• fpizlo@apple.com's avatar
    DFG should be able to emit effectful structure checks · 99f3762d
    fpizlo@apple.com authored
    Reviewed by Oliver Hunt.
    This change allows us to find out if an array access that has gone polymorphic
    is operating over known structures - i.e. the primordial array structures of the
    global object that the code block containing the array access belongs to. We
    term this state "OriginalArray" for short. The fact that the access has gone
    polymorphic means that the array profile will not be able to report the set of
    structures it had seen - but if it can tell us that all of the structures were
    primordial then it just so happens that we can deduce what the structure set
    would have been by just querying the code block's global object. This allows us
    to emit an ArrayifyToStructure instead of an Arrayify if we find that we need to
    do conversions. The fast path of an ArrayifyToStructure is exactly like the fast
    path of a CheckStructure and is mostly subject to the same optimizations. It
    also burns one fewer registers.
    Essentially the notion of OriginalArray is a super cheap way of getting the
    array profile to tell us a structure set instead of a singleton structure.
    Currently, the array profile can only tell us the structure seen at an array
    access if there was exactly one structure. If there were multiple structures, it
    won't tell us anything other than the array modes and other auxiliary profiling
    data (whether there were stores to holes, for example). With OriginalArray, we
    cheaply get a structure set if all of the structures were primordial for the
    code block's global object, since in that case the array mode set (ArrayModes)
    can directly tell us the structure set. In the future, we might consider adding
    complete structure sets to the array profiles, but I suspect that we would hit
    diminishing returns if we did so - it would only help if we have array accesses
    that are both polymorphic and are cross-global-object accesses (rare) or if the
    arrays had named properties or other structure transitions that are unrelated to
    indexing type (also rare).
    This also does away with Arrayify (and the new ArrayifyToStructure) returning
    the butterfly pointer. This turns out to be faster and easier to CSE.
    And, this also changes constant folding to be able to eliminate CheckStructure,
    ForwardCheckStructure, and ArrayifyToStructure in addition to being able to
    transform them into structure transition watchpoints. This is great for
    ArrayifyToStructure because then CSE and CFA know that there is no side effect.
    Converting CheckStructure and ForwardCheckStructure to also behave this way is
    just a matter of elegance.
    This has no performance impact right now. It's intended to alleviate some of the
    regressions seen in the early implementation of
    * bytecode/ArrayProfile.cpp:
    * bytecode/ArrayProfile.h:
    * bytecode/CodeBlock.cpp:
    * dfg/DFGAbstractState.cpp:
    * dfg/DFGArrayMode.cpp:
    * dfg/DFGArrayMode.h:
    * dfg/DFGByteCodeParser.cpp:
    * dfg/DFGCSEPhase.cpp:
    * dfg/DFGConstantFoldingPhase.cpp:
    * dfg/DFGFixupPhase.cpp:
    * dfg/DFGNode.h:
    * dfg/DFGNodeType.h:
    * dfg/DFGPredictionPropagationPhase.cpp:
    * dfg/DFGSpeculativeJIT.cpp:
    * dfg/DFGSpeculativeJIT.h:
    * dfg/DFGSpeculativeJIT32_64.cpp:
    * dfg/DFGSpeculativeJIT64.cpp:
    * runtime/JSGlobalObject.h:
    * runtime/Structure.cpp:
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132759 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSGlobalObject.h 22.9 KB