Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c800622bab898f312ace1cc2fdab14a9eb7fbe3b
https://github.com/WebKit/WebKit/commit/c800622bab898f312ace1cc2fdab14a9eb7fbe3b
Author: Sosuke Suzuki <[email protected]>
Date: 2026-05-31 (Sun, 31 May 2026)
Changed paths:
A JSTests/microbenchmarks/regexp-search-digit-cached.js
A JSTests/microbenchmarks/regexp-search-digit-literal.js
A JSTests/microbenchmarks/string-search-digit-short.js
A JSTests/stress/string-prototype-search-edge-cases.js
A JSTests/stress/string-prototype-search-strength-reduction.js
A JSTests/stress/string-prototype-search-watchpoint-invalidation.js
M Source/JavaScriptCore/builtins/StringPrototype.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGCloneHelper.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.h
M Source/JavaScriptCore/dfg/DFGJITCode.cpp
M Source/JavaScriptCore/dfg/DFGJITCode.h
M Source/JavaScriptCore/dfg/DFGNode.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/RegExpObject.h
M Source/JavaScriptCore/runtime/RegExpObjectInlines.h
M Source/JavaScriptCore/runtime/RegExpPrototype.cpp
M Source/JavaScriptCore/runtime/RegExpPrototype.h
M Source/JavaScriptCore/runtime/StringPrototype.cpp
M Source/JavaScriptCore/runtime/StringPrototype.h
Log Message:
-----------
[JSC] Implement `String#search` in C++
https://bugs.webkit.org/show_bug.cgi?id=315456
Reviewed by Yusuke Suzuki.
Move String.prototype.search from a JS builtin to a C++ host function and add
a StringSearch DFG node, mirroring the String#match work in 313363@main.
Notes:
* StringSearch is converted to RegExpSearch in fixup (reusing the StringMatch
primordial checks), so the existing RegExpSearch strength reductions apply
to str.search(re) as well.
* searchSymbol is added to regExpPrimordialPropertiesWatchpointSet, and the new
stringSymbolSearchWatchpointSet watches @@search absence on String.prototype
and Object.prototype.
* isSymbolSearchFastAndNonObservable additionally requires lastIndexIsWritable()
since @@search resets and restores lastIndex.
* regExpProtoFuncSearch is split into regExpSearchFast / regExpSearchGeneric,
shared by stringProtoFuncSearch and the DFG operations.
TipOfTree
Patched
regexp-prototype-search-short-string 5.4420+-0.3191 ^
2.1768+-0.0847 ^ definitely 2.5001x faster
regexp-prototype-search-complex-pattern 7.0782+-0.6621 ^
2.2992+-0.2105 ^ definitely 3.0786x faster
regexp-prototype-search-basic 6.7999+-0.3401 ^
2.3138+-0.2230 ^ definitely 2.9389x faster
regexp-prototype-search-anchor 7.2162+-0.6817 ^
2.3149+-0.1519 ^ definitely 3.1172x faster
regexp-search-digit-literal 9.1569+-0.2871
8.6720+-0.2132 might be 1.0559x faster
Tests: JSTests/microbenchmarks/regexp-search-digit-cached.js
JSTests/microbenchmarks/regexp-search-digit-literal.js
JSTests/microbenchmarks/string-search-digit-short.js
JSTests/stress/string-prototype-search-edge-cases.js
JSTests/stress/string-prototype-search-strength-reduction.js
JSTests/stress/string-prototype-search-watchpoint-invalidation.js
* JSTests/microbenchmarks/regexp-search-digit-cached.js: Added.
(search):
* JSTests/microbenchmarks/regexp-search-digit-literal.js: Added.
(search):
* JSTests/microbenchmarks/string-search-digit-short.js: Added.
(search):
* JSTests/stress/string-prototype-search-edge-cases.js: Added.
(shouldBe):
(shouldThrow):
(shouldBe.String.prototype.search.call.toString):
(toString):
(shouldBe.string_appeared_here.search.Symbol.search):
(Symbol.search):
(shouldBe.string_appeared_here.search.toString):
(shouldThrow.string_appeared_here.search.get Symbol):
(throw.new.TypeError.MyRegExp):
(throw.new.TypeError):
(shouldBe.MyRegExp2.prototype.Symbol.search):
(shouldBe.MyRegExp2):
(shouldBe.MyRegExp3.prototype.exec):
(shouldBe.MyRegExp3):
(shouldBe.string_appeared_here.search):
* JSTests/stress/string-prototype-search-strength-reduction.js: Added.
(shouldBe):
(searchLiteral):
(searchGlobalLiteral):
(searchStickyLiteral):
(searchUnicode):
(searchCached):
(searchStringPattern):
(searchPoly):
(shouldBe.searchPoly):
* JSTests/stress/string-prototype-search-watchpoint-invalidation.js: Added.
(shouldBe):
(search):
(re.Symbol.search):
(RegExp.prototype.Symbol.search):
(RegExp.prototype.exec):
(value):
(re.lastIndex.valueOf):
(Symbol.search):
(receiver.toString.re.exec):
(receiver.toString):
(receiver.toString.RegExp.prototype.exec):
(catch):
* Source/JavaScriptCore/builtins/StringPrototype.js:
(search): Deleted.
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGCloneHelper.h:
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::addStringMatchAndSearchPrimordialChecks):
(JSC::DFG::FixupPhase::addStringMatchPrimordialChecks): Deleted.
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGJITCode.cpp:
(JSC::DFG::JITData::JITData):
(JSC::DFG::JITData::tryInitialize):
* Source/JavaScriptCore/dfg/DFGJITCode.h:
* Source/JavaScriptCore/dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToRegExpSearch):
* Source/JavaScriptCore/dfg/DFGNode.h:
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileStringSearch):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
* Source/JavaScriptCore/runtime/RegExpObject.h:
* Source/JavaScriptCore/runtime/RegExpObjectInlines.h:
(JSC::RegExpObject::isSymbolSearchFastAndNonObservable):
* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:
(JSC::regExpSearchFast):
(JSC::regExpSearchGeneric):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/RegExpPrototype.h:
* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
(JSC::stringSearchSlow):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/StringPrototype.h:
Canonical link: https://commits.webkit.org/314261@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
