[JSC] Move aINT / mINT / uINT bytecode under RTT by Constellation · Pull Request #64302 · WebKit/WebKit

Constellation · 2026-05-05T23:01:11Z

`5accc20`

[JSC] Move aINT / mINT / uINT bytecode under RTT
https://bugs.webkit.org/show_bug.cgi?id=314133
rdar://176306252

Reviewed by Keith Miller.

We move aINT / mINT / uINT bytecode to RTT since they are tied to the signature.
This allows us to share them between calls with the same signature, and
also this offers an ability to lazily generate it when mINT is actually
used.

1. aINT / uINT are right now generated eagerly. This is similar to what
   we have right now.
2. mINT is generated when a particular callsite encounters RTT and there
   is no already registered bytecode. This becomes lazy generation, and
   not happening until the callsite is actually used.

We save and restore MC in an unused slot before calls, which allows to
switch MC to pointing at shared bytecode instead of IPInt metadata.
We still have local bytecode which is used to initialize locals, but it
should be improved subsequently.

* Source/JavaScriptCore/llint/InPlaceInterpreter.asm:
* Source/JavaScriptCore/llint/InPlaceInterpreter64.asm:
* Source/JavaScriptCore/wasm/WasmCallee.cpp:
(JSC::Wasm::IPIntCallee::IPIntCallee):
* Source/JavaScriptCore/wasm/WasmCallee.h:
* Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.cpp:
(JSC::Wasm::FunctionIPIntMetadataGenerator::addReturnData): Deleted.
* Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.h:
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::getCurrentInstructionLength):
(JSC::Wasm::IPIntGenerator::cachedCallInformationFor):
(JSC::Wasm::IPIntGenerator::addArguments):
(JSC::Wasm::IPIntGenerator::addLocal):
(JSC::Wasm::IPIntGenerator::addTailCallCommonData):
(JSC::Wasm::IPIntGenerator::addCall):
(JSC::Wasm::IPIntGenerator::addCallIndirect):
(JSC::Wasm::IPIntGenerator::addCallRef):
(JSC::Wasm::IPIntGenerator::finalize):
(JSC::Wasm::addCallArgumentBytecode): Deleted.
(JSC::Wasm::addCallResultBytecode): Deleted.
(JSC::Wasm::IPIntGenerator::addCallCommonData): Deleted.
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.h:
* Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp:
(JSC::Wasm::IPIntPlan::compileFunction):
* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp:
(JSC::IPInt::ensureCallBytecodeForKind):
(JSC::IPInt::prepareCallImpl):
(JSC::IPInt::prepareCallIndirectImpl):
(JSC::IPInt::prepareCallRefImpl):
(JSC::IPInt::WASM_IPINT_EXTERN_CPP_DECL):
* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.h:
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::RTT::ensureArgumINTBytecode const):
(JSC::Wasm::RTT::ensureUINTBytecode const):
(JSC::Wasm::buildCallArgumentBytecode):
(JSC::Wasm::buildCallResultBytecode):
(JSC::Wasm::RTT::ensureCallBytecode const):
(JSC::Wasm::RTT::ensureTailCallBytecode const):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:

Canonical link: https://commits.webkit.org/312841@main

bb3ff1d

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	~~🧪 win-tests~~	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	❌ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
✅ 🛠 🧪 unsafe-merge	✅ 🧪 vision-wk2	~~🧪 mac-intel-wk2~~	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2026-05-05T23:01:17Z

