[webkit-changes] [WebKit/WebKit] 8f5016: [JSC] Optimize Object.assign with empty object

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 8f5016427be1a14414038b83395a443c94c10084
      https://github.com/WebKit/WebKit/commit/8f5016427be1a14414038b83395a443c94c10084
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-04-26 (Wed, 26 Apr 2023)

  Changed paths:
    A JSTests/microbenchmarks/object-assign-empty.js
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
    M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h
    M Source/JavaScriptCore/runtime/Structure.h
    M Source/JavaScriptCore/runtime/StructureInlines.h
    M Source/JavaScriptCore/runtime/StructureRareData.h

  Log Message:
  -----------
  [JSC] Optimize Object.assign with empty object
https://bugs.webkit.org/show_bug.cgi?id=256019
rdar://108585195

Reviewed by Alexey Shvayka.

Actually, this is pretty common that Object.assign's source objects are empty. The reason is the pattern like this,

    function func(options = {}) {
        var options = Object.assign({ defaultOption1: true, defaultOption2: false }, options);
        ...
    }

And if we call this func with no-options, then Object.assign will see empty options object.
This patch adds a fast path for that in C++ and DFG / FTL JIT.

1. In DFG and FTL, we quickly check empty objects and skip the execution of Object.assign if source is empty.
2. In C++, we check property count before entering into putOwnDataPropertyBatching.
3. We also relax putOwnDataPropertyBatching. Transition possibility should be checked only when we cause the transition.
   Otherwise, we do not need to give up the optimization, like, just replacing properties.

                                         ToT                     Patched

    object-assign-transition       84.0831+-0.2116     ^     70.7839+-0.2697        ^ definitely 1.1879x faster
    object-assign-replace          77.5201+-0.2244     ^     72.5579+-0.1398        ^ definitely 1.0684x faster
    object-assign-empty            13.7165+-0.0783     ^      7.0465+-0.0528        ^ definitely 1.9466x faster
    object-assign-multiple        132.1961+-0.1656     ^     98.9260+-0.5316        ^ definitely 1.3363x faster

* JSTests/microbenchmarks/object-assign-empty.js: Added.
(test):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileObjectAssign):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::putOwnDataPropertyBatching):
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::objectAssignFast):
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::propertyHashOffset):
* Source/JavaScriptCore/runtime/StructureInlines.h:
(JSC::Structure::canPerformFastPropertyEnumeration const):
* Source/JavaScriptCore/runtime/StructureRareData.h:

Canonical link: https://commits.webkit.org/263444@main