸ›  tv ❌ πŸ§ͺ mac-AS-debug-wk2 ❌ πŸ›  jsc-armv7
❌ πŸ›  tv-sim ❌ πŸ§ͺ mac-wk2-stress ❌ πŸ§ͺ jsc-armv7-tests
❌ πŸ›  watch βœ… πŸ›  jsc-mips
❌ πŸ›  watch-sim βœ… πŸ§ͺ jsc-mips-tests

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 13, 2023
@iangrunert iangrunert added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label Oct 13, 2023
https://bugs.webkit.org/show_bug.cgi?id=145366

Reviewed by NOBODY (OOPS!).

Enabling webassembly at build time and disabling at runtime, as FTL
makes assumptions that webassembly is enabled. Should be able to apply
a cleaner patch once https://bugs.webkit.org/show_bug.cgi?id=222315
lands (awaiting PR review).

The BBQ JIT won't work on Windows even after the changes for enabling
webassembly on Windows land - it requires changes to GPR assignment so
it can use callee saves. With two fewer GPRs to work with it runs out of
GPRs to assign when running benchmarks.

Currently segfaulting during JetStream2 when running stanford-crypto-aes
(on most but not all runs, it occasionally works).

FTL is disabled on Windows for EnumeratorNextUpdateIndexAndMode. It
crashes on Windows with a segfault on a simple test with
JSC_useConcurrentJIT=false. If converted from UGPRPair return type back
to JSValue it works - so either something in the FTL lowering, or the
register allocator is having problems due to the extra return register
required.

```
function getMappedArguments() { return arguments; }

function forIn(object) {
    var keys = [];
    for (var key in object)
        keys.push(key);
    return keys;
}

noInline(forIn);

(function() {
    var mappedArguments = getMappedArguments(0, 1, 2);
    for (var i = 0; i < 1e4; ++i) {
        forIn(mappedArguments);
    }
    print('done');
})();
```

* Source/JavaScriptCore/b3/B3LowerToAir.cpp:
* Source/JavaScriptCore/b3/air/AirCCallSpecial.cpp:
(JSC::B3::Air::CCallSpecial::generate):
* Source/JavaScriptCore/b3/air/AirCCallingConvention.cpp:
* Source/JavaScriptCore/b3/air/AirCode.h:
(JSC::B3::Air::Code::regsInPriorityOrder const):
(JSC::B3::Air::Code::regsInPriorityOrderImpl):
* Source/JavaScriptCore/b3/air/AirPrintSpecial.h:
* Source/JavaScriptCore/b3/air/opcode_generator.rb:
* Source/JavaScriptCore/b3/air/testair.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_3.cpp:
(correctSqrt):
(testStorePartial8BitRegisterOnX86):
* Source/JavaScriptCore/b3/testb3_4.cpp:
(testLoadFromFramePointer):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* Source/JavaScriptCore/ftl/FTLOperations.h:
* Source/JavaScriptCore/ftl/FTLOutput.cpp:
(JSC::FTL::Output::baseIndex):
* Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp:
(JSC::FTL::SlowPathCallContext::SlowPathCallContext):
* Source/JavaScriptCore/jit/RegisterSet.cpp:
(JSC::RegisterSetBuilder::ftlCalleeSaveRegisters):
* Source/JavaScriptCore/llint/LLIntData.cpp:
(JSC::LLInt::initialize):
* Source/JavaScriptCore/llint/LLIntThunks.cpp:
(JSC::LLInt::untaggedPtr):
(JSC::LLInt::inPlaceInterpreterEntryThunk):
(JSC::LLInt::inPlaceInterpreterEntryThunkSIMD):
* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:
* Source/JavaScriptCore/llint/WebAssembly.asm:
* Source/JavaScriptCore/offlineasm/x86.rb:
* Source/JavaScriptCore/runtime/Options.cpp:
(JSC::Options::notifyOptionsChanged):
* Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::addI64TruncUF64):
(JSC::Wasm::B3IRGenerator::addI64TruncUF32):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJIT::RegisterBinding::none):
(JSC::Wasm::BBQJIT::addI32Rotl):
(JSC::Wasm::BBQJIT::addI64Rotl):
(JSC::Wasm::BBQJIT::addF32ConvertUI32):
(JSC::Wasm::BBQJIT::addF32ConvertUI64):
(JSC::Wasm::BBQJIT::addF64ConvertUI32):
(JSC::Wasm::BBQJIT::addF64ConvertUI64):
(JSC::Wasm::BBQJIT::addF32Copysign):
(JSC::Wasm::BBQJIT::addF64Copysign):
(JSC::Wasm::BBQJIT::addF32Abs):
(JSC::Wasm::BBQJIT::addF64Abs):
(JSC::Wasm::BBQJIT::addF32Neg):
(JSC::Wasm::BBQJIT::addF64Neg):
* Source/JavaScriptCore/wasm/WasmCallee.h:
* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp:
(JSC::LLInt::WASM_IPINT_EXTERN_CPP_DECL):
* Source/cmake/OptionsJSCOnly.cmake:
* Source/cmake/OptionsWin.cmake:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. merging-blocked Applied to prevent a change from being merged
Projects
None yet
3 participants