[WIP] 2.46 BBQ backports - #1708
Open
justinmichaud wants to merge 11 commits into
Open
Conversation
https://bugs.webkit.org/show_bug.cgi?id=298157 Reviewed by Justin Michaud. In 32-bit, we use scratch fp regs to check the bounds of the input of in the truncSaturated and truncTrapping functions, before emitting the right ccall. However, the scratch fp registers are still bound when we emit the ccall, which leads to this assertion failure. These assertions only fail in debug mode and still provide the correct result in release mode because these fp registers are not used in the emitted C call. This PR implements the missing JIT calls for ARMv7 so we don't have to emit the C calls. * Source/JavaScriptCore/assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::vcmpz): (JSC::ARMv7Assembler::vmla): * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::branchFloatWithZero): (JSC::MacroAssemblerARMv7::branchDoubleWithZero): (JSC::MacroAssemblerARMv7::convertDoubleToUint64): (JSC::MacroAssemblerARMv7::truncateDoubleToUint64): (JSC::MacroAssemblerARMv7::truncateDoubleToInt64): (JSC::MacroAssemblerARMv7::truncateFloatToUint64): (JSC::MacroAssemblerARMv7::truncateFloatToInt64): * Source/JavaScriptCore/wasm/WasmBBQJIT.h: * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::truncInBounds): (JSC::Wasm::BBQJITImpl::BBQJIT::truncTrapping): (JSC::Wasm::BBQJITImpl::BBQJIT::truncSaturated): Canonical link: https://commits.webkit.org/299853@main
https://bugs.webkit.org/show_bug.cgi?id=301709 Reviewed by Justin Michaud. This PR improves the codegen of the shift operations (I64Shl, I64ShrS, I64ShrU) in the 32-bit implementation of BBQ: 1. The algorithm are now branchless 2. The previous version was not entirely correct when rhs/lhs' registers would alias the res registers. This new version fixes a crash on JS3's tfjs-wasm when using 32-bit JSC. tfjs-wasm is still crashing, due to a similar issue on the rotate algorithms, which I'll fix in follow-up PRs. This PR also doesn't handle cases where either lhs or rhs are constants (so we could generate more optimized code), and I have plan to fix that in the future. * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::lshiftUnchecked): (JSC::MacroAssemblerARMv7::lshift32): (JSC::MacroAssemblerARMv7::rshiftUnchecked): (JSC::MacroAssemblerARMv7::urshiftUnchecked): (JSC::MacroAssemblerARMv7::urshift32): (JSC::MacroAssemblerARMv7::sub32): * Source/JavaScriptCore/wasm/WasmBBQJIT.h: * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::addI64Shl): (JSC::Wasm::BBQJITImpl::BBQJIT::addI64ShrS): (JSC::Wasm::BBQJITImpl::BBQJIT::addI64ShrU): (JSC::Wasm::BBQJITImpl::BBQJIT::shiftI64Helper): Deleted. Canonical link: https://commits.webkit.org/302845@main
https://bugs.webkit.org/show_bug.cgi?id=302403 Reviewed by Yusuke Suzuki. This PR includes seveal changes to improve the codegen of store/load: * Optimized storePair to use a single move when constants are equal * Eliminated register materialization for constant integer store * Constant pointer folding when they are statically known One example where these work together is I64Store, before: [ 0x22d] I64Store 0xf1a22bcc: ldrd r1, r2, [r10, #0x34] 0xf1a22bd0: movw r0, #0x5d18 0xf1a22bd4: mov r5, r0 0xf1a22bd6: adds r5, r5, WebPlatformForEmbedded#7 0xf1a22bd8: bhs.w #0xf1a22c44 0xf1a22bdc: cmp r5, r2 0xf1a22bde: bhs.w #0xf1a22c44 0xf1a22be2: mov r5, r0 0xf1a22be4: add r5, r1 0xf1a22be6: movs r4, #0 0xf1a22be8: movs r3, #0 0xf1a22bea: str r3, [r5] 0xf1a22bec: str r4, [r5, WebPlatformForEmbedded#4] after: [ 0x22d] I64Store 0xf1b22c50: ldrd r1, r2, [r10, #0x34] 0xf1b22c54: movw r5, #0x5d1f 0xf1b22c58: cmp r5, r2 0xf1b22c5a: bhs.w #0xf1b22cc0 0xf1b22c5e: movw r12, #0x5d18 0xf1b22c62: add.w r5, r1, r12 0xf1b22c66: mov.w r12, #0 0xf1b22c6a: str.w r12, [r5] 0xf1b22c6e: str.w r12, [r5, WebPlatformForEmbedded#4] On JetStream3's tfjs-wasm.js, we reduce the code size by -9,5KiB: Base total code size: 433254 bytes (424KiB) New total code size: 423578 bytes (414KiB) Difference (new - base): -9676 bytes (-9,5KiB) Percentage change: -2.23% * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::store16): (JSC::MacroAssemblerARMv7::storePair32): * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::store): * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.h: (JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply): Canonical link: https://commits.webkit.org/302984@main
