[webkit-changes] [WebKit/WebKit] df4ada: [JSC] Use RegExpObject::globalOrSticky in DFG stre...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: df4adabdd6a1c75ed23e6acfa9a0f3996a373a41
      https://github.com/WebKit/WebKit/commit/df4adabdd6a1c75ed23e6acfa9a0f3996a373a41
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-06-02 (Fri, 02 Jun 2023)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp

  Log Message:
  -----------
  [JSC] Use RegExpObject::globalOrSticky in DFG strength reduction
https://bugs.webkit.org/show_bug.cgi?id=257657
rdar://110179746

Reviewed by Mark Lam.

We found that RegExpTestInline is not so frequently used and the reason was that we are incorrectly giving up
RegExpTest etc.'s strength reduction when it is not RegExpExecNonGlobalOrSticky. This means that we cannot use
RegExpTestInline if RegExp is something global variable.

    var regexp = /......../;

    function test() {
        return regexp.test(input)
    }

The reason of this restriction is that we need to identify lastIndex value to perform constant folding etc.
And this global variable's lastIndex is not known. But if regexp is not global and not sticky, lastIndex value
is not used, so we can attempt to perform strength reduction actually.

However, lastIndex is used by ToIntegerOrInfinity(regexp.lastIndex) before performing RegExp operations even when
RegExp is not global and not sticky. So, to make folding right, we first need to check that this field is Int32Use.

This patch relaxes the current folding policy. If we cannot identify lastIndex and RegExp is not global and not sticky,
then we insert GetRegExpObjectLastIndex and Check(Int32Use), and continue doing strength reduction.

* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):

Canonical link: https://commits.webkit.org/264839@main