Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 158fbd182b79b51d1fd1c2901d2c722a14079bb7
https://github.com/WebKit/WebKit/commit/158fbd182b79b51d1fd1c2901d2c722a14079bb7
Author: Sosuke Suzuki <[email protected]>
Date: 2026-02-03 (Tue, 03 Feb 2026)
Changed paths:
A JSTests/microbenchmarks/generator-object-sinking.js
A JSTests/stress/async-generator-function-declaration-sinking-osrexit.js
A JSTests/stress/async-generator-object-sinking-osrexit.js
A JSTests/stress/generator-object-sinking-osrexit.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/ftl/FTLOperations.cpp
M Source/JavaScriptCore/runtime/JSAsyncGenerator.cpp
M Source/JavaScriptCore/runtime/JSAsyncGenerator.h
M Source/JavaScriptCore/runtime/JSGenerator.cpp
M Source/JavaScriptCore/runtime/JSGenerator.h
Log Message:
-----------
[JSC] Unify NewGenerator and NewAsyncGenerator into NewInternalFieldObject
https://bugs.webkit.org/show_bug.cgi?id=306232
Reviewed by Yusuke Suzuki.
This patch removes the separate DFG node types NewGenerator and
NewAsyncGenerator,
and instead uses NewInternalFieldObject with dispatch based on JSType
(JSGeneratorType/JSAsyncGeneratorType) at compile time.
This unification:
1. Reduces code duplication across DFG and FTL
2. Simplifies the node type hierarchy
3. Enables allocation sinking for generator objects through the existing
InternalFieldObject infrastructure
TipOfTree Patched
generator-object-sinking 8.8991+-0.1698 ^ 2.2616+-0.1200
^ definitely 3.9349x faster
Tests: JSTests/microbenchmarks/generator-object-sinking.js
JSTests/stress/async-generator-function-declaration-sinking-osrexit.js
JSTests/stress/async-generator-object-sinking-osrexit.js
JSTests/stress/generator-object-sinking-osrexit.js
* JSTests/microbenchmarks/generator-object-sinking.js: Added.
(gen):
(test):
* JSTests/stress/async-generator-function-declaration-sinking-osrexit.js: Added.
(shouldBe):
(shouldBeAsyncValue):
(AsyncGeneratorFunctionPrototype):
(async g):
(async f):
(sink):
(async __proto__):
* JSTests/stress/async-generator-object-sinking-osrexit.js: Added.
(shouldBe):
(shouldBeAsyncValue):
(async gen):
(sink):
* JSTests/stress/generator-object-sinking-osrexit.js: Added.
(shouldBe):
(gen):
(sink):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp:
(JSC::DFG::clobbersExitState):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::convertToNewInternalFieldObject):
(JSC::DFG::Node::hasStructure):
(JSC::DFG::Node::convertToNewInternalFieldObjectWithInlineFields): Deleted.
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp:
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileNewGenerator): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileNewAsyncGenerator): Deleted.
* Source/JavaScriptCore/ftl/FTLOperations.cpp:
(JSC::FTL::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/runtime/JSAsyncGenerator.cpp:
(JSC::JSAsyncGenerator::createWithInitialValues):
* Source/JavaScriptCore/runtime/JSAsyncGenerator.h:
* Source/JavaScriptCore/runtime/JSGenerator.cpp:
(JSC::JSGenerator::create):
(JSC::JSGenerator::createWithInitialValues):
* Source/JavaScriptCore/runtime/JSGenerator.h:
Canonical link: https://commits.webkit.org/306701@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
