ZJIT: Specialize send with caller_splat

[k0kubun]

On liquid-render,

Top-14 send fallback reasons (100.0% of total 397,638):
                          send_without_block_no_profiles: 93,590 (23.5%)
                             invokeblock_not_specialized: 87,975 (22.1%)
                          send_without_block_polymorphic: 63,841 (16.1%)
                            one_or_more_complex_arg_pass: 45,114 (11.3%)
                                        send_no_profiles: 37,455 ( 9.4%)
                                        send_polymorphic: 34,957 ( 8.8%)

Top-3 popular complex argument-parameter features not optimized (100.0% of total 45,114):
     caller_splat: 40,469 (89.7%)
  caller_blockarg:  3,352 ( 7.4%)
       param_rest:  1,293 ( 2.9%)

caller_splat accounts for about 90% of the one_or_more_complex_arg_pass fallback reason.

TODO

1. Specialize send with caller_splat
2. Investigate whether there are caller array allocations we can optimize away if the array allocation and the callee are inlined
3. Consider optimizing away such array allocation
   • We need to make sure the array doesn't escape

[tekknolagi]

To be clear, this is the pattern that looks like a.b(*c)?

[k0kubun]

Yeah. A caller already has an array and passes it as a.b(*arr).

[nozomemein]

I've started looking into this.

It looks like we can handle caller_splat by branching on the splat array's length and loading each element with ArrayAref, roughly like this:

Monomorphic case:

v20:ArrayExact = ToArray v11
v21:CInt64 = ArrayLength v20
v22:CInt64[2] = Const CInt64(2)
v23:CBool = IsBitEqual v21, v22
CondBranch v23, bb4(), bb5()

bb4():
  v24:Fixnum[0] = Const Value(0)
  v25:Fixnum[1] = Const Value(1)
  v26:BasicObject = ArrayAref v20, v24
  v27:BasicObject = ArrayAref v20, v25
  v28:BasicObject = SendDirect v10, :target, v26, v27
  Jump bb6(v28)

bb5():
  v29:BasicObject = Send v10, :target, v20 # VM_CALL_ARGS_SPLAT
  Jump bb6(v29)

bb6(v30:BasicObject):
  CheckInterrupts
  Return v30

Polymorphic case:

v20:ArrayExact = ToArray v11
v21:CInt64 = ArrayLength v20

v22:CInt64[1] = Const CInt64(1)
v23:CBool = IsBitEqual v21, v22
CondBranch v23, bb4(), bb5()

bb4():
  v24:Fixnum[0] = Const Value(0)
  v25:BasicObject = ArrayAref v20, v24
  v26:BasicObject = SendDirect v10, :target, v25
  Jump bb8(v26)

bb5():
  v27:CInt64[2] = Const CInt64(2)
  v28:CBool = IsBitEqual v21, v27
  CondBranch v28, bb6(), bb7()

bb6():
  v29:Fixnum[0] = Const Value(0)
  v30:Fixnum[1] = Const Value(1)
  v31:BasicObject = ArrayAref v20, v29
  v32:BasicObject = ArrayAref v20, v30
  v33:BasicObject = SendDirect v10, :target, v31, v32
  Jump bb8(v33)

bb7():
  v34:BasicObject = Send v10, :target, v20 # VM_CALL_ARGS_SPLAT
  Jump bb8(v34)

bb8(v35:BasicObject):
  CheckInterrupts
  Return v35

As a first step, I've added profiling for splat array lengths so we can determine whether call sites are monomorphic or polymorphic before deciding how to specialize them.

• ZJIT: Profile caller splat length distributions ruby/ruby#17967

If this lands, I'll follow up with a patch to specialize monomorphic call sites.