[webkit-changes] [WebKit/WebKit] 06b27b: [JSC] Fold super call with explicitly specified `O...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 06b27b91cf2cb5e6e4fc78f5410c065d75de1633
      https://github.com/WebKit/WebKit/commit/06b27b91cf2cb5e6e4fc78f5410c065d75de1633
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2024-08-07 (Wed, 07 Aug 2024)

  Changed paths:
    A JSTests/microbenchmarks/construct-object.js
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h

  Log Message:
  -----------
  [JSC] Fold super call with explicitly specified `Object` constructor
https://bugs.webkit.org/show_bug.cgi?id=277787
rdar://133426751

Reviewed by Keith Miller.

We do slow path when we explicitly specifying `Object` for the super class. We found these patterns in some cases, so we would like to optimize it.
In DFG AI, we attempt to figure out that

1. super class is `Object`
2. new.target is something constant JSFunction

Then we do folding into NewObject by using internalFunctionAllocationProfile.

                                 ToT                     Patched

    construct-object       10.3615+-0.0283     ^      2.9730+-0.0200        ^ definitely 3.4852x faster

* JSTests/microbenchmarks/construct-object.js: Added.
(A):
(B):
(test):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::convertToNewObject):

Canonical link: https://commits.webkit.org/281981@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications