Bug 113481 – fourthTier: FTL JIT should be able run some simple function

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

The fourth tier LLVM JIT should be able to run some simple function.

This is going to be the very initial prototype.

[Filip Pizlo]

Created attachment 195489 [details]
it begins

Fun.

[Filip Pizlo]

Created attachment 195509 [details]
more

[Filip Pizlo]

Created attachment 195653 [details]
more

[Filip Pizlo]

Created attachment 195668 [details]
lowering is done

Lowering should now have support for all of the opcodes that we're going to initially compile.  It's a small list.  It also has support for locals, captured locals, basic blocks, and trap-based OSR exits (i.e. OSR exit = crash, for now).

Now I just need to write the wrapper.

[Filip Pizlo]

Created attachment 195682 [details]
done

Of course, it doesn't compile, and I have no idea what I'm doing.

[Filip Pizlo]

It just ran function foo() { return 42; }.


DFG compiling foo#B0Pv4u:[0x7fa1cb805000->0x11150fef0, NoneFunctionCall], number of instructions = 3
Allocating another allocator region.
Phase CPS rethreading changed the IR.
Phase unification changed the IR.
Phase prediction injection changed the IR.
Phase backwards propagation changed the IR.
Phase prediction propagation changed the IR.
Phase fixup changed the IR.
Phase control flow analysis changed the IR.
Phase dead code elimination changed the IR.
Phase virtual register allocation changed the IR.
Graph after optimization:
DFG for foo#B0Pv4u:[0x7fa1cb805000->0x11150fef0, DFGFunctionCall]:
  Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: ExactRefCount
Block #0 (bc#0):  (OSR target)
  Predecessors:
  Phi Nodes:
  vars before: arg0:(Top, TOP, TOP, TOP) : 
  var links: arg0:@0 : 
   0:  skipped  < 0:->	SetArgument(arg0(a), bc#0)
   1:           < 1:0>	JSConstant(JS|UseAsOther, $0 = Int32: 42, bc#1)
   2:           <!0:->	Return(@1<Int32>, MustGen, bc#1)
  vars after: arg0:(None, 0:<empty>, [], []) : 
  var links: arg0:@0 : 
; ModuleID = 'B0Pv4u'

define i64 @B0Pv4u(i64) {
  ret i64 -281474976710614
}
Generated JIT code for FTL entrypoint thunk for foo#B0Pv4u:[0x7fa1cb805000->0x11150fef0, DFGFunctionCall]:
    Code at [0x53d4efc013c0, 0x53d4efc01480):
      0x53d4efc013c0: pop %rcx
      0x53d4efc013c1: mov %rcx, -0x10(%r13)
      0x53d4efc013c5: mov $0x7fa1cb805000, %r11
      0x53d4efc013cf: mov %r11, -0x8(%r13)
      0x53d4efc013d3: lea 0x8(%r13), %rdx
      0x53d4efc013d7: mov $0x7fa1ca40ef90, %r11
      0x53d4efc013e1: cmp %rdx, (%r11)
      0x53d4efc013e4: jb 0x53d4efc01403
      0x53d4efc013ea: mov %r13, %rdi
      0x53d4efc013ed: mov $0x111570010, %rax
      0x53d4efc013f7: call %rax
      0x53d4efc013f9: mov -0x10(%r13), %rdx
      0x53d4efc013fd: mov -0x28(%r13), %r13
      0x53d4efc01401: push %rdx
      0x53d4efc01402: ret 
      0x53d4efc01403: mov %rsp, %rdi
      0x53d4efc01406: mov %r13, 0x58(%rsp)
      0x53d4efc0140b: mov $0x0, -0x2c(%r13)
      0x53d4efc01413: mov $0x10dc1b260, %r11
      0x53d4efc0141d: call %r11
      0x53d4efc01420: jmp 0x53d4efc013ea
      0x53d4efc01425: pop %rcx
      0x53d4efc01426: mov %rcx, -0x10(%r13)
      0x53d4efc0142a: mov $0x7fa1cb805000, %r11
      0x53d4efc01434: mov %r11, -0x8(%r13)
      0x53d4efc01438: mov -0x30(%r13), %edx
      0x53d4efc0143c: cmp $0x1, %edx
      0x53d4efc0143f: jae 0x53d4efc013d3
      0x53d4efc01445: mov %rsp, %rdi
      0x53d4efc01448: mov %r13, 0x58(%rsp)
      0x53d4efc0144d: mov $0x0, -0x2c(%r13)
      0x53d4efc01455: mov $0x10dc202b0, %r11
      0x53d4efc0145f: call %r11
      0x53d4efc01462: mov %rax, %r13
      0x53d4efc01465: jmp 0x53d4efc013d3
42
42
42

