Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (184919 => 184920)
--- trunk/Source/_javascript_Core/ChangeLog 2015-05-27 21:21:51 UTC (rev 184919)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-05-27 21:29:09 UTC (rev 184920)
@@ -1,3 +1,28 @@
+2015-05-26 Filip Pizlo <[email protected]>
+
+ JIT-generated store barrier code should assume the buffer pointer and capacity to be compile-time constants
+ https://bugs.webkit.org/show_bug.cgi?id=145404
+
+ Reviewed by Andreas Kling.
+
+ We never change the capacity of a write barrier buffer. We never repoint the buffer
+ pointer. So, the JIT shouldn't load those from memory; it should take advantage of the
+ fact that these are compile-time constants.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+ * heap/WriteBarrierBuffer.h:
+ (JSC::WriteBarrierBuffer::currentIndexAddress):
+ (JSC::WriteBarrierBuffer::capacity):
+ (JSC::WriteBarrierBuffer::buffer):
+ (JSC::WriteBarrierBuffer::currentIndexOffset): Deleted.
+ (JSC::WriteBarrierBuffer::capacityOffset): Deleted.
+ (JSC::WriteBarrierBuffer::bufferOffset): Deleted.
+ * jit/Repatch.cpp:
+ (JSC::emitPutTransitionStubAndGetOldStructure):
+
2015-05-27 Geoffrey Garen <[email protected]>
REGRESSION: These sorting idioms used by Peacekeeper and Browsermark are ~20X slower
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (184919 => 184920)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2015-05-27 21:21:51 UTC (rev 184919)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2015-05-27 21:29:09 UTC (rev 184920)
@@ -6125,15 +6125,14 @@
void SpeculativeJIT::storeToWriteBarrierBuffer(GPRReg cell, GPRReg scratch1, GPRReg scratch2)
{
ASSERT(scratch1 != scratch2);
- WriteBarrierBuffer* writeBarrierBuffer = &m_jit.vm()->heap.m_writeBarrierBuffer;
- m_jit.move(TrustedImmPtr(writeBarrierBuffer), scratch1);
- m_jit.load32(MacroAssembler::Address(scratch1, WriteBarrierBuffer::currentIndexOffset()), scratch2);
- JITCompiler::Jump needToFlush = m_jit.branch32(MacroAssembler::AboveOrEqual, scratch2, MacroAssembler::Address(scratch1, WriteBarrierBuffer::capacityOffset()));
+ WriteBarrierBuffer& writeBarrierBuffer = m_jit.vm()->heap.m_writeBarrierBuffer;
+ m_jit.load32(writeBarrierBuffer.currentIndexAddress(), scratch2);
+ JITCompiler::Jump needToFlush = m_jit.branch32(MacroAssembler::AboveOrEqual, scratch2, MacroAssembler::TrustedImm32(writeBarrierBuffer.capacity()));
m_jit.add32(TrustedImm32(1), scratch2);
- m_jit.store32(scratch2, MacroAssembler::Address(scratch1, WriteBarrierBuffer::currentIndexOffset()));
+ m_jit.store32(scratch2, writeBarrierBuffer.currentIndexAddress());
- m_jit.loadPtr(MacroAssembler::Address(scratch1, WriteBarrierBuffer::bufferOffset()), scratch1);
+ m_jit.move(TrustedImmPtr(writeBarrierBuffer.buffer()), scratch1);
// We use an offset of -sizeof(void*) because we already added 1 to scratch2.
m_jit.storePtr(cell, MacroAssembler::BaseIndex(scratch1, scratch2, MacroAssembler::ScalePtr, static_cast<int32_t>(-sizeof(void*))));
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (184919 => 184920)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2015-05-27 21:21:51 UTC (rev 184919)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2015-05-27 21:29:09 UTC (rev 184920)
@@ -7874,17 +7874,17 @@
// Append to the write barrier buffer.
LBasicBlock lastNext = m_out.appendTo(isMarkedAndNotRemembered, bufferHasSpace);
- LValue currentBufferIndex = m_out.load32(m_out.absolute(&vm().heap.writeBarrierBuffer().m_currentIndex));
- LValue bufferCapacity = m_out.load32(m_out.absolute(&vm().heap.writeBarrierBuffer().m_capacity));
+ LValue currentBufferIndex = m_out.load32(m_out.absolute(vm().heap.writeBarrierBuffer().currentIndexAddress()));
+ LValue bufferCapacity = m_out.constInt32(vm().heap.writeBarrierBuffer().capacity());
m_out.branch(
m_out.lessThan(currentBufferIndex, bufferCapacity),
usually(bufferHasSpace), rarely(bufferIsFull));
// Buffer has space, store to it.
m_out.appendTo(bufferHasSpace, bufferIsFull);
- LValue writeBarrierBufferBase = m_out.loadPtr(m_out.absolute(&vm().heap.writeBarrierBuffer().m_buffer));
+ LValue writeBarrierBufferBase = m_out.constIntPtr(vm().heap.writeBarrierBuffer().buffer());
m_out.storePtr(base, m_out.baseIndex(m_heaps.WriteBarrierBuffer_bufferContents, writeBarrierBufferBase, m_out.zeroExtPtr(currentBufferIndex)));
- m_out.store32(m_out.add(currentBufferIndex, m_out.constInt32(1)), m_out.absolute(&vm().heap.writeBarrierBuffer().m_currentIndex));
+ m_out.store32(m_out.add(currentBufferIndex, m_out.constInt32(1)), m_out.absolute(vm().heap.writeBarrierBuffer().currentIndexAddress()));
m_out.jump(continuation);
// Buffer is out of space, flush it.
