Skip to content

[JSC] NativeExecutable should have name and length in the same way to FunctionExecutable#66580

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
Constellation:host-bound
Jun 6, 2026
Merged

[JSC] NativeExecutable should have name and length in the same way to FunctionExecutable#66580
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
Constellation:host-bound

Conversation

@Constellation
Copy link
Copy Markdown
Member

@Constellation Constellation commented Jun 5, 2026

a633a8a

[JSC] NativeExecutable should have name and length in the same way to FunctionExecutable
https://bugs.webkit.org/show_bug.cgi?id=316443
rdar://178844469

Reviewed by Justin Michaud and Yijia Huang.

This is slight optimization for case doing `bind` with native functions,
but largely a preparation for introducing optimization for patterns converting
JS builtins to C++ native functions. Previously NativeExecutable was not
holding length / name appropriately while FunctionExecutable was doing
so. As a result, JSBoundFunction related optimization was skipping
NativeExecutable cases. This becomes a problem when we convert JS
builtin functions to Native version as bind starts going to the slow path.
This patch alignes NativeExecutable's name and length handling much more
to FunctionExecutable.

* JSTests/stress/promise-resolving-functions-name-and-length.js: Added.
(shouldBe):
(new.Promise):
(checkAnonymousBuiltin):
(i.new.Promise):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/jit/JITThunks.cpp:
(JSC::JITThunks::WeakNativeExecutableHash::hash):
(JSC::JITThunks::WeakNativeExecutableHash::equal):
(JSC::JITThunks::finalize):
(JSC::JITThunks::hostFunctionStub):
* Source/JavaScriptCore/jit/JITThunks.h:
* Source/JavaScriptCore/runtime/BooleanConstructor.cpp:
(JSC::BooleanConstructor::finishCreation):
(JSC::BooleanConstructor::create):
* Source/JavaScriptCore/runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::canSkipNameAndLengthMaterialization):
* Source/JavaScriptCore/runtime/JSCustomGetterFunction.cpp:
(JSC::JSCustomGetterFunction::create):
* Source/JavaScriptCore/runtime/JSCustomSetterFunction.cpp:
(JSC::JSCustomSetterFunction::create):
* Source/JavaScriptCore/runtime/JSFunction.cpp:
(JSC::JSFunction::create):
(JSC::JSFunction::reifyLazyPropertyIfNeeded):
(JSC::JSFunction::reifyLazyPropertyForHostOrBuiltinIfNeeded):
(JSC::JSFunction::reifyLazyBoundNameIfNeeded):
(JSC::JSFunction::finishCreation): Deleted.
* Source/JavaScriptCore/runtime/JSFunction.h:
* Source/JavaScriptCore/runtime/JSFunctionInlines.h:
(JSC::JSFunction::originalLength):
(JSC::JSFunction::originalName):
(JSC::JSFunction::canAssumeNameAndLengthAreOriginal):
* Source/JavaScriptCore/runtime/JSFunctionWithFields.cpp:
(JSC::JSFunctionWithFields::create):
* Source/JavaScriptCore/runtime/JSFunctionWithFields.h:
* Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp:
(JSC::JSNativeStdFunction::getHostFunction):
(JSC::JSNativeStdFunction::create):
(JSC::JSNativeStdFunction::finishCreation): Deleted.
* Source/JavaScriptCore/runtime/JSNativeStdFunction.h:
* Source/JavaScriptCore/runtime/JSPromise.cpp:
(JSC::JSPromise::createFirstResolveFunction):
(JSC::JSPromise::createFirstRejectFunction):
* Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp:
(JSC::promiseAllSlow):
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::promiseAllSettledSlow):
(JSC::promiseAnySlow):
* Source/JavaScriptCore/runtime/JSPromisePrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::promiseProtoFuncFinallySlow):
* Source/JavaScriptCore/runtime/NativeExecutable.cpp:
(JSC::NativeExecutable::create):
(JSC::NativeExecutable::finishCreation):
(JSC::NativeExecutable::nameJSString const):
* Source/JavaScriptCore/runtime/NativeExecutable.h:
* Source/JavaScriptCore/runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::create):
(JSC::NumberConstructor::finishCreation):
* Source/JavaScriptCore/runtime/PinballCompletion.cpp:
(JSC::createHandler):
* Source/JavaScriptCore/runtime/StringConstructor.cpp:
(JSC::StringConstructor::finishCreation):
(JSC::StringConstructor::create):
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::getHostFunction):
(JSC::VM::getBoundFunction):
(JSC::VM::getRemoteFunction):
(JSC::VM::promiseResolvingFunctionResolveExecutableSlow):
(JSC::VM::promiseResolvingFunctionRejectExecutableSlow):
(JSC::VM::promiseFirstResolvingFunctionResolveExecutableSlow):
(JSC::VM::promiseFirstResolvingFunctionRejectExecutableSlow):
(JSC::VM::promiseResolvingFunctionResolveWithInternalMicrotaskExecutableSlow):
(JSC::VM::promiseResolvingFunctionRejectWithInternalMicrotaskExecutableSlow):
(JSC::VM::promiseCapabilityExecutorExecutableSlow):
(JSC::VM::promiseAllFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSlowFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledRejectFunctionExecutableSlow):
(JSC::VM::promiseAllSettledSlowFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledSlowRejectFunctionExecutableSlow):
(JSC::VM::promiseAnyRejectFunctionExecutableSlow):
(JSC::VM::promiseAnySlowRejectFunctionExecutableSlow):
* Source/JavaScriptCore/runtime/VM.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp:
(JSC::WebAssemblyFunction::create):
* Source/JavaScriptCore/wasm/js/WebAssemblyFunctionBase.cpp:
(JSC::WebAssemblyFunctionBase::finishCreation): Deleted.
* Source/JavaScriptCore/wasm/js/WebAssemblyFunctionBase.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyPromising.cpp:
(JSC::createWebAssemblyPromisingFunction):
* Source/JavaScriptCore/wasm/js/WebAssemblySuspending.cpp:
(JSC::createWebAssemblySuspendingFunction):
* Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.cpp:
(JSC::WebAssemblyWrapperFunction::create):

Canonical link: https://commits.webkit.org/314682@main

612a568

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
✅ 🧪 style ✅ 🛠 ios 🛠 mac ✅ 🛠 wpe 🛠 win ⏳ 🛠 ios-apple
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug loading 🧪 wpe-wk2 🧪 win-tests ⏳ 🛠 mac-apple
✅ 🧪 webkitperl 🧪 ios-wk2 🧪 api-mac 🧪 api-wpe ⏳ 🛠 vision-apple
🧪 ios-wk2-wpt 🧪 api-mac-debug 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc-x86-64 🧪 api-ios 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64 ✅ 🛠 ios-safer-cpp 🧪 mac-wk2 🧪 gtk-wk2
✅ 🛠 vision 🧪 mac-AS-debug-wk2 🧪 api-gtk
✅ 🛠 vision-sim 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🛠 🧪 unsafe-merge 🧪 vision-wk2 🧪 mac-intel-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 tv ✅ 🛠 mac-safer-cpp ✅ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim 🧪 mac-site-isolation
✅ 🛠 watch
❌ 🛠 watch-sim

@Constellation Constellation requested a review from a team as a code owner June 5, 2026 20:21
@Constellation Constellation self-assigned this Jun 5, 2026
@Constellation Constellation added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label Jun 5, 2026
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 5, 2026
@Constellation Constellation removed the merging-blocked Applied to prevent a change from being merged label Jun 5, 2026
@@ -53,13 +53,13 @@ JSCustomSetterFunction::JSCustomSetterFunction(VM& vm, NativeExecutable* executa
JSCustomSetterFunction* JSCustomSetterFunction::create(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, CustomFunctionPointer setter)
{
ASSERT(setter);
NativeExecutable* executable = vm.getHostFunction(customSetterFunctionCall, ImplementationVisibility::Public, callHostFunctionAsConstructor, String(propertyName.publicName()));
auto name = makeString("set "_s, propertyName.publicName());
NativeExecutable* executable = vm.getHostFunction(customSetterFunctionCall, ImplementationVisibility::Public, callHostFunctionAsConstructor, 1, name);
Structure* structure = globalObject->customSetterFunctionStructure();
JSCustomSetterFunction* function = new (NotNull, allocateCell<JSCustomSetterFunction>(vm)) JSCustomSetterFunction(vm, executable, globalObject, structure, propertyName, setter);

// Can't do this during initialization because getHostFunction might do a GC allocation.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this comment relevant?

Comment thread Source/JavaScriptCore/runtime/VM.cpp Outdated
@@ -1633,119 +1633,119 @@ JSPropertyNameEnumerator* VM::emptyPropertyNameEnumeratorSlow()
NativeExecutable* VM::promiseResolvingFunctionResolveExecutableSlow()
{
ASSERT(!m_promiseResolvingFunctionResolveExecutable);
auto* executable = getHostFunction(promiseResolvingFunctionResolve, ImplementationVisibility::Public, callHostFunctionAsConstructor, emptyString());
auto* executable = getHostFunction(promiseResolvingFunctionResolve, ImplementationVisibility::Public, callHostFunctionAsConstructor, 0, emptyString());
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this length be 1 instead? Since the previous JSPromise::createResolvingFunctions needs length 1. I think all the followings have similar issues?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, fixed!

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 5, 2026
@Constellation Constellation removed the merging-blocked Applied to prevent a change from being merged label Jun 5, 2026
@webkit-ews-buildbot
Copy link
Copy Markdown
Collaborator

iOS Safer C++ Build #31293 (e685177)

⚠️ Found 1 fixed file! Please update expectations in Source/[Project]/SaferCPPExpectations by running the following command and update your pull request:

  • Tools/Scripts/update-safer-cpp-expectations -p WebCore --NoUncheckedPtrMemberChecker css/SelectorChecker.cpp --NoUncountedMemberChecker css/SelectorChecker.cpp --platform iOS

Copy link
Copy Markdown
Contributor

@hyjorc1 hyjorc1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me if EWS is happy

@Constellation Constellation added the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Jun 6, 2026
… FunctionExecutable

https://bugs.webkit.org/show_bug.cgi?id=316443
rdar://178844469

Reviewed by Justin Michaud and Yijia Huang.

This is slight optimization for case doing `bind` with native functions,
but largely a preparation for introducing optimization for patterns converting
JS builtins to C++ native functions. Previously NativeExecutable was not
holding length / name appropriately while FunctionExecutable was doing
so. As a result, JSBoundFunction related optimization was skipping
NativeExecutable cases. This becomes a problem when we convert JS
builtin functions to Native version as bind starts going to the slow path.
This patch alignes NativeExecutable's name and length handling much more
to FunctionExecutable.

* JSTests/stress/promise-resolving-functions-name-and-length.js: Added.
(shouldBe):
(new.Promise):
(checkAnonymousBuiltin):
(i.new.Promise):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/jit/JITThunks.cpp:
(JSC::JITThunks::WeakNativeExecutableHash::hash):
(JSC::JITThunks::WeakNativeExecutableHash::equal):
(JSC::JITThunks::finalize):
(JSC::JITThunks::hostFunctionStub):
* Source/JavaScriptCore/jit/JITThunks.h:
* Source/JavaScriptCore/runtime/BooleanConstructor.cpp:
(JSC::BooleanConstructor::finishCreation):
(JSC::BooleanConstructor::create):
* Source/JavaScriptCore/runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::canSkipNameAndLengthMaterialization):
* Source/JavaScriptCore/runtime/JSCustomGetterFunction.cpp:
(JSC::JSCustomGetterFunction::create):
* Source/JavaScriptCore/runtime/JSCustomSetterFunction.cpp:
(JSC::JSCustomSetterFunction::create):
* Source/JavaScriptCore/runtime/JSFunction.cpp:
(JSC::JSFunction::create):
(JSC::JSFunction::reifyLazyPropertyIfNeeded):
(JSC::JSFunction::reifyLazyPropertyForHostOrBuiltinIfNeeded):
(JSC::JSFunction::reifyLazyBoundNameIfNeeded):
(JSC::JSFunction::finishCreation): Deleted.
* Source/JavaScriptCore/runtime/JSFunction.h:
* Source/JavaScriptCore/runtime/JSFunctionInlines.h:
(JSC::JSFunction::originalLength):
(JSC::JSFunction::originalName):
(JSC::JSFunction::canAssumeNameAndLengthAreOriginal):
* Source/JavaScriptCore/runtime/JSFunctionWithFields.cpp:
(JSC::JSFunctionWithFields::create):
* Source/JavaScriptCore/runtime/JSFunctionWithFields.h:
* Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp:
(JSC::JSNativeStdFunction::getHostFunction):
(JSC::JSNativeStdFunction::create):
(JSC::JSNativeStdFunction::finishCreation): Deleted.
* Source/JavaScriptCore/runtime/JSNativeStdFunction.h:
* Source/JavaScriptCore/runtime/JSPromise.cpp:
(JSC::JSPromise::createFirstResolveFunction):
(JSC::JSPromise::createFirstRejectFunction):
* Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp:
(JSC::promiseAllSlow):
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::promiseAllSettledSlow):
(JSC::promiseAnySlow):
* Source/JavaScriptCore/runtime/JSPromisePrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::promiseProtoFuncFinallySlow):
* Source/JavaScriptCore/runtime/NativeExecutable.cpp:
(JSC::NativeExecutable::create):
(JSC::NativeExecutable::finishCreation):
(JSC::NativeExecutable::nameJSString const):
* Source/JavaScriptCore/runtime/NativeExecutable.h:
* Source/JavaScriptCore/runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::create):
(JSC::NumberConstructor::finishCreation):
* Source/JavaScriptCore/runtime/PinballCompletion.cpp:
(JSC::createHandler):
* Source/JavaScriptCore/runtime/StringConstructor.cpp:
(JSC::StringConstructor::finishCreation):
(JSC::StringConstructor::create):
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::getHostFunction):
(JSC::VM::getBoundFunction):
(JSC::VM::getRemoteFunction):
(JSC::VM::promiseResolvingFunctionResolveExecutableSlow):
(JSC::VM::promiseResolvingFunctionRejectExecutableSlow):
(JSC::VM::promiseFirstResolvingFunctionResolveExecutableSlow):
(JSC::VM::promiseFirstResolvingFunctionRejectExecutableSlow):
(JSC::VM::promiseResolvingFunctionResolveWithInternalMicrotaskExecutableSlow):
(JSC::VM::promiseResolvingFunctionRejectWithInternalMicrotaskExecutableSlow):
(JSC::VM::promiseCapabilityExecutorExecutableSlow):
(JSC::VM::promiseAllFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSlowFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledRejectFunctionExecutableSlow):
(JSC::VM::promiseAllSettledSlowFulfillFunctionExecutableSlow):
(JSC::VM::promiseAllSettledSlowRejectFunctionExecutableSlow):
(JSC::VM::promiseAnyRejectFunctionExecutableSlow):
(JSC::VM::promiseAnySlowRejectFunctionExecutableSlow):
* Source/JavaScriptCore/runtime/VM.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp:
(JSC::WebAssemblyFunction::create):
* Source/JavaScriptCore/wasm/js/WebAssemblyFunctionBase.cpp:
(JSC::WebAssemblyFunctionBase::finishCreation): Deleted.
* Source/JavaScriptCore/wasm/js/WebAssemblyFunctionBase.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyPromising.cpp:
(JSC::createWebAssemblyPromisingFunction):
* Source/JavaScriptCore/wasm/js/WebAssemblySuspending.cpp:
(JSC::createWebAssemblySuspendingFunction):
* Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.cpp:
(JSC::WebAssemblyWrapperFunction::create):

Canonical link: https://commits.webkit.org/314682@main
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 314682@main (a633a8a): https://commits.webkit.org/314682@main

Reviewed commits have been landed. Closing PR #66580 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit a633a8a into WebKit:main Jun 6, 2026
@webkit-commit-queue webkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Jun 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants