Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 24f0a336557e9618836f7025396888bc42f25ff1
https://github.com/WebKit/WebKit/commit/24f0a336557e9618836f7025396888bc42f25ff1
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
A JSTests/stress/jsstring-definitely-atom-bit.js
M Source/JavaScriptCore/bytecode/SpeculatedType.cpp
M Source/JavaScriptCore/bytecode/SpeculatedType.h
M Source/JavaScriptCore/bytecode/ValueProfile.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.h
M Source/JavaScriptCore/jit/JITOpcodes.cpp
M Source/JavaScriptCore/runtime/JSString.h
M Source/JavaScriptCore/runtime/JSStringInlines.h
M Source/JavaScriptCore/tools/JSDollarVM.cpp
Log Message:
-----------
[JSC] Add JSString::isDefinitelyAtom
https://bugs.webkit.org/show_bug.cgi?id=322536
rdar://185830225
Reviewed by Keith Miller.
This patch uses JSString's perCellBit for `isDefinitelyAtom` flag. This
indicates that this JSString is *definitely* having AtomStringImpl
without querying to the actual AtomStringImpl content. This flag can be
false-negative: it can be not-set even if JSString is actually holding
AtomStringImpl because one StringImpl can be held by multiple different
JSString* and one may upgrade it to AtomStringImpl in-place. But this
flag is totally fine as the invariant is "when it is saying true, then
JSString is holding AtomStringImpl*. Otherwise, unknown, it may have
AtomStringImpl or not".
By using this flag, we replace our speculationFromCell code to use this
flag instead of looking into AtomStringImpl* actually. This resolves
memory ordering issue around ValueProfile in a conservative way. It may
say wrong result, but since it is speculation, anyway, it is fine.
Test: JSTests/stress/jsstring-definitely-atom-bit.js
* JSTests/stress/jsstring-definitely-atom-bit.js: Added.
(shouldBe):
(set makeString):
(makeRope):
(exercise):
* Source/JavaScriptCore/bytecode/SpeculatedType.cpp:
(JSC::speculationFromCellImpl):
(JSC::speculationFromCell):
(JSC::speculationFromValueImpl):
(JSC::speculationFromValue):
(JSC::speculationFromValueForProfiling):
* Source/JavaScriptCore/bytecode/SpeculatedType.h:
* Source/JavaScriptCore/bytecode/ValueProfile.h:
(JSC::ValueProfileBase::dump):
(JSC::ValueProfileBase::computeUpdatedPrediction):
(JSC::ValueProfileBase::computeUpdatedPredictionForExtraValue):
(JSC::ValueProfileBase::classInfo const): Deleted.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::loadCacheableIdentifierImpl):
* Source/JavaScriptCore/jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::branchIfNotAtomStringImpl):
* Source/JavaScriptCore/jit/JITOpcodes.cpp:
(JSC::JIT::compileOpStrictEq):
* Source/JavaScriptCore/runtime/JSString.h:
(JSC::JSString::typeInfoBlobForAtomness):
(JSC::JSString::JSString):
(JSC::JSString::isDefinitelyAtom const):
(JSC::JSString::markAsAtom const):
(JSC::JSString::existingAtomOrNull const):
(JSC::JSString::swapToAtomString const):
(JSC::JSString::toIdentifier const):
(JSC:: const):
* Source/JavaScriptCore/runtime/JSStringInlines.h:
(JSC::JSRopeString::convertToNonRope const):
(JSC::jsAtomString):
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::JSDollarVM::finishCreation):
Canonical link: https://commits.webkit.org/319852@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
