Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5e57a5812ef4218e611a1f7601bf20544267394c
https://github.com/WebKit/WebKit/commit/5e57a5812ef4218e611a1f7601bf20544267394c
Author: Yusuke Suzuki <[email protected]>
Date: 2026-05-14 (Thu, 14 May 2026)
Changed paths:
A JSTests/stress/symbol-prototype-to-string-intrinsic.js
M Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/StringConstructor.cpp
M Source/JavaScriptCore/runtime/Symbol.cpp
M Source/JavaScriptCore/runtime/Symbol.h
M Source/JavaScriptCore/runtime/SymbolConstructor.cpp
M Source/JavaScriptCore/runtime/SymbolPrototype.cpp
Log Message:
-----------
[JSC] Cache result of Symbol.prototype.toString
https://bugs.webkit.org/show_bug.cgi?id=314842
rdar://177099930
Reviewed by Yijia Huang.
We found that this is relatively frequently called and we are generating
JSString each time. This patch adds some fields to cache the idempotent
string results from Symbol. As we already hash-consing Symbols, this
cache works well for the same Symbol globally.
We also added SymbolToString DFG node to handle this efficiently, and
the fast path is just loading a value from the cached field of Symbol.
Test: JSTests/stress/symbol-prototype-to-string-intrinsic.js
* JSTests/stress/symbol-prototype-to-string-intrinsic.js: Added.
(shouldBe):
(shouldThrow):
(test):
(viaString):
(viaToString):
(desc):
(const.descriptor.toString):
* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileSymbolToString):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/StringConstructor.cpp:
(JSC::stringConstructor):
* Source/JavaScriptCore/runtime/Symbol.cpp:
(JSC::Symbol::Symbol):
(JSC::Symbol::toString):
(JSC::Symbol::visitChildrenImpl):
(JSC::Symbol::description):
(JSC::Symbol::createWithDescription):
(JSC::Symbol::description const): Deleted.
* Source/JavaScriptCore/runtime/Symbol.h:
* Source/JavaScriptCore/runtime/SymbolConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/SymbolPrototype.cpp:
(JSC::JSC_DEFINE_CUSTOM_GETTER):
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/313284@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
