Branch: refs/heads/safari-7616.1.27.211-branch
Home: https://github.com/WebKit/WebKit
Commit: ba27ec33b5e22b51ff423d4de0e83efd74fcd47a
https://github.com/WebKit/WebKit/commit/ba27ec33b5e22b51ff423d4de0e83efd74fcd47a
Author: Dan Robson <dtr_bugzi...@apple.com>
Date: 2023-08-18 (Fri, 18 Aug 2023)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7616.1.27.111.16
Identifier: 265870.343@safari-7616.1.27.111-branch
Commit: a4bb3596d60a871abb78b0347ac0f6433b3a835e
https://github.com/WebKit/WebKit/commit/a4bb3596d60a871abb78b0347ac0f6433b3a835e
Author: Yusuke Suzuki <ysuz...@apple.com>
Date: 2023-08-18 (Fri, 18 Aug 2023)
Changed paths:
M Source/JavaScriptCore/bytecode/SpeculatedType.cpp
M Source/JavaScriptCore/bytecode/SpeculatedType.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGAbstractValue.cpp
M Source/JavaScriptCore/dfg/DFGAbstractValue.h
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGInsertionSet.cpp
M Source/JavaScriptCore/dfg/DFGInsertionSet.h
M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
M Source/JavaScriptCore/runtime/JSType.h
Log Message:
-----------
Cherry-pick ea191c94955d. rdar://114103295
[JSC] Make speculationFromValue cheap
https://bugs.webkit.org/show_bug.cgi?id=259633
rdar://113098188
Reviewed by Mark Lam.
This patch makes speculationFromValue extremely cheap by using JSType based
SpeculatedType lookup.
This function can be called from operationOptimize & GC End phase. And this
sometimes takes very long
time due to huge size of functions. Thus making this function extremely
cheap is particularly important
to make startup time faster. In particular, we observed massive sampling
points for speculationFromValue
in startup times in Speedometer2.1, Speedometer3.0, JetStream2.1, and
JetStream3.0.
1. This patch removes SpecFunctionWithDefaultHasInstance and
SpecFunctionWithNonDefaultHasInstance.
We can just use existing Structure iteration and that can cover almost
all possible cases. These
type makes speculationFromValue costly for JSFunction and derived
classes, so rather not so great.
2. This patch makes some functions JS_EXPORT_PRIVATE to make
speculationFromValue non-JS_EXPORT_PRIVATE.
So we can allow LTO / PGO to inline this if it is useful.
3. We define JSType via macro, and we list up corresponding SpeculatedType
at that time. This allows us
to construct a mapping between them easily, and this makes
speculationFromValue just array lookup,
which becomes extremely fast.
* Source/JavaScriptCore/bytecode/SpeculatedType.cpp:
(JSC::=):
(JSC::speculationFromStructure):
(JSC::speculationFromCell):
* Source/JavaScriptCore/bytecode/SpeculatedType.h:
* Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::validateOSREntryValue const):
(JSC::DFG::AbstractValue::validateTypeAcceptingBoxedInt52 const):
* Source/JavaScriptCore/dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::observeIndexingTypeTransition):
(JSC::DFG::AbstractValue::validateOSREntryValue const): Deleted.
(JSC::DFG::AbstractValue::validateTypeAcceptingBoxedInt52 const): Deleted.
* Source/JavaScriptCore/dfg/DFGInsertionSet.cpp:
(JSC::DFG::InsertionSet::insertConstant):
* Source/JavaScriptCore/dfg/DFGInsertionSet.h:
* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:
* Source/JavaScriptCore/runtime/JSType.h:
Canonical link: https://commits.webkit.org/266422@main
Identifier: 265870.344@safari-7616.1.27.111-branch
Commit: 9239f61644d286ec9113b9e839ec9f5ce73de721
https://github.com/WebKit/WebKit/commit/9239f61644d286ec9113b9e839ec9f5ce73de721
Author: Russell Epstein <repst...@apple.com>
Date: 2023-09-14 (Thu, 14 Sep 2023)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7616.1.27.211.1
Canonical link:
https://commits.webkit.org/265870.345@safari-7616.1.27.211-branch
Commit: 0e722583a4d695c7b25f384c61fbf5b59b4c3146
https://github.com/WebKit/WebKit/commit/0e722583a4d695c7b25f384c61fbf5b59b4c3146
Author: Keith Miller <keith_mil...@apple.com>
Date: 2023-09-14 (Thu, 14 Sep 2023)
Changed paths:
A JSTests/stress/getbyoffset-cse-consistency.js
A JSTests/stress/multigetbyoffset-cse-consistency.js
M Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGHeapLocation.h
Log Message:
-----------
Cherry-pick 47e039ffd689. rdar://115399657
clobberize needs to be more precise with the *ByOffset nodes
https://bugs.webkit.org/show_bug.cgi?id=261544
rdar://115399657
Reviewed by Yusuke Suzuki and Mark Lam.
CSE phase uses clobberize to figure out if it's safe to merge two
operations that
def the same HeapLocation. Since HeapLocation does not currently have a way
to
track the offset used by the various *ByOffset nodes it can get confused and
think that two ByOffset instructions produce the same value even if they
don't
use the same offset. This patch solves this by adding a new field to
HeapLocation,
which takes the metadata associated with the corresponding *ByOffset node.
If two
*ByOffset operations don't share the same metadata then they cannot be
CSEed.
* Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGHeapLocation.h:
(JSC::DFG::HeapLocation::HeapLocation):
(JSC::DFG::HeapLocation::extraState const):
(JSC::DFG::HeapLocation::hash const):
Canonical link: https://commits.webkit.org/265870.558@safari-7616-branch
Canonical link:
https://commits.webkit.org/265870.346@safari-7616.1.27.211-branch
Compare: https://github.com/WebKit/WebKit/compare/ba27ec33b5e2%5E...0e722583a4d6
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
