[webkit-changes] [WebKit/WebKit] 17e340: [JSC] Expand InByVal ICs to cover integer indices ...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 17e3401e8e8ec94c6d94fa97c76104c0f1022b90
      https://github.com/WebKit/WebKit/commit/17e3401e8e8ec94c6d94fa97c76104c0f1022b90
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-09-14 (Thu, 14 Sep 2023)

  Changed paths:
    M Source/JavaScriptCore/bytecode/AccessCase.cpp
    M Source/JavaScriptCore/bytecode/AccessCase.h
    M Source/JavaScriptCore/bytecode/InByStatus.cpp
    M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
    M Source/JavaScriptCore/bytecode/Repatch.cpp
    M Source/JavaScriptCore/bytecode/Repatch.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.h

  Log Message:
  -----------
  [JSC] Expand InByVal ICs to cover integer indices as well
https://bugs.webkit.org/show_bug.cgi?id=226619
rdar://79172384

Reviewed by Keith Miller.

Inline Cache for InByVal should cover indexed accesses too so that we can handle multiple indexed-shaped arrays efficiently at one InByVal site.

* Source/JavaScriptCore/bytecode/AccessCase.cpp:
(JSC::AccessCase::create):
(JSC::AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck const):
(JSC::AccessCase::requiresIdentifierNameMatch const):
(JSC::AccessCase::requiresInt32PropertyCheck const):
(JSC::AccessCase::forEachDependentCell const):
(JSC::AccessCase::doesCalls const):
(JSC::AccessCase::canReplace const):
(JSC::AccessCase::runWithDowncast):
(JSC::AccessCase::canBeShared):
(JSC::AccessCase::needsScratchFPR const): Deleted.
* Source/JavaScriptCore/bytecode/AccessCase.h:
* Source/JavaScriptCore/bytecode/InByStatus.cpp:
(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::toTypedArrayType):
(JSC::forResizableTypedArray):
(JSC::needsScratchFPR):
(JSC::forInBy):
(JSC::InlineCacheCompiler::generateWithGuard):
(JSC::InlineCacheCompiler::generateImpl):
(JSC::InlineCacheCompiler::regenerate):
* Source/JavaScriptCore/bytecode/Repatch.cpp:
(JSC::tryCacheArrayInByVal):
(JSC::repatchArrayInByVal):
* Source/JavaScriptCore/bytecode/Repatch.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::opInByVal):

Canonical link: https://commits.webkit.org/267991@main