Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 65d02142320f137310829f11c8522761c1cb9725
https://github.com/WebKit/WebKit/commit/65d02142320f137310829f11c8522761c1cb9725
Author: Yusuke Suzuki <[email protected]>
Date: 2026-03-11 (Wed, 11 Mar 2026)
Changed paths:
A JSTests/stress/megamorphic-ic-string-load-invalidate-2.js
A JSTests/stress/megamorphic-ic-string-load-invalidate.js
A JSTests/stress/megamorphic-ic-string-miss-invalidate.js
A JSTests/stress/megamorphic-ic-string.js
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/BaselineJITRegisters.h
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/runtime/BigIntPrototype.cpp
M Source/JavaScriptCore/runtime/BooleanPrototype.cpp
M Source/JavaScriptCore/runtime/NumberPrototype.cpp
M Source/JavaScriptCore/runtime/StringPrototype.cpp
M Source/JavaScriptCore/runtime/SymbolPrototype.cpp
Log Message:
-----------
[JSC] GetById megamorphic IC should handle String too
https://bugs.webkit.org/show_bug.cgi?id=309646
rdar://172251161
Reviewed by Yijia Huang.
This patch extends megamorphic GetById IC to accept String as a base
value. We found a case that we are giving up when we encounter a String
cell as a base value in the megamorphic IC. To achieve that we load
String.prototype when base value is a String and starting with that. But
operation function should take original String as a base since we may
call getter etc. which should have the original String as a |this|
value.
Test: JSTests/stress/megamorphic-ic-string.js
* JSTests/stress/megamorphic-ic-string.js: Added.
(makeObject):
(test1.access):
(test1):
(test2.getCharAt):
(test2.getIndexOf):
(test2.getSlice):
(test2):
(test3.access):
(test3):
(test4.access):
(test4):
(test5.access):
(test5):
(test6.callSubstring):
(test6):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::getByIdMegamorphic):
* Source/JavaScriptCore/runtime/BigIntPrototype.cpp:
(JSC::BigIntPrototype::finishCreation):
* Source/JavaScriptCore/runtime/BooleanPrototype.cpp:
(JSC::BooleanPrototype::finishCreation):
* Source/JavaScriptCore/runtime/NumberPrototype.cpp:
(JSC::NumberPrototype::finishCreation):
* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
* Source/JavaScriptCore/runtime/SymbolPrototype.cpp:
(JSC::SymbolPrototype::finishCreation):
Canonical link: https://commits.webkit.org/309095@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
