Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: be0094718dcc8f7b99f46d6eda275e98db5d7c56
https://github.com/WebKit/WebKit/commit/be0094718dcc8f7b99f46d6eda275e98db5d7c56
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-28 (Mon, 28 Sep 2026)
Changed paths:
A JSTests/stress/arith-mul-int52-after-int32-overflow-in-baseline.js
M Source/JavaScriptCore/b3/B3ReduceStrength.cpp
M Source/JavaScriptCore/b3/testb3_6.cpp
M Source/JavaScriptCore/bytecode/ArithProfile.cpp
M Source/JavaScriptCore/bytecode/ArithProfile.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.h
M Source/JavaScriptCore/jit/JITMulGenerator.cpp
M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
M Source/JavaScriptCore/runtime/JSCJSValue.h
Log Message:
-----------
[JSC] Optimize Int52 more
https://bugs.webkit.org/show_bug.cgi?id=325457
rdar://188553116
Reviewed by Vassili Bykov.
This patch optimizes Int52 pattern more used in the wild.
1. tryConvertToInt52 should be optimized with architecture-specific
conversion instruction.
2. ObservedResults was conservatively collecting Int52Overflow as it is
recording Int52Overflow whenever it sees Doubles. This patch fixes it
by checking precise Int52 overflow cases.
3. Like Truc, we add Int52-targetting optimization for SShr + Mul with
proven range information.
Tests: JSTests/stress/arith-mul-int52-after-int32-overflow-in-baseline.js
Source/JavaScriptCore/b3/testb3_6.cpp
* JSTests/stress/arith-mul-int52-after-int32-overflow-in-baseline.js: Added.
(shouldBe):
(hash):
(product):
* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:
* Source/JavaScriptCore/b3/testb3_6.cpp:
(testSShrMulConstantInt32Operand):
(testSShrMulConstantInt64Operand):
(addSShrShTests):
* Source/JavaScriptCore/bytecode/ArithProfile.cpp:
(JSC::ArithProfile<BitfieldType>::emitObserveResult):
(JSC::ArithProfile<BitfieldType>::emitSetInt52OverflowIfNeeded const):
* Source/JavaScriptCore/bytecode/ArithProfile.h:
(JSC::ObservedResults::isInt52Overflow):
(JSC::ArithProfile::observeResult):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::isStrictInt52):
(JSC::AssemblyHelpers::isNotStrictInt52):
* Source/JavaScriptCore/jit/JITMulGenerator.cpp:
(JSC::JITMulGenerator::generateFastPath):
* Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:
(JSC::updateArithProfileForUnaryArithOp):
(JSC::updateArithProfileForBinaryArithOp):
* Source/JavaScriptCore/runtime/JSCJSValue.h:
(JSC::tryConvertToInt52):
Canonical link: https://commits.webkit.org/322123@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
