Skip to content

[JSC] Make DataIC inline code adaptive#32085

Merged
webkit-commit-queue merged 1 commit intoWebKit:mainfrom
Constellation:eng/JSC-Make-DataIC-inline-code-adaptive
Aug 13, 2024
Merged

[JSC] Make DataIC inline code adaptive#32085
webkit-commit-queue merged 1 commit intoWebKit:mainfrom
Constellation:eng/JSC-Make-DataIC-inline-code-adaptive

Conversation

@Constellation
Copy link
Copy Markdown
Member

@Constellation Constellation commented Aug 13, 2024

9fa6f1a

[JSC] Make DataIC inline code adaptive
https://bugs.webkit.org/show_bug.cgi?id=277992
rdar://133724890

Reviewed by Keith Miller.

This patch make inlined part of DataIC code adaptive by getting some information from lower tiers.
In Baseline, we use LLInt's GetByIdMode's metadata and use GetByIdSelf or GetByIdPrototype.
In DFG, we use GetByStatus' information and pick appropriate one for inline cache code.

Instead of having very special cache for inlined code in DataIC, we use InlineCacheHandler.
We hold this inlined case as m_inlinedHandler so that watchpoint etc. works well: when invariant
gets broken, StructureStubInfo gets cleared.

* Source/JavaScriptCore/bytecode/GetByStatus.cpp:
(JSC::GetByStatus::preferredCacheType const):
* Source/JavaScriptCore/bytecode/GetByStatus.h:
* Source/JavaScriptCore/bytecode/InlineAccess.cpp:
(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheHandler::InlineCacheHandler):
(JSC::m_watchpoint):
(JSC::InlineCacheHandler::create):
(JSC::InlineCacheHandler::createPreCompiled):
(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):
(JSC::m_next): Deleted.
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.h:
* Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::aboutToDie):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::callLinkInfoAt):
(JSC::StructureStubInfo::containsPC const):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
(JSC::StructureStubInfo::initializeFromDFGUnlinkedStructureStubInfo):
(JSC::StructureStubInfo::setInlinedHandler):
(JSC::StructureStubInfo::clearInlinedHandler):
(JSC::StructureStubInfo::initializeWithUnitHandler):
(JSC::StructureStubInfo::prependHandler):
(JSC::StructureStubInfo::rewireStubAsJumpInAccess):
(JSC::StructureStubInfo::resetStubAsJumpInAccess):
(JSC::StructureStubInfo::replaceHandler): Deleted.
* Source/JavaScriptCore/bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::offsetOfInlineHolder):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handleGetPrivateNameById):
(JSC::DFG::ByteCodeParser::handleDeleteById):
(JSC::DFG::ByteCodeParser::parseBlock):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::addStringReplacePrimordialChecks):
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToGetByIdMaybeMegamorphic):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::cacheableIdentifier):
(JSC::DFG::Node::hasGetByIdData const):
(JSC::DFG::Node::getByIdData):
(JSC::DFG::Node::hasCacheType const):
(JSC::DFG::Node::cacheType):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
(JSC::DFG::SpeculativeJIT::compileGetByVal):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileGetByValWithThis):
(JSC::DFG::SpeculativeJIT::compileGetById):
(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):
(JSC::DFG::SpeculativeJIT::compileInById):
(JSC::DFG::SpeculativeJIT::compileInByVal):
(JSC::DFG::SpeculativeJIT::compileHasPrivate):
(JSC::DFG::SpeculativeJIT::compilePutByVal):
(JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal):
(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand):
(JSC::DFG::SpeculativeJIT::compileSetPrivateBrand):
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compileEnumeratorPutByVal):
* Source/JavaScriptCore/jit/BaselineJITRegisters.h:
* Source/JavaScriptCore/jit/JITCall.cpp:
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
* Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:
(JSC::JITInlineCacheGenerator::generateDataICFastPath):
(JSC::generateGetByIdInlineAccessBaselineDataIC):
(JSC::JITGetByIdGenerator::generateDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateDataICFastPath):
(JSC::JITPutByIdGenerator::generateDataICFastPath):
(JSC::JITDelByValGenerator::generateDataICFastPath):
(JSC::JITDelByIdGenerator::generateDataICFastPath):
(JSC::JITInByValGenerator::generateDataICFastPath):
(JSC::JITInByIdGenerator::generateDataICFastPath):
(JSC::JITInstanceOfGenerator::generateDataICFastPath):
(JSC::JITGetByValGenerator::generateDataICFastPath):
(JSC::JITGetByValWithThisGenerator::generateDataICFastPath):
(JSC::JITPutByValGenerator::generateDataICFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateDataICFastPath):
(JSC::JITInlineCacheGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByIdGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByIdWithThisGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITPutByIdGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITDelByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITDelByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITInByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITInByIdGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITInstanceOfGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByValWithThisGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITPutByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITPrivateBrandAccessGenerator::generateBaselineDataICFastPath): Deleted.
* Source/JavaScriptCore/jit/JITInlineCacheGenerator.h:
* Source/JavaScriptCore/jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_instanceof):
* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_get_length):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emit_op_get_by_val_with_this):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_op_enumerator_put_by_val):

Canonical link: https://commits.webkit.org/282181@main

353c03d

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug 🧪 wpe-wk2 ✅ 🧪 wincairo-tests
✅ 🧪 webkitperl 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 vision 🧪 mac-AS-debug-wk2 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 🧪 unsafe-merge 🛠 tv ❌ 🧪 jsc-armv7-tests
🛠 tv-sim
🛠 watch
🛠 watch-sim

@Constellation Constellation requested a review from a team as a code owner August 13, 2024 00:29
@Constellation Constellation self-assigned this Aug 13, 2024
@Constellation Constellation added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label Aug 13, 2024
@Constellation Constellation force-pushed the eng/JSC-Make-DataIC-inline-code-adaptive branch from 633c291 to e8601ba Compare August 13, 2024 02:03
@Constellation Constellation force-pushed the eng/JSC-Make-DataIC-inline-code-adaptive branch from e8601ba to 02fc2ad Compare August 13, 2024 02:44
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Aug 13, 2024
@Constellation Constellation removed the merging-blocked Applied to prevent a change from being merged label Aug 13, 2024
@Constellation Constellation force-pushed the eng/JSC-Make-DataIC-inline-code-adaptive branch from 02fc2ad to 89998d7 Compare August 13, 2024 06:37
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Aug 13, 2024
@Constellation Constellation removed the merging-blocked Applied to prevent a change from being merged label Aug 13, 2024
@Constellation Constellation force-pushed the eng/JSC-Make-DataIC-inline-code-adaptive branch from 89998d7 to 8faa42a Compare August 13, 2024 15:32
Copy link
Copy Markdown
Contributor

@kmiller68 kmiller68 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me with nit.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: I would have these default to CacheType::Unset since it seems like a vast majority of callers pass that anyway.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed finishCreation... one since it always pass CacheType to this function.

@Constellation Constellation force-pushed the eng/JSC-Make-DataIC-inline-code-adaptive branch from 8faa42a to 353c03d Compare August 13, 2024 17:43
@Constellation Constellation added the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Aug 13, 2024
https://bugs.webkit.org/show_bug.cgi?id=277992
rdar://133724890

Reviewed by Keith Miller.

This patch make inlined part of DataIC code adaptive by getting some information from lower tiers.
In Baseline, we use LLInt's GetByIdMode's metadata and use GetByIdSelf or GetByIdPrototype.
In DFG, we use GetByStatus' information and pick appropriate one for inline cache code.

Instead of having very special cache for inlined code in DataIC, we use InlineCacheHandler.
We hold this inlined case as m_inlinedHandler so that watchpoint etc. works well: when invariant
gets broken, StructureStubInfo gets cleared.

* Source/JavaScriptCore/bytecode/GetByStatus.cpp:
(JSC::GetByStatus::preferredCacheType const):
* Source/JavaScriptCore/bytecode/GetByStatus.h:
* Source/JavaScriptCore/bytecode/InlineAccess.cpp:
(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheHandler::InlineCacheHandler):
(JSC::m_watchpoint):
(JSC::InlineCacheHandler::create):
(JSC::InlineCacheHandler::createPreCompiled):
(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):
(JSC::m_next): Deleted.
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.h:
* Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::aboutToDie):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::callLinkInfoAt):
(JSC::StructureStubInfo::containsPC const):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
(JSC::StructureStubInfo::initializeFromDFGUnlinkedStructureStubInfo):
(JSC::StructureStubInfo::setInlinedHandler):
(JSC::StructureStubInfo::clearInlinedHandler):
(JSC::StructureStubInfo::initializeWithUnitHandler):
(JSC::StructureStubInfo::prependHandler):
(JSC::StructureStubInfo::rewireStubAsJumpInAccess):
(JSC::StructureStubInfo::resetStubAsJumpInAccess):
(JSC::StructureStubInfo::replaceHandler): Deleted.
* Source/JavaScriptCore/bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::offsetOfInlineHolder):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handleGetPrivateNameById):
(JSC::DFG::ByteCodeParser::handleDeleteById):
(JSC::DFG::ByteCodeParser::parseBlock):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::addStringReplacePrimordialChecks):
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToGetByIdMaybeMegamorphic):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::cacheableIdentifier):
(JSC::DFG::Node::hasGetByIdData const):
(JSC::DFG::Node::getByIdData):
(JSC::DFG::Node::hasCacheType const):
(JSC::DFG::Node::cacheType):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
(JSC::DFG::SpeculativeJIT::compileGetByVal):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileGetByValWithThis):
(JSC::DFG::SpeculativeJIT::compileGetById):
(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):
(JSC::DFG::SpeculativeJIT::compileInById):
(JSC::DFG::SpeculativeJIT::compileInByVal):
(JSC::DFG::SpeculativeJIT::compileHasPrivate):
(JSC::DFG::SpeculativeJIT::compilePutByVal):
(JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal):
(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand):
(JSC::DFG::SpeculativeJIT::compileSetPrivateBrand):
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compileEnumeratorPutByVal):
* Source/JavaScriptCore/jit/BaselineJITRegisters.h:
* Source/JavaScriptCore/jit/JITCall.cpp:
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
* Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:
(JSC::JITInlineCacheGenerator::generateDataICFastPath):
(JSC::generateGetByIdInlineAccessBaselineDataIC):
(JSC::JITGetByIdGenerator::generateDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateDataICFastPath):
(JSC::JITPutByIdGenerator::generateDataICFastPath):
(JSC::JITDelByValGenerator::generateDataICFastPath):
(JSC::JITDelByIdGenerator::generateDataICFastPath):
(JSC::JITInByValGenerator::generateDataICFastPath):
(JSC::JITInByIdGenerator::generateDataICFastPath):
(JSC::JITInstanceOfGenerator::generateDataICFastPath):
(JSC::JITGetByValGenerator::generateDataICFastPath):
(JSC::JITGetByValWithThisGenerator::generateDataICFastPath):
(JSC::JITPutByValGenerator::generateDataICFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateDataICFastPath):
(JSC::JITInlineCacheGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByIdGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByIdWithThisGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITPutByIdGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITDelByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITDelByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITInByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITInByIdGenerator::generateDFGDataICFastPath): Deleted.
(JSC::JITInstanceOfGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITGetByValWithThisGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITPutByValGenerator::generateBaselineDataICFastPath): Deleted.
(JSC::JITPrivateBrandAccessGenerator::generateBaselineDataICFastPath): Deleted.
* Source/JavaScriptCore/jit/JITInlineCacheGenerator.h:
* Source/JavaScriptCore/jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_instanceof):
* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_get_length):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emit_op_get_by_val_with_this):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_op_enumerator_put_by_val):

Canonical link: https://commits.webkit.org/282181@main
@webkit-commit-queue webkit-commit-queue force-pushed the eng/JSC-Make-DataIC-inline-code-adaptive branch from 353c03d to 9fa6f1a Compare August 13, 2024 18:58
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 282181@main (9fa6f1a): https://commits.webkit.org/282181@main

Reviewed commits have been landed. Closing PR #32085 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit 9fa6f1a into WebKit:main Aug 13, 2024
@webkit-commit-queue webkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Aug 13, 2024
@Constellation Constellation deleted the eng/JSC-Make-DataIC-inline-code-adaptive branch August 13, 2024 18:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants