Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2b0e50239ab5a1a9bc9ab066de1aa7616a67f630
https://github.com/WebKit/WebKit/commit/2b0e50239ab5a1a9bc9ab066de1aa7616a67f630
Author: Andrew Gaul <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
Log Message:
-----------
[JSC] Fold the string-impl hash shift into the megamorphic cache hash add
https://bugs.webkit.org/show_bug.cgi?id=322496
Reviewed by Yusuke Suzuki.
The inline megamorphic property cache lookup and the DFG HasOwnPropertyCache
lookup both recompute UniquedStringImpl::hash() by loading the flags word and
shifting out StringImpl::s_flagCount low bits, then adding the result into the
running hash. Emitting that as a standalone urshift32() followed by add32()
leaves an arm64 pair that the assembler can express as a single shifted-register
add:
lsr w5, w5, #8
add w6, w6, w5
becomes
add w6, w6, w5, lsr #8
MacroAssembler::addUnsignedRightShift32() already exists on every 64-bit
backend, and AssemblyHelpers already uses it a few lines later for the secondary
hash (key + (key >> structureIDHashShift3)), so this just closes the gap for the
uid half. The x86_64 and RISCV64 implementations expand to the same two
instructions they emitted before, so nothing regresses there.
Profiling JetStream 3 with armlint found 2454 of these unfolded pairs across the
generated code: 1648 in DFG, 699 in FTL and 107 in inline caches. Every one of
them is a shift by StringImpl::s_flagCount, which is 8.
Found with armlint.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileHasOwnProperty):
* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::findMegamorphicCacheEntry):
(JSC::AssemblyHelpers::storeMegamorphicProperty):
(JSC::AssemblyHelpers::hasMegamorphicProperty):
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Canonical link: https://commits.webkit.org/319825@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
