Speed up JSGlobalObject initialization by making some properties lazy
https://bugs.webkit.org/show_bug.cgi?id=157045
Reviewed by Keith Miller.
Source/JavaScriptCore:
This makes about half of JSGlobalObject's state lazy. There are three categories of
state in JSGlobalObject:
1) C++ fields in JSGlobalObject.
2) JS object properties in JSGlobalObject's JSObject superclass.
3) JS variables in JSGlobalObject's JSSegmentedVariableObject superclass.
State held in JS variables cannot yet be made lazy. That's why this patch only goes
half-way.
State in JS object properties can be made lazy if we move it to the static property
hashtable. JSGlobalObject already had one of those. This patch makes static property
hashtables a lot more powerful, by adding three new kinds of static properties. These
new kinds allow us to make almost all of JSGlobalObject's object properties lazy.
State in C++ fields can now be made lazy thanks in part to WTF's support for stateless
lambdas. You can of course make anything lazy by hand, but there are many C++ fields in
JSGlobalObject and we are adding more all the time. We don't want to require that each
of these has a getter with an initialization check and a corresponding out-of-line slow
path that does the initialization. We want this kind of boilerplate to be handled by
some abstractions.
The primary abstraction introduced in this patch is LazyProperty<Type>. Currently, this
only works where Type is a subclass of JSCell. Such a property holds a pointer to Type.
You can use it like you would a WriteBarrier<Type>. It even has set() and get() methods,
so it's almost a drop-in replacement.
The key to LazyProperty<Type>'s power is that you can do this:
class Bar {
...
LazyProperty<Foo> m_foo;
};
...
m_foo.initLater(
[] (const LazyProperty<Foo>::Initializer<Bar>& init) {
init.set(Foo::create(init.vm, init.owner));
});
This initLater() call requires that you pass a stateless lambda (see WTF changelog for
the definition). Miraculously, this initLater() call is guaranteed to compile to a store
of a pointer constant to m_foo, as in:
movabsq 0xBLAH, %rax
movq %rax, &m_foo
This magical pointer constant points to a callback that was generated by the template
instantiation of initLater(). That callback knows to call your stateless lambda, but
also does some other bookkeeping: it makes sure that you indeed initialized the property
inside the callback and it manages recursive initializations. It's totally legal to call
m_foo.get() inside the initLater() callback. If you do that before you call init.set(),
m_foo.get() will return null. This is an excellent escape hatch if we ever find
ourselves in a dependency cycle. I added this feature because I already had to create a
dependency cycle.
Note that using LazyProperties from DFG threads is super awkward. It's going to be hard
to get this right. The DFG thread cannot initialize those fields, so it has to make sure
that it does conservative things. But for some nodes this could mean adding a lot of new
logic, like NewTypedArray, which currently is written in such a way that it assumes that
we always have the typed array structure. Currently we take a two-fold approach: for
typed arrays we don't handle the NewTypedArray intrinsic if the structure isn't
initialized, and for everything else we don't make the properties lazy if the DFG needs
them. As we optimize this further we might need to teach the DFG to handle more lazy
properties. I tried to do this for RegExp but found it to be very confusing. With typed
arrays I got lucky.
There is also a somewhat more powerful construct called LazyClassStructure. We often
need to keep around the structure of some standard JS class, like Date. We also need to
make sure that the constructor ends up in the global object's property table. And we
often need to keep the original value of the constructor for ourselves. In this case, we
want to make sure that the creation of the structure-prototype-constructor constellation
is atomic. We don't want code to start looking at the structure if it points to a
prototype that doesn't have its "constructor" property set yet, for example.
LazyClassStructure solves this by abstracting that whole initialization. You provide the
callback that allocates everything, since we are super inconsistent about the way we
initialize things, but LazyClassStructure establishes the workflow and helps you not
mess up.
Finally, the new static hashtable attributes allow for all of this to work with the JS
property table:
PropertyCallback: if you use this attribute, the second column in the table should be
the name of a function to call to initialize this property. This is useful for things
like the Math property. The Math object turns out to be very expensive to allocate.
Delaying its allocation is super easy with the PropertyCallback attribute.
