inline caching in javascriptcore · “inline cache” indexing type flags cell state structure...
TRANSCRIPT
![Page 1: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/1.jpg)
Inline Caching in JavaScriptCore
Filip PizloApple Inc.
![Page 2: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/2.jpg)
webkit.org
https://svn.webkit.org/repository/webkit/trunk
![Page 3: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/3.jpg)
JavaScriptCore.framework
![Page 4: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/4.jpg)
Safari
![Page 5: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/5.jpg)
Agenda
• JavaScript execution strategy
• Focus on property access inline caches - Simple inline caching
- Inline Caching Optimizations
- Lots of perf data
![Page 6: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/6.jpg)
JavaScript execution strategy
![Page 7: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/7.jpg)
Four Tiers
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
latency throughput
![Page 8: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/8.jpg)
Profiling
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
![Page 9: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/9.jpg)
Speculation and OSR
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
![Page 10: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/10.jpg)
![Page 11: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/11.jpg)
Parser
![Page 12: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/12.jpg)
ParserAST
![Page 13: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/13.jpg)
Parser
Bytecompiler
AST
![Page 14: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/14.jpg)
Parser
Bytecompiler
AST
unlinked bytecode
![Page 15: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/15.jpg)
Parser
Bytecompiler
Generatorification
AST
unlinked bytecode
![Page 16: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/16.jpg)
Parser
Bytecompiler
Generatorification
Bytecode Linker
AST
unlinked bytecode
![Page 17: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/17.jpg)
Parser
Bytecompiler
Generatorification
Bytecode Linker
AST
unlinked bytecode
bytecode
![Page 18: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/18.jpg)
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt
AST
unlinked bytecode
bytecode
![Page 19: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/19.jpg)
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
AST
unlinked bytecode
bytecode
![Page 20: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/20.jpg)
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
AST
unlinked bytecode
bytecodeDFG
![Page 21: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/21.jpg)
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG
![Page 22: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/22.jpg)
DFG Optimizer
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG
![Page 23: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/23.jpg)
DFG Optimizer
DFG Backend
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG
![Page 24: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/24.jpg)
DFG Optimizer
DFG Backend
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 25: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/25.jpg)
DFG Optimizer
DFG Backend
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 26: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/26.jpg)
DFG Optimizer
DFG Backend
Extended DFG Optimizer
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 27: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/27.jpg)
FTL-to-B3 lowering
DFG Optimizer
DFG Backend
Extended DFG Optimizer
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 28: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/28.jpg)
FTL-to-B3 lowering
DFG Optimizer
DFG Backend
Extended DFG Optimizer
B3 Optimizer
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 29: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/29.jpg)
FTL-to-B3 lowering
DFG Optimizer
DFG Backend
Extended DFG Optimizer
B3 Optimizer
Instruction Selection
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 30: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/30.jpg)
FTL-to-B3 lowering
DFG Optimizer
DFG Backend
Extended DFG Optimizer
B3 Optimizer
Instruction Selection
Air Optimizer
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 31: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/31.jpg)
FTL-to-B3 lowering
DFG Optimizer
DFG Backend
Extended DFG Optimizer
B3 Optimizer
Instruction Selection
Air Optimizer
Air Backend
Parser
Bytecompiler
Generatorification
Bytecode Linker
LLInt Bytecode Template JIT
DFG Bytecode Parser
DFG Bytecode Parser
AST
unlinked bytecode
bytecodeDFG FTL
![Page 32: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/32.jpg)
Inline Caching
![Page 33: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/33.jpg)
Inline Caching• Performance
• Why?
• Simple inline caching- in interpreter
- in JIT
- prototype
• Advanced topics- Polymorphic Access JIT
- Inlining inline caches
- Type inference
![Page 34: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/34.jpg)
Performance
![Page 35: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/35.jpg)
Benchmark Summary Number of Samples in my experiments
JetStream 1.1 ES5 benchmarks(real and synthetic) 9
ARES-6 1.0.1 ES6 benchmarks(real and synthetic) 24
Speedometer 2.0DOM framework
benchmarks(real)
30
Source: browserbench.org
![Page 36: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/36.jpg)
![Page 37: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/37.jpg)
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5×
![Page 38: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/38.jpg)
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5×
Baseline = no property inline caching
![Page 39: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/39.jpg)
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5×
Baseline = no property inline caching
![Page 40: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/40.jpg)
{x: 1, y: 2}
{x: 42, y: 3}
{x: -5, y: 7}
![Page 41: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/41.jpg)
{x: 1, y: 2}
{x: 42, y: 3}
{x: -5, y: 7}
var x = o.x;
![Page 42: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/42.jpg)
{x: 1, y: 2}
{x: 42, y: 3}
{x: -5, y: 7}
o.x = x;
![Page 43: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/43.jpg)
Hashtable
{x: 1, y: 2}{ hashtable
object
x: 1
y: 1
![Page 44: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/44.jpg)
Hashtable
• Pointer chasing is slow
{x: 1, y: 2}{ hashtable
object
x: 1
y: 1
![Page 45: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/45.jpg)
Hashtable
• Pointer chasing is slow
• Hash codes take time to compute
{x: 1, y: 2}{ hashtable
object
x: 1
y: 1
![Page 46: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/46.jpg)
Hashtable
• Pointer chasing is slow
• Hash codes take time to compute
• Lots of instructions, hard to inline
{x: 1, y: 2}{ hashtable
object
x: 1
y: 1
![Page 47: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/47.jpg)
Hashtable
• Pointer chasing is slow
• Hash codes take time to compute
• Lots of instructions, hard to inline
{x: 1, y: 2}{ hashtable
object
x: 1
y: 1
![Page 48: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/48.jpg)
{x: 1, y: 2}
{x: 42, y: 3}
{x: -5, y: 7}
![Page 49: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/49.jpg)
{1, 2}
{42, 3}
{-5, 7}
{x, y}
![Page 50: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/50.jpg)
{1, 2}
{42, 3}
{-5, 7}
{x, y}
structure
![Page 51: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/51.jpg)
{1, 2}
{42, 3}
{-5, 7}
{x, y}
structure
‣ hashtable
![Page 52: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/52.jpg)
{1, 2}
{42, 3}
{-5, 7}
{x, y}
structure
‣ hashtable
‣ maps name to offset
![Page 53: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/53.jpg)
{1, 2}
{42, 3}
{-5, 7}
{x, y}
structure
‣ hashtable
‣ maps name to offset
‣ hash-consed
![Page 54: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/54.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
![Page 55: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/55.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
64 bits
64 bits
64 bits 64 bits 64 bits
64 bits 64 bits
![Page 56: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/56.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
![Page 57: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/57.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
![Page 58: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/58.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
![Page 59: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/59.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
statically configurable
![Page 60: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/60.jpg)
JSC Object Model
indexingtypeflags
cell state
structure ID butterfly pointer inline slot 0 inline slot 1
public length
vector lengthout of line slot 0 array slot 0
…
……
statically configurable
dynamically configurable
![Page 61: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/61.jpg)
Fast JSObject
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
![Page 62: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/62.jpg)
Fast JSObject
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
![Page 63: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/63.jpg)
Fast JSObject
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Structure
![Page 64: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/64.jpg)
Fast JSObject
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
![Page 65: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/65.jpg)
Fast JSObject
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
![Page 66: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/66.jpg)
Fast JSObject
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
g: inline(1)
![Page 67: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/67.jpg)
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
g: inline(1)
![Page 68: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/68.jpg)
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
g: inline(1)
![Page 69: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/69.jpg)
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
g: inline(1)
var v = o.f;
![Page 70: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/70.jpg)
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
g: inline(1)
var v = o.f;
if (o->structureID == 42) v = o->inlineStorage[0]else v = slowGet(o, “f”)
![Page 71: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/71.jpg)
“Inline Cache”
indexingtypeflags
cell state
structure ID: 42 null 0xffff000000000005
var o = {f: 5, g: 6};
0xffff000000000006
Structure Table
Property Table
Structure
f: inline(0)
g: inline(1)
var v = o.f;
if (o->structureID == 42) v = o->inlineStorage[0]else v = slowGet(o, “f”)
![Page 72: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/72.jpg)
Interpreter Inline Cache
get_by_id <result>, <base>, <properyName>
![Page 73: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/73.jpg)
Interpreter Inline Cache
get_by_id <result>, <base>, <properyName>, <cachedStructureID>, <cachedOffset>
![Page 74: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/74.jpg)
Interpreter Inline Cache
get_by_id loc42, loc43, “g”, 0, 0
![Page 75: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/75.jpg)
Interpreter Inline Cache
get_by_id loc42, loc43, “g”, 0, 0
indexingtypeflags
cell state
structure ID: 42 null
f:0xffff000000000005
g:0xffff000000000006
![Page 76: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/76.jpg)
Interpreter Inline Cache
get_by_id loc42, loc43, “g”, 42, 1
indexingtypeflags
cell state
structure ID: 42 null
f:0xffff000000000005
g:0xffff000000000006
![Page 77: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/77.jpg)
JIT Inline Cache
0x46f8c30b9b0: mov 0x30(%rbp), %rax0x46f8c30b9b4: test %rax, %r150x46f8c30b9b7: jnz 0x46f8c30ba2c0x46f8c30b9bd: jmp 0x46f8c30ba2c0x46f8c30b9c2: o16 nop %cs:0x200(%rax,%rax)0x46f8c30b9d1: nop (%rax)0x46f8c30b9d4: mov %rax, -0x38(%rbp)
![Page 78: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/78.jpg)
JIT Inline Cache
0x46f8c30b9b0: mov 0x30(%rbp), %rax0x46f8c30b9b4: test %rax, %r150x46f8c30b9b7: jnz 0x46f8c30ba2c0x46f8c30b9bd: jmp 0x46f8c30ba2c0x46f8c30b9c2: o16 nop %cs:0x200(%rax,%rax)0x46f8c30b9d1: nop (%rax)0x46f8c30b9d4: mov %rax, -0x38(%rbp)
![Page 79: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/79.jpg)
JIT Inline Cache
0x46f8c30b9b0: mov 0x30(%rbp), %rax0x46f8c30b9b4: test %rax, %r150x46f8c30b9b7: jnz 0x46f8c30ba2c0x46f8c30b9bd: jmp 0x46f8c30ba2c0x46f8c30b9c2: o16 nop %cs:0x200(%rax,%rax)0x46f8c30b9d1: nop (%rax)0x46f8c30b9d4: mov %rax, -0x38(%rbp)
![Page 80: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/80.jpg)
JIT Inline Cache
0x46f8c30b9b0: mov 0x30(%rbp), %rax0x46f8c30b9b4: test %rax, %r150x46f8c30b9b7: jnz 0x46f8c30ba2c0x46f8c30b9bd: cmp $0x125, (%rax)0x46f8c30b9c3: jnz 0x46f8c30ba2c0x46f8c30b9c9: mov 0x18(%rax), %rax0x46f8c30b9cd: nop 0x200(%rax)0x46f8c30b9d4: mov %rax, -0x38(%rbp)
![Page 81: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/81.jpg)
“Self” IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.1× 1.2× 1.3× 1.4× 1.5× 1.6× 1.7× 1.8×
1.19×
1.66×
1.49×
![Page 82: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/82.jpg)
“Self” IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.1× 1.2× 1.3× 1.4× 1.5× 1.6× 1.7× 1.8×
1.19×
1.66×
1.49× p = 10-23
![Page 83: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/83.jpg)
“Self” IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.1× 1.2× 1.3× 1.4× 1.5× 1.6× 1.7× 1.8×
1.19×
1.66×
1.49× p = 10-23
p = 10-57
![Page 84: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/84.jpg)
“Self” IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.1× 1.2× 1.3× 1.4× 1.5× 1.6× 1.7× 1.8×
1.19×
1.66×
1.49× p = 10-23
p = 10-57
p = 10-46
![Page 85: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/85.jpg)
Simple Inline Caching
• Interpreter edits instruction operands.
• JIT reserves a nop sled and patches it.
![Page 86: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/86.jpg)
Prototypes
![Page 87: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/87.jpg)
Prototypesfunction Foo(f){ this.f = f;}
Foo.prototype.getF = function(){ return this.f;}
![Page 88: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/88.jpg)
Prototypesfunction Foo(f){ this.f = f;}
Foo.prototype.getF = function(){ return this.f;}
getF: λ
Foo.prototype
![Page 89: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/89.jpg)
Prototypesfunction Foo(f){ this.f = f;}
Foo.prototype.getF = function(){ return this.f;}
var o = new Foo(42);{f: 42}
getF: λ
Foo.prototype
![Page 90: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/90.jpg)
Prototypesfunction Foo(f){ this.f = f;}
Foo.prototype.getF = function(){ return this.f;}
var o = new Foo(42);
var tmp = o.getF();
{f: 42}
getF: λ
Foo.prototype
![Page 91: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/91.jpg)
Prototypesfunction Foo(f){ this.f = f;}
Foo.prototype.getF = function(){ return this.f;}
var o = new Foo(42);
var tmp = o.getF();
{f: 42}
getF: λ
Foo.prototype
![Page 92: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/92.jpg)
Prototypesclass Foo { constructor(f) { this.f = f; }
getF() { return this.f; }}
var o = new Foo(42);
var tmp = o.getF();
{f: 42}
getF: λ
Foo.prototype
![Page 93: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/93.jpg)
Prototypesclass Foo { constructor(f) { this.f = f; }
getF() { return this.f; }}
var o = new Foo(42);
var tmp = o.getF();
{f: 42}
getF: λ
Foo.prototype
![Page 94: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/94.jpg)
Prototypesclass Foo { constructor(f) { this.f = f; }
getF() { return this.f; }}
var o = new Foo(42);
var tmp = o.getF();
{f: 42}
getF: λ
Foo.prototype
![Page 95: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/95.jpg)
Prototype Inline Caching
• Goals:
• o.getF should be fast
• o.getF() should be inlineable
• o.newField = value should be fast
![Page 96: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/96.jpg)
Prototype Inline Caching
• Mono proto
• Transition watchpoint
• Replacement watchpoint
![Page 97: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/97.jpg)
Mono Proto
{1, 2}
{42, 3}
{-5, 7}
{x, y}
prototype
global object
![Page 98: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/98.jpg)
Mono Proto
{1, 2}
{42, 3}
{-5, 7}
{x, y}
prototype
global object
structure
![Page 99: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/99.jpg)
Proto Chain
object
![Page 100: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/100.jpg)
Proto Chain
object
structure 42
![Page 101: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/101.jpg)
Proto Chain
object
structure 42
prototype P1
![Page 102: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/102.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
![Page 103: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/103.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
prototype P2
![Page 104: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/104.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
![Page 105: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/105.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
// tmp = o.getFif (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44) return P2->inlineStorage[…]else slowGet(o, “getF”)
![Page 106: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/106.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
// tmp = o.getFif (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44) return P2->inlineStorage[…]else slowGet(o, “getF”)
![Page 107: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/107.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
prototype P2
structure 44// o.newField = value
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44) o->inlineStorage[…] = value o->structureID = 100;else slowPut(o, “newField”, value)
![Page 108: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/108.jpg)
Proto Chain
object
structure 42
prototype P1
structure 43
prototype P2
structure 44// o.newField = value
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44) o->inlineStorage[…] = value o->structureID = 100;else slowPut(o, “newField”, value)
![Page 109: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/109.jpg)
{}
Transition Table
Transition Hash Consing
Structure {}
![Page 110: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/110.jpg)
{x}
Transition Table
Transition Hash Consing
Structure {}
Transition Table
x Structure {x}
![Page 111: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/111.jpg)
{x, y}
Transition Hash Consing
Structure {}
Transition Table
x Structure {x}
Structure {x, y}
Transition Table
y
Transition Table
![Page 112: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/112.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44)
![Page 113: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/113.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44)
![Page 114: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/114.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44)
![Page 115: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/115.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
Transition Table
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44)
![Page 116: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/116.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
Transition Table
if (o->structureID == 42 && P1->structureID == 43 && P2->structureID == 44)
![Page 117: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/117.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
Transition Table
![Page 118: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/118.jpg)
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
Transition Table
P1.thingy = “boom”;
![Page 119: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/119.jpg)
Transition Table
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
structure 666
thingy
P1.thingy = “boom”;
![Page 120: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/120.jpg)
Transition Table
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
structure 666
thingy
P1.thingy = “boom”;
![Page 121: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/121.jpg)
Watchpoint
class Watchpoint {public: virtual void fire() = 0;};
![Page 122: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/122.jpg)
Transition Table
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
![Page 123: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/123.jpg)
Transition Table
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
![Page 124: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/124.jpg)
Transition Table
Optimized Code
return P2->inlineStorage[…]else slowGet(o, “…”)
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
Replacement Map
field
![Page 125: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/125.jpg)
Transition Table
Optimized Code
if (o->structureID == 42)
object
structure 42
prototype P1
structure 43
prototype P2
structure 44
Transition Table
Transition Table
return constantelse slowGet(o, “…”)
Replacement Map
field
![Page 126: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/126.jpg)
Simple Inline Caching
• tmp = o.f // self
• o.f = tmp // self, existing
• o.f = tmp // self, new
• tmp = o.f // prototype
![Page 127: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/127.jpg)
Simple Inline Caching
• tmp = o.f // self
• o.f = tmp // self, existing
• o.f = tmp // self, new
• tmp = o.f // prototype}only need one branch
![Page 128: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/128.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
![Page 129: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/129.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
![Page 130: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/130.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
![Page 131: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/131.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
![Page 132: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/132.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
![Page 133: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/133.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
![Page 134: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/134.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
![Page 135: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/135.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
p = 10-9
![Page 136: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/136.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
p = 10-9
p = 0.06
![Page 137: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/137.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
p = 10-9
p = 0.06
p = 0.009
![Page 138: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/138.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
p = 10-9
p = 0.06
p = 0.009
p = 0.0001
![Page 139: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/139.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
p = 10-9
p = 0.06
p = 0.009
p = 0.0001
p = 10-12
![Page 140: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/140.jpg)
JIT Monomorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4×
1.30×
3.52×
2.09×
1.29×
3.13×
2.05×
1.26×
3.05×
1.97×
1.25×
2.82×
1.87×
1.19×
1.66×
1.49× Self+ Proto+ New Property+ Transition Watch+ Replacement Watch
p = 10-18
p = 10-48
p = 10-13
p = 10-22
p = 10-9
p = 10-15
p = 10-9
p = 0.06
p = 0.009
p = 0.0001
p = 10-12
p = 0.09
![Page 141: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/141.jpg)
Advanced Topics
• Polymorphic Inline Caches
• Inlining Inline Caches
• Type Inference
![Page 142: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/142.jpg)
Polymorphic Inline Caches
![Page 143: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/143.jpg)
![Page 144: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/144.jpg)
{f: 64, g:75}
![Page 145: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/145.jpg)
{f: 64, g:75}
{f: 98, g:23}
![Page 146: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/146.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
![Page 147: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/147.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
{f: 342, g:5}
![Page 148: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/148.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
{f: 342, g:5}
{f: 54, g:75, h:389}
![Page 149: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/149.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
{f: 342, g:5}
{f: 54, g:75, h:389}
{f: 6, g:18, h:83}
![Page 150: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/150.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
{f: 342, g:5}
{f: 54, g:75, h:389}
{f: 6, g:18, h:83}
{g: 37, f: 30}
![Page 151: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/151.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
{f: 342, g:5}
{f: 54, g:75, h:389}
{f: 6, g:18, h:83}
{g: 37, f: 30}
{g: 835, f: 0}
![Page 152: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/152.jpg)
{f: 64, g:75}
{f: 98, g:23}
{f: 7, g:32}
{f: 342, g:5}
{f: 54, g:75, h:389}
{f: 6, g:18, h:83}
{g: 37, f: 30}
{g: 835, f: 0}
{f, g}
{f, g, h}
{g, f}
![Page 153: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/153.jpg)
var tmp = o.f;
![Page 154: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/154.jpg)
var tmp = o.f;
{f: 64, g:75}
S1: {f, g}
![Page 155: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/155.jpg)
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389}
S1: {f, g}
S2: {f, g, h}
![Page 156: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/156.jpg)
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389} {g: 37, f: 30}
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
![Page 157: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/157.jpg)
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389} {g: 37, f: 30}
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
if (o->structureID == S1 || o->structureID == S2) o->inlineStorage[0]else if (o->structureID == S3) o->inlineStorage[1]else slowGet(o, “f”)
![Page 158: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/158.jpg)
function foo(o) { return o.f;}
noInline(foo);
for (var i = 0; i < 10000; ++i) { foo({f: 1, g: 2}); foo({f: 1, g: 2, h:3}); foo({g: 2, f: 1});}
![Page 159: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/159.jpg)
0x456923529be: cmp $0x129, (%rax)0x456923529c4: jnz 0x45692352a2d0x456923529ca: mov 0x10(%rax), %rax0x456923529ce: nop 0x200(%rax)
S1: {f, g}
![Page 160: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/160.jpg)
function foo(o) { return o.f;}
noInline(foo);
for (var i = 0; i < 10000; ++i) { foo({f: 1, g: 2}); foo({f: 1, g: 2, h:3}); foo({g: 2, f: 1});}
![Page 161: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/161.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
![Page 162: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/162.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
![Page 163: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/163.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
done
![Page 164: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/164.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
done
![Page 165: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/165.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
done
done
![Page 166: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/166.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
done
done
slow
![Page 167: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/167.jpg)
0x45692352be0: mov (%rax), %esi0x45692352be2: cmp $0x129, %esi0x45692352be8: jnz 0x45692352bf70x45692352bee: mov 0x10(%rax), %rax0x45692352bf2: jmp 0x456923529d50x45692352bf7: cmp $0x126, %esi0x45692352bfd: jnz 0x45692352c0c0x45692352c03: mov 0x10(%rax), %rax0x45692352c07: jmp 0x456923529d50x45692352c0c: cmp $0x12b, %esi0x45692352c12: jnz 0x45692352a2d0x45692352c18: mov 0x18(%rax), %rax0x45692352c1c: jmp 0x456923529d50x45692352c21: jmp 0x45692352a2d
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
done
done
done
slow
![Page 168: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/168.jpg)
Polymorphic Access JIT• Self
• Prototype
• Transition (new property)
• Getters
• Setters
• Custom accessors
• Snippets (DOM JIT)
![Page 169: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/169.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
![Page 170: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/170.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
![Page 171: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/171.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
![Page 172: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/172.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
![Page 173: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/173.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
p = 0.7
![Page 174: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/174.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
p = 0.7
p = 0.05
![Page 175: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/175.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
p = 0.7
p = 0.05
p = 0.7
![Page 176: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/176.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
p = 0.7
p = 0.05
p = 0.7
p = 10-10
![Page 177: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/177.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
p = 0.7
p = 0.05
p = 0.7
p = 10-10
p = 10-21
![Page 178: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/178.jpg)
JIT Polymorphic IC speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5×
1.37×
4.68×
2.28×
1.32×
3.99×
2.14×
1.31×
3.92×
2.13×
1.30×
3.52×
2.09× Monomorphic IC+ Simple Poly IC+ Misses+ Accessors & Snippets
p = 0.003
p = 10-14
p = 0.4
p = 0.7
p = 0.05
p = 0.7
p = 10-10
p = 10-21
p = 0.004
![Page 179: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/179.jpg)
Inlining Inline Caches
![Page 180: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/180.jpg)
Four Tiers
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
latency throughput
![Page 181: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/181.jpg)
Four Tiers
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
latency throughput
profiling
![Page 182: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/182.jpg)
Four Tiers
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
latency throughput
profiling
speculation and OSR
![Page 183: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/183.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
get_by_idjmp Lslow jmp Lslow jmp Lslow
tmp = o.fS1:
{f, g}
![Page 184: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/184.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
jmp Lslow jmp Lslow jmp Lslow
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 185: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/185.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
jmp Lslow jmp Lslow
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 186: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/186.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
jmp Lslow
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 187: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/187.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 188: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/188.jpg)
LLInt (interpreter)
get_by_id
tmp = o.fS1:
{f, g}
![Page 189: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/189.jpg)
LLInt (interpreter)
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 190: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/190.jpg)
LLInt (interpreter)
Baseline (template JIT)
jmp Lslow
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 191: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/191.jpg)
LLInt (interpreter)
Baseline (template JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 192: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/192.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
![Page 193: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/193.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
![Page 194: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/194.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
![Page 195: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/195.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.f
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
![Page 196: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/196.jpg)
LLInt (interpreter)
get_by_id
tmp = o.ftmp2 = o.g
S1: {f, g}
get_by_id
![Page 197: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/197.jpg)
LLInt (interpreter)
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
get_by_id
![Page 198: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/198.jpg)
LLInt (interpreter)
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
get_by_id…, S1, 1
![Page 199: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/199.jpg)
LLInt (interpreter)
Baseline (template JIT)
jmp Lslow
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
jmp Lslowget_by_id…, S1, 1
![Page 200: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/200.jpg)
LLInt (interpreter)
Baseline (template JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
jmp Lslowget_by_id…, S1, 1
![Page 201: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/201.jpg)
LLInt (interpreter)
Baseline (template JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
get_by_id…, S1, 1
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 202: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/202.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
get_by_id…, S1, 1
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 203: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/203.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
get_by_id…, S1, 1
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 204: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/204.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
get_by_id…, S1, 1
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 205: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/205.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
get_by_id…, S1, 1
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 206: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/206.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
get_by_id…, S1, 1
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 207: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/207.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
get_by_id…, S1, 1
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 208: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/208.jpg)
LLInt (interpreter)
Baseline (template JIT)
DFG (less optimizing JIT)
FTL (optimizing JIT)
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
tmp = o.ftmp2 = o.g
get_by_id…, S1, 0
S1: {f, g}
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
CheckStructure(@o, S1)GetByOffset(@o, “f”, 0)
get_by_id…, S1, 1
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
CheckStructure(@o, S1)GetByOffset(@o, “g”, 1)
cmp S1, (%rax)jnz Lslowmov 18(%rax), %rax
![Page 209: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/209.jpg)
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x10) Call(slow path)
… things …
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x18) Call(slow path)
… more things …
Inline Cache Control Flow
![Page 210: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/210.jpg)
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x10) Call(slow path)
… things …
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x18) Call(slow path)
… more things …
not redundant!
Inline Cache Control Flow
![Page 211: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/211.jpg)
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x10) Call(slow path)
… things …
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x18) Call(slow path)
… more things …
Branch(Equal( @structure, $S1))
OSR exit
Load(@object, offset = 0x10)
… things …
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x18)
… more things …
OSR exit
Inline Cache Control Flow Inlined with OSR exits
![Page 212: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/212.jpg)
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x10) Call(slow path)
… things …
Branch(Equal( @structure, $S1))
Load(@object, offset = 0x18) Call(slow path)
… more things …
Branch(Equal( @structure, $S1))
OSR exit
Load(@object, offset = 0x10)
… things …
Load(@object, offset = 0x18)
… more things …
Inline Cache Control Flow Inlined with OSR exits
![Page 213: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/213.jpg)
Benefits of Inlining
• Common subexpression elimination
• Abstract interpreter models the structure
• Object allocation sinking
• Many other optimizations
![Page 214: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/214.jpg)
IC Monomorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.37×
4.68×
2.28×Polymorphic IC+ Mono IC Inlining
![Page 215: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/215.jpg)
IC Monomorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.37×
4.68×
2.28×Polymorphic IC+ Mono IC Inlining
p = 10-14
![Page 216: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/216.jpg)
IC Monomorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.37×
4.68×
2.28×Polymorphic IC+ Mono IC Inlining
p = 10-14
p = 10-21
![Page 217: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/217.jpg)
IC Monomorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.37×
4.68×
2.28×Polymorphic IC+ Mono IC Inlining
p = 10-14
p = 10-21
p = 0.02
![Page 218: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/218.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
![Page 219: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/219.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
p = 10-8
![Page 220: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/220.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
p = 10-8
p = 10-9
![Page 221: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/221.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
p = 10-8
p = 10-9
p = 0.0003
![Page 222: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/222.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
p = 10-8
p = 10-9
p = 0.0003
p = 10-13
![Page 223: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/223.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
p = 10-8
p = 10-9
p = 0.0003
p = 10-13
p = 10-26
![Page 224: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/224.jpg)
IC Inlining and Watchpoints
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.39×
5.67×
2.49×
1.36×
4.54×
2.33×
1.32×
4.33×
2.24×IC Inlining w/o WatchpointsIC inlining w/ Transition WatchpointsIC Inlining w/ Transition & Replacement
p = 10-8
p = 10-9
p = 0.0003
p = 10-13
p = 10-26
p = 0.02
![Page 225: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/225.jpg)
Minimorphic IC Inlining
var tmp = o.f;
![Page 226: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/226.jpg)
Minimorphic IC Inlining
var tmp = o.f;
{f: 64, g:75}
S1: {f, g}
![Page 227: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/227.jpg)
Minimorphic IC Inlining
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389}
S1: {f, g}
S2: {f, g, h}
![Page 228: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/228.jpg)
Minimorphic IC Inlining
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389}
S1: {f, g}
S2: {f, g, h}
CheckStructure(@o, [S1, S2])GetByOffset(@o, “f”, 0)
![Page 229: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/229.jpg)
Polymorphic IC Inlining
var tmp = o.f;
![Page 230: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/230.jpg)
Polymorphic IC Inlining
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389} {g: 37, f: 30}
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
![Page 231: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/231.jpg)
Polymorphic IC Inlining
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389} {g: 37, f: 30}
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
MultiGetByOffset(@o, “f”, [S1, S2] => 0, [S3] => 1)DFG IR:
![Page 232: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/232.jpg)
Polymorphic IC Inlining
var tmp = o.f;
{f: 64, g:75} {f: 54, g:75, h:389} {g: 37, f: 30}
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
MultiGetByOffset(@o, “f”, [S1, S2] => 0, [S3] => 1)
if (o->structureID == S1 || o->structureID == S2) result = o->inlineStorage[0]else result = o->inlineStorage[1]
DFG IR:
B3 IR:
![Page 233: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/233.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inlining
![Page 234: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/234.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inliningp = 0.02
![Page 235: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/235.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inliningp = 0.02
p = 0.5
![Page 236: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/236.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inliningp = 0.02
p = 0.5
p = 0.6
![Page 237: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/237.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inliningp = 0.02
p = 0.5
p = 0.6
p = 0.8
![Page 238: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/238.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inliningp = 0.02
p = 0.5
p = 0.6
p = 0.8
p = 0.6
![Page 239: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/239.jpg)
IC Polymorphic Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7×
1.38×
5.76×
2.52×
1.40×
5.72×
2.52×
1.39×
5.67×
2.49× Mono IC Inlining+ Mini IC Inlining+ Poly IC Inliningp = 0.02
p = 0.5
p = 0.6
p = 0.8
p = 0.6
p = 0.3
![Page 240: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/240.jpg)
![Page 241: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/241.jpg)
function foo(o) { return o.f; }
![Page 242: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/242.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
![Page 243: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/243.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
![Page 244: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/244.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
S1: {f, g}
![Page 245: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/245.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
S1: {f, g}
DFG (less optimizing JIT)
![Page 246: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/246.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
S1: {f, g}
DFG (less optimizing JIT)
…—> foo
<- foo
jmp Lslow
![Page 247: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/247.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
S1: {f, g}
DFG (less optimizing JIT)
…—> foo
<- foo
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
![Page 248: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/248.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
S1: {f, g}
DFG (less optimizing JIT)
…—> foo
<- foo
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
FTL (optimizing JIT)
![Page 249: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/249.jpg)
function foo(o) { return o.f; }
S1: {f, g}
S2: {f, g, h}
S3: {g, f}
function bar(p) { return foo(p.g); }
S1: {f, g}
DFG (less optimizing JIT)
…—> foo
<- foo
cmp S1, (%rax)jnz Lslowmov 10(%rax), %rax
FTL (optimizing JIT)
…—> foo CheckStructure GetByOffset<- foo
![Page 250: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/250.jpg)
IC Polyvariant Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.14×
2.53×
1.38×
