Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 54277a51f596fb85427058a5df880af83de657f6
https://github.com/WebKit/WebKit/commit/54277a51f596fb85427058a5df880af83de657f6
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-13 (Sun, 13 Sep 2026)
Changed paths:
A JSTests/microbenchmarks/get-by-val-single-identifier-non-atom-key.js
A JSTests/stress/by-val-single-identifier-non-atom-key-recompile.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] `by-val` accesses should not loop on `BadStringType` OSR exits
https://bugs.webkit.org/show_bug.cgi?id=323839
Reviewed by Yusuke Suzuki.
When the Baseline IC of get_by_val, put_by_val, in_by_val or del_by_val has
seen exactly one identifier, DFG compiles the access as CheckIdent plus a
by-id access. CheckIdent speculates StringIdent, so a non-atom string key,
such as name.toLowerCase() of a mixed-case header name in Express's
req.get(), fails it with a BadStringType exit. The parser only looks for
BadIdent, BadType and BadConstantValue exit sites before taking this path,
so each recompilation plants the same CheckIdent and exits again on the next
non-atom key, forever.
This patch also checks for BadStringType exit sites there, as FixupPhase
already does before choosing StringIdentUse, so the access falls back to a
generic by-val access after the first exit.
Running JetStream3 locally, BadStringType exits in WSL's valueForSelectedType
(type["formatValueFrom" + config.literalClassName]) went from 1402 to 201,
and the score did not change.
base
patched
get-by-val-single-identifier-non-atom-key
56.9910+-0.8449 ^
7.0980+-0.2008 ^ definitely 8.0292x faster
Tests: JSTests/microbenchmarks/get-by-val-single-identifier-non-atom-key.js
JSTests/stress/by-val-single-identifier-non-atom-key-recompile.js
* JSTests/microbenchmarks/get-by-val-single-identifier-non-atom-key.js: Added.
(header):
* JSTests/stress/by-val-single-identifier-non-atom-key-recompile.js: Added.
(getHeader):
(putHeader):
(hasHeader):
(deleteHeader):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handlePutByVal):
Canonical link: https://commits.webkit.org/321033@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