CellProperty: with this attribute the second column should be a C++ field name like
JSGlobalObject::m_evalErrorConstructor. The static hashtable will grab the offset of
this property, and when it needs to be initialized, Lookup will assume you have a
LazyProperty<JSCell> and call its get() method. It will initialize the property to
whatever get() returned. Note that it's legal to cast a LazyProperty<Anything> to
LazyProperty<JSCell> for the purpose of calling get() because the get() method will just
call whatever callback function pointer is encoded in the property and it does not need
to know anything about what type that callback will instantiate.
ClassStructure: with this attribute the second column should be a C++ field name. The
static hashtable will initialize the property by treating the field as a
LazyClassStructure and it will call get(). LazyClassStructure completely owns the whole
initialization workflow, so Lookup assumes that when LazyClassStructure::get() returns,
the property in question will already be set. By convention, we have LazyClassStructure
initialize the property with a pointer to the constructor, since that's how all of our
classes work: "globalObject.Date" points to the DateConstructor.
This is a 2x speed-up in JSGlobalObject initialization time in a microbenchmark that
calls our C API. This is a 1% speed-up on SunSpider and JSRegress.
* API/JSCallbackFunction.cpp:
(JSC::JSCallbackFunction::create):
* API/ObjCCallbackFunction.h:
(JSC::ObjCCallbackFunction::impl):
* API/ObjCCallbackFunction.mm:
(JSC::ObjCCallbackFunction::ObjCCallbackFunction):
(JSC::ObjCCallbackFunction::create):
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* create_hash_table:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::set):
* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::originalArrayStructure):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureRegistrationPhase.cpp:
(JSC::DFG::StructureRegistrationPhase::run):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
* runtime/ClonedArguments.cpp:
(JSC::ClonedArguments::getOwnPropertySlot):
(JSC::ClonedArguments::materializeSpecials):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncToString):
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::visitChildren):
(JSC::InternalFunction::name):
(JSC::InternalFunction::calculatedDisplayName):
(JSC::InternalFunction::createSubclassStructure):
* runtime/InternalFunction.h:
* runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::finishCreation):
(JSC::JSBoundFunction::visitChildren):
* runtime/JSFunction.cpp:
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayView):
* runtime/JSGlobalObject.cpp:
(JSC::createProxyProperty):
(JSC::createJSONProperty):
(JSC::createMathProperty):
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::stringPrototypeChainIsSane):
(JSC::JSGlobalObject::resetPrototype):
(JSC::JSGlobalObject::visitChildren):
(JSC::JSGlobalObject::toThis):
(JSC::JSGlobalObject::getOwnPropertySlot):
(JSC::JSGlobalObject::createThrowTypeError): Deleted.
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::objectConstructor):
(JSC::JSGlobalObject::promiseConstructor):
(JSC::JSGlobalObject::internalPromiseConstructor):
(JSC::JSGlobalObject::evalErrorConstructor):
(JSC::JSGlobalObject::rangeErrorConstructor):
(JSC::JSGlobalObject::referenceErrorConstructor):
(JSC::JSGlobalObject::syntaxErrorConstructor):
(JSC::JSGlobalObject::typeErrorConstructor):
(JSC::JSGlobalObject::URIErrorConstructor):
(JSC::JSGlobalObject::nullGetterFunction):
(JSC::JSGlobalObject::nullSetterFunction):
(JSC::JSGlobalObject::callFunction):
(JSC::JSGlobalObject::applyFunction):
(JSC::JSGlobalObject::definePropertyFunction):
(JSC::JSGlobalObject::arrayProtoValuesFunction):
(JSC::JSGlobalObject::initializePromiseFunction):
