Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (268941 => 268942)
--- trunk/Source/_javascript_Core/ChangeLog 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-10-23 22:53:30 UTC (rev 268942)
@@ -1,3 +1,37 @@
+2020-10-23 Keith Miller <[email protected]>
+
+ Using WASM function size as the cap for choosing a register allocator causes performance regressions.
+ https://bugs.webkit.org/show_bug.cgi?id=217290
+
+ Reviewed by Michael Saboff.
+
+ Previously in https://bugs.webkit.org/show_bug.cgi?id=212105 we
+ limited the size of WASM functions we compile with OMG because
+ sufficiently large functions caused us to OOM while register
+ allocating. The memory growth we saw is because the memory usage
+ of graph coloring is O((number of tmps)^2). However, some large
+ WASM functions may not have that many tmps by the time we get to
+ register allocation. This patch changes our heuristic to instead
+ use the total number of tmps right before register allocation
+ instead of the WASM function size. The number of tmps is more
+ likely to represent the worst case memory usage of register
+ allocation. This fixes a performance regression in Safari 14 when running
+ https://dos.zone/en/play/https%3A%2F%2Fdoszone-uploads.s3.dualstack.eu-central-1.amazonaws.com%2Foriginal%2F2X%2Fb%2Fb4b5275904d86a4ab8a20917b2b7e34f0df47bf7.jsdos
+
+ * b3/air/AirGenerate.cpp:
+ (JSC::B3::Air::prepareForGeneration):
+ * runtime/OptionsList.h:
+ * wasm/WasmAirIRGenerator.cpp:
+ (JSC::Wasm::AirIRGenerator::AirIRGenerator):
+ * wasm/WasmB3IRGenerator.cpp:
+ (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+ (JSC::Wasm::parseAndCompile):
+ * wasm/WasmCompilationMode.cpp:
+ (JSC::Wasm::wasmFunctionSizeCanBeOMGCompiled): Deleted.
+ * wasm/WasmCompilationMode.h:
+ * wasm/WasmOperations.cpp:
+ (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
+
2020-10-23 Angelos Oikonomopoulos <[email protected]>
[JSC] Fix argument order for double and/or ops on ARMv7
Modified: trunk/Source/_javascript_Core/b3/air/AirGenerate.cpp (268941 => 268942)
--- trunk/Source/_javascript_Core/b3/air/AirGenerate.cpp 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/b3/air/AirGenerate.cpp 2020-10-23 22:53:30 UTC (rev 268942)
@@ -110,7 +110,8 @@
eliminateDeadCode(code);
- if (code.optLevel() == 1) {
+ size_t numTmps = code.numTmps(Bank::GP) + code.numTmps(Bank::FP);
+ if (code.optLevel() == 1 || numTmps > Options::maximumTmpsForGraphColoring()) {
// When we're compiling quickly, we do register and stack allocation in one linear scan
// phase. It's fast because it computes liveness only once.
allocateRegistersAndStackByLinearScan(code);
Modified: trunk/Source/_javascript_Core/runtime/OptionsList.h (268941 => 268942)
--- trunk/Source/_javascript_Core/runtime/OptionsList.h 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/runtime/OptionsList.h 2020-10-23 22:53:30 UTC (rev 268942)
@@ -413,6 +413,7 @@
\
v(Bool, logPhaseTimes, false, Normal, nullptr) \
v(Double, rareBlockPenalty, 0.001, Normal, nullptr) \
+ v(Unsigned, maximumTmpsForGraphColoring, 25000, Normal, "The maximum number of tmps an Air program can have before always register allocating with Linear Scan") \
v(Bool, airLinearScanVerbose, false, Normal, nullptr) \
v(Bool, airLinearScanSpillsEverything, false, Normal, nullptr) \
v(Bool, airForceBriggsAllocator, false, Normal, nullptr) \
@@ -457,7 +458,6 @@
v(Unsigned, webAssemblyBBQAirOptimizationLevel, 0, Normal, "Air Optimization level for BBQ Web Assembly module compilations.") \
v(Unsigned, webAssemblyBBQB3OptimizationLevel, 1, Normal, "B3 Optimization level for BBQ Web Assembly module compilations.") \
