New `DateNow` DFG node

d53865e

Source/JavaScriptCore/dfg/DFGAbstractHeap.h

Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

JSC's DFG JIT represents JS computations as a typed data-flow graph. "Intrinsic" nodes let the compiler emit specialised machine code for known builtins instead of a full host-call sequence. Each node must be registered across multiple analysis passes (clobberize, doesGC, safeToExecute, prediction propagation, abstract interpreter) and across both 32-bit and 64-bit speculative JIT backends.

This commit introduces a DateNow DFG intrinsic so Date.now() is inlined directly in DFG and FTL tiers via a direct call to operationDateNow, eliminating host function dispatch overhead. A new WallClock abstract heap location is registered so CSE will not fold two DateNow nodes into one and LICM will not hoist the node out of a loop.

Significance

Benchmarks show a ~19% improvement, but more importantly every new DFG intrinsic must be wired through clobberize, doesGC, safeToExecute, prediction propagation, loop unrolling, and both speculative JIT backends, making each of those phase interactions a potential miscompilation surface.

Audit directions