(JSC::JSGlobalObject::newPromiseCapabilityFunction):
(JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
(JSC::JSGlobalObject::regExpProtoExecFunction):
(JSC::JSGlobalObject::regExpProtoSymbolReplaceFunction):
(JSC::JSGlobalObject::regExpProtoGlobalGetter):
(JSC::JSGlobalObject::regExpProtoUnicodeGetter):
(JSC::JSGlobalObject::throwTypeErrorGetterSetter):
(JSC::JSGlobalObject::moduleLoader):
(JSC::JSGlobalObject::objectPrototype):
(JSC::JSGlobalObject::functionPrototype):
(JSC::JSGlobalObject::arrayPrototype):
(JSC::JSGlobalObject::booleanPrototype):
(JSC::JSGlobalObject::stringPrototype):
(JSC::JSGlobalObject::symbolPrototype):
(JSC::JSGlobalObject::numberPrototype):
(JSC::JSGlobalObject::datePrototype):
(JSC::JSGlobalObject::regExpPrototype):
(JSC::JSGlobalObject::errorPrototype):
(JSC::JSGlobalObject::iteratorPrototype):
(JSC::JSGlobalObject::generatorFunctionPrototype):
(JSC::JSGlobalObject::generatorPrototype):
(JSC::JSGlobalObject::debuggerScopeStructure):
(JSC::JSGlobalObject::withScopeStructure):
(JSC::JSGlobalObject::strictEvalActivationStructure):
(JSC::JSGlobalObject::activationStructure):
(JSC::JSGlobalObject::moduleEnvironmentStructure):
(JSC::JSGlobalObject::directArgumentsStructure):
(JSC::JSGlobalObject::scopedArgumentsStructure):
(JSC::JSGlobalObject::clonedArgumentsStructure):
(JSC::JSGlobalObject::isOriginalArrayStructure):
(JSC::JSGlobalObject::booleanObjectStructure):
(JSC::JSGlobalObject::callbackConstructorStructure):
(JSC::JSGlobalObject::callbackFunctionStructure):
(JSC::JSGlobalObject::callbackObjectStructure):
(JSC::JSGlobalObject::propertyNameIteratorStructure):
(JSC::JSGlobalObject::objcCallbackFunctionStructure):
(JSC::JSGlobalObject::objcWrapperObjectStructure):
(JSC::JSGlobalObject::dateStructure):
(JSC::JSGlobalObject::nullPrototypeObjectStructure):
(JSC::JSGlobalObject::errorStructure):
(JSC::JSGlobalObject::calleeStructure):
(JSC::JSGlobalObject::functionStructure):
(JSC::JSGlobalObject::boundFunctionStructure):
(JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
(JSC::JSGlobalObject::getterSetterStructure):
(JSC::JSGlobalObject::nativeStdFunctionStructure):
(JSC::JSGlobalObject::namedFunctionStructure):
(JSC::JSGlobalObject::functionNameOffset):
(JSC::JSGlobalObject::numberObjectStructure):
(JSC::JSGlobalObject::privateNameStructure):
(JSC::JSGlobalObject::mapStructure):
(JSC::JSGlobalObject::regExpStructure):
(JSC::JSGlobalObject::generatorFunctionStructure):
(JSC::JSGlobalObject::setStructure):
(JSC::JSGlobalObject::stringObjectStructure):
(JSC::JSGlobalObject::symbolObjectStructure):
(JSC::JSGlobalObject::iteratorResultObjectStructure):
(JSC::JSGlobalObject::lazyTypedArrayStructure):
(JSC::JSGlobalObject::typedArrayStructure):
(JSC::JSGlobalObject::typedArrayStructureConcurrently):
(JSC::JSGlobalObject::isOriginalTypedArrayStructure):
(JSC::JSGlobalObject::typedArrayConstructor):
(JSC::JSGlobalObject::actualPointerFor):
(JSC::JSGlobalObject::internalFunctionStructure): Deleted.
* runtime/JSNativeStdFunction.cpp:
(JSC::JSNativeStdFunction::create):
* runtime/JSWithScope.cpp:
(JSC::JSWithScope::create):
(JSC::JSWithScope::visitChildren):
(JSC::JSWithScope::createStructure):
(JSC::JSWithScope::JSWithScope):
* runtime/JSWithScope.h:
(JSC::JSWithScope::object):
(JSC::JSWithScope::create): Deleted.
(JSC::JSWithScope::createStructure): Deleted.
(JSC::JSWithScope::JSWithScope): Deleted.
* runtime/LazyClassStructure.cpp: Added.
(JSC::LazyClassStructure::Initializer::Initializer):
(JSC::LazyClassStructure::Initializer::setPrototype):
(JSC::LazyClassStructure::Initializer::setStructure):
(JSC::LazyClassStructure::Initializer::setConstructor):
(JSC::LazyClassStructure::visit):
(JSC::LazyClassStructure::dump):
* runtime/LazyClassStructure.h: Added.
(JSC::LazyClassStructure::LazyClassStructure):
(JSC::LazyClassStructure::get):
(JSC::LazyClassStructure::prototype):
(JSC::LazyClassStructure::constructor):
(JSC::LazyClassStructure::getConcurrently):
(JSC::LazyClassStructure::prototypeConcurrently):
(JSC::LazyClassStructure::constructorConcurrently):
* runtime/LazyClassStructureInlines.h: Added.
(JSC::LazyClassStructure::initLater):
* runtime/LazyProperty.h: Added.
(JSC::LazyProperty::Initializer::Initializer):
(JSC::LazyProperty::LazyProperty):
(JSC::LazyProperty::get):
(JSC::LazyProperty::getConcurrently):
* runtime/LazyPropertyInlines.h: Added.
(JSC::LazyProperty<ElementType>::Initializer<OwnerType>::set):
(JSC::LazyProperty<ElementType>::initLater):
(JSC::LazyProperty<ElementType>::setMayBeNull):
(JSC::LazyProperty<ElementType>::set):
(JSC::LazyProperty<ElementType>::visit):
(JSC::LazyProperty<ElementType>::dump):
(JSC::LazyProperty<ElementType>::callFunc):
* runtime/Lookup.cpp:
(JSC::setUpStaticFunctionSlot):
* runtime/Lookup.h:
(JSC::HashTableValue::function):
(JSC::HashTableValue::functionLength):
(JSC::HashTableValue::propertyGetter):
(JSC::HashTableValue::propertyPutter):
(JSC::HashTableValue::accessorGetter):
(JSC::HashTableValue::accessorSetter):
(JSC::HashTableValue::constantInteger):
(JSC::HashTableValue::lexerValue):
(JSC::HashTableValue::lazyCellPropertyOffset):
(JSC::HashTableValue::lazyClassStructureOffset):
(JSC::HashTableValue::lazyPropertyCallback):
(JSC::getStaticPropertySlot):
(JSC::getStaticValueSlot):
(JSC::reifyStaticProperty):
* runtime/PropertySlot.h:
* runtime/TypedArrayType.h:
Source/WebCore:
No new tests because no change in behavior.
This adapts JSHTMLElementCustom.cpp to the new JSWithScope API. Note that this revealed
that this was using a curious choice of global object, which may not be right. I decided
to do a very literal refactoring that exactly preserves what this code got before, but I
added a FIXME to reconsider this later.
* bindings/js/JSHTMLElementCustom.cpp:
(WebCore::JSHTMLElement::pushEventHandlerScope):
Source/WTF:
This WTF change is at the heart of a large JSC change. In JSC I found myself wanting to
do this a lot:
static void callback(Foo& foo) { ... }
foo.setCallback(callback);
But that's not very nice to write if many different setCallback() calls are inside of the
same very large function: you'll have to have a lot of static function definitions in
one part of the file, and then a bunch of setCallback() calls in another part. It's hard
to reason about what's going on with such code.
So what if you wrote this instead:
foo.setCallback([] (Foo& foo) { ... });
Much nicer! There is a standard way to do this: lambdas that are stateless are
convertible to function pointers. This change also offers another approach that is a bit
more general.
These additions to WTF help you do it:
isStatelessLambda<Func>(): tells you if Func is a stateless lambda. This uses is_empty to
test if the lambda is stateless. This turns out to be a stronger property than
convertibility to function pointers. For example, a function pointer is convertible to a
function pointer, but it is definitely stateful: you cannot successfully call it if you
only has its type. On the other hand, a stateless lambda is really stateless in the sense
that you only need its type to call it.
callStatelessLambda<ResultType, Func>(Arguments&&...): calls the given stateless lambda.
JSC uses these to build up some sophisticated lazy-initialization APIs. The use of
statelessness allows JSC to combine a lambda with other logic into a single function
pointer.
* wtf/StdLibExtras.h:
(WTF::isStatelessLambda):
(WTF::callStatelessLambda):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@200383 268f45cc-cd09-0410-ab3c-d52691b4dbfc
45 files changed
