1855301 - Add initial support for fuses.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement, P3)

Description

[Matthew Gaudet (he/him) [:mgaudet]]

• A Fuse: A data structure in memory that asserts some property of the system.
• A fuse may be popped/invalidated/burnt out; this indicates that the property the fuse was asserting no longer holds.
• There are two models of Fuse: Guard fuses are used as guards at various points through the engine to allow dynamic choice of a fallback path vs. fast path. A guard is checked explicitly before each action. In constrast, an Invalidating fuse instead performs some cleanup actions which inform various parts of the code that the assumption made no longer holds (e.g invalidating code).

I have patches I will attach that sketch out guard-fuses

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Use Array.prototype[@@iterator].next fuse during spread call optimization.

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Add Watchtower support for property modification

Adds the ability to have a specific object kick off a Watchtower callback on property
write to a specific NativeObject.

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Add GuardFuse, and the initial fuse for modifications to Array.prototype[@@iterator]

This also makes the design decision to -also- pop fuses on property change, which
is triggered on the property descriptor change paths.

Depends on D189282

Comment 4

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Use CacheIR to help validate the fuse

Verify that CacheIR and the fuse agree on the optimizability of Array.prototype[@@iterator]

Depends on D189283

Comment 5

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Add GuardFuse to CacheIR

Depends on D189284

Comment 6

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Use GuardFuse during SpreadCall optimization

Depends on D189285

Comment 7

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: WIP: Bug 1855301 - Add a fuse for modification of Array.prototype[@@iterator].next

Depends on D189286

Comment 8

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Add more fuses, and use them to further speed up destructuring optimization r?jandem,iain

Comment 9

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Add basic support for GuardFuses r?jandem

A Fuse: A data structure in memory that asserts some property of the system.

• A fuse may be popped: this indicates that the property the fuse was asserting
  no longer holds.

• There are two models of Fuse: Guard fuses are used as guards at various
  points through the engine to allow dynamic choice of a fallback path vs. fast
  path. A guard is checked explicitly before each action. In contrast, an
  Invalidating fuse instead performs some cleanup actions which inform
  various parts of the code that the assumption made no longer holds (e.g
  invalidating code).

• A fuse can be checked easily for validity -- a single load and compare should
  suffice.

This patch only adds support for Realm scoped Guard Fuses.

In order to maintain the invariants required by fuses, Watchtower is enhanced
to support watching for property modification.

A few review notes:

• This large patch -can- be broken up if desired; it just grew large because I
  got tired of having a wonky bunch of corrections split across three different
  patches.

• I originally added a number of asserts to ensure that wherever we did a
  setSlot we either correctly watched for changes, or the underlying object
  did not watch for changes. This ended up being a bunch of additions to
  environment object paths; I would prefer to somehow assert that we never flag
  an environment object for watching (at least until we want to try), but I
  can't quite construct that.

Comment 10

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Use a fuse check to speed up destructuring optimization -- Landing Disabled-by-default r?jandem,iain

This speeds up a microbenchmark like the following by 50%.

function foo(x) {
    var b;
    [b] = x;
    return b;
}
let start = performance.now();
for (var i = 0; i < 200_000; i++) {
    foo([1, 2, 3]);
}
let end = performance.now();
console.log(end - start);

Depends on D194292

Comment 11

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Add getter for array iterator prototype r?jandem,iain

Comment 12

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Support observing NativeObject property modification r?jandem,iain

Depends on D195260

Comment 13

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Add ClassSpec support for marking a class as having a fuse prototype property. r?jandem,iain

Also, borrow support here for iterator prototypes in anticipation of adding fuses to ArrayIteratorPrototype

Depends on D195261

Comment 14

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Setup Array and ArrayIteratorPrototypes with watchtower in anticipation of Fuse support r?jandem,iain

Depends on D195262

Comment 15

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Introduce Fuses: Runtime Support r?jandem,iain

Depends on D195263

Comment 16

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Introduce Fuses: Code Generation support r?jandem,iain

Depends on D195264

Comment 17

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Add more fuses in anticipation of their future use r?iain

These fuses will be consumed when we enable fuse based optimization.

Depends on D195265

Comment 18

[Matthew Gaudet (he/him) [:mgaudet]]

Current plan is that we'll land this bug as an 'enabling build', without consuming then we'll move forward with consumption in other bugs.

Comment 19

[Phabricator Automation]

Comment on attachment 9364833 [details]
Bug 1855301 - Use a fuse check to speed up destructuring optimization -- Landing Disabled-by-default r?jandem,iain

Revision D194293 was moved to bug 1870396. Setting attachment 9364833 [details] to obsolete.

Comment 20

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1855301 - Fix PBL build for fuses r?cfallin,jsharp

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ced658288757
Add getter for array iterator prototype r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/6f96fe49c54e
Support observing NativeObject property modification r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/a5400fe43d70
Setup Array and ArrayIteratorPrototypes with watchtower in anticipation of Fuse support r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/2efe70d66fe4
Introduce Fuses: Runtime Support r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/ba7ca7800429
Introduce Fuses: Code Generation support r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/4937e75feec8
Add more fuses in anticipation of their future use r=iain
https://hg.mozilla.org/integration/autoland/rev/e357f23d1600
Use a fuse check to speed up destructuring optimization -- Landing Disabled-by-default r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/f7f45db393fa
Fix PBL build for fuses r=iain

Comment 22

[Atila Butkovits]

Backed out for causing bustages at Iteration.cpp

Backout link: https://hg.mozilla.org/integration/autoland/rev/32b8b208b182cc075a0a5d84eb135de321cdd31f

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=f7f45db393fa229b346ce726568ad3ec5b074f31&selectedTaskRun=JDb-ZpBLSY-LQI9zlnV75Q.0

Failure log: https://treeherder.mozilla.org/logviewer?job_id=440612034&repo=autoland&lineNumber=39372

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8483eb0f6998
Add getter for array iterator prototype r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/56cc0126e3ed
Support observing NativeObject property modification r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/339beb959236
Setup Array and ArrayIteratorPrototypes with watchtower in anticipation of Fuse support r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/267bec6e427c
Introduce Fuses: Runtime Support r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/7bdb688ff63b
Introduce Fuses: Code Generation support r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/2b1d14a12a9c
Add more fuses in anticipation of their future use r=iain
https://hg.mozilla.org/integration/autoland/rev/96176d302fca
Use a fuse check to speed up destructuring optimization -- Landing Disabled-by-default r=jandem,iain
https://hg.mozilla.org/integration/autoland/rev/da91b70056f1
Fix PBL build for fuses r=iain

Comment 24

[Matthew Gaudet (he/him) [:mgaudet]]

Fixed irksome old clang issue and attempted relanding.

Comment 25

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/8483eb0f6998
https://hg.mozilla.org/mozilla-central/rev/56cc0126e3ed
https://hg.mozilla.org/mozilla-central/rev/339beb959236
https://hg.mozilla.org/mozilla-central/rev/267bec6e427c
https://hg.mozilla.org/mozilla-central/rev/7bdb688ff63b
https://hg.mozilla.org/mozilla-central/rev/2b1d14a12a9c
https://hg.mozilla.org/mozilla-central/rev/96176d302fca
https://hg.mozilla.org/mozilla-central/rev/da91b70056f1