The JIT should cache property lookup misses.
authorakling@apple.com <akling@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 11 Nov 2014 03:10:13 +0000 (03:10 +0000)
committerakling@apple.com <akling@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 11 Nov 2014 03:10:13 +0000 (03:10 +0000)
commitac3565b4aa333ce5d2f6fa64b8d57072a118e4eb
treede7c8dec21c9b4fdacb74d50600f63b3c1f5ed68
parentb35ec470b9e70a4affb7001b0518d8d66b53d737
The JIT should cache property lookup misses.
<https://webkit.org/b/135578>

Source/JavaScriptCore:

Add support for inline caching of missed property lookups.
Previously this would banish us to C++ slow path.

It's implemented as a simple GetById cache that returns jsUndefined()
as long as the Structure chain check passes. There's no DFG exploitation
of this knowledge in this patch.

Test: js/regress/undefined-property-access.js (~5.5x speedup)

Reviewed by Filip Pizlo.

* bytecode/PolymorphicGetByIdList.h:
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfo):

    Add GetByIdAccess::SimpleMiss so we can communicate to the DFG that
    the access has been cached.

* jit/Repatch.cpp:
(JSC::toString):
(JSC::kindFor):
(JSC::generateByIdStub):
(JSC::tryCacheGetByID):
(JSC::tryBuildGetByIDList):

    Added a GetUndefined stub kind, just a simple "store jsUndefined()" snippet.
    Use this to cache missed lookups, piggybacking mostly on the GetValue kind.

* runtime/PropertySlot.h:
(JSC::PropertySlot::isUnset):

    Exposed the unset state so PropertySlot can communicate that lookup failed.

LayoutTests:

Add a JSRegress test for caching of property lookup misses.
There are three subtests:

    1. Pure speed test.
    2. Test for when a property previously cached as missing suddenly
       appears on the object.
    3. Same as (2), but it appears on the prototype.

The test runs ~5.5x faster with the optimization.

Reviewed by Filip Pizlo.

* js/regress/script-tests/undefined-property-access.js: Added.
(foo):
(bar):
(baz):
* js/regress/undefined-property-access-expected.txt: Added.
* js/regress/undefined-property-access.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@175846 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/js/regress/script-tests/undefined-property-access.js [new file with mode: 0644]
LayoutTests/js/regress/undefined-property-access-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/undefined-property-access.html [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.h
Source/JavaScriptCore/jit/Repatch.cpp
Source/JavaScriptCore/runtime/PropertySlot.h