Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6a9868495cb975b48825c3332a25ca1b857e7e23
https://github.com/WebKit/WebKit/commit/6a9868495cb975b48825c3332a25ca1b857e7e23
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/string-prototype-concat-int32.js
A JSTests/stress/string-prototype-concat-object-arguments-osr-exit.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
Log Message:
-----------
[JSC] Speculate on `String#concat` arguments based on profiling
https://bugs.webkit.org/show_bug.cgi?id=318660
Reviewed by Yusuke Suzuki.
@babel/preset-env compiles `${x}px` into "".concat(x, "px"), but the DFG
intrinsic emits Check(StringUse) on every argument, so the first number
argument takes a BadType OSR exit and permanently disables the intrinsic.
This patch defers the argument speculation to FixupPhase, which picks the
use kinds based on profiling instead.
baseline patched
string-concat-long-convert 103.0186+-1.4840 ^ 16.1301+-0.2485
^ definitely 6.3867x faster
string-prototype-concat-int32 79.0260+-0.6463 ^ 24.9199+-0.3324
^ definitely 3.1712x faster
string-concat-convert 112.5050+-1.0153 ^ 18.6171+-0.1443
^ definitely 6.0431x faster
Test: JSTests/microbenchmarks/string-prototype-concat-int32.js
* JSTests/microbenchmarks/string-prototype-concat-int32.js: Added.
(build):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::hasIntrinsic):
Canonical link: https://commits.webkit.org/316696@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
