Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 114fe5786783fb5548a3ef7f76c30443e0c330e2
https://github.com/WebKit/WebKit/commit/114fe5786783fb5548a3ef7f76c30443e0c330e2
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
A JSTests/stress/ftl-arithmetic-and-type-check-lowering.js
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Tighten FTL arith and comparison ops
https://bugs.webkit.org/show_bug.cgi?id=327146
rdar://189739207
Reviewed by Dan Hecht.
This applies bulk clean up of FTL code around arith and comparison ops.
Focusing on reducing micro-basic-blocks as as they hurt CPU's prediction
severely.
1. genericJSValueCompare tests both operands for int32 at once through the new
areNotBothInt32. A boxed int32 has every bit of the number tag set, so both
are int32 exactly when their AND is.
2. compileArithMul merges its two negative-zero checks into one test on the OR
of the operands, and compileArithDiv and compileArithMod merge their two
overflow checks, leaving one OSR exit each.
3. unboxBoolean produces an Int32 BitAnd with 1, which B3 knows is 0 or 1, and
boxBoolean adds ValueFalse to such a value instead of selecting between two
constants.
4. intValueToTypedArrayStoreOperand clamps for Uint8ClampedArray with selects
instead of a branch.
5. compileToLength returns its argument as is when it is a non-negative int32
instead of unboxing and reboxing it, and numberOrNotCellNorBigIntToInt32
uses the comparison result directly instead of selecting 1 or 0.
6. isNotAnyBigInt and speculateNeitherDoubleNorHeapBigIntNorString pass type
information already established by earlier checks to the later ones.
7. speculateRealNumber type-checked m_node->child1() instead of the edge it was
given. RealNumberUse is only on child1 today, so this was latent.
Test: JSTests/stress/ftl-arithmetic-and-type-check-lowering.js
* JSTests/stress/ftl-arithmetic-and-type-check-lowering.js: Added.
(shouldBe):
(storeClamped):
(lessThan):
(mul):
(div):
(mod):
(not):
(boxCompare):
(sloppyThis):
(callSloppyThis):
(lastIndexOf):
(i.String):
(i.let.receiver):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileToThis):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
(JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/323647@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
