jit-inline-cache-polymorphism-20260728

Answer

The implementation provides a complete Polymorphic Inline Cache (PIC) optimization pass for a JavaScript JIT compiler. The core design mirrors V8's IC system:

Shape System — Each object carries a Shape (hidden class) that tracks property offsets and transitions. When a property is added, the shape transitions to a new child shape, mirroring how V8's Map objects work.

Inline Cache States — Three dispatch tiers based on observed object shapes at a call site: 1. Monomorphic (1 shape): Single shape-guard → direct offset load 2. Polymorphic (2–4 shapes): Cascading shape-ID checks via a move-to-front heuristic 3. Megamorphic (5+ shapes): Dictionary-style slow path using a shape-ID → value cache

Stub Generation — Each IC emits a structured "stub" object containing guards (shape_check), load type (direct_load or prototype_chain_load), and a fallback handler. A real JIT backend lowers these stubs to native code (x86/ARM).

Prototype Chain Lookup — The lookupOffset method on Shape walks the prototype chain of shapes. The runtime doPrototypeChain helper walks parallel JSObject prototype objects with visited-set cycle detection.

Key code from the solution:

// Shape (hidden class) with property map, prototype link, and transition table
class Shape {
  constructor(prototype = null) {
    this.id = ++shapeIdCounter;
    this.properties = new Map();      // name → { offset, writable, ... }
    this.prototype = prototype;       // parent shape in prototype chain
    this.transitions = new Map();     // property name → { shape, offsetName }
  }

  lookupOffset(name) {
    if (this.properties.has(name)) return this.properties.get(name);
    if (this.prototype) return this.prototype.lookupOffset(name);
    return null;
  }
}

// Inline cache with three dispatch states
class InlineCache {
  constructor(name) {
    this.state = IC_STATE.UNINITIALIZED;
    this.monomorphicShape = null;
    this.polymorphicShapes = [];       // up to 4 shapes
    this.megamorphicCache = new Map(); // shapeId → cached value
  }

  recordAccess(object, propertyName) {
    const shape = object.shape;
    switch (this.state) {
      case IC_STATE.UNINITIALIZED:
        this.monomorphicShape = shape;
        this.state = IC_STATE.MONOMORPHIC;
        break;
      case IC_STATE.MONOMORPHIC:
        if (!this.monomorphicShape.matches(shape)) {
          // Second shape → polymorphic
          this.polymorphicShapes = [this.monomorphicShape, shape];
          this.monomorphicShape = null;
          this.state = IC_STATE.POLYMORPHIC;
        }
        break;
      case IC_STATE.POLYMORPHIC:
        // ... checks existing, adds up to 4, then megamorphic
      case IC_STATE.MEGAMORPHIC:
        this.megamorphicCache.set(shape.id, null);
    }
  }

  generateStub(propertyName) {
    // Returns structured IR: guards[], fallback type
  }
}