https://bugs.webkit.org/show_bug.cgi?id=302472 Reviewed by Justin Michaud. This PR enables fused branch compare for 32-bit platforms with the goal of reducing code size. The 32-bit and 64-bit code paths are also unified with only two #if USE(JSVALUE64), emitBranchI64 is the most affected but it's minimal, we only need to pass more registers in the branch64 call. There was also only one change in the code copied from 64-bit, which was to handle GPR2 in the two addFusedIfCompare methods. This feature saves -16KiB in code size of JetStream3's tfjs-wasm.js, a -3.53% improvement: Base total code size: 439162 bytes (429KiB) New total code size: 423680 bytes (414KiB) Difference (new - base): -15482 bytes (-16KiB) Percentage change: -3.53% * Source/JavaScriptCore/assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::invert): * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::armV7ConditionForHigh32): (JSC::MacroAssemblerARMv7::armV7ConditionForLow32): (JSC::MacroAssemblerARMv7::compare64): (JSC::MacroAssemblerARMv7::compare32AndSetFlags): (JSC::MacroAssemblerARMv7::branch64Impl): (JSC::MacroAssemblerARMv7::branch64): (JSC::MacroAssemblerARMv7::branchTest64): * Source/JavaScriptCore/wasm/WasmBBQJIT.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::tryFoldFusedBranchCompare): (JSC::Wasm::BBQJITImpl::BBQJIT::emitFusedBranchCompareBranch): (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedBranchCompare): (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare): (JSC::Wasm::BBQJITImpl::emitBranchI32): (JSC::Wasm::BBQJITImpl::emitBranchI64): (JSC::Wasm::BBQJITImpl::emitBranchF32): (JSC::Wasm::BBQJITImpl::emitBranchF64): * Source/JavaScriptCore/wasm/WasmBBQJIT.h: * Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::tryFoldFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::emitFusedBranchCompareBranch): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare): Deleted. * Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::tryFoldFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::emitFusedBranchCompareBranch): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedBranchCompare): Deleted. (JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchI32): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchI64): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchF32): Deleted. (JSC::Wasm::BBQJITImpl::emitBranchF64): Deleted. Canonical link: https://commits.webkit.org/303254@main
https://bugs.webkit.org/show_bug.cgi?id=293694 Reviewed by Yusuke Suzuki and Sosuke Suzuki. Not all armv7 chips are required to suport unaligned strd instructions. For example, my Neoverse N1 does not support it. This is documented at https://developer.arm.com/documentation/100748/0624/Alignment-support-in-Arm-Compiler-for-Embedded-6/Aligned-and-unaligned-accesses. We should remove these lowerings to support all armv7 processors. In the future, we may want to add them back when we can handle the alignment check separately. * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::storePair32): Canonical link: https://commits.webkit.org/298097@main
https://bugs.webkit.org/show_bug.cgi?id=288592 Unreviewed gardening. These tests assume more RAM than is available on memoryLimited devices. * JSTests/microbenchmarks/set-delete-add.js: * JSTests/stress/regexp-escape-oom.js: * JSTests/wasm/stress/array-element-creation.js: Canonical link: https://commits.webkit.org/291116@main
… is also a destination https://bugs.webkit.org/show_bug.cgi?id=302469 Reviewed by Justin Michaud. This patch expands a ldrd into a pair of ldr if any of the destination registers is also the register holding the memory address. Before: 0xf1502462: ldrd r0, r1, [r0] After: 0xf1502462: ldr r1, [r0, WebPlatformForEmbedded#4] 0xf1502464: ldr r0, [r0] * Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::loadPair32): Canonical link: https://commits.webkit.org/303043@main
https://bugs.webkit.org/show_bug.cgi?id=287677 rdar://144817380 Reviewed by Yijia Huang. 289530@main updated the handling of array_init_elem, but did not check for if the segment is null. Thus, a debug assertion within copyElementSegment could try to dereference a null pointer when checking the length. * Source/JavaScriptCore/wasm/WasmOperationsInlines.h: (JSC::Wasm::arrayInitElem): Canonical link: https://commits.webkit.org/290405@main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BBQ on 32-bit hits a few extra bugs on JS3, which was not available at the time when we cut the branch. Backport some fixes, and adapt them for 32-bit.
c09225c