[webkit-changes] [WebKit/WebKit] ff7f70: [JSC] Refine DFG AI type speculations for GetInter...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ff7f706b1d907c0c1fe8b55d4a6459e3cd4496c9
      https://github.com/WebKit/WebKit/commit/ff7f706b1d907c0c1fe8b55d4a6459e3cd4496c9
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2023-03-23 (Thu, 23 Mar 2023)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

  Log Message:
  -----------
  [JSC] Refine DFG AI type speculations for GetInternalField when called on ProxyObject
https://bugs.webkit.org/show_bug.cgi?id=254271
<rdar://problem/107056889>

Reviewed by Yusuke Suzuki.

This change refines type speculations for [[ProxyTarget]] and [[ProxyHandler]] internal fields
as their types are guaranteed by the ECMA-262, getting rid of SpecBytecodeTop, which enables downstream
optimizations in IC helpers for ProxyObject's "has" and "get" traps, progressing microbenchmarks by 6-10%.

microbenchmarks/proxy-get-miss-handler.js speedup probably slighly affects Speedometer2/Flight-TodoMVC.

This very optimization may be applied to other object types, including Promise.

                                    ToT                     patch

proxy-has-hit                 4.9520+-0.0588     ^      4.6705+-0.0609        ^ definitely 1.0603x faster
proxy-has-miss-handler        5.0585+-0.0674     ^      4.7937+-0.0778        ^ definitely 1.0552x faster
proxy-get-miss-handler       17.1412+-0.1817     ^     15.5256+-0.1962        ^ definitely 1.1041x faster

* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Canonical link: https://commits.webkit.org/262054@main