v(Unsigned, webAssemblyOMGOptimizationLevel, Options::defaultB3OptLevel(), Normal, "B3 Optimization level for OMG Web Assembly module compilations.") \
- v(Unsigned, webAssemblyBBQFallbackSize, 60000, Normal, "Limit of Wasm function size above which we fallback to BBQ compilation mode.") \
\
v(Bool, useBBQTierUpChecks, true, Normal, "Enables tier up checks for our BBQ code.") \
v(Bool, useWebAssemblyOSR, true, Normal, nullptr) \
Modified: trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp (268941 => 268942)
--- trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2020-10-23 22:53:30 UTC (rev 268942)
@@ -893,8 +893,7 @@
}
}
- if (wasmFunctionSizeCanBeOMGCompiled(m_info.functions[m_functionIndex].data.size()))
- emitEntryTierUpCheck();
+ emitEntryTierUpCheck();
}
B3::Type AirIRGenerator::toB3ResultType(BlockSignature returnType)
Modified: trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp (268941 => 268942)
--- trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2020-10-23 22:53:30 UTC (rev 268942)
@@ -537,8 +537,7 @@
});
}
- if (wasmFunctionSizeCanBeOMGCompiled(m_info.functions[m_functionIndex].data.size()))
- emitEntryTierUpCheck();
+ emitEntryTierUpCheck();
if (m_compilationMode == CompilationMode::OMGForOSREntryMode)
m_currentBlock = m_proc.addBlock();
@@ -1974,7 +1973,7 @@
// optLevel=1.
procedure.setNeedsUsedRegisters(false);
- procedure.setOptLevel(compilationMode == CompilationMode::BBQMode || !wasmFunctionSizeCanBeOMGCompiled(function.data.size())
+ procedure.setOptLevel(compilationMode == CompilationMode::BBQMode
? Options::webAssemblyBBQB3OptimizationLevel()
: Options::webAssemblyOMGOptimizationLevel());
Modified: trunk/Source/_javascript_Core/wasm/WasmCompilationMode.cpp (268941 => 268942)
--- trunk/Source/_javascript_Core/wasm/WasmCompilationMode.cpp 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/wasm/WasmCompilationMode.cpp 2020-10-23 22:53:30 UTC (rev 268942)
@@ -49,9 +49,4 @@
return "";
}
-bool wasmFunctionSizeCanBeOMGCompiled(size_t size)
-{
- return size < Options::webAssemblyBBQFallbackSize();
-}
-
} } // namespace JSC::Wasm
Modified: trunk/Source/_javascript_Core/wasm/WasmCompilationMode.h (268941 => 268942)
--- trunk/Source/_javascript_Core/wasm/WasmCompilationMode.h 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/wasm/WasmCompilationMode.h 2020-10-23 22:53:30 UTC (rev 268942)
@@ -36,6 +36,5 @@
};
const char* makeString(CompilationMode);
-bool wasmFunctionSizeCanBeOMGCompiled(size_t);
} } // namespace JSC::Wasm
Modified: trunk/Source/_javascript_Core/wasm/WasmOperations.cpp (268941 => 268942)
--- trunk/Source/_javascript_Core/wasm/WasmOperations.cpp 2020-10-23 21:27:27 UTC (rev 268941)
+++ trunk/Source/_javascript_Core/wasm/WasmOperations.cpp 2020-10-23 22:53:30 UTC (rev 268942)
@@ -268,11 +268,6 @@
dataLogLnIf(Options::verboseOSR(), "Consider OMGForOSREntryPlan for [", functionIndex, "] loopIndex#", loopIndex, " with executeCounter = ", tierUp, " ", RawPointer(callee.replacement()));
if (!Options::useWebAssemblyOSR()) {
- if (!wasmFunctionSizeCanBeOMGCompiled(instance->module().moduleInformation().functions[functionIndex].data.size())) {
- tierUp.deferIndefinitely();
- return returnWithoutOSREntry();
- }
-
if (shouldTriggerOMGCompile(tierUp, callee.replacement(), functionIndex))
triggerOMGReplacementCompile(tierUp, callee.replacement(), instance, codeBlock, functionIndex);
@@ -339,9 +334,6 @@
return returnWithoutOSREntry();
if (!triggeredSlowPathToStartCompilation) {
- if (!wasmFunctionSizeCanBeOMGCompiled(instance->module().moduleInformation().functions[functionIndex].data.size()))
- return returnWithoutOSREntry();
-
triggerOMGReplacementCompile(tierUp, callee.replacement(), instance, codeBlock, functionIndex);
if (!callee.replacement())
