[webkit-changes] [WebKit/WebKit] e1e2cb: [JSC] Cache lookups of ProxyObject's traps

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: e1e2cbbf2d6f36f82c6b7094312c230f6d152a2a
      https://github.com/WebKit/WebKit/commit/e1e2cbbf2d6f36f82c6b7094312c230f6d152a2a
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    A JSTests/stress/object-prototype-is-immutable-prototype-object.js
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/ProxyObject.cpp
    M Source/JavaScriptCore/runtime/ProxyObject.h

  Log Message:
  -----------
  [JSC] Cache lookups of ProxyObject's traps
https://bugs.webkit.org/show_bug.cgi?id=256554
<rdar://problem/109119378>

Reviewed by Yusuke Suzuki.

This patch introduces a caching of handler's traps by storing an array of property offsets, handler's
structure ID, and handler's prototype structure ID. We optimize for common case of ProxyObject's handler
being a plain JSFinalObject inheriting from Object.prototype, which [[Prototype]] is always `null`.

For now, only 3 of the most popular traps are cached: "has", "get", and "set".
Also, removes extra isCell() check from getMethod() to micro-optimize lookup of other traps.

This change progresses microbenchmarks with missing handlers by 60-70% when IC is off,
and speeds up Speedometer2/Flight-TodoMVC by 2%.

                                   ToT                      patch

proxy-has-miss-handler      310.7297+-1.4310     ^    182.3500+-0.2509        ^ definitely 1.7040x faster
proxy-set-miss-handler     1305.7705+-2.9307     ^   1179.7164+-4.0497        ^ definitely 1.1069x faster
proxy-get-miss-handler      310.6261+-0.1537     ^    190.5240+-0.3619        ^ definitely 1.6304x faster

<geometric>                 501.3743+-1.0979     ^    344.7815+-0.4166        ^ definitely 1.4542x faster

* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::getMethod):
* Source/JavaScriptCore/runtime/ProxyObject.cpp:
(JSC::ProxyObject::ProxyObject):
(JSC::ProxyObject::getHandlerTrap):
(JSC::ProxyObject::clearHandlerTrapsOffsetsCache):
(JSC::performProxyGet):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::visitChildrenImpl):
* Source/JavaScriptCore/runtime/ProxyObject.h:

Canonical link: https://commits.webkit.org/263944@main