Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e7acf9bf3a6ae415055712cb92c482fea713a863
https://github.com/WebKit/WebKit/commit/e7acf9bf3a6ae415055712cb92c482fea713a863
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-15 (Thu, 15 Oct 2026)
Changed paths:
A JSTests/microbenchmarks/for-of-map-set-mixed.js
A JSTests/stress/for-await-of-mixed-iteration-modes.js
A JSTests/stress/for-of-mixed-iteration-modes-should-not-keep-exiting.js
A JSTests/stress/for-of-mixed-iteration-modes.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGOpInfo.h
Log Message:
-----------
[JSC] DFG iterator open fast paths should pass `JSTypeRange` to
`IsCellWithType`
https://bugs.webkit.org/show_bug.cgi?id=327661
Reviewed by Yusuke Suzuki.
Since 317660@main, IsCellWithType takes a JSTypeRange. Five callers in
handleIteratorOpen and handleAsyncIteratorOpen still pass a bare JSType.
`OpInfo(JSMapType)` compiles via the constructor for enums and is read back
as the empty range { JSMapType, 0 }, so the abstract interpreter folds the
check to false and the fast path is removed.
These checks are emitted only when the site has seen more than one iteration
mode. For example, when a for-of has seen Maps and Sets, a Map falls through
to the check for Sets, which is the last one, and causes an OSR exit every time.
This patch passes a JSTypeRange in these callers, and deletes `OpInfo(JSType)`
so that the same mistake does not compile.
Tests: JSTests/microbenchmarks/for-of-map-set-mixed.js
JSTests/stress/for-await-of-mixed-iteration-modes.js
JSTests/stress/for-of-mixed-iteration-modes-should-not-keep-exiting.js
JSTests/stress/for-of-mixed-iteration-modes.js
* JSTests/microbenchmarks/for-of-map-set-mixed.js: Added.
(test):
(const.set new):
* JSTests/stress/for-await-of-mixed-iteration-modes.js: Added.
(shouldBe):
(makeSite):
* JSTests/stress/for-of-mixed-iteration-modes-should-not-keep-exiting.js: Added.
(shouldBe):
(makeSite):
* JSTests/stress/for-of-mixed-iteration-modes.js: Added.
(shouldBe):
(fold):
(reference):
(run):
(makeSite):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIteratorOpen):
(JSC::DFG::ByteCodeParser::handleAsyncIteratorOpen):
* Source/JavaScriptCore/dfg/DFGOpInfo.h:
Canonical link: https://commits.webkit.org/323817@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
