Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0b92c2bcd0d55ced7be0cbbd1fa38009b5138f4c
https://github.com/WebKit/WebKit/commit/0b92c2bcd0d55ced7be0cbbd1fa38009b5138f4c
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M Source/JavaScriptCore/bytecode/BytecodeRewriter.cpp
M Source/JavaScriptCore/bytecode/CodeBlock.h
M Source/JavaScriptCore/bytecode/PreciseJumpTargets.cpp
M Source/JavaScriptCore/bytecode/PreciseJumpTargets.h
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
M Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBaseInlines.h
M Source/JavaScriptCore/lol/LOLJIT.cpp
M Source/JavaScriptCore/lol/LOLJIT.h
M Source/JavaScriptCore/runtime/CachedTypes.cpp
Log Message:
-----------
[JSC] Remove `UnlinkedCodeBlock::m_jumpTargets`
https://bugs.webkit.org/show_bug.cgi?id=321843
Reviewed by Yusuke Suzuki.
BytecodeGenerator records the offset of every label it emits, and
UnlinkedCodeBlockGenerator::finalize
copies the list into UnlinkedCodeBlock::m_jumpTargets, where it stays for the
lifetime of the code block
and is also written to the bytecode cache. Nothing in a shipping configuration
reads the contents: DFG and
the liveness analysis recompute the targets from the instruction stream with
computePreciseJumpTargets(),
Baseline labels every instruction, and computePreciseJumpTargets() only checks
whether the list is empty.
It never is, because emitEnter() adds an entry to every code block. The one
reader of the contents is
LOLJIT, which is off by default.
Remove the list from the generator, UnlinkedCodeBlock, CodeBlock and
CachedCodeBlock, along with the
empty check and the recomputation after generatorification. emitLabel() only
needs to disable peephole
optimizations. LOLJIT computes the targets with computePreciseJumpTargets()
like DFG does, which also
gives it the op_catch offsets of handlers with a completion register; the label
list recorded the
following mov instead. The generated bytecode is unchanged.
After loading typescript.js and compiling one file, this saves 4 bytes per
label (7,040 labels in 944 code
blocks, about 38 KB with malloc rounding) and 46 KB (1.4%) of bytecode cache.
sizeof(UnlinkedFunctionCodeBlock)
goes from 216 to 208 bytes, so its cell goes from 224 to 208 bytes as well.
* Source/JavaScriptCore/bytecode/BytecodeRewriter.cpp:
(JSC::BytecodeRewriter::execute):
* Source/JavaScriptCore/bytecode/CodeBlock.h:
(JSC::CodeBlock::numberOfJumpTargets const): Deleted.
(JSC::CodeBlock::jumpTarget const): Deleted.
* Source/JavaScriptCore/bytecode/PreciseJumpTargets.cpp:
(JSC::computePreciseJumpTargetsInternal):
(JSC::computePreciseJumpTargets):
(JSC::recomputePreciseJumpTargets): Deleted.
* Source/JavaScriptCore/bytecode/PreciseJumpTargets.h:
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::visitChildrenImpl):
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::numberOfJumpTargets const): Deleted.
(JSC::UnlinkedCodeBlock::jumpTarget const): Deleted.
(JSC::UnlinkedCodeBlock::lastJumpTarget const): Deleted.
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp:
(JSC::UnlinkedCodeBlockGenerator::finalize):
(JSC::UnlinkedCodeBlockGenerator::applyModification):
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h:
(JSC::UnlinkedCodeBlockGenerator::numberOfJumpTargets const): Deleted.
(JSC::UnlinkedCodeBlockGenerator::addJumpTarget): Deleted.
(JSC::UnlinkedCodeBlockGenerator::jumpTarget const): Deleted.
(JSC::UnlinkedCodeBlockGenerator::lastJumpTarget const): Deleted.
* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::generate):
(JSC::BytecodeGenerator::emitEnter):
* Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBaseInlines.h:
(JSC::BytecodeGeneratorBase<Traits>::emitLabel):
* Source/JavaScriptCore/lol/LOLJIT.cpp:
(JSC::LOL::LOLJIT::compileAndLinkWithoutFinalizing):
* Source/JavaScriptCore/lol/LOLJIT.h:
(JSC::LOL::LOLJIT::nextBytecodeIndexWithFlushForJumpTargetsIfNeeded):
* Source/JavaScriptCore/runtime/CachedTypes.cpp:
(JSC::CachedCodeBlock<CodeBlockType>::decode const):
(JSC::CachedCodeBlock<CodeBlockType>::encode):
Canonical link: https://commits.webkit.org/319376@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
