Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4ae6483cec93af044af3c2ca0b8b6baf1447843a
https://github.com/WebKit/WebKit/commit/4ae6483cec93af044af3c2ca0b8b6baf1447843a
Author: Keith Miller <[email protected]>
Date: 2025-03-16 (Sun, 16 Mar 2025)
Changed paths:
M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
M
Source/JavaScriptCore/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations
M
Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
M Source/JavaScriptCore/Sources.txt
M Source/JavaScriptCore/heap/Heap.h
M Source/JavaScriptCore/runtime/BrandedStructure.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/Structure.cpp
M Source/JavaScriptCore/runtime/Structure.h
M Source/JavaScriptCore/runtime/StructureInlines.h
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmFormat.cpp
M Source/JavaScriptCore/wasm/WasmModuleInformation.h
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp
M Source/JavaScriptCore/wasm/WasmOperations.cpp
M Source/JavaScriptCore/wasm/WasmOperationsInlines.h
M Source/JavaScriptCore/wasm/WasmSectionParser.cpp
M Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h
M Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
M Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.h
M Source/JavaScriptCore/wasm/js/WebAssemblyGCObjectBase.cpp
M Source/JavaScriptCore/wasm/js/WebAssemblyGCObjectBase.h
A Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.cpp
A Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.h
Log Message:
-----------
[Wasm] GC objects should not require destructors
https://bugs.webkit.org/show_bug.cgi?id=289811
rdar://147064715
Reviewed by Yusuke Suzuki.
This patch removes the need for destructors on Wasm GC objects. To do this the
RTT and TypeDefinition
have been moved into the structure rather than the object itself. This means
adding a new Structure
subtype WebAssemblyGCStructure. This patch doesn't bother trying to cache or
deduplicate these structures
because:
1) There's typically only one instance per module.
2) We don't have global GC so we can't duplicate across threads.
3) We don't do optimizations on the identity of the structure in Wasm so it's
unlikely to do much.
4) JS can't access any fields from wasm structs/arrays directly.
Since we don't have a global GC all the structures have to be cached on the
instance in a new trailing array
that has a typeIndex -> structure map.
In a subsequent patch we will start allocating these objects directly in the
JIT rather than in C++.
This change is a 40% win on Dart-flute-wasm in JS3 (11s -> 7s).
* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
* Source/JavaScriptCore/Sources.txt:
* Source/JavaScriptCore/heap/Heap.cpp:
(JSC::Heap::Heap):
* Source/JavaScriptCore/heap/Heap.h:
* Source/JavaScriptCore/runtime/BrandedStructure.cpp:
(JSC::BrandedStructure::BrandedStructure):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::~Structure):
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::variant const):
(JSC::Structure::isBrandedStructure):
* Source/JavaScriptCore/runtime/StructureInlines.h:
(JSC::Structure::create):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::emitArrayGetPayload):
* Source/JavaScriptCore/wasm/WasmFormat.cpp:
(JSC::Wasm::validateWasmValue):
* Source/JavaScriptCore/wasm/WasmModuleInformation.h:
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::emitGetArrayPayloadBase):
(JSC::Wasm::OMGIRGenerator::emitRefTestOrCast):
(JSC::Wasm::OMGIRGenerator::decodeNonNullStructure):
(JSC::Wasm::OMGIRGenerator::emitLoadRTTFromObject):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp:
(JSC::Wasm::OMGIRGenerator::emitGetArrayPayloadBase):
* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/wasm/WasmOperationsInlines.h:
(JSC::Wasm::fillArray):
(JSC::Wasm::arrayNew):
(JSC::Wasm::copyElementsInReverse):
(JSC::Wasm::arrayNewFixed):
(JSC::Wasm::createArrayFromDataSegment):
(JSC::Wasm::arrayNewData):
(JSC::Wasm::arrayNewElem):
(JSC::Wasm::structNew):
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseType):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::TypeInformation::castReference):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp:
(JSC::JSWebAssemblyArray::JSWebAssemblyArray):
(JSC::JSWebAssemblyArray::fill):
(JSC::JSWebAssemblyArray::createStructure): Deleted.
(JSC::JSWebAssemblyArray::destroy): Deleted.
* Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h:
* Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h:
(JSC::JSWebAssemblyArray::createStructure):
(JSC::JSWebAssemblyArray::span):
(JSC::JSWebAssemblyArray::bytes):
(JSC::JSWebAssemblyArray::visitSpan):
(JSC::JSWebAssemblyArray::visitSpanNonVector):
(JSC::JSWebAssemblyArray::set):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:
(JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
(JSC::JSWebAssemblyInstance::finishCreation):
(JSC::JSWebAssemblyInstance::visitChildrenImpl):
(JSC::JSWebAssemblyInstance::tryCreate):
(JSC::JSWebAssemblyInstance::extraMemoryAllocated const): Deleted.
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:
* Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp:
(JSC::JSWebAssemblyStruct::JSWebAssemblyStruct):
(JSC::JSWebAssemblyStruct::create):
(JSC::JSWebAssemblyStruct::createStructure): Deleted.
(JSC::JSWebAssemblyStruct::destroy): Deleted.
* Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.h:
(JSC::JSWebAssemblyStruct::createStructure):
* Source/JavaScriptCore/wasm/js/WebAssemblyGCObjectBase.cpp:
(JSC::WebAssemblyGCObjectBase::WebAssemblyGCObjectBase):
* Source/JavaScriptCore/wasm/js/WebAssemblyGCObjectBase.h:
(JSC::WebAssemblyGCObjectBase::gcStructure const):
(JSC::WebAssemblyGCObjectBase::rtt const):
(JSC::WebAssemblyGCObjectBase::rtt): Deleted.
(JSC::WebAssemblyGCObjectBase::offsetOfRTT): Deleted.
* Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.cpp: Copied from
Source/JavaScriptCore/runtime/BrandedStructure.cpp.
(JSC::WebAssemblyGCStructure::WebAssemblyGCStructure):
(JSC::WebAssemblyGCStructure::create):
* Source/JavaScriptCore/wasm/js/WebAssemblyGCStructure.h: Added.
Canonical link: https://commits.webkit.org/292257@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