5.76×
2.52×Polymorphic IC Inlining+ Polyvariant IC Inlining
![Page 251: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/251.jpg)
IC Polyvariant Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.14×
2.53×
1.38×
5.76×
2.52×Polymorphic IC Inlining+ Polyvariant IC Inlining
p = 0.4
![Page 252: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/252.jpg)
IC Polyvariant Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.14×
2.53×
1.38×
5.76×
2.52×Polymorphic IC Inlining+ Polyvariant IC Inlining
p = 0.4
p = 0.0002
![Page 253: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/253.jpg)
IC Polyvariant Inlining Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.14×
2.53×
1.38×
5.76×
2.52×Polymorphic IC Inlining+ Polyvariant IC Inlining
p = 0.4
p = 0.0002
p = 0.9
![Page 254: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/254.jpg)
MultiGetByOffset(@o, “f”, [S1, S2] => 0, [S3] => 1)MultiGetByOffset(@o, “g”, [S1, S2] => 1, [S3] => 0)DFG IR:
![Page 255: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/255.jpg)
MultiGetByOffset(@o, “f”, [S1, S2] => 0, [S3] => 1)MultiGetByOffset(@o, “g”, [S1, S2] => 1, [S3] => 0)DFG IR:
B3 IR:
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
else
![Page 256: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/256.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
else
![Page 257: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/257.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
else
![Page 258: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/258.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)Branch(Equal( @structure, $S1))
OSR exit
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
elsethenelse
![Page 259: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/259.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)Branch(Equal( @structure, $S1))
OSR exit
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
else
then
else
![Page 260: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/260.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)Branch(Equal( @structure, $S1))
OSR exit
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
else
then
else
![Page 261: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/261.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)Branch(Equal( @structure, $S1))
OSR exit
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
elseelse
else
then
else
![Page 262: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/262.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
else
else
elseelse
![Page 263: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/263.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x18)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
else
else
elseelse
![Page 264: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/264.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Load(@object, offset = 0x18)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
else
else
else
![Page 265: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/265.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Load(@object, offset = 0x18)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
else
else
else
![Page 266: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/266.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Load(@object, offset = 0x18)
Load(@object, offset = 0x10)
then
elsethen
then
else
else
![Page 267: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/267.jpg)
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))Load(@object,
offset = 0x10)Load(@object, offset = 0x18)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
else
else
![Page 268: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/268.jpg)
B3 IR before:
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))
Load(@object, offset = 0x10)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))
Load(@object, offset = 0x18)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
else
else
else
![Page 269: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/269.jpg)
B3 IR before:
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))
Load(@object, offset = 0x10)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)
OSR exit
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))
Load(@object, offset = 0x18)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
then
then
then
else
else
else
else
else
B3 IR after:
Branch(Equal( @structure, $S1))
Branch(Equal( @structure, $S2))
Load(@object, offset = 0x10)Load(@object, offset = 0x18)
Branch(Equal( @structure, $S3))
Load(@object, offset = 0x18)Load(@object, offset = 0x10)
OSR exit
then
elsethen
then
else
else
duplicateTails(procedure); foldPathConstants(procedure);
![Page 270: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/270.jpg)
Taildup Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.23×
2.57×
1.39×
6.14×
2.53×Poly Poly IC Inlining+ Taildup
![Page 271: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/271.jpg)
Taildup Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.23×
2.57×
1.39×
6.14×
2.53×Poly Poly IC Inlining+ Taildup
p = 0.03
![Page 272: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/272.jpg)
Taildup Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.23×
2.57×
1.39×
6.14×
2.53×Poly Poly IC Inlining+ Taildup
p = 0.03
p = 0.5
![Page 273: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/273.jpg)
Taildup Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.39×
6.23×
2.57×
1.39×
6.14×
2.53×Poly Poly IC Inlining+ Taildup
p = 0.03
p = 0.5
p = 0.6
![Page 274: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/274.jpg)
o.f.g
![Page 275: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/275.jpg)
o.f.g
a: CheckStructure(@o, S1)b: GetByOffset(@o)c: CheckStructure(@b, S2)d: GetByOffset(@c)
![Page 276: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/276.jpg)
o.f.g
a: CheckStructure(@o, S1)b: GetByOffset(@o)c: CheckStructure(@b, S2)d: GetByOffset(@c)
![Page 277: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/277.jpg)
Property Type Inference
![Page 278: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/278.jpg)
Property Type Inference
{f: , …)
![Page 279: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/279.jpg)
Property Type Inference
{f: , …)
{g: , …)
![Page 280: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/280.jpg)
Property Type Inference
{f: , …)
{g: , …)S1:
{f, …}
![Page 281: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/281.jpg)
Property Type Inference
{f: , …)
{g: , …)S1:
{f, …}
S2: {g, …}
![Page 282: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/282.jpg)
Property Type Inference
{f: , …)
{g: , …)S1:
{f, …}
S2: {g, …}Inferred Type
Table
![Page 283: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/283.jpg)
Property Type Inference
{f: , …)
{g: , …)S1:
{f, …}
S2: {g, …}Inferred Type
Table
f: S2
![Page 284: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/284.jpg)
Property Type Inference
• Stores to f check type{f: , …)
{g: , …)S1:
{f, …}
S2: {g, …}Inferred Type
Table
f: S2
![Page 285: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/285.jpg)
Property Type Inference
• Stores to f check type
• Loads don’t have to
{f: , …)
{g: , …)S1:
{f, …}
S2: {g, …}Inferred Type
Table
f: S2
![Page 286: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/286.jpg)
Property Type Inference
• Stores to f check type
• Loads don’t have to
• S1’s inferred type table watches S2’s transitions
{f: , …)
{g: , …)S1:
{f, …}
S2: {g, …}Inferred Type
Table
f: S2
![Page 287: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/287.jpg)
Inferred Type “Speed-up”
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.04×
2.60×
1.39×
6.23×
2.57×Poly Poly IC Inlining + Taildup+ Inferred Type
![Page 288: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/288.jpg)
Inferred Type “Speed-up”
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.04×
2.60×
1.39×
6.23×
2.57×Poly Poly IC Inlining + Taildup+ Inferred Type
!!!
