Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1cdf1c9f02aa1592b606dd986e6bd9e5b1e03efc
https://github.com/WebKit/WebKit/commit/1cdf1c9f02aa1592b606dd986e6bd9e5b1e03efc
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
A JSTests/stress/promise-catch-own-then.js
A JSTests/stress/regexp-test-exec-watchpoint-invalidation.js
A JSTests/stress/regexp-test-own-exec.js
A JSTests/stress/regexp-test-subclass-exec.js
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
M Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp
M Source/JavaScriptCore/bytecode/PropertyInlineCache.h
M Source/JavaScriptCore/bytecode/Repatch.cpp
M Source/JavaScriptCore/bytecode/Repatch.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.h
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/jit/JITOperations.h
Log Message:
-----------
[JSC] Remove DFG TryGetById node
https://bugs.webkit.org/show_bug.cgi?id=318603
Reviewed by Yusuke Suzuki.
Now that op_try_get_by_id and the @tryGetById builtin intrinsic are gone,
the DFG TryGetById node is only created by the ByteCodeParser for a handful
of intrinsics, where it performs a runtime "is this property still the
primordial one" check:
- RegExpTestIntrinsic / RegExpSearchIntrinsic / RegExpMatchIntrinsic /
RegExpSplitIntrinsic verify that the RegExp object's "exec" is the
primordial RegExp.prototype.exec.
- PromisePrototypeCatchIntrinsic verifies that the promise's "then" is the
primordial Promise.prototype.then.
These checks can be expressed as a watchpoint plus a CheckStructure against
the primordial structure instead (subclass instances now take the generic
path, like the other RegExp intrinsics already do). Do that, and delete the
node along with the IC layer's TryGetById support, which was only reachable
from DFG / FTL.
* JSTests/stress/promise-catch-own-then.js: Added.
* JSTests/stress/regexp-test-exec-watchpoint-invalidation.js: Added.
* JSTests/stress/regexp-test-own-exec.js: Added.
* JSTests/stress/regexp-test-subclass-exec.js: Added.
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheCompiler::generateSlowPathCode):
(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):
* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:
(JSC::PropertyInlineCache::reset):
* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:
(JSC::appropriateGetByIdOptimizeFunction):
(JSC::appropriateGetByIdGenericFunction):
(JSC::hasConstantIdentifier):
* Source/JavaScriptCore/bytecode/Repatch.cpp:
(JSC::appropriateGetByOptimizeFunction):
(JSC::appropriateGetByGaveUpFunction):
(JSC::tryCacheGetBy):
* Source/JavaScriptCore/bytecode/Repatch.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleGetById):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp:
(JSC::DFG::clobbersExitState):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGGraph.h:
(JSC::DFG::Graph::isWatchingPromiseThenWatchpoint):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::hasCacheableIdentifier):
(JSC::DFG::Node::cacheableIdentifier):
(JSC::DFG::Node::hasGetByIdData const):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileGetById):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileGetById):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetById):
* Source/JavaScriptCore/jit/JITOperations.cpp:
* Source/JavaScriptCore/jit/JITOperations.h:
Canonical link: https://commits.webkit.org/316539@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
