Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 219167e2b464d7d9ab4233bcaaa7c78d2035747c
https://github.com/WebKit/WebKit/commit/219167e2b464d7d9ab4233bcaaa7c78d2035747c
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-16 (Wed, 16 Sep 2026)
Changed paths:
A JSTests/stress/osr-exit-entrance-fire-repeatedly.js
M Source/JavaScriptCore/assembler/CodeLocation.h
M Source/JavaScriptCore/dfg/DFGJITCode.h
M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
M Source/JavaScriptCore/dfg/DFGJITCompiler.h
M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
M Source/JavaScriptCore/dfg/DFGOSRExit.h
M Source/JavaScriptCore/dfg/DFGOSRExitBase.h
M Source/JavaScriptCore/dfg/DFGOSRExitCompilationInfo.h
M Source/JavaScriptCore/dfg/DFGThunks.cpp
M Source/JavaScriptCore/disassembler/ARM64/A64DOpcode.cpp
M Source/JavaScriptCore/runtime/VM.h
Log Message:
-----------
[JSC] Shrink the DFG code that enters the OSR exit thunk
https://bugs.webkit.org/show_bug.cgi?id=324137
Reviewed by Yusuke Suzuki.
For every OSR exit, DFG emits two instructions to enter the OSR exit
generation thunk: a mov that puts the exit index in a register, and a jump
to the thunk.
These entrances are laid out after the function body in exit index order,
so if they call the thunk instead of jumping to it, the exit index can be
computed from the return address, as V8 does [1]. This patch does that on
ARM64 and X86_64, and RISCV64 keeps the current entrance. Since the location
of an entrance is now computed from the exit index,
DFG::OSRExit::m_patchableJumpLocation is removed.
Before After
Entrance, ARM64 8 B 4 B
Entrance, X86_64 11 B 5 B
sizeof(DFG::OSRExit) 80 B 72 B
One run of JetStream3 on ARM64, summed over all compilations:
Before After
DFG exits 496,247 495,368
DFG entrances 3.97 MB 1.98 MB
DFG code 49.68 MB 47.62 MB
[1]: https://chromium.googlesource.com/v8/v8/+/207d6b35e9
* JSTests/stress/osr-exit-entrance-fire-repeatedly.js: Added.
(shouldBe):
(add):
(load):
(index):
(thrower):
(catcher):
* Source/JavaScriptCore/dfg/DFGJITCode.h:
* Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::linkOSRExits):
(JSC::DFG::JITCompiler::link):
* Source/JavaScriptCore/dfg/DFGJITCompiler.h:
* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOSRExit.h:
(JSC::DFG::OSRExit::codeLocationForRepatch const):
* Source/JavaScriptCore/dfg/DFGOSRExitBase.h:
* Source/JavaScriptCore/dfg/DFGOSRExitCompilationInfo.h:
* Source/JavaScriptCore/dfg/DFGThunks.cpp:
(JSC::DFG::osrExitGenerationThunkGenerator):
* Source/JavaScriptCore/disassembler/ARM64/A64DOpcode.cpp:
(JSC::ARM64Disassembler::A64DOpcode::handlePotentialDataPointer):
* Source/JavaScriptCore/runtime/VM.h:
Canonical link: https://commits.webkit.org/321236@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