![Page 289: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/289.jpg)
Inferred Type “Speed-up”
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.04×
2.60×
1.39×
6.23×
2.57×Poly Poly IC Inlining + Taildup+ Inferred Type
!!!
!!!
![Page 290: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/290.jpg)
Inferred Type “Speed-up”
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.04×
2.60×
1.39×
6.23×
2.57×Poly Poly IC Inlining + Taildup+ Inferred Type
!!!
!!!
p = 0.03
![Page 291: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/291.jpg)
Inferred Type “Speed-up”
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.04×
2.60×
1.39×
6.23×
2.57×Poly Poly IC Inlining + Taildup+ Inferred Type
!!!
!!!
p = 0.03
p = 0.08
![Page 292: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/292.jpg)
Inferred Type “Speed-up”
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.04×
2.60×
1.39×
6.23×
2.57×Poly Poly IC Inlining + Taildup+ Inferred Type
!!!
!!!
p = 0.03
p = 0.08
p = 0.02
![Page 293: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/293.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
![Page 294: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/294.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
P1
S1
![Page 295: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/295.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
P1
S1 P2
S2
![Page 296: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/296.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
P1
S1 P2
S2 P3
S3
![Page 297: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/297.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
P1
S1 P2
S2 P3
S3 P4
S4
![Page 298: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/298.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
P1
S1 P2
S2 P3
S3 P4
S4 P5
S5
![Page 299: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/299.jpg)
function foo(){ class Helper { … } var h = new Helper(); …}
P1
S1 P2
S2 P3
S3 P4
S4 P5
S5 P6
S6
![Page 300: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/300.jpg)
{1, 2}
{42, 3}{-5, 7}
{x, y}
proto
global object
Mono Proto
{1, 2}
{42, 3}{-5, 7}
{x, y}global object
Poly Proto
proto1
proto2
![Page 301: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/301.jpg)
Poly Proto Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.27×
2.61×
1.37×
6.04×
2.60×Poly Poly + Taildup + Inferred Type+ Poly Proto
![Page 302: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/302.jpg)
Poly Proto Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.27×
2.61×
1.37×
6.04×
2.60×Poly Poly + Taildup + Inferred Type+ Poly Proto
p = 0.8
![Page 303: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/303.jpg)
Poly Proto Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.27×
2.61×
1.37×
6.04×
2.60×Poly Poly + Taildup + Inferred Type+ Poly Proto
p = 0.8
p = 0.02
![Page 304: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/304.jpg)
Poly Proto Speed-up
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5× 7× 7.5×
1.37×
6.27×
2.61×
1.37×
6.04×
2.60×Poly Poly + Taildup + Inferred Type+ Poly Proto
p = 0.8
p = 0.02
p = 0.7
![Page 305: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/305.jpg)
How I Ran These Experiments
• WebKit trunk revision 233406
• Safari trunk hash dd8296dbaac7afa5ed9a699aa261033ea5f5577c
• macOS Internal SDK
• make release (not a root, no shared cache)
• Patch, scripts, and raw data at webkit.org/b/187414
• MacBookPro11,5 2.8GHz 16GB RAM 1TB SSD
![Page 306: Inline Caching in JavaScriptCore · “Inline Cache” indexing type flags cell state structure ID: 42 null 0xffff000000000005 var o = {f: 5, g: 6}; 0xffff000000000006 Structure](https://reader036.vdocument.in/reader036/viewer/2022071512/6132da60dfd10f4dd73ab6d1/html5/thumbnails/306.jpg)
JetStream
ARES-6
Speedometer 2
1× 1.5× 2× 2.5× 3× 3.5× 4× 4.5× 5× 5.5× 6× 6.5×1.37×
6.27×
2.605×
Self+ Proto+ New Property+ Transition Watch+ Replacement Watch+ Polymorphic+ Miss+ Accessors+ Monomorphic Inlining+ Minimorphic Inlining+ Polymorphic Inlining+ Polyvariant Inlining+ Taildup+ Inferred Types+ Poly Proto