Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7fbbbd1f450b34c85e0ad90024af44dcf1ef2802
https://github.com/WebKit/WebKit/commit/7fbbbd1f450b34c85e0ad90024af44dcf1ef2802
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-10 (Sat, 10 Oct 2026)
Changed paths:
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Remove redundant work from FTL object and array access lowering
https://bugs.webkit.org/show_bug.cgi?id=327078
rdar://189684727
Reviewed by Sosuke Suzuki.
Do several optimizations in FTL lowering in object and array access.
1. compileMultiGetByOffset and compileMultiPutByOffset load the butterfly once
before the structure switch when every case reads or replaces an out-of-line
property of the base, instead of once in each case.
2. compileMatchStructure with a proven structure set emits a compare against
the smaller of the true and false structure sets (or a constant) instead of
a switch feeding a phi of constants.
3. compileSpread with a structure check skips the indexing shape check because
every structure in originalArrayShapesForSpread has an Int32, Double, or
Contiguous shape.
4. compileGetByValImpl for an out-of-bounds Double array read with a double
result no longer branches on NaN in bounds. That combination implies
out-of-bounds sane chain, where a hole yields PNaN, which is what a hole
slot already holds.
5. compileGetMyArgumentByVal folds the +1 for |this| into the address offset.
6. compileDelBy tested `if (child1UseKind)`, which is true for every use kind
but UntypedUse, so it emitted a not-cell check on a base known to be a cell.
7. compileArrayPop for ArrayStorage drops an anchor in a block that never
reaches the phi.
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOfOrArrayIncludes):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
(JSC::FTL::DFG::LowerDFGToB3::compileSpread):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMatchStructure):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/323372@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
