Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3c0f403d81c9ce38a7f5256f0209f941610de414
https://github.com/WebKit/WebKit/commit/3c0f403d81c9ce38a7f5256f0209f941610de414
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A JSTests/wasm/gc/bulk-array-element-types.js
M JSTests/wasm/gc/bulk-array.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT.h
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
M Source/JavaScriptCore/wasm/WasmExceptionType.h
M Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
M Source/JavaScriptCore/wasm/WasmOperations.cpp
M Source/JavaScriptCore/wasm/WasmOperations.h
Log Message:
-----------
[JSC] Optimize wasm array.copy and array.fill
https://bugs.webkit.org/show_bug.cgi?id=322222
rdar://185455041
Reviewed by Yijia Huang.
This patch optimizes WasmGC array.copy and array.fill.
1. We noticed that they are called frequently with count = 0. So we do
bound check etc. in the JIT code and skip calling a function when
count = 0. This optimization is done in BBQ and OMG both.
2. For non-ref types, array.copy can use B3 MemoryCopy operation, which
is introduced for `memory.copy` too. For ref-types, we need to call
GC-safe memory move operations, so we cannot use it.
3. For non-ref types, array.fill uses very fast memset operations, using
memset_pattern16 / memset_pattern8 / memset_pattern4. For ref-types,
we have naive loop as it needs to be GC-safe.
Test: JSTests/wasm/gc/bulk-array-element-types.js
* JSTests/wasm/gc/bulk-array-element-types.js: Added.
(module):
(get return):
(get string_appeared_here):
(const.cases.get string_appeared_here):
* JSTests/wasm/gc/bulk-array.js:
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::addArrayCopy):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitZeroExtendI32):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitArrayRangeCheck):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitGetArraySizeWithNullCheck):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitArrayElementAddress):
* Source/JavaScriptCore/wasm/WasmBBQJIT.h:
* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::addArrayFill):
* Source/JavaScriptCore/wasm/WasmExceptionType.h:
(JSC::Wasm::isTypeErrorExceptionType):
* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp:
(JSC::IPInt::WASM_IPINT_EXTERN_CPP_DECL):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::emitGetArraySize):
(JSC::Wasm::OMGIRGenerator::emitGetArraySizeWithNullCheck):
(JSC::Wasm::OMGIRGenerator::emitArrayRangeCheck):
(JSC::Wasm::OMGIRGenerator::emitArrayElementAddress):
(JSC::Wasm::repeatedFillByte):
(JSC::Wasm::OMGIRGenerator::emitArrayFillRange):
(JSC::Wasm::OMGIRGenerator::addArrayFill):
(JSC::Wasm::OMGIRGenerator::addArrayCopy):
* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/wasm/WasmOperations.h:
Canonical link: https://commits.webkit.org/319567@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
