Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7a5cfe078bb3dc84193758100b90adf522947469
https://github.com/WebKit/WebKit/commit/7a5cfe078bb3dc84193758100b90adf522947469
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-16 (Wed, 16 Sep 2026)
Changed paths:
M Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.h
M Source/JavaScriptCore/ftl/FTLJITCode.h
M Source/JavaScriptCore/ftl/FTLOSRExit.cpp
M Source/JavaScriptCore/ftl/FTLOSRExit.h
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.h
M Source/JavaScriptCore/ftl/FTLOSRExitHandle.cpp
M Source/JavaScriptCore/ftl/FTLThunks.cpp
Log Message:
-----------
[JSC] Shrink the FTL code that enters the OSR exit thunk
https://bugs.webkit.org/show_bug.cgi?id=324407
Reviewed by Yusuke Suzuki.
This patch does for FTL what 321236@main did for DFG.
The basic idea is the same, but FTL differs from DFG in a few ways.
First, since B3 can allocate any register, an FTL entrance pushes the exit
index to the stack instead of putting it in a register, and then jumps to
the OSR exit generation thunk. This takes 5 instructions on ARM64 and 2
instructions on X86_64 for every OSR exit. This patch makes the entrance a
single call to the thunk as in DFG, and the exit is identified by the return
address of that call.
Second, DFG lays out the entrances in exit index order, but FTL emits them
in B3 late paths, so they are scattered. The exit index cannot be computed
from the return address as in DFG. Instead, it is found by searching
FTL::JITCode::m_osrExit for the exit whose m_entrance is right before the
return address. m_entrance is the existing m_patchableJump with its name and
type changed, since it is no longer a jump.
Finally, the OSR exit stub used the stack slot that the entrance pushed as
the scratch slot of saveAllRegisters(). Since the entrance no longer pushes
anything once it is repatched to jump to the stub, the stub makes that slot
by itself, and the thunk pops the return address before jumping to the stub.
Before After
Entrance, ARM64 20 B 4 B
Entrance, X86_64 10 B 5 B
One run of JetStream3 on ARM64, summed over all compilations:
Before After
FTL exits 162,857 165,575
FTL entrances 3.26 MB 0.66 MB
FTL code 15.46 MB 13.10 MB
* Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.h:
(JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
* Source/JavaScriptCore/ftl/FTLJITCode.h:
(JSC::FTL::JITCode::osrExitIndexForReturnPC const):
* Source/JavaScriptCore/ftl/FTLOSRExit.cpp:
(JSC::FTL::OSRExit::codeLocationForRepatch const): Deleted.
* Source/JavaScriptCore/ftl/FTLOSRExit.h:
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
(JSC::FTL::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.h:
* Source/JavaScriptCore/ftl/FTLOSRExitHandle.cpp:
(JSC::FTL::OSRExitHandle::emitExitThunk):
* Source/JavaScriptCore/ftl/FTLThunks.cpp:
(JSC::FTL::genericGenerationThunkGenerator):
(JSC::FTL::osrExitGenerationThunkGenerator):
(JSC::FTL::lazySlowPathGenerationThunkGenerator):
Canonical link: https://commits.webkit.org/321305@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
