Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 960adeccefcd5f0320489e46f1aa4af764983853
https://github.com/WebKit/WebKit/commit/960adeccefcd5f0320489e46f1aa4af764983853
Author: Yusuke Suzuki <[email protected]>
Date: 2026-07-28 (Tue, 28 Jul 2026)
Changed paths:
M JSTests/stress/array-shift-intrinsic.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/JSArray.cpp
M Source/JavaScriptCore/runtime/JSArray.h
Log Message:
-----------
[JSC] Add fast operation for Array#shift
https://bugs.webkit.org/show_bug.cgi?id=320484
rdar://183450092
Reviewed by Yijia Huang.
This patch adds optimized code for Array#shift by leveraging ArrayMode-based
speculation.
1. We are already emitting Write based ArrayMode in DFGByteCodeParser.
So blessArrayOperation can ensure that this is not CoW array
(otherwise, we convert them).
2. Based on that, we further speculate InBoundsSaneChain status, which
subscribes a watchpoint.
3. With (2), we no longer need to care about holes. They should just go
to all the [[Prototype]] and getting undefined without side-effect.
This makes Array#shift operation simpler by just moving elements.
4. DFG and FTL supports 0, 1, <= 128 elements cases efficiently. 0 And 1
are handled inline, and small array shift is handled in exremely
optimized operation (I tried doing this inline and it had negative
effect rather).
* JSTests/stress/array-shift-intrinsic.js:
(shiftNonOriginal):
(MyArray):
(shiftSubclass):
(checkShift):
(int32Element):
(doubleElement):
(stringElement):
(shiftCells):
(shiftIsolated):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::assertArrayShiftElementsPreconditions):
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileArrayShift):
* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::JSArray::fastShift):
(JSC::JSArray::shiftCountWithAnyIndexingType):
* Source/JavaScriptCore/runtime/JSArray.h:
(JSC::JSArray::shiftCount):
Canonical link: https://commits.webkit.org/318132@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