Modified: trunk/Source/_javascript_Core/heap/WriteBarrierBuffer.cpp (184919 => 184920)
--- trunk/Source/_javascript_Core/heap/WriteBarrierBuffer.cpp 2015-05-27 21:21:51 UTC (rev 184919)
+++ trunk/Source/_javascript_Core/heap/WriteBarrierBuffer.cpp 2015-05-27 21:29:09 UTC (rev 184920)
@@ -44,7 +44,6 @@
WriteBarrierBuffer::~WriteBarrierBuffer()
{
fastFree(m_buffer);
- m_buffer = 0;
}
void WriteBarrierBuffer::flush(Heap& heap)
Modified: trunk/Source/_javascript_Core/heap/WriteBarrierBuffer.h (184919 => 184920)
--- trunk/Source/_javascript_Core/heap/WriteBarrierBuffer.h 2015-05-27 21:21:51 UTC (rev 184919)
+++ trunk/Source/_javascript_Core/heap/WriteBarrierBuffer.h 2015-05-27 21:29:09 UTC (rev 184920)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -33,10 +33,7 @@
class Heap;
class JSCell;
-namespace FTL { class LowerDFGToLLVM; }
-
class WriteBarrierBuffer {
- friend class FTL::LowerDFGToLLVM;
public:
WriteBarrierBuffer(unsigned capacity);
~WriteBarrierBuffer();
@@ -45,25 +42,25 @@
void flush(Heap&);
void reset();
- static ptrdiff_t currentIndexOffset()
+ unsigned* currentIndexAddress()
{
- return OBJECT_OFFSETOF(WriteBarrierBuffer, m_currentIndex);
+ return &m_currentIndex;
}
- static ptrdiff_t capacityOffset()
+ unsigned capacity() const
{
- return OBJECT_OFFSETOF(WriteBarrierBuffer, m_capacity);
+ return m_capacity;
}
- static ptrdiff_t bufferOffset()
+ JSCell** buffer()
{
- return OBJECT_OFFSETOF(WriteBarrierBuffer, m_buffer);
+ return m_buffer;
}
private:
unsigned m_currentIndex;
- unsigned m_capacity;
- JSCell** m_buffer;
+ const unsigned m_capacity;
+ JSCell** const m_buffer;
};
} // namespace JSC
Modified: trunk/Source/_javascript_Core/jit/Repatch.cpp (184919 => 184920)
--- trunk/Source/_javascript_Core/jit/Repatch.cpp 2015-05-27 21:21:51 UTC (rev 184919)
+++ trunk/Source/_javascript_Core/jit/Repatch.cpp 2015-05-27 21:29:09 UTC (rev 184920)
@@ -1169,16 +1169,15 @@
MacroAssembler::Call callFlushWriteBarrierBuffer;
MacroAssembler::Jump ownerIsRememberedOrInEden = stubJit.jumpIfIsRememberedOrInEden(baseGPR);
{
- WriteBarrierBuffer* writeBarrierBuffer = &stubJit.vm()->heap.writeBarrierBuffer();
- stubJit.move(MacroAssembler::TrustedImmPtr(writeBarrierBuffer), scratchGPR1);
- stubJit.load32(MacroAssembler::Address(scratchGPR1, WriteBarrierBuffer::currentIndexOffset()), scratchGPR2);
+ WriteBarrierBuffer& writeBarrierBuffer = stubJit.vm()->heap.writeBarrierBuffer();
+ stubJit.load32(writeBarrierBuffer.currentIndexAddress(), scratchGPR2);
MacroAssembler::Jump needToFlush =
- stubJit.branch32(MacroAssembler::AboveOrEqual, scratchGPR2, MacroAssembler::Address(scratchGPR1, WriteBarrierBuffer::capacityOffset()));
+ stubJit.branch32(MacroAssembler::AboveOrEqual, scratchGPR2, MacroAssembler::TrustedImm32(writeBarrierBuffer.capacity()));
stubJit.add32(MacroAssembler::TrustedImm32(1), scratchGPR2);
- stubJit.store32(scratchGPR2, MacroAssembler::Address(scratchGPR1, WriteBarrierBuffer::currentIndexOffset()));
+ stubJit.store32(scratchGPR2, writeBarrierBuffer.currentIndexAddress());
- stubJit.loadPtr(MacroAssembler::Address(scratchGPR1, WriteBarrierBuffer::bufferOffset()), scratchGPR1);
+ stubJit.move(MacroAssembler::TrustedImmPtr(writeBarrierBuffer.buffer()), scratchGPR1);
// We use an offset of -sizeof(void*) because we already added 1 to scratchGPR2.
stubJit.storePtr(baseGPR, MacroAssembler::BaseIndex(scratchGPR1, scratchGPR2, MacroAssembler::ScalePtr, static_cast<int32_t>(-sizeof(void*))));
