[webkit-changes] [WebKit/WebKit] ba27ec: Versioning.

[Keith Miller]

  Branch: refs/heads/safari-7616.1.27.211-branch
  Home:   https://github.com/WebKit/WebKit
  Commit: ba27ec33b5e22b51ff423d4de0e83efd74fcd47a
      https://github.com/WebKit/WebKit/commit/ba27ec33b5e22b51ff423d4de0e83efd74fcd47a
  Author: Dan Robson <dtr_bugzilla at apple.com>
  Date:   2023-08-18 (Fri, 18 Aug 2023)

  Changed paths:
    M Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7616.1.27.111.16

Identifier: 265870.343 at safari-7616.1.27.111-branch


  Commit: a4bb3596d60a871abb78b0347ac0f6433b3a835e
      https://github.com/WebKit/WebKit/commit/a4bb3596d60a871abb78b0347ac0f6433b3a835e
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-08-18 (Fri, 18 Aug 2023)

  Changed paths:
    M Source/JavaScriptCore/bytecode/SpeculatedType.cpp
    M Source/JavaScriptCore/bytecode/SpeculatedType.h
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGAbstractValue.cpp
    M Source/JavaScriptCore/dfg/DFGAbstractValue.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGInsertionSet.cpp
    M Source/JavaScriptCore/dfg/DFGInsertionSet.h
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/JSType.h

  Log Message:
  -----------
  Cherry-pick ea191c94955d. rdar://114103295

    [JSC] Make speculationFromValue cheap
    https://bugs.webkit.org/show_bug.cgi?id=259633
    rdar://113098188

    Reviewed by Mark Lam.

    This patch makes speculationFromValue extremely cheap by using JSType based SpeculatedType lookup.
    This function can be called from operationOptimize & GC End phase. And this sometimes takes very long
    time due to huge size of functions. Thus making this function extremely cheap is particularly important
    to make startup time faster. In particular, we observed massive sampling points for speculationFromValue
    in startup times in Speedometer2.1, Speedometer3.0, JetStream2.1, and JetStream3.0.

    1. This patch removes SpecFunctionWithDefaultHasInstance and SpecFunctionWithNonDefaultHasInstance.
       We can just use existing Structure iteration and that can cover almost all possible cases. These
       type makes speculationFromValue costly for JSFunction and derived classes, so rather not so great.
    2. This patch makes some functions JS_EXPORT_PRIVATE to make speculationFromValue non-JS_EXPORT_PRIVATE.
       So we can allow LTO / PGO to inline this if it is useful.
    3. We define JSType via macro, and we list up corresponding SpeculatedType at that time. This allows us
       to construct a mapping between them easily, and this makes speculationFromValue just array lookup,
       which becomes extremely fast.

    * Source/JavaScriptCore/bytecode/SpeculatedType.cpp:
    (JSC::=):
    (JSC::speculationFromStructure):
    (JSC::speculationFromCell):
    * Source/JavaScriptCore/bytecode/SpeculatedType.h:
    * Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:
    (JSC::DFG::AbstractValue::validateOSREntryValue const):
    (JSC::DFG::AbstractValue::validateTypeAcceptingBoxedInt52 const):
    * Source/JavaScriptCore/dfg/DFGAbstractValue.h:
    (JSC::DFG::AbstractValue::observeIndexingTypeTransition):
    (JSC::DFG::AbstractValue::validateOSREntryValue const): Deleted.
    (JSC::DFG::AbstractValue::validateTypeAcceptingBoxedInt52 const): Deleted.
    * Source/JavaScriptCore/dfg/DFGInsertionSet.cpp:
    (JSC::DFG::InsertionSet::insertConstant):
    * Source/JavaScriptCore/dfg/DFGInsertionSet.h:
    * Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:
    * Source/JavaScriptCore/runtime/JSType.h:

    Canonical link: https://commits.webkit.org/266422@main

Identifier: 265870.344 at safari-7616.1.27.111-branch


  Commit: 9239f61644d286ec9113b9e839ec9f5ce73de721
      https://github.com/WebKit/WebKit/commit/9239f61644d286ec9113b9e839ec9f5ce73de721
  Author: Russell Epstein <repstein at apple.com>
  Date:   2023-09-14 (Thu, 14 Sep 2023)

  Changed paths:
    M Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7616.1.27.211.1

Canonical link: https://commits.webkit.org/265870.345@safari-7616.1.27.211-branch


  Commit: 0e722583a4d695c7b25f384c61fbf5b59b4c3146
      https://github.com/WebKit/WebKit/commit/0e722583a4d695c7b25f384c61fbf5b59b4c3146
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2023-09-14 (Thu, 14 Sep 2023)

  Changed paths:
    A JSTests/stress/getbyoffset-cse-consistency.js
    A JSTests/stress/multigetbyoffset-cse-consistency.js
    M Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGHeapLocation.h

  Log Message:
  -----------
  Cherry-pick 47e039ffd689. rdar://115399657

    clobberize needs to be more precise with the *ByOffset nodes
    https://bugs.webkit.org/show_bug.cgi?id=261544
    rdar://115399657

    Reviewed by Yusuke Suzuki and Mark Lam.

    CSE phase uses clobberize to figure out if it's safe to merge two operations that
    def the same HeapLocation. Since HeapLocation does not currently have a way to
    track the offset used by the various *ByOffset nodes it can get confused and
    think that two ByOffset instructions produce the same value even if they don't
    use the same offset. This patch solves this by adding a new field to HeapLocation,
    which takes the metadata associated with the corresponding *ByOffset node. If two
    *ByOffset operations don't share the same metadata then they cannot be CSEed.

    * Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:
    * Source/JavaScriptCore/dfg/DFGClobberize.h:
    (JSC::DFG::clobberize):
    * Source/JavaScriptCore/dfg/DFGHeapLocation.h:
    (JSC::DFG::HeapLocation::HeapLocation):
    (JSC::DFG::HeapLocation::extraState const):
    (JSC::DFG::HeapLocation::hash const):

    Canonical link: https://commits.webkit.org/265870.558@safari-7616-branch

Canonical link: https://commits.webkit.org/265870.346@safari-7616.1.27.211-branch


Compare: https://github.com/WebKit/WebKit/compare/ba27ec33b5e2%5E...0e722583a4d6