Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b00e0c35f823f59fd5ee06f517c2ce1fdf5c465e
https://github.com/WebKit/WebKit/commit/b00e0c35f823f59fd5ee06f517c2ce1fdf5c465e
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-15 (Sat, 15 Aug 2026)
Changed paths:
M Source/JavaScriptCore/bytecode/AccessCase.cpp
M Source/JavaScriptCore/bytecode/InlineAccess.cpp
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
M Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp
M Source/JavaScriptCore/bytecode/PropertyInlineCache.h
M Source/JavaScriptCore/dfg/DFGInlineCacheWrapperInlines.h
M Source/JavaScriptCore/dfg/DFGJITCode.h
M Source/JavaScriptCore/jit/JIT.cpp
M Source/JavaScriptCore/jit/JITCall.cpp
M Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp
M Source/JavaScriptCore/jit/JITInlineCacheGenerator.h
M Source/JavaScriptCore/jit/JITPropertyAccess.cpp
Log Message:
-----------
[JSC] Move repatching-only fields out of `HandlerPropertyInlineCache`
https://bugs.webkit.org/show_bug.cgi?id=321765
Reviewed by Yusuke Suzuki.
PropertyInlineCache keeps slowPathStartLocation and six GPRReg fields in the
base class, so every
HandlerPropertyInlineCache carries them too. Handler ICs never use
slowPathStartLocation, and their
registers are fixed per AccessType since 281584@main. Only repatching ICs store
per-site values
for them.
This patch moves both to RepatchingPropertyInlineCache and adds registers(),
which returns the
stored registers for repatching ICs and computes them from accessType for
handler ICs, like
usedRegisters() in 315196@main. The unlinked ICs stored the same fields without
anyone reading
them, so they are removed as well.
HandlerPropertyInlineCache shrinks from 128 to 112 bytes,
BaselineUnlinkedPropertyInlineCache from
40 to 32 bytes, and DFG::UnlinkedPropertyInlineCache from 64 to 40 bytes.
Running Octane typescript,
this saves 465 KB of malloc'ed memory for about 16,500 Baseline and 1,700 DFG
IC sites.
* Source/JavaScriptCore/bytecode/AccessCase.cpp:
(JSC::AccessCase::createTransition):
* Source/JavaScriptCore/bytecode/InlineAccess.cpp:
(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::getScratchRegister):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheCompiler::succeed):
(JSC::InlineCacheCompiler::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::InlineCacheCompiler::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::InlineCacheCompiler::makeDefaultScratchAllocator):
(JSC::InlineCacheCompiler::generateWithGuard):
(JSC::InlineCacheCompiler::generateAccessCase):
(JSC::InlineCacheCompiler::emitDOMJITGetter):
(JSC::InlineCacheCompiler::emitModuleNamespaceLoad):
(JSC::InlineCacheCompiler::emitProxyObjectAccess):
(JSC::InlineCacheCompiler::emitIntrinsicGetter):
(JSC::InlineCacheCompiler::compile):
(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):
(JSC::InlineCacheCompiler::compileGetByDOMJITHandler):
* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:
(JSC::PropertyInlineCache::registers const):
(JSC::HandlerPropertyInlineCache::initializeFromUnlinkedPropertyInlineCache):
(JSC::HandlerPropertyInlineCache::initializeFromDFGUnlinkedPropertyInlineCache):
(JSC::PropertyInlineCache::resetStubAsJumpInAccess):
(JSC::PropertyInlineCache::initializePredefinedRegisters): Deleted.
* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:
(JSC::PropertyInlineCache::valueRegs const):
(JSC::PropertyInlineCache::propertyRegs const):
(JSC::PropertyInlineCache::baseRegs const):
(JSC::PropertyInlineCache::offsetOfCallSiteIndex):
(JSC::PropertyInlineCache::baseGPR const):
(JSC::PropertyInlineCache::valueGPR const):
(JSC::PropertyInlineCache::extraGPR const):
(JSC::PropertyInlineCache::extra2GPR const):
(JSC::PropertyInlineCache::propertyCacheGPR const):
(JSC::PropertyInlineCache::arrayProfileGPR const):
(JSC::PropertyInlineCache::thisGPR const):
(JSC::PropertyInlineCache::prototypeGPR const):
(JSC::PropertyInlineCache::brandGPR const):
(JSC::PropertyInlineCache::propertyGPR const):
(JSC::PropertyInlineCache::offsetOfSlowPathStartLocation): Deleted.
(JSC::PropertyInlineCache::setUsedRegisters): Deleted.
(JSC::PropertyInlineCache::removeUsedRegister): Deleted.
* Source/JavaScriptCore/dfg/DFGInlineCacheWrapperInlines.h:
(JSC::DFG::InlineCacheWrapper<GeneratorType>::finalize):
* Source/JavaScriptCore/dfg/DFGJITCode.h:
(JSC::DFG::UnlinkedPropertyInlineCache::setUsedRegisters): Deleted.
(JSC::DFG::UnlinkedPropertyInlineCache::removeUsedRegister): Deleted.
* Source/JavaScriptCore/jit/JIT.cpp:
(JSC::JIT::link):
* Source/JavaScriptCore/jit/JITCall.cpp:
(JSC::JIT::emitSlowIteratorOpenGeneric):
(JSC::JIT::emitSlow_op_iterator_next):
(JSC::JIT::emitSlow_op_instanceof):
* Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:
(JSC::JITInlineCacheGenerator::finalize):
* Source/JavaScriptCore/jit/JITInlineCacheGenerator.h:
(JSC::JITInlineCacheGenerator::setUpPropertyInlineCacheImpl):
(JSC::JITByIdGenerator::setUpPropertyInlineCacheImpl):
(JSC::JITInByValGenerator::setUpPropertyInlineCache):
(JSC::JITInlineCacheGenerator::reportBaselineDataICSlowPathBegin): Deleted.
* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::generatePutByValSlowCase):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emitSlow_op_get_length):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_get_by_val_with_this):
Canonical link: https://commits.webkit.org/319228@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
