[webkit-changes] [WebKit/WebKit] d126a3: [JSC] Expand existing property names caching onto ...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: d126a37a66b1639268a94da0647988bc565a6a99
      https://github.com/WebKit/WebKit/commit/d126a37a66b1639268a94da0647988bc565a6a99
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2023-04-26 (Wed, 26 Apr 2023)

  Changed paths:
    M JSTests/microbenchmarks/object-get-own-property-symbols.js
    M JSTests/microbenchmarks/reflect-own-keys.js
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/dfg/DFGOperations.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.h
    M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
    M Source/JavaScriptCore/runtime/ObjectConstructor.h
    M Source/JavaScriptCore/runtime/ReflectObject.cpp
    M Source/JavaScriptCore/runtime/ReflectObject.h
    M Source/JavaScriptCore/runtime/StructureRareData.h

  Log Message:
  -----------
  [JSC] Expand existing property names caching onto Reflect.ownKeys() / Object.getOwnPropertySymbols()
https://bugs.webkit.org/show_bug.cgi?id=255935
<rdar://problem/108512520>

Reviewed by Yusuke Suzuki.

This change expands existing Object.keys() / Object.getOwnPropertyNames() StructureRareData-based
property names caching onto Reflect.ownKeys() / Object.getOwnPropertySymbols().

Vue.js v3 traps "ownKeys" on all reactive objects (except Map / Set) to merely forward the call to
Reflect.ownKeys(), while web developers often destructure / call Object.assign() on those Proxy objects.

Also, this change enables a follow-up optimization of Proxy objects without "ownKeys" traps,
hence the renaming of CachedPropertyNamesKind that unties enumerators from ObjectConstructor methods.

As for Object.getOwnPropertySymbols(), some older code on the web uses it conditionally instead of
polyfilling Reflect.ownKeys(), and optimizing it along with Reflect.ownKeys() brought convenience
of removing std::optional and a few conditions.

The downside of this patch is sizeof(StructureRareData) increase from 80 to 96.

                                            ToT                      patch

reflect-own-keys-proxy                18.8444+-0.1230     ?     18.9896+-0.1170        ?
reflect-own-keys-proxy-2              23.4113+-0.1775     ^     21.2813+-0.1835        ^ definitely 1.1001x faster
reflect-own-keys-function              8.3105+-0.0650     ^      6.4431+-0.0452        ^ definitely 1.2898x faster
reflect-own-keys                      31.3966+-0.1861     ^      0.9040+-0.0209        ^ definitely 34.7312x faster
object-get-own-property-symbols       18.6633+-0.1597     ^      1.0756+-0.0218        ^ definitely 17.3512x faster

<geometric>                           18.4640+-0.0749     ^      4.7893+-0.0312        ^ definitely 3.8553x faster

* JSTests/microbenchmarks/object-get-own-property-symbols.js:
* JSTests/microbenchmarks/reflect-own-keys.js:
Makes the property keys count way more real-world.

* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::cachedPropertyNamesKind const):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
(JSC::DFG::operationOwnPropertyKeysVariant):
(JSC::DFG::operationOwnPropertyKeysVariantObject):
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h:
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::abstractHeapForOwnPropertyKeysCache):
(JSC::FTL::DFG::LowerDFGToB3::compileOwnPropertyKeysVariant):
(JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames): Deleted.
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::inferCachedPropertyNamesKind):
(JSC::ownPropertyKeys): Merely removes PropertyNameMode check, de-indents, and extracts copyPropertiesToBuffer() helper.

* Source/JavaScriptCore/runtime/ObjectConstructor.h:
* Source/JavaScriptCore/runtime/ReflectObject.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/StructureRareData.h:

Canonical link: https://commits.webkit.org/263441@main