Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e759fa9dd06385bb3cdd8e6150c16322df0f1feb
https://github.com/WebKit/WebKit/commit/e759fa9dd06385bb3cdd8e6150c16322df0f1feb
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
M Source/JavaScriptCore/bytecode/CodeBlock.h
M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
Log Message:
-----------
[JSC] Inline hot part of `op_enter` in LLInt
https://bugs.webkit.org/show_bug.cgi?id=320530
Reviewed by Keith Miller.
The LLInt's op_enter unconditionally calls slow_path_enter on every
function entry, paying a C++ call for what is usually just one store of
the callee's scope. 280547@main inlined this hot part in the Baseline
JIT, but the LLInt never got the same treatment, so interpreted calls
(startup, module initialization, cold code) still take the slow path.
This patch inlines the scope store in LowLevelInterpreter64.asm,
falling back to the slow path when the CodeBlock needs a write barrier
(same dynamic-threshold check as the Baseline JIT's branchIfBarriered)
or could be tainted. To make the couldBeTainted bit testable from asm,
the m_numberOfArgumentsToSkip / m_couldBeTainted bitfield pair becomes
a named union word whose sign bit is the taint bit, keeping
sizeof(CodeBlock) unchanged.
Microbenchmark results with useJIT=false:
Baseline
Patched
arrowfunction-call-in-class-method 13.2319+-0.8860 ^
11.8726+-0.0429 ^ definitely 1.1145x faster
arrowfunction-call-in-function 41.5227+-0.6378 ^
36.7882+-1.0128 ^ definitely 1.1287x faster
call-or-not-call 663.3894+-64.3912
608.4128+-13.9092 might be 1.0904x faster
simple-activation-demo 106.1805+-3.7712 ?
109.7916+-6.0971 ? might be 1.0340x slower
bound-function-call 31.7472+-1.4550 ^
27.2062+-0.4002 ^ definitely 1.1669x faster
function-call 45.8869+-3.1223 ^
38.7891+-1.7009 ^ definitely 1.1830x faster
arrowfunction-call 35.7700+-1.9583 ^
28.9808+-0.8511 ^ definitely 1.2343x faster
arrowfunction-call-in-class-constructor 85.9472+-5.6473 ^
75.2668+-4.0816 ^ definitely 1.1419x faster
await-async-function-call-chain 56.1613+-2.0973
55.8413+-10.8399
dfg-internal-function-call 0.6401+-0.0274
0.6014+-0.0254 might be 1.0642x faster
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
* Source/JavaScriptCore/bytecode/CodeBlock.h:
* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:
Canonical link: https://commits.webkit.org/318231@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
