Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 86925a32584726ff306109f2e78718824f98a5a8
https://github.com/WebKit/WebKit/commit/86925a32584726ff306109f2e78718824f98a5a8
Author: Sosuke Suzuki <[email protected]>
Date: 2026-03-26 (Thu, 26 Mar 2026)
Changed paths:
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
Log Message:
-----------
[JSC] Remove dead `thisRegister` mov in `emitCallImpl` / `emitConstructImpl`
spread paths
https://bugs.webkit.org/show_bug.cgi?id=310779
Reviewed by Yusuke Suzuki.
Both emitCallImpl and emitConstructImpl contain an unused local
`RefPtr<RegisterID> thisRegister = move(newTemporary(),
callArguments.thisRegister())`
in their spread-argument code paths. The very next line passes
callArguments.thisRegister() directly to emitCallVarargs, so the local
is never read. However, the move() call still emits an op_mov into the
bytecode stream and the newTemporary() consumes a register slot.
This affects calls and constructs whose argument list, after the parser
rewrites f(...x) into f(...[...x]), yields an array literal with more
than one element — e.g. f(...a, ...b), f(x, ...rest), or new F(...args)
where the inner spread expression is itself a spread. Single-spread
calls like f(...args) take the earlier single-element fast path and are
unaffected.
* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitConstructImpl):
Canonical link: https://commits.webkit.org/309978@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