EWS run on previous version of this PR (hash e7847d6)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	~~🛠 ios~~	~~🛠 mac~~	~~🛠 wpe~~	~~🛠 win~~	⏳ 🛠 ios-apple
🧪 bindings	~~🛠 ios-sim~~	~~🛠 mac-AS-debug~~	~~🧪 wpe-wk2~~	~~🧪 win-tests~~	⏳ 🛠 mac-apple
~~🧪 webkitperl~~	~~🧪 ios-wk2~~	~~🧪 api-mac~~	~~🧪 api-wpe~~		⏳ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	~~🛠 gtk3-libwebrtc~~
~~🛠 🧪 jsc~~	~~🧪 api-ios~~	~~🧪 mac-wk1~~	~~🛠 gtk~~
~~🛠 🧪 jsc-debug-arm64~~	~~🛠 ios-safer-cpp~~	~~🧪 mac-wk2~~	~~🧪 gtk-wk2~~
	~~🛠 vision~~	~~🧪 mac-AS-debug-wk2~~	~~🧪 api-gtk~~
	~~🛠 vision-sim~~	~~🧪 mac-wk2-stress~~	~~🛠 playstation~~
	~~🧪 vision-wk2~~	~~🧪 mac-intel-wk2~~	~~🛠 jsc-armv7~~
	~~🛠 tv~~	~~🛠 mac-safer-cpp~~	~~🧪 jsc-armv7-tests~~
	~~🛠 tv-sim~~
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2026-05-05T23:02:02Z

EWS run on previous version of this PR (hash 90b9efe)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	~~🛠 mac~~	~~🛠 wpe~~	~~🛠 win~~	⏳ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~	⏳ 🛠 mac-apple
~~🧪 webkitperl~~	~~🧪 ios-wk2~~	~~🧪 api-mac~~	~~🧪 api-wpe~~		⏳ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	~~🛠 gtk3-libwebrtc~~
~~🛠 🧪 jsc~~	~~🧪 api-ios~~	~~🧪 mac-wk1~~	~~🛠 gtk~~
~~🛠 🧪 jsc-debug-arm64~~	~~🛠 ios-safer-cpp~~	~~🧪 mac-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 api-gtk~~
	✅ 🛠 vision-sim	~~🧪 mac-wk2-stress~~	~~🛠 playstation~~
	~~🧪 vision-wk2~~	~~🧪 mac-intel-wk2~~	~~🛠 jsc-armv7~~
	✅ 🛠 tv	~~🛠 mac-safer-cpp~~	~~🧪 jsc-armv7-tests~~
	~~🛠 tv-sim~~
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2026-05-05T23:03:44Z

EWS run on previous version of this PR (hash 4566606)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 win-tests	⏳ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		⏳ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	❌ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-ews-buildbot · 2026-05-06T01:51:53Z

macOS Safer C++ Build #100576 (`4566606`)

❌ Found 1 failing file with 6 issues. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

webkit-ews-buildbot · 2026-05-06T02:03:38Z

iOS Safer C++ Build #18966 (`4566606`)

❌ Found 1 failing file with 6 issues. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

webkit-early-warning-system · 2026-05-06T18:57:37Z

EWS run on previous version of this PR (hash aee4c24)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	~~🧪 win-tests~~	❌ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		⏳ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
~~🛠 🧪 jsc~~	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

kmiller68

r=me with comments

kmiller68 · 2026-05-07T02:17:28Z


+    // Function-kind only. Lazy-install under m_ipintBytecodeLock; buffer is
+    // immutable once published.
+    Ref<const IPIntSharedBytecode> ensureArgumINTBytecode(const CallInformation&) const;


I don't think you use the results of these ensureXYZBytecode() functions anywhere. Could probably avoid a ref count churn.

Sounds good. Changed.

kmiller68 · 2026-05-07T02:48:55Z

+    if (auto buffer = m_argumINTBytecode) [[likely]]
+        return buffer.releaseNonNull();


Why not do the:

if (m_argumINTBytecode) [[likely]] return; Locker ... if (m_argumINTBytecode) return;

idiom?

Sounds good. Changed.

kmiller68 · 2026-05-07T02:52:47Z

+    SUPPRESS_UNCOUNTED_LOCAL const auto& rtt = *call->signature.rtt;
+    rtt.ensureCallBytecode();
+
+    auto* callee = IPINT_CALLEE(callFrame);


All this code seems heavily duplicated after the rtt.ensureXYZBytecode() can we have a shared helper?

Ditto for the others.

Sounds good. Changed.

webkit-early-warning-system · 2026-05-07T04:49:08Z

EWS run on previous version of this PR (hash 834d881)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	❌ 🛠 ios	❌ 🛠 mac	❌ 🛠 wpe	~~🛠 win~~	⏳ 🛠 ios-apple
	❌ 🛠 ios-sim	❌ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2	~~🧪 win-tests~~	⏳ 🛠 mac-apple
✅ 🧪 webkitperl	❌ 🧪 ios-wk2	❌ 🧪 api-mac	❌ 🧪 api-wpe		⏳ 🛠 vision-apple
	❌ 🧪 ios-wk2-wpt	❌ 🧪 api-mac-debug	❌ 🛠 gtk3-libwebrtc
~~🛠 🧪 jsc~~	❌ 🧪 api-ios	❌ 🧪 mac-wk1	❌ 🛠 gtk
~~🛠 🧪 jsc-debug-arm64~~	❌ 🛠 ios-safer-cpp	❌ 🧪 mac-wk2	❌ 🧪 gtk-wk2
	❌ 🛠 vision	❌ 🧪 mac-AS-debug-wk2	❌ 🧪 api-gtk
	~~🛠 vision-sim~~	❌ 🧪 mac-wk2-stress	~~🛠 playstation~~
	~~🧪 vision-wk2~~	❌ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	❌ 🛠 tv	❌ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	~~🛠 tv-sim~~
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2026-05-07T05:02:08Z

EWS run on previous version of this PR (hash 8811767)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	⏳ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	~~🧪 win-tests~~	⏳ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	~~🧪 api-mac~~	✅ 🧪 api-wpe		⏳ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	✅ 🛠 gtk3-libwebrtc
~~🛠 🧪 jsc~~	~~🧪 api-ios~~	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	~~🧪 mac-intel-wk2~~	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2026-05-07T08:17:11Z

EWS run on previous version of this PR (hash af5ffec)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	~~🛠 mac~~	✅ 🛠 wpe	~~🛠 win~~	⏳ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~	⏳ 🛠 mac-apple
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	~~🧪 api-mac~~	✅ 🧪 api-wpe		⏳ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	✅ 🛠 gtk3-libwebrtc
~~🛠 🧪 jsc~~	~~🧪 api-ios~~	~~🧪 mac-wk1~~	✅ 🛠 gtk
~~🛠 🧪 jsc-debug-arm64~~	✅ 🛠 ios-safer-cpp	~~🧪 mac-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	✅ 🧪 api-gtk
	~~🛠 vision-sim~~	~~🧪 mac-wk2-stress~~	~~🛠 playstation~~
	~~🧪 vision-wk2~~	~~🧪 mac-intel-wk2~~	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	~~🛠 tv-sim~~
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2026-05-07T08:44:20Z

EWS run on previous version of this PR (hash da03041)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	~~🛠 mac~~	✅ 🛠 wpe	~~🛠 win~~	⏳ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~	⏳ 🛠 mac-apple
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	~~🧪 api-mac~~	~~🧪 api-wpe~~		⏳ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	~~🛠 gtk3-libwebrtc~~
~~🛠 🧪 jsc~~	~~🧪 api-ios~~	~~🧪 mac-wk1~~	✅ 🛠 gtk
~~🛠 🧪 jsc-debug-arm64~~	~~🛠 ios-safer-cpp~~	~~🧪 mac-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 api-gtk~~
	~~🛠 vision-sim~~	~~🧪 mac-wk2-stress~~	~~🛠 playstation~~
	~~🧪 vision-wk2~~	~~🧪 mac-intel-wk2~~	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	~~🧪 jsc-armv7-tests~~
	~~🛠 tv-sim~~
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2026-05-07T08:47:22Z

EWS run on previous version of this PR (hash 3bc3af1)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	⏳ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	~~🧪 win-tests~~	🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		⏳ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	✅ 🛠 gtk3-libwebrtc
~~🛠 🧪 jsc~~	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

kmiller68

Discussing offline, I think there's a bug here because there's no data dependency between the bytecode pointer and the other fields. Since the bytecode pointer controls publication it's possible for one of the other fields to get hoisted by a "reader" thread above the publication.

