[webkit-changes] [WebKit/WebKit] bef1df: [JSC] Inline InstanceOfMegamorphic in DFG / FTL

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: bef1df82911b88e94309cad5c07cc8d2b5fda348
      https://github.com/WebKit/WebKit/commit/bef1df82911b88e94309cad5c07cc8d2b5fda348
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2024-08-09 (Fri, 09 Aug 2024)

  Changed paths:
    A JSTests/microbenchmarks/instanceof-inlining.js
    M Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp
    M Source/JavaScriptCore/bytecode/InstanceOfStatus.h
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/jit/JITOperations.h

  Log Message:
  -----------
  [JSC] Inline InstanceOfMegamorphic in DFG / FTL
https://bugs.webkit.org/show_bug.cgi?id=277839
rdar://problem/133502621

Reviewed by Keith Miller.

This patch inlines InstanceOfMegamorphic into DFG / FTL. From BaselineJIT's feedback, we can know this is megamorphic.
So we can just inline the code into DFG / FTL instead of using IC.
We are planning to extend InstanceOfMegamorphic further by introducing InstanceOfMegamorphic table recording results.
But for now, let's just first inline them.

                                    ToT                     Patched

    instanceof-inlining       42.5337+-0.1710     ^     37.8356+-0.2130        ^ definitely 1.1242x faster

* JSTests/microbenchmarks/instanceof-inlining.js: Added.
(test):
(A):
(B):
(C):
* Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp:
(JSC::InstanceOfStatus::computeForStubInfo):
* Source/JavaScriptCore/bytecode/InstanceOfStatus.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileInstanceOfMegamorphic):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITOperations.h:

Canonical link: https://commits.webkit.org/282047@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications