Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[JSC] DFG AI should attempt to remove @tryGetById for String.replace #4522

Conversation

Constellation
Copy link
Member

@Constellation Constellation commented Sep 20, 2022

e289c32

[JSC] DFG AI should attempt to remove @tryGetById for String.replace
https://bugs.webkit.org/show_bug.cgi?id=245418

Reviewed by Ross Kirsling.

@tryGetById is adhoc one: it is used only in builtin code and used in very limited places.
So this patch introduces adhoc folding rules for @tryGetById to remove TryGetById attached before
String.replace. Unfortunately these @tryGetById are not usually removed since it is adhocly attached
in DFG fixup phase.
In this patch,

1. Ensure RegExp.prototype's properties via watchpoints.
2. Check structure in AI, and ensure that this structure is one for RegExpObject, its [[Prototype]] is RegExp.prototype, it is cacheable,
   and it does not have properties for particular names.

Then we fold TryGetById to RegExp's specific properties values. It eliminates these TryGetById and improves String.replace in DFG / FTL
by 65% (e.g. string-replace).

                                                         ToT                     Patched

    string-replace-generic                         33.0472+-0.1132     ^     31.9405+-0.1483        ^ definitely 1.0346x faster
    string-replace                                  3.3774+-0.0951     ^      2.0387+-0.0476        ^ definitely 1.6566x faster
    put-by-val-with-string-replace-and-transition
                                                    4.4385+-0.0233            4.4319+-0.0188
    string-replace-benchmark                       83.8759+-0.1186     ^     83.4655+-0.2393        ^ definitely 1.0049x faster
    string-replace-string                         380.3462+-0.7600          379.2646+-1.0203
    string-replace-empty                            3.2455+-0.0406     ^      2.0051+-0.1350        ^ definitely 1.6186x faster

* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Canonical link: https://commits.webkit.org/254717@main

cc558c3

Misc iOS, tvOS & watchOS macOS Linux Windows
βœ… πŸ§ͺ style βœ… πŸ›  ios   πŸ›  mac   πŸ›  wpe   πŸ›  πŸ§ͺ win
βœ… πŸ›  ios-sim   πŸ›  mac-debug βœ… πŸ›  gtk   πŸ›  wincairo
βœ… πŸ§ͺ webkitperl   πŸ§ͺ ios-wk2   πŸ›  mac-AS-debug   πŸ§ͺ gtk-wk2
  πŸ§ͺ api-ios   πŸ§ͺ api-mac   πŸ§ͺ api-gtk
βœ… πŸ›  πŸ§ͺ jsc   πŸ›  tv   πŸ§ͺ mac-wk1 βœ… πŸ›  jsc-armv7
  πŸ›  tv-sim   πŸ§ͺ mac-wk2 βœ… πŸ§ͺ jsc-armv7-tests
βœ… πŸ›  πŸ§ͺ merge   πŸ›  watch   πŸ§ͺ mac-AS-debug-wk2 βœ… πŸ›  jsc-mips
  πŸ›  watch-sim   πŸ§ͺ mac-wk2-stress βœ… πŸ§ͺ jsc-mips-tests

@Constellation Constellation requested a review from a team as a code owner September 20, 2022 09:05
@Constellation Constellation self-assigned this Sep 20, 2022
@Constellation Constellation added JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. WebKit Nightly Build labels Sep 20, 2022
Copy link
Member

@rkirsling rkirsling left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems okay, but...

  1. Ensure RegExp.prototype's properties via watchpoints.
  2. Check structure in AI, and ensure that this structure is one for RegExpObject, its [[Prototype]] is RegExp.prototype, it is cacheable,
    and it does not have properties for particular names.

...(1) appears to be existing functionality and not actually part of this patch?

@@ -3424,12 +3425,56 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
makeHeapTopForNode(node);
break;

case TryGetById:
case TryGetById: {
// This is very adhoc, but @tryGetById is not usually used in user code, and it is used adhocly in very limited places.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like you don't need the "usually"?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, dropped.

@Constellation
Copy link
Member Author

Seems okay, but...

  1. Ensure RegExp.prototype's properties via watchpoints.
  2. Check structure in AI, and ensure that this structure is one for RegExpObject, its [[Prototype]] is RegExp.prototype, it is cacheable,
    and it does not have properties for particular names.

...(1) appears to be existing functionality and not actually part of this patch?

Yes

@Constellation Constellation force-pushed the eng/JSC-DFG-AI-should-attempt-to-remove-tryGetById-for-String-replace branch from 21367ae to cc558c3 Compare September 21, 2022 06:05
@Constellation Constellation added the merge-queue Applied to send a pull request to merge-queue label Sep 21, 2022
@webkit-early-warning-system
Copy link
Collaborator

Starting EWS tests for cc558c3. Live statuses available at the PR page, #4522

https://bugs.webkit.org/show_bug.cgi?id=245418

Reviewed by Ross Kirsling.

@tryGetById is adhoc one: it is used only in builtin code and used in very limited places.
So this patch introduces adhoc folding rules for @tryGetById to remove TryGetById attached before
String.replace. Unfortunately these @tryGetById are not usually removed since it is adhocly attached
in DFG fixup phase.
In this patch,

1. Ensure RegExp.prototype's properties via watchpoints.
2. Check structure in AI, and ensure that this structure is one for RegExpObject, its [[Prototype]] is RegExp.prototype, it is cacheable,
   and it does not have properties for particular names.

Then we fold TryGetById to RegExp's specific properties values. It eliminates these TryGetById and improves String.replace in DFG / FTL
by 65% (e.g. string-replace).

                                                         ToT                     Patched

    string-replace-generic                         33.0472+-0.1132     ^     31.9405+-0.1483        ^ definitely 1.0346x faster
    string-replace                                  3.3774+-0.0951     ^      2.0387+-0.0476        ^ definitely 1.6566x faster
    put-by-val-with-string-replace-and-transition
                                                    4.4385+-0.0233            4.4319+-0.0188
    string-replace-benchmark                       83.8759+-0.1186     ^     83.4655+-0.2393        ^ definitely 1.0049x faster
    string-replace-string                         380.3462+-0.7600          379.2646+-1.0203
    string-replace-empty                            3.2455+-0.0406     ^      2.0051+-0.1350        ^ definitely 1.6186x faster

* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Canonical link: https://commits.webkit.org/254717@main
@webkit-commit-queue
Copy link
Collaborator

Committed 254717@main (e289c32): https://commits.webkit.org/254717@main

Reviewed commits have been landed. Closing PR #4522 and removing active labels.

@webkit-early-warning-system webkit-early-warning-system force-pushed the eng/JSC-DFG-AI-should-attempt-to-remove-tryGetById-for-String-replace branch from cc558c3 to e289c32 Compare September 21, 2022 07:38
@webkit-early-warning-system webkit-early-warning-system merged commit e289c32 into WebKit:main Sep 21, 2022
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Sep 21, 2022
@Constellation Constellation deleted the eng/JSC-DFG-AI-should-attempt-to-remove-tryGetById-for-String-replace branch September 21, 2022 17:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.
Projects
None yet
4 participants