Constellation · 2026-05-07T17:24:35Z

Discussing offline, I think there's a bug here because there's no data dependency between the bytecode pointer and the other fields. Since the bytecode pointer controls publication it's possible for one of the other fields to get hoisted by a "reader" thread above the publication.

The latest version of the code fixed it by embedding that field into the bytecode :)

webkit-early-warning-system · 2026-05-07T17:38:04Z

EWS run on previous version of this PR (hash 06c78ed)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	❌ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~	❌ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	~~🧪 api-mac~~	✅ 🧪 api-wpe		❌ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	✅ 🛠 gtk3-libwebrtc
~~🛠 🧪 jsc~~	~~🧪 api-ios~~	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	~~🧪 gtk-wk2~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
	✅ 🧪 vision-wk2	~~🧪 mac-intel-wk2~~	✅ 🛠 jsc-armv7
	✅ 🛠 tv	~~🛠 mac-safer-cpp~~	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

kmiller68 · 2026-05-07T17:38:13Z

Why is this refcounted rather than unique_ptr?

Originally trying to share even further between some RTTs, like func(array, array) and func(struct, struct), but just going to the simpler way for now. Changed it to unique-ptr.

webkit-early-warning-system · 2026-05-07T18:21:21Z

EWS run on current version of this PR (hash bb3ff1d)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	~~🧪 win-tests~~	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	❌ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	~~🧪 ios-wk2-wpt~~	~~🧪 api-mac-debug~~	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🛠 playstation
✅ 🛠 🧪 unsafe-merge	✅ 🧪 vision-wk2	~~🧪 mac-intel-wk2~~	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

https://bugs.webkit.org/show_bug.cgi?id=314133 rdar://176306252 Reviewed by Keith Miller. We move aINT / mINT / uINT bytecode to RTT since they are tied to the signature. This allows us to share them between calls with the same signature, and also this offers an ability to lazily generate it when mINT is actually used. 1. aINT / uINT are right now generated eagerly. This is similar to what we have right now. 2. mINT is generated when a particular callsite encounters RTT and there is no already registered bytecode. This becomes lazy generation, and not happening until the callsite is actually used. We save and restore MC in an unused slot before calls, which allows to switch MC to pointing at shared bytecode instead of IPInt metadata. We still have local bytecode which is used to initialize locals, but it should be improved subsequently. * Source/JavaScriptCore/llint/InPlaceInterpreter.asm: * Source/JavaScriptCore/llint/InPlaceInterpreter64.asm: * Source/JavaScriptCore/wasm/WasmCallee.cpp: (JSC::Wasm::IPIntCallee::IPIntCallee): * Source/JavaScriptCore/wasm/WasmCallee.h: * Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.cpp: (JSC::Wasm::FunctionIPIntMetadataGenerator::addReturnData): Deleted. * Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.h: * Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp: (JSC::Wasm::IPIntGenerator::getCurrentInstructionLength): (JSC::Wasm::IPIntGenerator::cachedCallInformationFor): (JSC::Wasm::IPIntGenerator::addArguments): (JSC::Wasm::IPIntGenerator::addLocal): (JSC::Wasm::IPIntGenerator::addTailCallCommonData): (JSC::Wasm::IPIntGenerator::addCall): (JSC::Wasm::IPIntGenerator::addCallIndirect): (JSC::Wasm::IPIntGenerator::addCallRef): (JSC::Wasm::IPIntGenerator::finalize): (JSC::Wasm::addCallArgumentBytecode): Deleted. (JSC::Wasm::addCallResultBytecode): Deleted. (JSC::Wasm::IPIntGenerator::addCallCommonData): Deleted. * Source/JavaScriptCore/wasm/WasmIPIntGenerator.h: * Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp: (JSC::Wasm::IPIntPlan::compileFunction): * Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp: (JSC::IPInt::ensureCallBytecodeForKind): (JSC::IPInt::prepareCallImpl): (JSC::IPInt::prepareCallIndirectImpl): (JSC::IPInt::prepareCallRefImpl): (JSC::IPInt::WASM_IPINT_EXTERN_CPP_DECL): * Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.h: * Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp: (JSC::Wasm::RTT::ensureArgumINTBytecode const): (JSC::Wasm::RTT::ensureUINTBytecode const): (JSC::Wasm::buildCallArgumentBytecode): (JSC::Wasm::buildCallResultBytecode): (JSC::Wasm::RTT::ensureCallBytecode const): (JSC::Wasm::RTT::ensureTailCallBytecode const): * Source/JavaScriptCore/wasm/WasmTypeDefinition.h: Canonical link: https://commits.webkit.org/312841@main

