Bug 182965 – [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)

• Component: New Bugs
• Status: RESOLVED FIXED

[Yusuke Suzuki]

[FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)

[Yusuke Suzuki]

Created attachment 334260 [details]
Patch

[EWS Watchlist]

Attachment 334260 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Wrong number of spaces before statement. (expected: 24)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
Total errors found: 10 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Yusuke Suzuki]

Created attachment 334444 [details]
Patch

[EWS Watchlist]

Attachment 334444 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Wrong number of spaces before statement. (expected: 24)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
Total errors found: 10 in 10 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Yusuke Suzuki]

Created attachment 334592 [details]
Patch

[EWS Watchlist]

Attachment 334592 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Wrong number of spaces before statement. (expected: 24)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4199:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4199:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4225:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4225:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
Total errors found: 10 in 11 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Yusuke Suzuki]

Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

> Source/JavaScriptCore/ChangeLog:11
> +        This is the last change for FTL to support all the types of DFG nodes.

Except for CreateThis. I’ll change ths part later.

[Saam Barati]

(In reply to Yusuke Suzuki from comment #7)
> Comment on attachment 334592 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=334592&action=review
> 
> > Source/JavaScriptCore/ChangeLog:11
> > +        This is the last change for FTL to support all the types of DFG nodes.
> 
> Except for CreateThis. I’ll change ths part later.

FYI, adding CreateThis will lead to a performance regression, or at least it did when I added it. I remember it ended up having some effects on ICs which made certain GetByOffsets turn into GetByOd, which caused object allocation sinking to not kick in.

[Saam Barati]

(In reply to Saam Barati from comment #8)
> (In reply to Yusuke Suzuki from comment #7)
> > Comment on attachment 334592 [details]
> > Patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=334592&action=review
> > 
> > > Source/JavaScriptCore/ChangeLog:11
> > > +        This is the last change for FTL to support all the types of DFG nodes.
> > 
> > Except for CreateThis. I’ll change ths part later.
> 
> FYI, adding CreateThis will lead to a performance regression, or at least it
> did when I added it. I remember it ended up having some effects on ICs which
> made certain GetByOffsets turn into GetByOd, which caused object allocation
> sinking to not kick in.

See:
https://bugs.webkit.org/show_bug.cgi?id=164904

[Saam Barati]

Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

r=me

> Source/JavaScriptCore/dfg/DFGOperations.cpp:810
> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value)

Is this actually guaranteed to be a JSArray* here? If so, I'd give it that type. Otherwise, perhaps just name the variable "object".

> Source/JavaScriptCore/dfg/DFGOperations.cpp:826
> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value)

ditto

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084
> +                m_jit.codeBlock()->isStrictMode()
> +                    ? (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsStrict)
> +                    : (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict),

Was this doing the wrong thing before?

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4274
> +            LBasicBlock notHoleCase = m_out.newBlock();

nit: This isn't really "notHoleCase" since the hole case may jump here. I'd call this "doStoreCase" or something like that

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),

Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?

[Yusuke Suzuki]

Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

>>>> Source/JavaScriptCore/ChangeLog:11
>>>> +        This is the last change for FTL to support all the types of DFG nodes.
>>> 
>>> Except for CreateThis. I’ll change ths part later.
>> 
>> FYI, adding CreateThis will lead to a performance regression, or at least it did when I added it. I remember it ended up having some effects on ICs which made certain GetByOffsets turn into GetByOd, which caused object allocation sinking to not kick in.
> 
> See:
> https://bugs.webkit.org/show_bug.cgi?id=164904

Yeah

>> Source/JavaScriptCore/dfg/DFGOperations.cpp:810
>> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value)
> 
> Is this actually guaranteed to be a JSArray* here? If so, I'd give it that type. Otherwise, perhaps just name the variable "object".

Yeah, it would be JSObject* if the indexing type is NonArray.
I've changed the name to `object`.

>> Source/JavaScriptCore/dfg/DFGOperations.cpp:826
>> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value)
> 
> ditto

Fixed.

>> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084
>> +                    : (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict),
> 
> Was this doing the wrong thing before?

No. Basically, this was OK. But for consistency, I've introduced this.
I described the detail in ChangeLog.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4274
>> +            LBasicBlock notHoleCase = m_out.newBlock();
> 
> nit: This isn't really "notHoleCase" since the hole case may jump here. I'd call this "doStoreCase" or something like that

OK, changed it to `doStoreCase`.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
> 
> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?

Sounds nice. Fixed.

[Yusuke Suzuki]

Committed r229053: <https://trac.webkit.org/changeset/229053>

[Radar WebKit Bug Importer]

<rdar://problem/37932289>

[Saam Barati]

Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
>>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
>> 
>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
> 
> Sounds nice. Fixed.

Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?

[Yusuke Suzuki]

Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

>>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
>>>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
>>> 
>>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
>> 
>> Sounds nice. Fixed.
> 
> Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?

Yeah, because of this, my landing patch makes ArrayStorage_vectorLength and ArrayStorage_publicLength as complete alias to Butterfly_vectorLength and Butterfly_publicLength. https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp#L62-L63
So I think it is OK.

[Saam Barati]

(In reply to Yusuke Suzuki from comment #15)
> Comment on attachment 334592 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=334592&action=review
> 
> >>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
> >>>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
> >>> 
> >>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
> >> 
> >> Sounds nice. Fixed.
> > 
> > Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?
> 
> Yeah, because of this, my landing patch makes ArrayStorage_vectorLength and
> ArrayStorage_publicLength as complete alias to Butterfly_vectorLength and
> Butterfly_publicLength.
> https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/ftl/
> FTLAbstractHeapRepository.cpp#L62-L63
> So I think it is OK.

👍🏽