Attachment #205948 for bug #118329

View Details Raw Unified Return to Bug 118329



2013-07-02  Filip Pizlo  <fpizlo@apple.com>

        fourthTier: add option to disable OSR entry in loops
        https://bugs.webkit.org/show_bug.cgi?id=118329

        Reviewed by NOBODY (OOPS!).
        
        This adds that option, and also makes the OSR exit reoptimization trigger rely less on
        OSR entry failing. Now even if we never attempt OSR entry but our execution counter gets
        high after a small number of OSR exits, we will recompile.

        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        * dfg/DFGOperations.cpp:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_loop_hint):
        * runtime/Options.h:
        (JSC):

2013-07-02  Filip Pizlo  <fpizlo@apple.com>

        fourthTier: since the FTL disassembly hacks cannot distinguish between code and data, the LLVM disassembler symbol table callback should be able to deal gracefully with arbitrary garbage

Lines 44-52 void handleExitCounts(CCallHelpers& jit, Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp +8 lines
44	jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()), GPRInfo::regT2);	44	jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()), GPRInfo::regT2);
45	jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);	45	jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
46	jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()));	46	jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()));
		47
47	jit.move(AssemblyHelpers::TrustedImmPtr(jit.baselineCodeBlock()), GPRInfo::regT0);	48	jit.move(AssemblyHelpers::TrustedImmPtr(jit.baselineCodeBlock()), GPRInfo::regT0);
		49	AssemblyHelpers::Jump reoptimizeNow = jit.branch32(
		50	AssemblyHelpers::GreaterThanOrEqual,
		51	AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()),
		52	AssemblyHelpers::TrustedImm32(0));
		53
48	tooFewFails = jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(jit.codeBlock()->exitCountThresholdForReoptimization()));	54	tooFewFails = jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(jit.codeBlock()->exitCountThresholdForReoptimization()));
49		55
		56	reoptimizeNow.link(&jit);
		57
50	// Reoptimize as soon as possible.	58	// Reoptimize as soon as possible.
51	#if !NUMBER_OF_ARGUMENT_REGISTERS	59	#if !NUMBER_OF_ARGUMENT_REGISTERS
52	jit.poke(GPRInfo::regT0);	60	jit.poke(GPRInfo::regT0);




    // If I am my own replacement, then reoptimization has already been triggered.
    // This can happen in recursive functions.
    if (codeBlock->replacement() == codeBlock) {
        if (Options::verboseOSR())
            dataLog(*codeBlock, ": Not reoptimizing because we've already been jettisoned.\n");
        return;
    }
    
    // Otherwise, the replacement must be optimized code. Use this as an opportunity
    // to check our logic.
    ASSERT(codeBlock->hasOptimizedReplacement());
    CodeBlock* optimizedCodeBlock = codeBlock->replacement();
    ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));

    // In order to trigger reoptimization, one of two things must have happened:
    // 1) We exited more than some number of times.
    // 2) We exited and got stuck in a loop, and now we're exiting again.
    bool didExitABunch = optimizedCodeBlock->shouldReoptimizeNow();
    bool didGetStuckInLoop =
        codeBlock->checkIfOptimizationThresholdReached()
        && optimizedCodeBlock->shouldReoptimizeFromLoopNow();
    
    if (!didExitABunch && !didGetStuckInLoop) {
        if (Options::verboseOSR())
            dataLog(*codeBlock, ": Not reoptimizing ", *optimizedCodeBlock, " because it either didn't exit enough or didn't loop enough after exit.\n");
        codeBlock->optimizeAfterLongWarmUp();
        return;
    }

    codeBlock->reoptimize();
}



void JIT::emit_op_loop_hint(Instruction*)
{
    // Emit the JIT optimization check: 
    if (canBeOptimized()) {
        if (Options::enableOSREntryInLoops()) {
            addSlowCase(branchAdd32(PositiveOrZero, TrustedImm32(Options::executionCounterIncrementForLoop()),
                AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter())));
        } else {
            // Add with saturation.
            move(TrustedImmPtr(m_codeBlock->addressOfJITExecuteCounter()), regT3);
            load32(regT3, regT2);
            Jump dontAdd = branch32(
                GreaterThan, regT2,
                TrustedImm32(std::numeric_limits<int32_t>::max() - Options::executionCounterIncrementForLoop()));
            add32(TrustedImm32(Options::executionCounterIncrementForLoop()), regT2);
            store32(regT2, regT3);
            dontAdd.link(this);
        }
    }

