Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8f6bc9a16adff49552c9c5b5d5cce0a2388f8834
https://github.com/WebKit/WebKit/commit/8f6bc9a16adff49552c9c5b5d5cce0a2388f8834
Author: Yusuke Suzuki <[email protected]>
Date: 2026-06-09 (Tue, 09 Jun 2026)
Changed paths:
A JSTests/stress/multi-get-by-val-mixed-dfg.js
A JSTests/stress/multi-get-by-val-mixed-oob-dfg.js
A JSTests/stress/multi-get-by-val-sane-chain-oob-dfg.js
A JSTests/stress/multi-put-by-val-mixed-dfg.js
A JSTests/stress/multi-put-by-val-oob-dfg.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Log Message:
-----------
[JSC] Add DFG MultiGetByVal and MultiPutByVal
https://bugs.webkit.org/show_bug.cgi?id=315832
rdar://178232333
Reviewed by Yijia Huang.
This patch
implements MultiGetByVal / MultiPutByVal in DFG.
They are already implemented in FTL, so basically importing the
implementation from FTL to DFG. The key difference is that we are not
supporting Int32Result and Int52Result since they are annotated in
DFG ValueRep phase which runs only on FTL. So we only support JSResults
or DoubleResult.
* JSTests/stress/multi-get-by-val-mixed-dfg.js: Added.
(shouldBe):
(test):
* JSTests/stress/multi-get-by-val-mixed-oob-dfg.js: Added.
(shouldBe):
(test):
* JSTests/stress/multi-get-by-val-sane-chain-oob-dfg.js: Added.
(shouldBe):
(test):
* JSTests/stress/multi-put-by-val-mixed-dfg.js: Added.
(shouldBe):
(shouldBeArray):
(test):
* JSTests/stress/multi-put-by-val-oob-dfg.js: Added.
(shouldBe):
(shouldBeArray):
(test):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
*
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::getIntTypedArrayStoreOperand):
(JSC::DFG::compileClampIntegerToByte): Deleted.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::arrayModeToIndexingType):
(JSC::DFG::arrayModeToTypedArrayType):
(JSC::DFG::SpeculativeJIT::compileMultiGetByVal):
(JSC::DFG::SpeculativeJIT::compileMultiPutByVal):
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dw4L8j0im7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE0ODI3QG1haW4=&emid=1af70b88-5c53-4a09-af63-5b8859c7a41f&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
