[JSC] DFG iterator_next should dispatch fast modes by iterator type
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
- Node* hasNext = addToGraph(IsEmpty, get(bytecode.m_next));
+ Node* isEmpty = addToGraph(IsEmpty, get(bytecode.m_next));
+ Node* isArrayIterator = addToGraph(IsCellWithType, OpInfo(JSArrayIteratorType), get(bytecode.m_iterator));
+ Node* andResult = addToGraph(ArithBitAnd, isEmpty, isArrayIterator);
+ m_exitOK = true;
+ addToGraph(ExitOK);
+ ...
- addToGraph(Branch, OpInfo(branchData), hasNext);
+ addToGraph(Branch, OpInfo(branchData), andResult);
A prior change allowed seenModes to carry multiple fast modes simultaneously, but the existing branch condition was IsEmpty(m_next) alone — true for every fast mode — so Map and Set iterators entered the FastArray block and immediately OSR-exited on its CheckStructure. The fix ANDs IsEmpty(m_next) with IsCellWithType(iterator, JSArrayIteratorType) (or JSMapIteratorType/JSSetIteratorType), mirroring the pattern already used in handleIteratorOpen.
Significance
Restores 2.5–2.8x speedup for mixed Array/Map and Array/Set for-of loops that were silently deoptimizing — a correctness fix in the DFG's multi-mode fast-path dispatcher.