Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a88a607d357e17b158c318100fac93ce2407c2b1
https://github.com/WebKit/WebKit/commit/a88a607d357e17b158c318100fac93ce2407c2b1
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-21 (Tue, 21 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/array-buffer-is-view.js
A JSTests/stress/array-buffer-is-view.js
M Source/JavaScriptCore/builtins/BuiltinNames.h
M Source/JavaScriptCore/bytecode/SpeculatedType.cpp
M Source/JavaScriptCore/bytecode/SpeculatedType.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOpInfo.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
M Source/JavaScriptCore/runtime/JSCast.h
M Source/JavaScriptCore/runtime/JSType.h
Log Message:
-----------
[JSC] Inline `ArrayBuffer.isView` in DFG/FTL by extending `IsCellWithType` to
a JSType range
https://bugs.webkit.org/show_bug.cgi?id=319796
Reviewed by Yusuke Suzuki.
ArrayBuffer.isView had no intrinsic, so DFG/FTL emitted a host function call
for it.
This patch adds ArrayBufferIsViewIntrinsic and inlines it as IsCellWithType,
which now takes a JSTypeRange instead of a single JSType. ArrayBuffer.isView
is IsCellWithType[Int8ArrayType, DataViewType] and @isTypedArrayView is
IsCellWithType[Int8ArrayType, BigUint64ArrayType], so the IsTypedArrayView
node is removed and both get the folding, CSE and CellUse fixup that
IsCellWithType already had. speculationFromJSTypeRange unions the range so
that the type based folding still applies.
@isView, the private name alias of ArrayBuffer.isView, has no user and is
removed.
Baseline Patched
array-buffer-is-view 48.8141+-0.8753 ^ 32.3578+-0.2090 ^
definitely 1.5086x faster
Tests: JSTests/microbenchmarks/array-buffer-is-view.js
JSTests/stress/array-buffer-is-view.js
* JSTests/microbenchmarks/array-buffer-is-view.js: Added.
(isView):
* JSTests/stress/array-buffer-is-view.js: Added.
(shouldBe):
(DerivedUint8Array):
(DerivedDataView):
(new.Proxy.new.Uint8Array):
(isViewOfTypedArray):
(isViewOfDataView):
(isViewOfArrayBuffer):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp:
(JSC::JSGenericArrayBufferConstructor<sharingMode>::finishCreation):
Canonical link: https://commits.webkit.org/317660@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
