Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 16828c4bb03fe7c335c5fbbd883c8516f4018821
https://github.com/WebKit/WebKit/commit/16828c4bb03fe7c335c5fbbd883c8516f4018821
Author: Keith Miller <[email protected]>
Date: 2026-06-17 (Wed, 17 Jun 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT.h
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
M Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Log Message:
-----------
[Wasm] Function parser's expression stack should be a single buffer
https://bugs.webkit.org/show_bug.cgi?id=316500
rdar://178951229
Reviewed by Yusuke Suzuki.
The wasm function parser previously tracked the operand stack as one
Vector<TypedExpression> per active control block. On every Block/Loop/If/Try
the parent's live values were moved into the new ControlEntry's
enclosedExpressionStack, m_expressionStack was rewritten to hold just the new
block's arguments, and End swapped the parent's slice back. With deeply nested
control flow this meant N live Vectors for N active entries, plus a copy on
each push and a swap-and-destroy on each pop.
Replace the per-block storage with a single contiguous m_expressionStack shared
by every active control block, plus an m_currentStackBegin offset marking
where the innermost block's slice starts. ControlEntry now stores just one
uint32_t enclosedStackBegin recording the parent's begin offset. Any of the
generator functions that took a stack before now take a `std::span` into the
relevant stack segment.
The only place still using a Vector to hold stack data is when there's an
if-else block. In JetStream 3 no function ever passes stack arguments into
the else block. The else block is also itself rare 87% of ifs don't have one.
I also looked at the max stack depth of functions in JS3 and the P99 depth
is 15 so the current inline capacity of 15 should cover nearly all functions.
No new tests, no behavior change. Covered by existing tests.
Canonical link: https://commits.webkit.org/315376@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
