Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 89be2da97f720db0fec908746d1cfe3a3c56c91c
https://github.com/WebKit/WebKit/commit/89be2da97f720db0fec908746d1cfe3a3c56c91c
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/string-charcodeat-out-of-bounds-lookahead.js
A JSTests/stress/string-charcodeat-cse-array-mode.js
A JSTests/stress/string-charcodeat-out-of-bounds-constant-folding.js
A JSTests/stress/string-charcodeat-out-of-bounds-mode.js
A JSTests/stress/string-charcodeat-out-of-bounds-uses.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGMayExit.cpp
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Add OOB mode to `StringCharCodeAt` node in DFG/FTL
https://bugs.webkit.org/show_bug.cgi?id=319928
Reviewed by Yusuke Suzuki.
When the inlined StringCharCodeAt hits an out-of-bounds index, it OSR exits
(Uncountable in
DFG, OutOfBounds in FTL), and once that exit site is recorded the bytecode
parser never inlines
that call site again, leaving a generic Call forever.
This patch does what StringAt already does: the in-bounds code exits with
OutOfBounds, and when
that exit site is present the bytecode parser emits StringCharCodeAt in an
out-of-bounds mode that
performs the length check inline and returns NaN.
Since charCodeAt returns NaN for out-of-bounds indices, the out-of-bounds mode
uses
NodeResultDouble.
Baseline
Patched
string-at-char-code-at 9.0700+-0.2991
9.0434+-0.2745
string-char-code-at 2.3423+-0.1432
2.3154+-0.1080 might be 1.0116x faster
string-codePointAt-constant-folding 0.8742+-0.0722
0.8419+-0.0475 might be 1.0384x faster
string-charcodeat-out-of-bounds-lookahead
10.8058+-0.2333 ^
4.8701+-0.2511 ^ definitely 2.2188x faster
Tests: JSTests/microbenchmarks/string-charcodeat-out-of-bounds-lookahead.js
JSTests/stress/string-charcodeat-cse-array-mode.js
JSTests/stress/string-charcodeat-out-of-bounds-constant-folding.js
JSTests/stress/string-charcodeat-out-of-bounds-mode.js
JSTests/stress/string-charcodeat-out-of-bounds-uses.js
* JSTests/microbenchmarks/string-charcodeat-out-of-bounds-lookahead.js: Added.
(scan):
* JSTests/stress/string-charcodeat-cse-array-mode.js: Added.
(shouldBe):
(opt):
* JSTests/stress/string-charcodeat-out-of-bounds-constant-folding.js: Added.
(shouldBe):
(charCodeAt):
(foldedInRange):
(foldedOutOfRange):
* JSTests/stress/string-charcodeat-out-of-bounds-mode.js: Added.
(shouldBe):
(charCodeAt):
* JSTests/stress/string-charcodeat-out-of-bounds-uses.js: Added.
(shouldBe):
(bitOr):
(bitAnd):
(plusOne):
(isSlash):
(isNaNResult):
(switchOn):
(rope):
(anyIndex):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
Canonical link: https://commits.webkit.org/317823@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
