Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9aa1cb79e9dbfd91ef0a1f603a8fb5594a6df833
https://github.com/WebKit/WebKit/commit/9aa1cb79e9dbfd91ef0a1f603a8fb5594a6df833
Author: Yusuke Suzuki <[email protected]>
Date: 2025-10-11 (Sat, 11 Oct 2025)
Changed paths:
A JSTests/stress/promise-resolve-folded-own.js
A JSTests/stress/promise-resolve-folded-proto.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.cpp
M Source/JavaScriptCore/dfg/DFGGraph.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Log Message:
-----------
[JSC] Promise.resolve should be folded into fulfill
https://bugs.webkit.org/show_bug.cgi?id=300550
rdar://162424524
Reviewed by Sosuke Suzuki.
`Promise.resolve(value)` specially handles "thenable" objects which
have "then" function. This is kind-of backward compatibility feature
so that native Promise can work together with non native Promise
implementations. However, to detect "thenable", we need to check
"then" function existence for any input objects and this is costly
since (1) now almost everyone is using native Promise so "thenable"
custom promise is rare, and (2) we need to check "then" function for any
object argument which is just a resolution value for the promise.
In this patch, we add intrinsics for resolve operations and handle them
in DFG / FTL. And through DFG pipeline, we attempt to fold "resolve"
operation into "fulfill" operation which does not pipe the value as a
promise. We convert "resolve" to "fulfill" when,
1. Input is not an object. Then we do not need to look up "then".
2. Input Structure is finite, it is only one and we cannot find "then"
function. We insert watchpoint for this case to ensure this shape and
convert "resolve" to "fulfill".
Tests: JSTests/stress/promise-resolve-folded-own.js
JSTests/stress/promise-resolve-folded-proto.js
* JSTests/stress/promise-resolve-folded-own.js: Added.
(test):
(object.then):
* JSTests/stress/promise-resolve-folded-proto.js: Added.
(test):
(Object.prototype.then):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryEnsureAbsence):
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
Canonical link: https://commits.webkit.org/301376@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
