New `DateNow` DFG node

d53865e

Source/JavaScriptCore/dfg/DFGAbstractHeap.h

+ macro(WallClock) \

macro(JSDateFields) \

Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

+    case DateNow: {
+        setNonCellTypeForNode(node, SpecDoubleReal);
+        break;
+    }

JSC's DFG JIT represents JS computations as a typed data-flow graph. "Intrinsic" nodes let the compiler emit specialised machine code for known builtins instead of a full host-call sequence. Each node must be registered across multiple analysis passes (clobberize, doesGC, safeToExecute, prediction propagation, abstract interpreter) and across both 32-bit and 64-bit speculative JIT backends.

This commit introduces a DateNow DFG intrinsic so Date.now() is inlined directly in DFG and FTL tiers via a direct call to operationDateNow, eliminating host function dispatch overhead. A new WallClock abstract heap location is registered so CSE will not fold two DateNow nodes into one and LICM will not hoist the node out of a loop.

Significance

Benchmarks show a ~19% improvement, but more importantly every new DFG intrinsic must be wired through clobberize, doesGC, safeToExecute, prediction propagation, loop unrolling, and both speculative JIT backends, making each of those phase interactions a potential miscompilation surface.

Audit directions

WallClock clobberize annotation and superKind() chain. If the chain accidentally collapses into a broader heap class (e.g., World), alias analysis becomes overly conservative; if WallClock is missing from a relevant alias check, CSE could still fold calls.
SpecDoubleReal type tightness. Abstract interpreter sets the result to SpecDoubleReal (finite, non-NaN doubles). Platform clock implementations have edge cases; if operationDateNow ever returns NaN, Infinity, or negative values, downstream type-based speculations will fire.
Loop unrolling phase. DFGLoopUnrollingPhase::isNumericComputationNode was modified. If DateNow is misclassified as a pure numeric computation node, loop unrolling may duplicate or reorder clock reads.
32-bit JIT path. 32-bit intrinsic compile paths are exercised far less than 64-bit, and doubles returned from C operations require a GPR pair — most likely site for a subtle calling-convention or register-allocation mistake.