Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6589b2e5c18c0a0d4180c0e77ad2fb46f4be0d46
https://github.com/WebKit/WebKit/commit/6589b2e5c18c0a0d4180c0e77ad2fb46f4be0d46
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
A JSTests/wasm/gc/array-new-constant-size.js
A JSTests/wasm/gc/struct-new-does-not-clobber-loads.js
A JSTests/wasm/gc/struct-new-nested-alloc-gc.js
M Source/JavaScriptCore/b3/B3AbstractHeapRepository.cpp
M Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
M Source/JavaScriptCore/b3/B3LowerMacros.cpp
M Source/JavaScriptCore/b3/B3Value.cpp
M Source/JavaScriptCore/b3/B3WasmArrayNewValue.h
M Source/JavaScriptCore/b3/B3WasmStructNewValue.h
M Source/JavaScriptCore/heap/CompleteSubspace.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
M Source/JavaScriptCore/jit/JITAllocator.h
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Log Message:
-----------
[JSC] Tighten WasmGC allocation
https://bugs.webkit.org/show_bug.cgi?id=321522
rdar://184632964
Reviewed by Yijia Huang.
This patch tightens WasmGC allocations.
1. While allocator is not a constant in WasmGC struct allocations (it is
coming from JSWebAssemblyInstance field), size is constant when
compiling. We add VariableNonNullWithConstantCellSize mode, which
means that "allocator is in GPR as a variable, but cell size is constant"
to tighten the code generation.
2. We revisit effect model of WasmGC allocations, now it is more aligned
to DFG's allocations (not saying write-top).
3. We also fold WasmGC array allocations with constant size too.
Tests: JSTests/wasm/gc/struct-new-does-not-clobber-loads.js
JSTests/wasm/gc/struct-new-nested-alloc-gc.js
* JSTests/wasm/gc/array-new-constant-size.js: Added.
(get return):
(make):
(get for):
* JSTests/wasm/gc/struct-new-does-not-clobber-loads.js: Added.
* JSTests/wasm/gc/struct-new-nested-alloc-gc.js: Added.
(want):
* Source/JavaScriptCore/b3/B3AbstractHeapRepository.cpp:
(JSC::B3::AbstractHeapRepository::AbstractHeapRepository):
(JSC::B3::AbstractHeapRepository::decorateWasmStructNew):
(JSC::B3::AbstractHeapRepository::decorateWasmArrayNew):
(JSC::B3::AbstractHeapRepository::computeRangesAndDecorateInstructions):
* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:
* Source/JavaScriptCore/b3/B3LowerMacros.cpp:
* Source/JavaScriptCore/b3/B3Value.cpp:
(JSC::B3::Value::effectsSlow const):
* Source/JavaScriptCore/b3/B3WasmArrayNewValue.h:
* Source/JavaScriptCore/b3/B3WasmStructNewValue.h:
* Source/JavaScriptCore/heap/CompleteSubspace.cpp:
(JSC::CompleteSubspace::prepareAllAllocators):
* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
(JSC::AssemblyHelpers::emitAllocate):
* Source/JavaScriptCore/jit/JITAllocator.h:
(JSC::JITAllocator::variableNonNullWithConstantCellSize):
(JSC::JITAllocator::hasConstantCellSize const):
(JSC::JITAllocator::constantCellSize const):
* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::emitAllocateGCArrayUninitialized):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitAllocateGCStructUninitialized):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::addArrayNew):
(JSC::Wasm::OMGIRGenerator::addArrayNewDefault):
(JSC::Wasm::OMGIRGenerator::addArrayNewFixed):
(JSC::Wasm::OMGIRGenerator::addStructNew):
(JSC::Wasm::OMGIRGenerator::addStructNewDefault):
Canonical link: https://commits.webkit.org/319020@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