    // Emit the watchdog timer check:
    if (m_vm->watchdog.isEnabled())

{
#if ENABLE(DFG_JIT)
    // Emit the slow path for the JIT optimization check:
    if (canBeOptimized() && Options::enableOSREntryInLoops()) {
        linkSlowCase(iter);
        
        JITStubCall stubCall(this, cti_optimize);
        stubCall.addArgument(TrustedImm32(m_bytecodeOffset));
        stubCall.call();
        
        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_loop_hint));
    }
#endif

Lines 86-91 namespace JSC { Source/JavaScriptCore/runtime/Options.h_sec1
- Source/JavaScriptCore/runtime/Options.h +2 lines
86	v(bool, verboseCompilationQueue, false) \	86	v(bool, verboseCompilationQueue, false) \
87	v(bool, reportCompileTimes, false) \	87	v(bool, reportCompileTimes, false) \
88	\	88	\
		89	v(bool, enableOSREntryInLoops, true) \
		90	\
89	v(bool, useExperimentalFTL, false) \	91	v(bool, useExperimentalFTL, false) \
90	v(bool, useFTLTBAA, true) \	92	v(bool, useFTLTBAA, true) \
91	v(bool, enableLLVMFastISel, false) \	93	v(bool, enableLLVMFastISel, false) \

Return to Bug 118329

Lines 1740-1752 extern "C" void DFG_OPERATION triggerReo Source/JavaScriptCore/dfg/DFGOperations.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOperations.cpp -3 / +22 lines
1740		1740
1741	// If I am my own replacement, then reoptimization has already been triggered.	1741	// If I am my own replacement, then reoptimization has already been triggered.
1742	// This can happen in recursive functions.	1742	// This can happen in recursive functions.
1743	if (codeBlock->replacement() == codeBlock)	1743	if (codeBlock->replacement() == codeBlock) {
		1744	if (Options::verboseOSR())
		1745	dataLog(*codeBlock, ": Not reoptimizing because we've already been jettisoned.\n");
1744	return;	1746	return;
1745		1747	}
		1748
1746	// Otherwise, the replacement must be optimized code. Use this as an opportunity	1749	// Otherwise, the replacement must be optimized code. Use this as an opportunity
1747	// to check our logic.	1750	// to check our logic.
1748	ASSERT(codeBlock->hasOptimizedReplacement());	1751	ASSERT(codeBlock->hasOptimizedReplacement());
1749	ASSERT(JITCode::isOptimizingJIT(codeBlock->replacement()->jitType()));	1752	CodeBlock* optimizedCodeBlock = codeBlock->replacement();
		1753	ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
		1754
		1755	// In order to trigger reoptimization, one of two things must have happened:
		1756	// 1) We exited more than some number of times.
		1757	// 2) We exited and got stuck in a loop, and now we're exiting again.
		1758	bool didExitABunch = optimizedCodeBlock->shouldReoptimizeNow();
		1759	bool didGetStuckInLoop =
		1760	codeBlock->checkIfOptimizationThresholdReached()
		1761	&& optimizedCodeBlock->shouldReoptimizeFromLoopNow();
		1762
		1763	if (!didExitABunch && !didGetStuckInLoop) {
		1764	if (Options::verboseOSR())
		1765	dataLog(codeBlock, ": Not reoptimizing ", optimizedCodeBlock, " because it either didn't exit enough or didn't loop enough after exit.\n");
		1766	codeBlock->optimizeAfterLongWarmUp();
		1767	return;
		1768	}
1750		1769
1751	codeBlock->reoptimize();	1770	codeBlock->reoptimize();
1752	}	1771	}

