Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6d70d346c664d6619e364953fbccc4122cc493ed
https://github.com/WebKit/WebKit/commit/6d70d346c664d6619e364953fbccc4122cc493ed
Author: Yusuke Suzuki <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
A JSTests/stress/megamorphic-getter-ic.js
M Source/JavaScriptCore/bytecode/AccessCase.cpp
M Source/JavaScriptCore/bytecode/AccessCase.h
M Source/JavaScriptCore/bytecode/GetByStatus.cpp
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.h
M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.h
M Source/JavaScriptCore/jit/ICStats.h
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/jit/JITThunks.h
M Source/JavaScriptCore/runtime/MegamorphicCache.cpp
M Source/JavaScriptCore/runtime/MegamorphicCache.h
Log Message:
-----------
[JSC] Add LoadMegamorphicGetter IC
https://bugs.webkit.org/show_bug.cgi?id=318745
rdar://181544093
Reviewed by Keith Miller.
Currently our Megamorphic IC is supporting plain properties, and getter
is always going to the slow path. But we may have some places which is
repeatedly calling a getter with various structures. Then Megamorphic IC
for getter is beneficial (setter is also beneficial, so we are planning
to have that later).
Key observation is that megamorphic IC getter site is just handling getters.
It is very rare that one property access site is having normal
properties and getters. It is typically either normal-properties-only or
getters-only. Thus this patch adds LoadMegamorphicGetter which handles
getter well so that we can keep LoadMegamorphic clean and extremely
optimized while we start handling getter sites as well.
* JSTests/stress/megamorphic-getter-ic.js: Added.
(shouldBe):
(makeShapes.const.getter):
(makeShapes.get shapes):
(makeShapes.else.get const):
(makeShapes):
(access):
(shouldBe.access.):
(shouldBe.access.get const):
(shouldBe.access.accessSide):
(shouldBe.access):
(shouldBe.):
(shouldBe.get const):
(shouldBe.accessReconf):
(shouldBe.get for):
(shouldBe.const.getter):
(shouldBe.accessThrow):
(shouldBe.get else.get object):
(shouldBe.get else):
* Source/JavaScriptCore/bytecode/AccessCase.cpp:
(JSC::AccessCase::create):
(JSC::AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck const):
(JSC::AccessCase::requiresIdentifierNameMatch const):
(JSC::AccessCase::requiresInt32PropertyCheck const):
(JSC::AccessCase::forEachDependentCell const):
(JSC::AccessCase::doesCalls const):
(JSC::AccessCase::canReplace const):
(JSC::AccessCase::runWithDowncast):
(JSC::AccessCase::canBeShared):
* Source/JavaScriptCore/bytecode/AccessCase.h:
* Source/JavaScriptCore/bytecode/GetByStatus.cpp:
(JSC::GetByStatus::computeForPropertyInlineCacheWithoutExitSiteFeedback):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::needsScratchFPR):
(JSC::forInBy):
(JSC::isStateless):
(JSC::doesJSCalls):
(JSC::isMegamorphic):
(JSC::canBeViaGlobalProxy):
(JSC::InlineCacheCompiler::generateWithGuard):
(JSC::InlineCacheCompiler::generateAccessCase):
(JSC::InlineCacheCompiler::tryFoldToMegamorphic):
(JSC::getterCallFromGetterSetterImpl):
(JSC::getterHandlerImpl):
(JSC::getByIdMegamorphicGetterHandler):
(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.h:
* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::findMegamorphicCacheEntry):
(JSC::AssemblyHelpers::loadMegamorphicProperty):
(JSC::AssemblyHelpers::loadMegamorphicGetterSetter):
* Source/JavaScriptCore/jit/AssemblyHelpers.h:
* Source/JavaScriptCore/jit/ICStats.h:
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::getByIdMegamorphic):
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITThunks.h:
* Source/JavaScriptCore/runtime/MegamorphicCache.cpp:
(JSC::MegamorphicCache::age):
(JSC::MegamorphicCache::clearEntries):
* Source/JavaScriptCore/runtime/MegamorphicCache.h:
(JSC::MegamorphicCache::offsetOfGetterCachePrimaryEntries):
(JSC::MegamorphicCache::offsetOfGetterCacheSecondaryEntries):
(JSC::MegamorphicCache::initAsGetterHit):
Canonical link: https://commits.webkit.org/316687@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