[Filip Pizlo]

Created attachment 195806 [details]
the patch

[WebKit Review Bot]

Attachment 195806 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig', u'Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj', u'Source/JavaScriptCore/bytecode/Operands.h', u'Source/JavaScriptCore/dfg/DFGAbstractState.h', u'Source/JavaScriptCore/dfg/DFGDriver.cpp', u'Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp', u'Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h', u'Source/JavaScriptCore/dfg/DFGUseKind.h', u'Source/JavaScriptCore/ftl/FTLAbbreviations.h', u'Source/JavaScriptCore/ftl/FTLCapabilities.cpp', u'Source/JavaScriptCore/ftl/FTLCapabilities.h', u'Source/JavaScriptCore/ftl/FTLCompile.cpp', u'Source/JavaScriptCore/ftl/FTLCompile.h', u'Source/JavaScriptCore/ftl/FTLJITCode.cpp', u'Source/JavaScriptCore/ftl/FTLJITCode.h', u'Source/JavaScriptCore/ftl/FTLLLVMHeaders.h', u'Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp', u'Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h', u'Source/JavaScriptCore/ftl/FTLOutput.h', u'Source/JavaScriptCore/ftl/FTLState.h', u'Source/JavaScriptCore/runtime/InitializeThreading.cpp', u'Source/JavaScriptCore/runtime/Options.h', u'Source/WTF/wtf/Platform.h', u'Tools/ChangeLog', u'Tools/Scripts/build-jsc', u'Tools/Scripts/copy-webkitlibraries-to-product-directory', u'Tools/Scripts/export-llvm-build']" exit_code: 1
Source/JavaScriptCore/ftl/FTLCompile.cpp:57:  Tests for true/false, null/non-null, and zero/non-zero should all be done without equality comparisons.  [readability/comparison_to_zero] [5]
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:41:  _ftc_lowValue is incorrectly named. Don't use underscores in your identifier names.  [readability/naming/underscores] [4]
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:42:  _ftc_highValue is incorrectly named. Don't use underscores in your identifier names.  [readability/naming/underscores] [4]
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:43:  _ftc_typesPassedThrough is incorrectly named. Don't use underscores in your identifier names.  [readability/naming/underscores] [4]
Source/JavaScriptCore/ftl/FTLLLVMHeaders.h:38:  Alphabetical sorting problem.  [build/include_order] [4]
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:3011:  _dtc_source is incorrectly named. Don't use underscores in your identifier names.  [readability/naming/underscores] [4]
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:3012:  _dtc_edge is incorrectly named. Don't use underscores in your identifier names.  [readability/naming/underscores] [4]
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:3013:  _dtc_typesPassedThrough is incorrectly named. Don't use underscores in your identifier names.  [readability/naming/underscores] [4]
Source/JavaScriptCore/ftl/FTLJITCode.h:33:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 9 in 28 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Early Warning System Bot]

Comment on attachment 195806 [details]
the patch

Attachment 195806 [details] did not pass qt-ews (qt):
Output: http://webkit-commit-queue.appspot.com/results/17372022

[Geoffrey Garen]

Comment on attachment 195806 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=195806&action=review

Please file a bug for each fix me, and for the weak viable thingy, and for the "use our executable allocator" thingy.

> Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:3671
> +			shellScript = "exit 0\n\nif [ -f ../../Tools/Scripts/check-for-weak-vtables-and-externals ]; then\n    ../../Tools/Scripts/check-for-weak-vtables-and-externals || exit $?\nfi";

This needs a bug report.

>> Source/JavaScriptCore/ftl/FTLCompile.cpp:57
>> +    if (LLVMCreateJITCompilerForModule(&engine, state.module, 2, &error) != 0) {
> 
> Tests for true/false, null/non-null, and zero/non-zero should all be done without equality comparisons.  [readability/comparison_to_zero] [5]

Please fix.

>> Source/JavaScriptCore/ftl/FTLJITCode.h:33
>> +#include "JITCode.h"
> 
> Alphabetical sorting problem.  [build/include_order] [4]

Please fix.

[Build Bot]

Comment on attachment 195806 [details]
the patch

Attachment 195806 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-commit-queue.appspot.com/results/17294466

[Build Bot]

Comment on attachment 195806 [details]
the patch

Attachment 195806 [details] did not pass mac-ews (mac):
Output: http://webkit-commit-queue.appspot.com/results/17359066

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/147259

[Filip Pizlo]

Follow-up fix landed in http://trac.webkit.org/changeset/147269