[webkit-changes] [WebKit/WebKit] 5b9fce: [JSC] Inline op_to_this for global object case

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 5b9fce6f483abfdfb225e5ce76ceeda307d35d6c
      https://github.com/WebKit/WebKit/commit/5b9fce6f483abfdfb225e5ce76ceeda307d35d6c
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-06-21 (Wed, 21 Jun 2023)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/JSBigInt.h
    M Source/JavaScriptCore/runtime/JSCast.h
    M Source/JavaScriptCore/runtime/JSScope.h
    M Source/JavaScriptCore/runtime/JSString.h
    M Source/JavaScriptCore/runtime/JSType.h
    M Source/JavaScriptCore/runtime/JSTypeInfo.h
    M Source/JavaScriptCore/runtime/Symbol.h

  Log Message:
  -----------
  [JSC] Inline op_to_this for global object case
https://bugs.webkit.org/show_bug.cgi?id=258343
rdar://problem/111089057

Reviewed by Alexey Shvayka.

This patch inlines non-object-allocating simple ToThis operation in DFG and FTL.
And we drop OverridesToThis bit, which is no longer necessary.

* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::isToThisAnIdentity):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileToThis):
* Source/JavaScriptCore/runtime/JSBigInt.h:
* Source/JavaScriptCore/runtime/JSCast.h:
* Source/JavaScriptCore/runtime/JSScope.h:
* Source/JavaScriptCore/runtime/JSString.h:
* Source/JavaScriptCore/runtime/JSType.h:
* Source/JavaScriptCore/runtime/JSTypeInfo.h:
(JSC::TypeInfo::perCellBit):
(JSC::TypeInfo::overridesToThis const): Deleted.
* Source/JavaScriptCore/runtime/Symbol.h:

Canonical link: https://commits.webkit.org/265373@main