Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d1c8801fc607be347c0e8bf1584b5f1df22f831a
https://github.com/WebKit/WebKit/commit/d1c8801fc607be347c0e8bf1584b5f1df22f831a
Author: Yusuke Suzuki <[email protected]>
Date: 2025-03-13 (Thu, 13 Mar 2025)
Changed paths:
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Log Message:
-----------
[JSC] Do not need to sign extend for StrictInt32 value in DFG when large
typed array size is constant and <= INT32_MAX
https://bugs.webkit.org/show_bug.cgi?id=289731
rdar://146978994
Reviewed by Justin Michaud.
The input is StrictInt32 (upper bits are zeros). So when large typed
array's length is constant and it is within int32_t range, we can just
use branch32 and we do not need sign extension.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
Canonical link: https://commits.webkit.org/292124@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
