Skip to content

[JSC] Inlined Array#sort should keep the comparator call kind for bound functions - #77428

Open
sosukesuzuki wants to merge 1 commit into
WebKit:mainfrom
sosukesuzuki:eng/dfg-inlined-array-sort-should-keep-the-comparator-call-kind-for-bound-functions
Open

sosukesuzuki wants to merge 1 commit into
WebKit:mainfrom
sosukesuzuki:eng/dfg-inlined-array-sort-should-keep-the-comparator-call-kind-for-bound-functions

Conversation

@sosukesuzuki

@sosukesuzuki sosukesuzuki commented Oct 18, 2026 •

Copy link
Copy Markdown
Member

b23a44b

[JSC] Inlined `Array#sort` should keep the comparator call kind for bound functions
https://bugs.webkit.org/show_bug.cgi?id=327983

Reviewed by NOBODY (OOPS!).

When the comparator is a bound function, BoundFunctionCallIntrinsic inlined its target as
BoundFunctionCall and dropped ArraySortComparatorCall. An OSR exit inside the target then
returned past the sort call instead of restarting it. Keep ArraySortComparatorCall.

Test: JSTests/stress/array-sort-inline-osr-exit-in-bound-comparator.js

* JSTests/stress/array-sort-inline-osr-exit-in-bound-comparator.js: Added.
(shouldBe):
(compare):
(compareWithBoundArguments):
(compareWithTailCall):
(useResult):
(ignoreResult):
(tailCall):
(callTailCall):
(sortBoundTwice):
(sortBoundWithArguments):
(sortBoundWithTailCall):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

b23a44b

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 loading 🧪 api-mac ✅ 🧪 api-wpe
loading 🧪 ios-wk2-wpt ⏳ 🧪 api-mac-debug ✅ 🧪 jsc-wpe
loading 🧪 jsc-x86-64 loading 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
✅ 🛠 🧪 jsc-debug-arm64 ✅ 🛠 ios-safer-cpp loading 🧪 mac-AS-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 gtk-wk2
✅ 🛠 vision-sim ⏳ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 loading 🛠 mac-safer-cpp ✅ 🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

…ound functions

https://bugs.webkit.org/show_bug.cgi?id=327983

Reviewed by NOBODY (OOPS!).

When the comparator is a bound function, BoundFunctionCallIntrinsic inlined its target as
BoundFunctionCall and dropped ArraySortComparatorCall. An OSR exit inside the target then
returned past the sort call instead of restarting it. Keep ArraySortComparatorCall.

Test: JSTests/stress/array-sort-inline-osr-exit-in-bound-comparator.js

* JSTests/stress/array-sort-inline-osr-exit-in-bound-comparator.js: Added.
(shouldBe):
(compare):
(compareWithBoundArguments):
(compareWithTailCall):
(useResult):
(ignoreResult):
(tailCall):
(callTailCall):
(sortBoundTwice):
(sortBoundWithArguments):
(sortBoundWithTailCall):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
@sosukesuzuki
sosukesuzuki requested a review from a team as a code owner October 18, 2026 05:24
@sosukesuzuki sosukesuzuki self-assigned this Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants