Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 218421554bbbf1b029d2cd2a0484fce36a46d5dd
https://github.com/WebKit/WebKit/commit/218421554bbbf1b029d2cd2a0484fce36a46d5dd
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
A JSTests/stress/json-parse-array-materialization.js
M Source/JavaScriptCore/runtime/LiteralParser.cpp
M Source/JavaScriptCore/runtime/LiteralParser.h
M Source/JavaScriptCore/runtime/MarkedVector.h
Log Message:
-----------
[JSC] Defer Array materialization in JSON.parse
https://bugs.webkit.org/show_bug.cgi?id=322048
rdar://185243612
Reviewed by Sosuke Suzuki.
This patch introduces deferred Array materialization mechanism in JSON.parse.
Instead of placing an element each time, we push it to the stack, and we
materialize Array at the end of Array literal. This stack is used for
arrays nested way, so when materializing, we use the slice between
[stackBase, end). This avoids growing and reallocating butterflies,
which reduces wasted allocation during JSON.parse.
Also we do drive-by fixes,
1. MarkedVector::append ends up calling slowAppend after it gets
mallocBase(). This is inefficient and not correct. We should do it
only when (1) expanding capacity or (2) newly registering a
m_markSet.
2. Accessing outOfLineCapacity requires some additional loads. But we do
not need to care about it when offset is not reaching to
firstOutOfLineOffset. Let's avoid loading them.
Test: JSTests/stress/json-parse-array-materialization.js
* JSTests/stress/json-parse-array-materialization.js: Added.
(shouldBe):
(shouldThrow):
(Array.isArray):
* Source/JavaScriptCore/runtime/LiteralParser.cpp:
(JSC::reviverMode>::materializeArray):
(JSC::requires):
* Source/JavaScriptCore/runtime/LiteralParser.h:
* Source/JavaScriptCore/runtime/MarkedVector.h:
(JSC::MarkedVector::append):
Canonical link: https://commits.webkit.org/319420@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
