Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 465d5ab28c60bc2521fb30cdce3c68dc289f5d71
https://github.com/WebKit/WebKit/commit/465d5ab28c60bc2521fb30cdce3c68dc289f5d71
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-03 (Mon, 03 Aug 2026)
Changed paths:
A JSTests/microbenchmarks/string-substring-empty.js
A JSTests/microbenchmarks/string-substring-multi-chars.js
A JSTests/microbenchmarks/string-substring-no-end.js
A JSTests/microbenchmarks/string-substring-one-char.js
A JSTests/microbenchmarks/string-substring-reversed.js
A JSTests/stress/string-substring-jit-constant-indices.js
A JSTests/stress/string-substring-jit.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Inline `String#substring` in DFG/FTL
https://bugs.webkit.org/show_bug.cgi?id=320045
Reviewed by Yusuke Suzuki.
StringSubstring was always lowered to operationStringSubstring(WithEnd) in
both tiers, while its siblings StringSlice and StringSubstr have inline fast
paths.
substring only differs from slice in how the range is computed: a negative
index clamps to 0 instead of counting from the end, and the range is reversed
when start is greater than end. Clamping is monotonic, so the indices can be
ordered before it, which lets B3 fold the ordering away for constant indices.
This patch computes that range inline and shares the rest of the lowering with
StringSlice in compileStringSliceOrSubstring, so substring now gets the empty
string, single character, whole string and inline substring rope fast paths
that slice already had.
Baseline Patched
string-substring-one-char 6.2668+-0.1659 ^ 3.0261+-0.0439
^ definitely 2.0709x faster
string-substring-no-end 6.6585+-0.1495 ^ 3.8226+-0.0724
^ definitely 1.7419x faster
string-substring-multi-chars 6.9944+-0.1302 ^ 4.1724+-0.0762
^ definitely 1.6763x faster
string-substring-reversed 6.9336+-0.1514 ^ 4.2162+-0.0876
^ definitely 1.6445x faster
string-substring-empty 4.1059+-0.0706 ^ 2.5331+-0.0572
^ definitely 1.6209x faster
Tests: JSTests/microbenchmarks/string-substring-empty.js
JSTests/microbenchmarks/string-substring-multi-chars.js
JSTests/microbenchmarks/string-substring-no-end.js
JSTests/microbenchmarks/string-substring-one-char.js
JSTests/microbenchmarks/string-substring-reversed.js
JSTests/stress/string-substring-jit-constant-indices.js
JSTests/stress/string-substring-jit.js
* JSTests/microbenchmarks/string-substring-empty.js: Added.
(substring):
* JSTests/microbenchmarks/string-substring-multi-chars.js: Added.
(substring):
* JSTests/microbenchmarks/string-substring-no-end.js: Added.
(substring):
* JSTests/microbenchmarks/string-substring-one-char.js: Added.
(substring):
* JSTests/microbenchmarks/string-substring-reversed.js: Added.
(substring):
* JSTests/stress/string-substring-jit-constant-indices.js: Added.
(shouldBe):
(reversed):
(negative):
(huge):
(tail):
* JSTests/stress/string-substring-jit.js: Added.
(shouldBe):
(substring):
(substringNoEnd):
(makeRope):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileStringSliceOrSubstring):
(JSC::DFG::SpeculativeJIT::compileStringSlice): Deleted.
(JSC::DFG::SpeculativeJIT::compileStringSubstring): Deleted.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::populateSubstringRange):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/318448@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
