Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a1e5cdc19b2dc611ba3e55de801c5d54b859dd68
https://github.com/WebKit/WebKit/commit/a1e5cdc19b2dc611ba3e55de801c5d54b859dd68
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-15 (Thu, 15 Oct 2026)
Changed paths:
A JSTests/microbenchmarks/typed-array-set-concat.js
A JSTests/microbenchmarks/typed-array-set-small.js
A JSTests/stress/typed-array-set-intrinsic-exit.js
A JSTests/stress/typed-array-set-intrinsic-large.js
A JSTests/stress/typed-array-set-intrinsic.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGCloneHelper.h
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp
Log Message:
-----------
[JSC] Add DFG / FTL intrinsic for `%TypedArray%.prototype.set`
https://bugs.webkit.org/show_bug.cgi?id=326994
Reviewed by Yusuke Suzuki.
%TypedArray%.prototype.set is always a host function call. For a small source,
the call and the argument validation cost more than the copy.
This patch adds a TypedArraySet node to DFG and FTL. It speculates that the
source
has the same type as the target, that neither is resizable or detached, and that
the copy fits in the target. Then it calls an operation which only does memmove.
If a speculation fails, we OSR exit and stop using the intrinsic at that call
site.
Baseline Patched
typed-array-prototype-set 1.8820+-0.0399
1.8734+-0.0415
typed-array-set-uint8-and-uint8clamped 1.4566+-0.0252 ?
1.4673+-0.0425 ?
typed-array-set-small 180.8575+-1.2421 ^
55.4910+-1.9837 ^ definitely 3.2592x faster
typed-array-set-concat 267.4650+-0.7874 ^
65.7571+-0.5393 ^ definitely 4.0675x faster
Tests: JSTests/microbenchmarks/typed-array-set-concat.js
JSTests/microbenchmarks/typed-array-set-small.js
JSTests/stress/typed-array-set-intrinsic-exit.js
JSTests/stress/typed-array-set-intrinsic-large.js
JSTests/stress/typed-array-set-intrinsic.js
* JSTests/microbenchmarks/typed-array-set-concat.js: Added.
(concat):
* JSTests/microbenchmarks/typed-array-set-small.js: Added.
(test):
* JSTests/stress/typed-array-set-intrinsic-exit.js: Added.
(shouldBe):
(shouldBeArray):
(shouldThrow):
(makeSet.const.set new):
(makeSet):
* JSTests/stress/typed-array-set-intrinsic-large.js: Added.
(shouldBe):
(shouldThrow):
(set target):
* JSTests/stress/typed-array-set-intrinsic.js: Added.
(shouldBe):
(shouldBeArray):
(shouldThrow):
(makeSet.const.set new):
(makeSet):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGCloneHelper.h:
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::hasTypedArrayType):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileTypedArraySet):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp:
(JSC::JSTypedArrayViewPrototype::finishCreation):
Canonical link: https://commits.webkit.org/323823@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
