Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 48985e195c6fddb7395ad65e72a7614f12366ae2
https://github.com/WebKit/WebKit/commit/48985e195c6fddb7395ad65e72a7614f12366ae2
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-27 (Thu, 27 Aug 2026)
Changed paths:
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGVariableEvent.h
M Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp
M Source/JavaScriptCore/dfg/DFGVariableEventStream.h
M Source/JavaScriptCore/ftl/FTLOSRExit.cpp
M Source/JavaScriptCore/ftl/FTLOSRExit.h
M Source/WTF/WTF.xcodeproj/project.pbxproj
M Source/WTF/wtf/CMakeLists.txt
M Source/WTF/wtf/LEBDecoder.h
A Source/WTF/wtf/LEBEncoder.h
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WTF/LEBEncoder.cpp
Log Message:
-----------
[JSC] Store the DFG `VariableEventStream` as a byte stream
https://bugs.webkit.org/show_bug.cgi?id=322713
Reviewed by Yusuke Suzuki.
DFG::VariableEventStream keeps one 14 byte VariableEvent per event for as long
as the DFG code lives, and its only reader is reconstruct() on OSR exit, which
seeks back to the last Reset and replays the events from there. On JetStream3
(25,095 DFG compiles) the streams hold 4.76 million events, 66.6 MB over the run
and 2.65 KB per DFG compile, mostly SetLocal and MovHint events whose payloads
are small integers.
This patch makes VariableEventStreamBuilder encode each event into a byte stream
as SpeculativeJIT emits it, in the format described above the class in
DFGVariableEventStream.h, and record the byte offset of every Reset in a side
table. The stream index that SpeculativeJIT captures for each OSR exit, slow
path and OSR entry is now a byte offset, so nothing has to map event counts to
offsets afterwards; reconstruct() binary-searches the Reset table for the
checkpoint and decodes forward to that offset. The events are still
VariableEvents on both sides of the stream, so the emitters and the replay
switch are unchanged; VariableEvent only loses the Packed<> wrappers that
existed to make the stored array dense.
This is the DFG counterpart of 319934@main, which did the same for
FTL::OSRExitDescriptor. The LEB128 encoders that both streams need move to a
new wtf/LEBEncoder.h, the counterpart of LEBDecoder.h, which in turn gains
decode*OrCrash() for streams the process encoded itself, and the FTL stream
switches its hand-rolled zigzag register offsets to the SLEB128 that WTF
already decodes.
On the same JetStream3 run the byte streams and Reset tables total 17.8 MB (3.7
bytes per event, -73%), 0.71 KB per DFG compile. Decoding adds 0.5 us to each
reconstruct().
Test: Tools/TestWebKitAPI/Tests/WTF/LEBEncoder.cpp
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::finalizeEventStream):
* Source/JavaScriptCore/dfg/DFGVariableEvent.h:
(JSC::DFG::VariableEvent::fillGPR):
(JSC::DFG::VariableEvent::fillFPR):
(JSC::DFG::VariableEvent::birth):
(JSC::DFG::VariableEvent::spill):
(JSC::DFG::VariableEvent::death):
(JSC::DFG::VariableEvent::setLocal):
(JSC::DFG::VariableEvent::movHint):
(JSC::DFG::VariableEvent::id const):
(JSC::DFG::VariableEvent::gpr const):
(JSC::DFG::VariableEvent::fpr const):
(JSC::DFG::VariableEvent::spillRegister const):
(JSC::DFG::VariableEvent::operand const):
(JSC::DFG::VariableEvent::machineRegister const):
(JSC::DFG::VariableEvent::variableRepresentation const):
* Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp:
(JSC::DFG::VariableEventStreamBuilder::logEvent):
(JSC::DFG::VariableEventStream::encode):
(JSC::DFG::VariableEventStream::decode):
(JSC::DFG::VariableEventStream::reconstruct const):
* Source/JavaScriptCore/dfg/DFGVariableEventStream.h:
(JSC::DFG::VariableEventStream::VariableEventStream):
(JSC::DFG::VariableEventStreamBuilder::VariableEventStreamBuilder):
(JSC::DFG::VariableEventStreamBuilder::appendAndLog):
(JSC::DFG::VariableEventStreamBuilder::size const):
(JSC::DFG::VariableEventStreamBuilder::finalize):
* Source/JavaScriptCore/ftl/FTLOSRExit.cpp:
(JSC::FTL::OSRExitValues::encode):
(JSC::FTL::OSRExitValues::decode const):
(JSC::FTL::DFG::appendLEB): Deleted.
(JSC::FTL::DFG::readLEB): Deleted.
* Source/JavaScriptCore/ftl/FTLOSRExit.h:
* Source/WTF/WTF.xcodeproj/project.pbxproj:
* Source/WTF/wtf/CMakeLists.txt:
* Source/WTF/wtf/LEBDecoder.h:
(WTF::LEBDecoder::decodeUIntOrCrash):
(WTF::LEBDecoder::decodeIntOrCrash):
(WTF::LEBDecoder::decodeUInt32OrCrash):
(WTF::LEBDecoder::decodeUInt64OrCrash):
(WTF::LEBDecoder::decodeInt32OrCrash):
(WTF::LEBDecoder::decodeInt64OrCrash):
* Source/WTF/wtf/LEBEncoder.h: Added.
(WTF::LEBEncoder::encodeUInt):
(WTF::LEBEncoder::encodeInt):
(WTF::LEBEncoder::encodeUInt32):
(WTF::LEBEncoder::encodeUInt64):
(WTF::LEBEncoder::encodeInt32):
(WTF::LEBEncoder::encodeInt64):
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WTF/LEBEncoder.cpp: Added.
(TestWebKitAPI::testUInt32LEBEncode):
(TestWebKitAPI::testInt32LEBEncode):
(TestWebKitAPI::TEST(WTF, LEBEncoderUInt32)):
(TestWebKitAPI::TEST(WTF, LEBEncoderInt32)):
(TestWebKitAPI::TEST(WTF, LEBEncoderRoundTrip64)):
Canonical link: https://commits.webkit.org/320007@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
