DFG JIT unnecessarily boxes and unboxes values during silent spilling

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

DFG silent spilling is performed for guarded slow-path C function calls.  There is a one-to-one relationship between each silent spill and silent fill.  Hence, there is no need to box and unbox values, yet the DFG JIT boxes and unboxes anyway.

[Filip Pizlo]

Created attachment 99951 [details]
the patch

[Gavin Barraclough]

Comment on attachment 99951 [details]
the patch

Hi Filip, I think there may be a subtle bug in this code.  When a register is silently spilled it is only actually written out to memory if it needs to be spilled (hasn't already been).  This means that if you have values in registers XMM0 & XMM1, and XMM0 has already been spilled as a boxed value, then after the silent spill one of the values in memory will be boxed and the other won't.  As such, you need to handle this in the silentFillFPR.  If the register needsSpill() then it is unboxed, if not the value in memory is boxed.  Also, please expand on the ChangeLog entry.

[Filip Pizlo]

Created attachment 100776 [details]
the patch (fix review)

[Gavin Barraclough]

Comment on attachment 100776 [details]
the patch (fix review)

Looks great!

[WebKit Review Bot]

Comment on attachment 100776 [details]
the patch (fix review)

Clearing flags on attachment: 100776

Committed r91010: <http://trac.webkit.org/changeset/91010>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.