Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 57c638004510c6530ad0f19332f5f707185cd601
https://github.com/WebKit/WebKit/commit/57c638004510c6530ad0f19332f5f707185cd601
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-10 (Sat, 10 Oct 2026)
Changed paths:
M Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp
Log Message:
-----------
[JSC] TypeCheckHoisting should not hoist a monomorphic CheckStructure over a
polymorphic access
https://bugs.webkit.org/show_bug.cgi?id=327063
rdar://189678698
Reviewed by Sosuke Suzuki.
TypeCheckHoistingPhase moves CheckStructure from GetLocal side to
SetLocal side when all CheckStructure against the GetLocal uses the same
Structure. But some places are using MutliGetByOffset and some places
are using CheckStructure. While MutliGetByOffset limits possible
structures too, but because we do not want to duplicate the check with
CheckStructure again, these nodes are not participating in
TypeCheckHoistingPhase. But this leads to making only one CheckStructure
visible to this phase, hoisting this Check regardless of what
MutliGetByOffset says, and making overly narrower CheckStructure hoisted.
BB#0:
@a: ...
@b: SetLocal(@a, loc0)
...
BB#1:
@c: GetLocal(loc0)
@d: CheckStructure(@c, <struct0>)
...
BB#2:
@e: GetLocal(loc0)
@f: MutliGetByOffset(@e, <struct0, struct1, struct2>)
Then we accidentally hoist @d to SetLocal place.
This patch makes sure that MutliGetByOffset, MultiPutByOffset,
MultiDeleteByOffset to tell its expected Structure sets to
TypeCheckHoistingPhase, while not requesting hoisting CheckStructure due
to them.
* Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::id,entifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::noticeStructuresAccessedBy):
Canonical link: https://commits.webkit.org/323371@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
