Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 83683abb036df547c679bd13ee7bca7ff64df9f9
https://github.com/WebKit/WebKit/commit/83683abb036df547c679bd13ee7bca7ff64df9f9
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-05 (Sat, 05 Sep 2026)
Changed paths:
A JSTests/microbenchmarks/regexp-test-inline-quantifier.js
A JSTests/microbenchmarks/regexp-test-inline-unicode-sets.js
A JSTests/microbenchmarks/regexp-test-inline-unicode.js
A JSTests/stress/regexp-test-inline-empty-iteration-punts-to-interpreter.js
A JSTests/stress/regexp-test-inline-frame-in-outgoing-argument-area.js
A JSTests/stress/regexp-test-inline-unicode-and-quantifiers.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/StackAlignment.h
M Source/JavaScriptCore/yarr/YarrJIT.cpp
M Source/JavaScriptCore/yarr/YarrJIT.h
Log Message:
-----------
[JSC] Inline `RegExp#test` for unicode patterns and patterns with a Yarr frame
https://bugs.webkit.org/show_bug.cgi?id=322949
Reviewed by Yusuke Suzuki.
RegExpTestInline emits the Yarr matcher for 8-bit strings directly into
DFG/FTL code, but it refuses any pattern whose terms need Yarr frame slots for
backtracking. That is every quantifier and alternation and, with the u or v
flag, every character class, so almost no real pattern is inlined. The Yarr
frame is addressed relative to the frame pointer, which only works inside
Yarr's own function frame, and the u/v flags are excluded on top of that even
though the 8-bit matcher does not decode surrogate pairs.
The inlined matcher calls nothing, so the outgoing-argument area at the bottom
of the DFG/FTL frame is free while it runs. This patch places the Yarr frame
there: DFG and FTL reserve the frame size in that area, and in
ExecutionMode::InlineTest the frame is addressed relative to the stack pointer.
The function's own stack check covers the reservation, so the inlined code
neither moves the stack pointer nor checks the stack limit. With frames
available, the unicode exclusions are dropped.
Baseline Patched
regexp-test-inline-quantifier 18.6940+-0.1085 ^ 10.7594+-0.1545
^ definitely 1.7375x faster
regexp-test-inline-unicode-sets 18.8223+-0.0938 ^ 11.6284+-0.1800
^ definitely 1.6186x faster
regexp-test-inline-unicode 18.6505+-0.1107 ^ 10.9138+-0.1957
^ definitely 1.7089x faster
Tests: JSTests/microbenchmarks/regexp-test-inline-quantifier.js
JSTests/microbenchmarks/regexp-test-inline-unicode-sets.js
JSTests/microbenchmarks/regexp-test-inline-unicode.js
JSTests/stress/regexp-test-inline-frame-in-outgoing-argument-area.js
JSTests/stress/regexp-test-inline-unicode-and-quantifiers.js
* JSTests/microbenchmarks/regexp-test-inline-quantifier.js: Added.
(isLowerAlpha):
* JSTests/microbenchmarks/regexp-test-inline-unicode-sets.js: Added.
(isLowerLetter):
* JSTests/microbenchmarks/regexp-test-inline-unicode.js: Added.
(isLowerAlpha):
* JSTests/stress/regexp-test-inline-frame-in-outgoing-argument-area.js: Added.
(shouldBe):
(callee):
(test):
* JSTests/stress/regexp-test-inline-unicode-and-quantifiers.js: Added.
(shouldBe):
(makeTest):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileRegExpTestInline):
* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/StackAlignment.h:
(JSC::argumentCountForStackSize): Deleted.
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
(JSC::Yarr::jitCompileInlinedTest):
* Source/JavaScriptCore/yarr/YarrJIT.h:
Canonical link: https://commits.webkit.org/320559@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
