Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 871d04ba21fbb2ae92396f13d51f367fdba23508
https://github.com/WebKit/WebKit/commit/871d04ba21fbb2ae92396f13d51f367fdba23508
Author: Yusuke Suzuki <[email protected]>
Date: 2023-05-09 (Tue, 09 May 2023)
Changed paths:
A JSTests/microbenchmarks/proxy-get-by-val-hit.js
A JSTests/microbenchmarks/proxy-get-by-val-miss.js
A JSTests/microbenchmarks/proxy-get-megamorphic.js
M Source/JavaScriptCore/builtins/ProxyHelpers.js
M Source/JavaScriptCore/bytecode/AccessCase.cpp
M Source/JavaScriptCore/bytecode/AccessCase.h
M Source/JavaScriptCore/bytecode/GetByStatus.cpp
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
M Source/JavaScriptCore/bytecode/Repatch.cpp
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/jit/JITOperations.h
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
Log Message:
-----------
[JSC] Optimize Proxy get with various keys without handlers
https://bugs.webkit.org/show_bug.cgi?id=256340
rdar://108920491
Reviewed by Michael Saboff.
This patch optimizes the use case, which is the following,
var proxy = new Proxy({}, { .. not get handler });
proxy[varousKeys];
1. First, we introduce IndexedProxyObjectLoad IC to handle GetByVal with
ProxyObject case.
We just extend existing ProxyObjectLoad with non-constant subscript. And to
enforce property-keys,
we need to call @toPropertyKey, and that's why we introduce a
performProxyObjectGetByVal separately
from performProxyObjectGet.
2. Inside performProxyObjectGetByVal, we would like to handle GetByValWithThis
efficiently. And one of
the key improvement we can have is introducing megamorphic IC for that.
Because megamorphic IC only
handles non-getter cases, it perfectly works well with GetByValWithThis
since megamorphic IC fast
path does not care about |this| value.
3. We introduce GetByValWithThisMegamorphic and GetByIdWithThisMegamorphic DFG
/ FTL nodes to handle
these megamorphic cases efficiently in DFG and FTL.
ToT Patched
proxy-get-by-val-hit 334.7270+-1.2121 ^ 62.1673+-0.2790
^ definitely 5.3843x faster
proxy-get-megamorphic 33.8379+-0.1459 ^ 9.9726+-0.0896
^ definitely 3.3931x faster
proxy-get-by-val-miss 390.1010+-1.5733 ^ 57.8217+-0.2928
^ definitely 6.7466x faster
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheCompiler::regenerate):
* Source/JavaScriptCore/bytecode/Repatch.cpp:
(JSC::repatchGetBy):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITOperations.h:
Canonical link: https://commits.webkit.org/263892@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
