DFG should be able to do JS and custom getter caching
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 17 Jan 2012 00:53:40 +0000 (00:53 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 17 Jan 2012 00:53:40 +0000 (00:53 +0000)
commit7be03035220f3a61f84eefc200a50d93ee573e75
treeea865a53a4cf4861bd739fceabb4476d31faa00b
parent4911ff64ef197105d7ef474ddf4bed33e3b157f0
DFG should be able to do JS and custom getter caching
https://bugs.webkit.org/show_bug.cgi?id=76361
<rdar://problem/10698060>

Source/JavaScriptCore:

Reviewed by Geoff Garen.

Added the ability to cache JS getter calls and custom getter calls in the DFG.
Most of this is pretty mundane, since the old JIT supported this functionality
as well. But a couple interesting things had to happen:

- There are now two variants of GetById: GetById, which works as before, and
  GetByIdFlush, which flushes registers prior to doing the GetById. Only
  GetByIdFlush can be used for caching getters. We detect which GetById style
  to use by looking at the inline caches of the old JIT.

- Exception handling for getter calls planted in stubs uses a separate lookup
  handler routine, which uses the CodeOrigin stored in the StructureStubInfo.

This is a 40% speed-up in the Dromaeo DOM Traversal average. It removes all of
the DFG regressions we saw in Dromaeo. This is neutral on SunSpider, V8, and
Kraken.

* bytecode/StructureStubInfo.h:
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGAssemblyHelpers.h:
(JSC::DFG::AssemblyHelpers::emitExceptionCheck):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::willNeedFlush):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCCallHelpers.h:
(JSC::DFG::CCallHelpers::setupResults):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):
* dfg/DFGJITCompiler.h:
(JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
(JSC::DFG::JITCompiler::addExceptionCheck):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::propagateNodePredictions):
* dfg/DFGRepatch.cpp:
(JSC::DFG::tryCacheGetByID):
(JSC::DFG::tryBuildGetByIDList):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Geoff Garen.

* fast/js/dfg-custom-getter-expected.txt: Added.
* fast/js/dfg-custom-getter-throw-expected.txt: Added.
* fast/js/dfg-custom-getter-throw-inlined-expected.txt: Added.
* fast/js/dfg-custom-getter-throw-inlined.html: Added.
* fast/js/dfg-custom-getter-throw.html: Added.
* fast/js/dfg-custom-getter.html: Added.
* fast/js/dfg-getter-expected.txt: Added.
* fast/js/dfg-getter-throw-expected.txt: Added.
* fast/js/dfg-getter-throw.html: Added.
* fast/js/dfg-getter.html: Added.
* fast/js/script-tests/dfg-custom-getter-throw-inlined.js: Added.
(foo):
(baz):
(bar):
* fast/js/script-tests/dfg-custom-getter-throw.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-custom-getter.js: Added.
(foo):
* fast/js/script-tests/dfg-getter-throw.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-getter.js: Added.
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@105107 268f45cc-cd09-0410-ab3c-d52691b4dbfc
33 files changed:
LayoutTests/ChangeLog
LayoutTests/fast/js/dfg-custom-getter-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-custom-getter-throw-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-custom-getter-throw-inlined-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-custom-getter-throw-inlined.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-custom-getter-throw.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-custom-getter.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-getter-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-getter-throw-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/dfg-getter-throw.html [new file with mode: 0644]
LayoutTests/fast/js/dfg-getter.html [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-custom-getter-throw-inlined.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-custom-getter-throw.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-custom-getter.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-getter-throw.js [new file with mode: 0644]
LayoutTests/fast/js/script-tests/dfg-getter.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/Instruction.h
Source/JavaScriptCore/bytecode/StructureStubInfo.h
Source/JavaScriptCore/dfg/DFGAbstractState.cpp
Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGCCallHelpers.h
Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
Source/JavaScriptCore/dfg/DFGJITCompiler.h
Source/JavaScriptCore/dfg/DFGNode.h
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGPropagator.cpp
Source/JavaScriptCore/dfg/DFGRepatch.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp