Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1a0160315f98d0eb6f2e7df4f039d1094273c4ee
https://github.com/WebKit/WebKit/commit/1a0160315f98d0eb6f2e7df4f039d1094273c4ee
Author: Sosuke Suzuki <[email protected]>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
A JSTests/microbenchmarks/regexp-split-digit-cached.js
A JSTests/microbenchmarks/regexp-split-digit-literal.js
A JSTests/microbenchmarks/string-split-comma-short.js
A JSTests/microbenchmarks/string-split-slash-short.js
M Source/JavaScriptCore/builtins/BuiltinNames.h
M Source/JavaScriptCore/builtins/StringPrototype.js
M Source/JavaScriptCore/bytecode/LinkTimeConstant.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGCloneHelper.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.h
M Source/JavaScriptCore/dfg/DFGJITCode.cpp
M Source/JavaScriptCore/dfg/DFGJITCode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/RegExpObject.h
M Source/JavaScriptCore/runtime/RegExpObjectInlines.h
M Source/JavaScriptCore/runtime/RegExpPrototype.cpp
M Source/JavaScriptCore/runtime/RegExpPrototype.h
M Source/JavaScriptCore/runtime/StringPrototype.cpp
M Source/JavaScriptCore/runtime/StringPrototype.h
Log Message:
-----------
[JSC] Implement `String#split` in C++
https://bugs.webkit.org/show_bug.cgi?id=314009
Reviewed by Yusuke Suzuki.
Move String.prototype.split from a JS builtin to a C++ host function and add
a StringSplit DFG node. The node does not inline anything itself; it just
dispatches to operationStringSplit (string separator) or
operationStringSplitRegExp (primordial RegExp separator).
To make the RegExp fast path safe, splitSymbol is added to
regExpPrimordialPropertiesWatchpointSet, m_stringSymbolSplitWatchpointSet
is introduced (mirroring the replace counterpart), and
m_regExpSpeciesWatchpointSet is added so an override of
RegExp[Symbol.species] invalidates the shortcut. Per-instance @@split
overrides are caught by the existing structure check in
isSymbolSplitFastAndNonObservable.
TipOfTree Patched
regexp-split-digit-literal 83.6760+-2.5457 ^ 74.9740+-1.7527
^ definitely 1.1161x faster
regexp-split-digit-cached 86.0425+-1.5091 ^ 76.5833+-1.9675
^ definitely 1.1235x faster
string-split-slash-short 93.2927+-3.7145 ^ 76.8576+-0.6003
^ definitely 1.2138x faster
string-split-comma-short 96.1436+-6.8025 ^ 77.8741+-1.0157
^ definitely 1.2346x faster
Tests: JSTests/microbenchmarks/regexp-split-digit-cached.js
JSTests/microbenchmarks/regexp-split-digit-literal.js
JSTests/microbenchmarks/string-split-comma-short.js
JSTests/microbenchmarks/string-split-slash-short.js
* JSTests/microbenchmarks/regexp-split-digit-cached.js: Added.
(split):
* JSTests/microbenchmarks/regexp-split-digit-literal.js: Added.
(split):
* JSTests/microbenchmarks/string-split-comma-short.js: Added.
(split):
* JSTests/microbenchmarks/string-split-slash-short.js: Added.
(split):
* Source/JavaScriptCore/builtins/BuiltinNames.h:
* Source/JavaScriptCore/builtins/StringPrototype.js:
(split): Deleted.
* Source/JavaScriptCore/bytecode/LinkTimeConstant.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGCloneHelper.h:
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGJITCode.cpp:
(JSC::DFG::JITData::JITData):
(JSC::DFG::JITData::tryInitialize):
* Source/JavaScriptCore/dfg/DFGJITCode.h:
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileStringSplit):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
* Source/JavaScriptCore/runtime/RegExpObject.h:
* Source/JavaScriptCore/runtime/RegExpObjectInlines.h:
(JSC::RegExpObject::isSymbolReplaceFastAndNonObservable):
(JSC::RegExpObject::isSymbolSplitFastAndNonObservable):
* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:
(JSC::regExpSplitFast):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/RegExpPrototype.h:
* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
(JSC::stringSplitFast):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/StringPrototype.h:
Canonical link: https://commits.webkit.org/312843@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
