[webkit-changes] [WebKit/WebKit] 871d04: [JSC] Optimize Proxy get with various keys without...
Yusuke Suzuki
noreply at github.com
Tue May 9 20:31:57 PDT 2023
Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 871d04ba21fbb2ae92396f13d51f367fdba23508
https://github.com/WebKit/WebKit/commit/871d04ba21fbb2ae92396f13d51f367fdba23508
Author: Yusuke Suzuki <ysuzuki at apple.com>
Date: 2023-05-09 (Tue, 09 May 2023)
Changed paths:
A JSTests/microbenchmarks/proxy-get-by-val-hit.js
A JSTests/microbenchmarks/proxy-get-by-val-miss.js
A JSTests/microbenchmarks/proxy-get-megamorphic.js
M Source/JavaScriptCore/builtins/ProxyHelpers.js
M Source/JavaScriptCore/bytecode/AccessCase.cpp
M Source/JavaScriptCore/bytecode/AccessCase.h
M Source/JavaScriptCore/bytecode/GetByStatus.cpp
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
M Source/JavaScriptCore/bytecode/Repatch.cpp
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/jit/JITOperations.h
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
Log Message:
-----------
[JSC] Optimize Proxy get with various keys without handlers
https://bugs.webkit.org/show_bug.cgi?id=256340
rdar://108920491
Reviewed by Michael Saboff.
This patch optimizes the use case, which is the following,
var proxy = new Proxy({}, { .. not get handler });
proxy[varousKeys];
1. First, we introduce IndexedProxyObjectLoad IC to handle GetByVal with ProxyObject case.
We just extend existing ProxyObjectLoad with non-constant subscript. And to enforce property-keys,
we need to call @toPropertyKey, and that's why we introduce a performProxyObjectGetByVal separately
from performProxyObjectGet.
2. Inside performProxyObjectGetByVal, we would like to handle GetByValWithThis efficiently. And one of
the key improvement we can have is introducing megamorphic IC for that. Because megamorphic IC only
handles non-getter cases, it perfectly works well with GetByValWithThis since megamorphic IC fast
path does not care about |this| value.
3. We introduce GetByValWithThisMegamorphic and GetByIdWithThisMegamorphic DFG / FTL nodes to handle
these megamorphic cases efficiently in DFG and FTL.
ToT Patched
proxy-get-by-val-hit 334.7270+-1.2121 ^ 62.1673+-0.2790 ^ definitely 5.3843x faster
proxy-get-megamorphic 33.8379+-0.1459 ^ 9.9726+-0.0896 ^ definitely 3.3931x faster
proxy-get-by-val-miss 390.1010+-1.5733 ^ 57.8217+-0.2928 ^ definitely 6.7466x faster
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheCompiler::regenerate):
* Source/JavaScriptCore/bytecode/Repatch.cpp:
(JSC::repatchGetBy):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITOperations.h:
Canonical link: https://commits.webkit.org/263892@main
More information about the webkit-changes
mailing list