Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b1a624172673ac28c2d4882c0f8a95260d80d457
https://github.com/WebKit/WebKit/commit/b1a624172673ac28c2d4882c0f8a95260d80d457
Author: Sosuke Suzuki <[email protected]>
Date: 2026-05-15 (Fri, 15 May 2026)
Changed paths:
A JSTests/microbenchmarks/promise-resolve-non-thenable-object.js
A JSTests/stress/dfg-promise-resolve-fulfilled-object.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Inline allocation for `Promise.resolve()` of a non-thenable object
https://bugs.webkit.org/show_bug.cgi?id=314865
Reviewed by Yusuke Suzuki.
313220@main rewrote how ConstantFoldingPhase folds the PromiseResolve node: when
the resolved value is proven non-thenable it now emits NewResolvedPromise
instead
of an inline NewInternalFieldObject. But NewResolvedPromise only
inline-allocates
for a statically non-object argument; for an object argument it falls back to
the
operationNewResolvedPromise C call and clobberTop(). The common
Promise.resolve({ ... }) pattern -- where ConstantFoldingPhase has already
proven
the argument non-thenable via a watched "then"-absence condition set -- thus
regressed from an inline allocation into a clobbering C call.
Carry that fact on the node via an isResolvedValueKnownNonThenable flag. When
set,
compileNewResolvedPromise inline-allocates the fulfilled promise even for an
object argument, and clobberize / AbstractInterpreter model it as a pure
allocation (HeapObjectCount) like NewPromise. Nodes created from the
NewResolvedPromiseIntrinsic keep the flag clear and the previous behavior.
promise-resolve-non-thenable-object 10.5459+-0.1503 ^
6.8783+-0.1186 ^ definitely 1.5332x faster
Tests: JSTests/microbenchmarks/promise-resolve-non-thenable-object.js
JSTests/stress/dfg-promise-resolve-fulfilled-object.js
* JSTests/microbenchmarks/promise-resolve-non-thenable-object.js: Added.
* JSTests/stress/dfg-promise-resolve-fulfilled-object.js: Added.
(shouldBe):
(resolveObject):
(resolveValue):
(resolveThenable):
(MyPromise):
(resolveSubclass):
(Proto):
(resolveProto):
(async main.Proto.prototype.then):
(async main):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::convertToNewResolvedPromise):
(JSC::DFG::Node::isResolvedValueKnownNonThenable):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileNewResolvedPromise):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/313301@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
