[webkit-changes] [WebKit/WebKit] 871d04: [JSC] Optimize Proxy get with various keys without...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 871d04ba21fbb2ae92396f13d51f367fdba23508
      https://github.com/WebKit/WebKit/commit/871d04ba21fbb2ae92396f13d51f367fdba23508
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-05-09 (Tue, 09 May 2023)

  Changed paths:
    A JSTests/microbenchmarks/proxy-get-by-val-hit.js
    A JSTests/microbenchmarks/proxy-get-by-val-miss.js
    A JSTests/microbenchmarks/proxy-get-megamorphic.js
    M Source/JavaScriptCore/builtins/ProxyHelpers.js
    M Source/JavaScriptCore/bytecode/AccessCase.cpp
    M Source/JavaScriptCore/bytecode/AccessCase.h
    M Source/JavaScriptCore/bytecode/GetByStatus.cpp
    M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
    M Source/JavaScriptCore/bytecode/Repatch.cpp
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/jit/JITOperations.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.h
    M Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h

  Log Message:
  -----------
  [JSC] Optimize Proxy get with various keys without handlers
https://bugs.webkit.org/show_bug.cgi?id=256340
rdar://108920491

Reviewed by Michael Saboff.

This patch optimizes the use case, which is the following,

    var proxy = new Proxy({}, { .. not get handler });
    proxy[varousKeys];

1. First, we introduce IndexedProxyObjectLoad IC to handle GetByVal with ProxyObject case.
   We just extend existing ProxyObjectLoad with non-constant subscript. And to enforce property-keys,
   we need to call @toPropertyKey, and that's why we introduce a performProxyObjectGetByVal separately
   from performProxyObjectGet.
2. Inside performProxyObjectGetByVal, we would like to handle GetByValWithThis efficiently. And one of
   the key improvement we can have is introducing megamorphic IC for that. Because megamorphic IC only
   handles non-getter cases, it perfectly works well with GetByValWithThis since megamorphic IC fast
   path does not care about |this| value.
3. We introduce GetByValWithThisMegamorphic and GetByIdWithThisMegamorphic DFG / FTL nodes to handle
   these megamorphic cases efficiently in DFG and FTL.

                                         ToT                     Patched

    proxy-get-by-val-hit          334.7270+-1.2121     ^     62.1673+-0.2790        ^ definitely 5.3843x faster
    proxy-get-megamorphic          33.8379+-0.1459     ^      9.9726+-0.0896        ^ definitely 3.3931x faster
    proxy-get-by-val-miss         390.1010+-1.5733     ^     57.8217+-0.2928        ^ definitely 6.7466x faster

* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheCompiler::regenerate):
* Source/JavaScriptCore/bytecode/Repatch.cpp:
(JSC::repatchGetBy):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITOperations.h:

Canonical link: https://commits.webkit.org/263892@main