Title: [173837] trunk/Source/_javascript_Core
- Revision
- 173837
- Author
- [email protected]
- Date
- 2014-09-22 08:34:29 -0700 (Mon, 22 Sep 2014)
Log Message
FTL should store the four bytes of the cell header using a 32-bit store rather than four 8-bit stores
https://bugs.webkit.org/show_bug.cgi?id=136992
Reviewed by Sam Weinig.
LLVM ought to be able to do this optimization for us given how the code was written, but
any such lower-level attempts to optimize this would get into trouble with the weird
object materialization logic I'll be introducing in bug 136330. So, this brings the
merging of the byte stores into the FTL lowering so that we can control it explicitly.
* ftl/FTLAbstractHeap.h:
(JSC::FTL::AbstractHeap::changeParent):
* ftl/FTLAbstractHeapRepository.cpp:
(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::allocateCell):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (173836 => 173837)
--- trunk/Source/_javascript_Core/ChangeLog 2014-09-22 15:00:52 UTC (rev 173836)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-09-22 15:34:29 UTC (rev 173837)
@@ -1,3 +1,23 @@
+2014-09-21 Filip Pizlo <[email protected]>
+
+ FTL should store the four bytes of the cell header using a 32-bit store rather than four 8-bit stores
+ https://bugs.webkit.org/show_bug.cgi?id=136992
+
+ Reviewed by Sam Weinig.
+
+ LLVM ought to be able to do this optimization for us given how the code was written, but
+ any such lower-level attempts to optimize this would get into trouble with the weird
+ object materialization logic I'll be introducing in bug 136330. So, this brings the
+ merging of the byte stores into the FTL lowering so that we can control it explicitly.
+
+ * ftl/FTLAbstractHeap.h:
+ (JSC::FTL::AbstractHeap::changeParent):
+ * ftl/FTLAbstractHeapRepository.cpp:
+ (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+ * ftl/FTLAbstractHeapRepository.h:
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::allocateCell):
+
2014-09-21 Saam Barati <[email protected]>
Web Inspector: fix TypeSet hierarchy in TypeTokenView
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeap.h (173836 => 173837)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeap.h 2014-09-22 15:00:52 UTC (rev 173836)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeap.h 2014-09-22 15:34:29 UTC (rev 173837)
@@ -72,6 +72,11 @@
m_parent = parent;
m_heapName = heapName;
}
+
+ void changeParent(AbstractHeap* parent)
+ {
+ m_parent = parent;
+ }
AbstractHeap* parent() const
{
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp (173836 => 173837)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp 2014-09-22 15:00:52 UTC (rev 173836)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.cpp 2014-09-22 15:34:29 UTC (rev 173837)
@@ -61,6 +61,17 @@
, m_context(context)
, m_tbaaKind(mdKindID(m_context, "tbaa"))
{
+ // Make sure that our explicit assumptions about the StructureIDBlob match reality.
+ RELEASE_ASSERT(!(JSCell_indexingType.offset() & (sizeof(int32_t) - 1)));
+ RELEASE_ASSERT(JSCell_indexingType.offset() + 1 == JSCell_typeInfoType.offset());
+ RELEASE_ASSERT(JSCell_indexingType.offset() + 2 == JSCell_typeInfoFlags.offset());
+ RELEASE_ASSERT(JSCell_indexingType.offset() + 3 == JSCell_gcData.offset());
+
+ JSCell_indexingType.changeParent(&JSCell_usefulBytes);
+ JSCell_typeInfoType.changeParent(&JSCell_usefulBytes);
+ JSCell_typeInfoFlags.changeParent(&JSCell_usefulBytes);
+ JSCell_gcData.changeParent(&JSCell_usefulBytes);
+
root.m_tbaaMetadata = mdNode(m_context, mdString(m_context, root.m_heapName));
RELEASE_ASSERT(m_tbaaKind);
Modified: trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h (173836 => 173837)
--- trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2014-09-22 15:00:52 UTC (rev 173836)
+++ trunk/Source/_javascript_Core/ftl/FTLAbstractHeapRepository.h 2014-09-22 15:34:29 UTC (rev 173837)
@@ -52,6 +52,7 @@
macro(JSArrayBufferView_mode, JSArrayBufferView::offsetOfMode()) \
macro(JSArrayBufferView_vector, JSArrayBufferView::offsetOfVector()) \
macro(JSCell_structureID, JSCell::structureIDOffset()) \
+ macro(JSCell_usefulBytes, JSCell::indexingTypeOffset()) \
macro(JSCell_typeInfoFlags, JSCell::typeInfoFlagsOffset()) \
macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
macro(JSCell_indexingType, JSCell::indexingTypeOffset()) \
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (173836 => 173837)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2014-09-22 15:00:52 UTC (rev 173836)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2014-09-22 15:34:29 UTC (rev 173837)
@@ -4857,11 +4857,11 @@
allocator, m_heaps.MarkedAllocator_freeListHead);
m_out.store32(m_out.constInt32(structure->id()), result, m_heaps.JSCell_structureID);
- m_out.store8(m_out.constInt8(structure->indexingType()), result, m_heaps.JSCell_indexingType);
- m_out.store8(m_out.constInt8(structure->typeInfo().type()), result, m_heaps.JSCell_typeInfoType);
- m_out.store8(m_out.constInt8(structure->typeInfo().inlineTypeFlags()), result, m_heaps.JSCell_typeInfoFlags);
- m_out.store8(m_out.constInt8(JSCell::NotMarked), result, m_heaps.JSCell_gcData);
+ m_out.store32(
+ m_out.constInt32(structure->objectInitializationBlob()),
+ result, m_heaps.JSCell_usefulBytes);
+
return result;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
