Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1d97334bd2adc29eeb83cd1e268bdb22af458ad3
https://github.com/WebKit/WebKit/commit/1d97334bd2adc29eeb83cd1e268bdb22af458ad3
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-18 (Sat, 18 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/regexp-matches-array-includes.js
A JSTests/microbenchmarks/regexp-matches-array-index-of.js
A JSTests/stress/regexp-matches-array-index-of-have-a-bad-time.js
A JSTests/stress/regexp-matches-array-index-of-mixed.js
A JSTests/stress/regexp-matches-array-index-of-mutated.js
A JSTests/stress/regexp-matches-array-index-of-with-indices.js
A JSTests/stress/regexp-matches-array-index-of.js
M Source/JavaScriptCore/bytecode/ArrayProfile.cpp
M Source/JavaScriptCore/bytecode/ArrayProfile.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] DFG should use the `ArrayIndexOf` / `ArrayIncludes` intrinsic for
RegExp matches arrays
https://bugs.webkit.org/show_bug.cgi?id=319351
Reviewed by Yusuke Suzuki.
RegExp matches arrays have non-original structures (they carry the index,
input, and groups property transitions), so the ArrayIndexOf/ArrayIncludes
intrinsic was rejected and every call went through the generic host function.
Since their prototype is still the original Array.prototype, we can use the
intrinsic by checking the structure against the matches array structures and
watching for having-a-bad-time, which replaces those structures with SlowPut
variants. The speculation is driven by a new ArrayProfile flag recorded when
profiling observes a matches array structure. Routers scanning the matches
array of a combined route regexp (e.g. Hono's RegExpRouter) hit this on every
request.
baseline
patched
regexp-matches-array-index-of 17.6912+-1.4997 ^
13.2829+-0.4919 ^ definitely 1.3319x faster
regexp-matches-array-includes 22.3299+-1.0463 ^
16.6826+-0.3012 ^ definitely 1.3385x faster
Tests: JSTests/microbenchmarks/regexp-matches-array-includes.js
JSTests/microbenchmarks/regexp-matches-array-index-of.js
JSTests/stress/regexp-matches-array-index-of-have-a-bad-time.js
JSTests/stress/regexp-matches-array-index-of-mixed.js
JSTests/stress/regexp-matches-array-index-of-mutated.js
JSTests/stress/regexp-matches-array-index-of-with-indices.js
JSTests/stress/regexp-matches-array-index-of.js
* JSTests/microbenchmarks/regexp-matches-array-includes.js: Added.
(test):
* JSTests/microbenchmarks/regexp-matches-array-index-of.js: Added.
(test):
* JSTests/stress/regexp-matches-array-index-of-have-a-bad-time.js: Added.
(shouldBe):
(indexOfValue):
* JSTests/stress/regexp-matches-array-index-of-mixed.js: Added.
(shouldBe):
(indexOfValue):
* JSTests/stress/regexp-matches-array-index-of-mutated.js: Added.
(shouldBe):
(indexOfValue):
* JSTests/stress/regexp-matches-array-index-of-with-indices.js: Added.
(shouldBe):
(indexOfValue):
(includesValue):
* JSTests/stress/regexp-matches-array-index-of.js: Added.
(shouldBe):
(indexOfEmpty):
(indexOfValue):
(indexOfUndefined):
(indexOfNegativeFrom):
(includesEmpty):
(includesValue):
(indexOfOnNamed):
* Source/JavaScriptCore/bytecode/ArrayProfile.cpp:
(JSC::ArrayProfile::computeUpdatedPrediction):
* Source/JavaScriptCore/bytecode/ArrayProfile.h:
(JSC::ArrayProfile::mayBeRegExpMatchesArray const):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::profiledArrayMayBeRegExpMatchesArray):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
Canonical link: https://commits.webkit.org/317466@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
