Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c3148b98af66fac9749148b3d02d350f9bc8d2c1
https://github.com/WebKit/WebKit/commit/c3148b98af66fac9749148b3d02d350f9bc8d2c1
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
A JSTests/wasm/stress/omg-inlined-constant-conditions.js
M Source/JavaScriptCore/b3/B3ReduceStrength.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_5.cpp
M Source/JavaScriptCore/ftl/FTLOutput.cpp
M Source/JavaScriptCore/ftl/FTLOutput.h
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Log Message:
-----------
[JSC] Quick simplification of B3 graph at frontend
https://bugs.webkit.org/show_bug.cgi?id=325097
rdar://188252497
Reviewed by Vassili Bykov.
It is actually quite common that we already have a constant when
generating a branch.
1. In FTL case, provenType can make condition true / false at compile
time inside each DFG node, so this can happen very frequently.
2. In OMG, when inlining happens, constant value argument is passed to
the inlinee, and branch with that can be fold easily at the frontend.
Thus, this patch adds very easy frontend level branch pruning based on
constant condition. The main goal here is reducing the heaviness of the
task in B3::ReduceStrength and others by offering already simplified CFG.
We also add "Switch" constant folding code as well in ReduceStrength,
which is the same to what we have for "Branch".
This change also revealed the existing validation-only bug that we were
not properly clearing successors / predecessors when Check(1)
gets converted to forced failure. It is possible that the last terminal
value was Patchpoint which can generate a value. Thus, let's convert all
values to Bottom first, and insert a new exit value at the end.
Tests: JSTests/wasm/stress/omg-inlined-constant-conditions.js
Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_5.cpp
* JSTests/wasm/stress/omg-inlined-constant-conditions.js: Added.
(expected):
(async test):
* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_5.cpp:
(testCheckTrueBeforeTerminalWithResult):
(testSwitchOnConstant):
* Source/JavaScriptCore/ftl/FTLOutput.cpp:
(JSC::FTL::Output::branch):
* Source/JavaScriptCore/ftl/FTLOutput.h:
(JSC::FTL::Output::switchInstruction):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::addLocal):
(JSC::Wasm::OMGIRGenerator::addInlinedArguments):
(JSC::Wasm::OMGIRGenerator::addArguments):
(JSC::Wasm::OMGIRGenerator::getLocal):
(JSC::Wasm::OMGIRGenerator::setLocal):
(JSC::Wasm::OMGIRGenerator::teeLocal):
(JSC::Wasm::OMGIRGenerator::addSelect):
(JSC::Wasm::OMGIRGenerator::addLoop):
(JSC::Wasm::OMGIRGenerator::addIf):
(JSC::Wasm::OMGIRGenerator::addBranch):
(JSC::Wasm::OMGIRGenerator::addSwitch):
Canonical link: https://commits.webkit.org/321779@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
