Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e164bce2e8884f242389930d9c0551d4b1f4ebb4
https://github.com/WebKit/WebKit/commit/e164bce2e8884f242389930d9c0551d4b1f4ebb4
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-17 (Fri, 17 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/data-view-bigint64-byte-swap.js
A JSTests/microbenchmarks/data-view-get-bigint64.js
A JSTests/microbenchmarks/data-view-set-bigint64.js
A JSTests/stress/dataview-jit-bigint64-byte-offset.js
A JSTests/stress/dataview-jit-bigint64-cse-and-aliasing.js
A JSTests/stress/dataview-jit-bigint64-type-check-failures.js
A JSTests/stress/dataview-jit-bigint64.js
M JSTests/stress/dataview-jit-bounds-checks.js
M JSTests/stress/dataview-jit-unaligned-accesses.js
M Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp
Log Message:
-----------
[JSC] Handle `DataView` BigInt64 accessors in DFG / FTL
https://bugs.webkit.org/show_bug.cgi?id=319594
Reviewed by Yusuke Suzuki.
DataView.prototype.getBigInt64 / getBigUint64 / setBigInt64 / setBigUint64
were the only DataView accessors without JIT intrinsics, so every call was
a C++ host call.
This handles them as the byteSize == 8 integer case of the existing
DataViewGetInt / DataViewSet nodes. Gets do the 64-bit load and byte swap
inline and box the result via operationInt64ToBigInt / newly added
operationUInt64ToBigInt. Sets speculate the value as HeapBigInt and store its
low 64 bits (toBigInt64), which is exactly the ToBigInt64 / ToBigUint64
wrapping the spec requires.
Baseline Patched
data-view-bigint64-byte-swap 146.5305+-4.5918 ^ 30.7756+-0.1811
^ definitely 4.7613x faster
data-view-set-bigint64 127.1115+-1.1375 ^ 15.5786+-1.0692
^ definitely 8.1593x faster
data-view-get-bigint64 135.3561+-0.8063 ^ 56.3917+-0.4440
^ definitely 2.4003x faster
Tests: JSTests/microbenchmarks/data-view-bigint64-byte-swap.js
JSTests/microbenchmarks/data-view-get-bigint64.js
JSTests/microbenchmarks/data-view-set-bigint64.js
JSTests/stress/dataview-jit-bigint64-byte-offset.js
JSTests/stress/dataview-jit-bigint64-cse-and-aliasing.js
JSTests/stress/dataview-jit-bigint64-type-check-failures.js
JSTests/stress/dataview-jit-bigint64.js
* JSTests/microbenchmarks/data-view-bigint64-byte-swap.js: Added.
(byteSwap64):
* JSTests/microbenchmarks/data-view-get-bigint64.js: Added.
(getInt64):
(getUint64):
* JSTests/microbenchmarks/data-view-set-bigint64.js: Added.
(setInt64):
(setUint64):
* JSTests/stress/dataview-jit-bigint64-byte-offset.js: Added.
(shouldBe):
(shouldThrow):
(get dv):
(set dv):
* JSTests/stress/dataview-jit-bigint64-cse-and-aliasing.js: Added.
(shouldBe):
(getSetGet):
(getTwice):
(getArrayStoreGet):
* JSTests/stress/dataview-jit-bigint64-type-check-failures.js: Added.
(shouldBe):
(shouldThrow):
(get dv):
(set dv):
(shouldBe.get dv):
* JSTests/stress/dataview-jit-bigint64.js: Added.
(shouldBe):
(shouldThrow):
(toUint64):
(toInt64):
(refSetBigUint64):
(getBE):
(getDefault):
(getVar):
(setLE):
(setBE):
(setDefault):
(setVar):
(oobGet):
(oobSet):
(setAny):
(shouldBe.view.getBigUint64):
(shouldThrow.rget):
(shouldThrow.rset):
(gcGet):
(view.setBigUint64):
(setZero):
* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp:
Canonical link: https://commits.webkit.org/317392@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