webkit-commit-queue · 2026-05-07T23:29:36Z

Committed 312841@main (5accc20): https://commits.webkit.org/312841@main

Reviewed commits have been landed. Closing PR #64302 and removing active labels.

Constellation self-assigned this May 5, 2026

Constellation added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label May 5, 2026

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from e7847d6 to 90b9efe Compare May 5, 2026 23:01

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from 90b9efe to 4566606 Compare May 5, 2026 23:03

Constellation marked this pull request as ready for review May 5, 2026 23:03

Constellation requested a review from a team as a code owner May 5, 2026 23:03

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label May 6, 2026

Constellation removed the merging-blocked Applied to prevent a change from being merged label May 6, 2026

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from 4566606 to aee4c24 Compare May 6, 2026 18:57

kmiller68 approved these changes May 7, 2026

View reviewed changes

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from aee4c24 to 834d881 Compare May 7, 2026 04:49

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label May 7, 2026

Constellation removed the merging-blocked Applied to prevent a change from being merged label May 7, 2026

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label May 7, 2026

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from 834d881 to 8811767 Compare May 7, 2026 05:02

Constellation removed the merging-blocked Applied to prevent a change from being merged label May 7, 2026

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from 8811767 to af5ffec Compare May 7, 2026 08:17

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from af5ffec to da03041 Compare May 7, 2026 08:44

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from da03041 to 3bc3af1 Compare May 7, 2026 08:47

kmiller68 self-requested a review May 7, 2026 15:55

kmiller68 reviewed May 7, 2026

View reviewed changes

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from 3bc3af1 to 06c78ed Compare May 7, 2026 17:37

kmiller68 approved these changes May 7, 2026

View reviewed changes

Constellation force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from 06c78ed to bb3ff1d Compare May 7, 2026 18:21

Constellation added the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label May 7, 2026

webkit-commit-queue force-pushed the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch from bb3ff1d to 5accc20 Compare May 7, 2026 23:29

webkit-commit-queue merged commit 5accc20 into WebKit:main May 7, 2026

webkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label May 7, 2026

Constellation deleted the eng/JSC-Move-aINT-mINT-uINT-bytecode-under-RTT branch May 8, 2026 00:59

		if (auto buffer = m_argumINTBytecode) [[likely]]
		return buffer.releaseNonNull();

Conversation

Constellation commented May 5, 2026 • edited by webkit-early-warning-system Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-ews-buildbot commented May 6, 2026

macOS Safer C++ Build #100576 (4566606)

Uh oh!

webkit-ews-buildbot commented May 6, 2026

iOS Safer C++ Build #18966 (4566606)

Uh oh!

webkit-early-warning-system commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kmiller68 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kmiller68 left a comment

Choose a reason for hiding this comment

Uh oh!

Constellation commented May 7, 2026

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webkit-early-warning-system commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-commit-queue commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Constellation commented May 5, 2026 •

edited by webkit-early-warning-system

Loading

webkit-early-warning-system commented May 5, 2026 •

edited

Loading

webkit-early-warning-system commented May 5, 2026 •

edited

Loading

webkit-early-warning-system commented May 5, 2026 •

edited

Loading

macOS Safer C++ Build #100576 (`4566606`)

iOS Safer C++ Build #18966 (`4566606`)

webkit-early-warning-system commented May 6, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading

webkit-early-warning-system commented May 7, 2026 •

edited

Loading