Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e57b0d1670910d44edac8f6ad5aa267bdaa10b48
https://github.com/WebKit/WebKit/commit/e57b0d1670910d44edac8f6ad5aa267bdaa10b48
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
M Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h
M Source/JavaScriptCore/dfg/DFGCommonData.h
M Source/JavaScriptCore/dfg/DFGJITCode.cpp
M Source/JavaScriptCore/dfg/DFGJITCode.h
M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
M Source/JavaScriptCore/dfg/DFGOSRExit.h
M Source/JavaScriptCore/dfg/DFGOSRExitBase.cpp
M Source/JavaScriptCore/dfg/DFGOSRExitBase.h
M Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPlan.cpp
M Source/JavaScriptCore/ftl/FTLJITCode.cpp
M Source/JavaScriptCore/ftl/FTLJITCode.h
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
Log Message:
-----------
[JSC] Store DFG OSR exits as a byte stream
https://bugs.webkit.org/show_bug.cgi?id=323407
Reviewed by Yusuke Suzuki.
Every DFG OSR exit keeps an 80-byte DFG::OSRExit in DFG::JITCode and a
16-byte MacroAssemblerCodeRef in DFG::JITData for as long as the DFG code
lives, although the exit is only read when it fires for the first time,
when the code block is jettisoned, or when an inline cache stub has to know
which registers are live at an exception handler. On JetStream3, 1.7% of
the exits ever fire.
This patch stores the exits of a JITCode as a byte stream (OSRExitStream;
the format is in the comment above the class) in chunks of 16 exits whose
code origins, stream indices and jump locations are delta-encoded, and
decodes an exit back into a DFG::OSRExit when it is needed. The two
operations that received a pointer to the exit from the exit code now take
the fields they read.
The exit counter, which was only ever tested for zero, is replaced in both
the DFG and the FTL by the list of exits whose code has been generated.
For the DFG this list also replaces the per-exit MacroAssemblerCodeRef:
linked DFG code reaches the exit through a patchable jump and never read
that table, and unlinked DFG code now reads a table of CodePtrs.
One JetStream3 run, 497k exits:
Before After
Total 47.7 MB 6.3 MB
Per exit 96 B 12.7 B
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::tallyFrequentExitSites):
* Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h:
* Source/JavaScriptCore/dfg/DFGCommonData.h:
* Source/JavaScriptCore/dfg/DFGJITCode.cpp:
(JSC::DFG::JITData::JITData):
(JSC::DFG::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
(JSC::DFG::JITCode::findPC):
* Source/JavaScriptCore/dfg/DFGJITCode.h:
(JSC::DFG::JITData::tryCreate):
* Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::linkOSRExits):
(JSC::DFG::JITCompiler::link):
* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:
(JSC::DFG::codeOriginTag):
(JSC::DFG::codeOriginTagFromFlags):
(JSC::DFG::encodeCodeOrigin):
(JSC::DFG::decodeCodeOrigin):
(JSC::DFG::OSRExitStream::OSRExitStream):
(JSC::DFG::OSRExitStream::decode const):
(JSC::DFG::OSRExitStream::at const):
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
(JSC::DFG::OSRExit::compileExit):
* Source/JavaScriptCore/dfg/DFGOSRExit.h:
(JSC::DFG::OSRExitStream::size const):
* Source/JavaScriptCore/dfg/DFGOSRExitBase.cpp:
(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow): Deleted.
* Source/JavaScriptCore/dfg/DFGOSRExitBase.h:
(): Deleted.
(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite): Deleted.
* Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::handleExitCounts):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGPlan.cpp:
(JSC::DFG::Plan::tryFinalizeJITData):
* Source/JavaScriptCore/ftl/FTLJITCode.cpp:
(JSC::FTL::JITCode::findPC):
* Source/JavaScriptCore/ftl/FTLJITCode.h:
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
Canonical link: https://commits.webkit.org/321231@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
