Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8e7f96f9a5dbad82750e21e61a99177085d518c3
https://github.com/WebKit/WebKit/commit/8e7f96f9a5dbad82750e21e61a99177085d518c3
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
A JSTests/microbenchmarks/double-to-int32-out-of-int32-range.js
A JSTests/stress/to-int32-out-of-int32-range-doubles.js
M Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Keep doubles outside the int32 range on the `ToInt32` fast path on
x86_64
https://bugs.webkit.org/show_bug.cgi?id=323498
Reviewed by Yusuke Suzuki.
On x86_64, the DFG and FTL convert a double to int32 with the 32-bit
cvttsd2si, which fails for every value outside [-2^31, 2^31) and falls
back to a call to operationToInt32SensibleSlow. Code that keeps 32-bit
constants in ordinary numbers, such as the lookup tables of aes-js,
takes the call for about half of its loads, through a data-dependent
branch that keeps mispredicting. arm64 does not pay this cost because
fjcvtzs implements ToInt32 directly.
Truncate with the 64-bit cvttsd2siq instead and keep the low 32 bits,
which is ToInt32 for every |x| < 2^63. The slow path now only sees NaN,
the infinities, and |x| >= 2^63, which cvttsd2siq all reports as
INT64_MIN -- a subset of the previous failure set, so
operationToInt32SensibleSlow needs no change. The new
branchTruncateDoubleToInt32ViaInt64 detects INT64_MIN as the only value
whose subtraction of 1 overflows, so it needs no scratch register.
Measured with run-jsc-benchmarks on Linux x64:
baseline patched
double-to-int32-out-of-int32-range 200.4000+-11.2357 ^ 63.3957+-0.3318
^ definitely 3.1611x faster
Tests: JSTests/microbenchmarks/double-to-int32-out-of-int32-range.js
JSTests/stress/to-int32-out-of-int32-range-doubles.js
* JSTests/microbenchmarks/double-to-int32-out-of-int32-range.js: Added.
(run):
* JSTests/stress/to-int32-out-of-int32-range-doubles.js: Added.
(shouldBe):
(bitOr):
(xorWith):
(shiftRight):
(bitOrTyped):
(xorWithTyped):
(shiftRightTyped):
(bitOrValue):
* Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::branchTruncateDoubleToInt32ViaInt64):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileDoubleToInt32):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/320602@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