Lines 1154-1162 void JIT::emitSlow_op_get_argument_by_va Source/JavaScriptCore/jit/JITOpcodes.cpp_sec1
- Source/JavaScriptCore/jit/JITOpcodes.cpp -6 / +19 lines
1154	void JIT::emit_op_loop_hint(Instruction*)	1154	void JIT::emit_op_loop_hint(Instruction*)
1155	{	1155	{
1156	// Emit the JIT optimization check:	1156	// Emit the JIT optimization check:
1157	if (canBeOptimized())	1157	if (canBeOptimized()) {
1158	addSlowCase(branchAdd32(PositiveOrZero, TrustedImm32(Options::executionCounterIncrementForLoop()),	1158	if (Options::enableOSREntryInLoops()) {
1159	AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter())));	1159	addSlowCase(branchAdd32(PositiveOrZero, TrustedImm32(Options::executionCounterIncrementForLoop()),
		1160	AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter())));
		1161	} else {
		1162	// Add with saturation.
		1163	move(TrustedImmPtr(m_codeBlock->addressOfJITExecuteCounter()), regT3);
		1164	load32(regT3, regT2);
		1165	Jump dontAdd = branch32(
		1166	GreaterThan, regT2,
		1167	TrustedImm32(std::numeric_limits<int32_t>::max() - Options::executionCounterIncrementForLoop()));
		1168	add32(TrustedImm32(Options::executionCounterIncrementForLoop()), regT2);
		1169	store32(regT2, regT3);
		1170	dontAdd.link(this);
		1171	}
		1172	}
1160		1173
1161	// Emit the watchdog timer check:	1174	// Emit the watchdog timer check:
1162	if (m_vm->watchdog.isEnabled())	1175	if (m_vm->watchdog.isEnabled())
Lines 1167-1179 void JIT::emitSlow_op_loop_hint(Instruct Source/JavaScriptCore/jit/JITOpcodes.cpp_sec2
1167	{	1180	{
1168	#if ENABLE(DFG_JIT)	1181	#if ENABLE(DFG_JIT)
1169	// Emit the slow path for the JIT optimization check:	1182	// Emit the slow path for the JIT optimization check:
1170	if (canBeOptimized()) {	1183	if (canBeOptimized() && Options::enableOSREntryInLoops()) {
1171	linkSlowCase(iter);	1184	linkSlowCase(iter);
1172		1185
1173	JITStubCall stubCall(this, cti_optimize);	1186	JITStubCall stubCall(this, cti_optimize);
1174	stubCall.addArgument(TrustedImm32(m_bytecodeOffset));	1187	stubCall.addArgument(TrustedImm32(m_bytecodeOffset));
1175	stubCall.call();	1188	stubCall.call();
1176		1189
1177	emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_loop_hint));	1190	emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_loop_hint));
1178	}	1191	}
1179	#endif	1192	#endif

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +20 lines
		1	2013-07-02 Filip Pizlo <fpizlo@apple.com>
		2
		3	fourthTier: add option to disable OSR entry in loops
		4	https://bugs.webkit.org/show_bug.cgi?id=118329
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	This adds that option, and also makes the OSR exit reoptimization trigger rely less on
		9	OSR entry failing. Now even if we never attempt OSR entry but our execution counter gets
		10	high after a small number of OSR exits, we will recompile.
		11
		12	* dfg/DFGOSRExitCompilerCommon.cpp:
		13	(JSC::DFG::handleExitCounts):
		14	* dfg/DFGOperations.cpp:
		15	* jit/JITOpcodes.cpp:
		16	(JSC::JIT::emit_op_loop_hint):
		17	(JSC::JIT::emitSlow_op_loop_hint):
		18	* runtime/Options.h:
		19	(JSC):
		20
1	2013-07-02 Filip Pizlo <fpizlo@apple.com>	21	2013-07-02 Filip Pizlo <fpizlo@apple.com>
2		22
3	fourthTier: since the FTL disassembly hacks cannot distinguish between code and data, the LLVM disassembler symbol table callback should be able to deal gracefully with arbitrary garbage	23	fourthTier: since the FTL disassembly hacks cannot distinguish between code and data, the LLVM disassembler symbol table callback should be able to deal gracefully with arbitrary garbage