Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cea233cedec0d634e84b0eb2d3e495e62c9a6959
https://github.com/WebKit/WebKit/commit/cea233cedec0d634e84b0eb2d3e495e62c9a6959
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A JSTests/stress/duplicate-parameter-names-last-wins.js
M
Source/JavaScriptCore/SaferCPPExpectations/NoUncountedMemberCheckerExpectations
M
Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations
M Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
M Source/JavaScriptCore/bytecode/BytecodeGeneratorification.cpp
M Source/JavaScriptCore/bytecode/BytecodeList.rb
M Source/JavaScriptCore/bytecode/VariableWriteFireDetail.cpp
M Source/JavaScriptCore/bytecode/VariableWriteFireDetail.h
M Source/JavaScriptCore/bytecode/Watchpoint.h
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGGraph.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/jit/AssemblyHelpers.h
M Source/JavaScriptCore/jit/JIT.cpp
M Source/JavaScriptCore/jit/JIT.h
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/llint/LowLevelInterpreter.asm
M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
M Source/JavaScriptCore/lol/LOLJITOperations.cpp
M Source/JavaScriptCore/runtime/CachedTypes.cpp
M Source/JavaScriptCore/runtime/CommonSlowPathsInlines.h
M Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp
M Source/JavaScriptCore/runtime/GetPutInfo.h
M Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSSymbolTableObject.h
M Source/JavaScriptCore/runtime/ProgramExecutable.cpp
M Source/JavaScriptCore/runtime/ScopedArgumentsTable.cpp
M Source/JavaScriptCore/runtime/ScopedArgumentsTable.h
M Source/JavaScriptCore/runtime/SymbolTable.cpp
M Source/JavaScriptCore/runtime/SymbolTable.h
M Source/JavaScriptCore/runtime/SymbolTableInlines.h
M Source/JavaScriptCore/runtime/SyntheticModuleRecord.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
Log Message:
-----------
[JSC] `SymbolTableEntry` should not allocate a `WatchpointSet` until somebody
watches the variable
https://bugs.webkit.org/show_bug.cgi?id=321587
Reviewed by Yusuke Suzuki.
Every closure variable that its own function stores to (which includes the
initializing store of
`var` / `let` / `function` / `class` bindings and captured parameters) and
every global variable
gets SymbolTableEntry::prepareToWatch() when its CodeBlock is linked or the
global is declared.
That allocated a 16-byte FatEntry plus a WatchpointSet (a 32-byte libpas cell)
per variable.
The WatchpointSet is only needed once DFG constant-folds a load of the variable
and adds a
Watchpoint to it; until then LLInt, Baseline and DFG only read and step its
ClearWatchpoint / IsWatched / IsInvalidated state.
This patch makes FatEntry hold an InlineWatchpointSet, which keeps that state
in one word and
inflates to a WatchpointSet only when a Watchpoint is added. The
op_get_from_scope /
op_put_to_scope metadata, ResolveOp, DFG NotifyWrite and ScopedArgumentsTable
now point at the
InlineWatchpointSet, and LLInt / Baseline / DFG / FTL check its word inline
before falling back to
the WatchpointSet state. Since an InlineWatchpointSet cannot be shared, copies
of a
SymbolTableEntry are now always thin; the few places that took the watchpoint
set from a copy use
SymbolTable::find() instead, and JSGlobalObject::defineOwnProperty sets the
read-only bit in place
rather than replacing the entry.
In a server application made of about 250 CommonJS modules, main allocated
1,466 WatchpointSets
right after loading the application, while this patch allocates none. Even
after the code has
been JIT-compiled by DFG/FTL, only 376 of the 1,752 watchpoint sets got
inflated; the rest stayed
inline watchpoint sets.
* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:
* Source/JavaScriptCore/bytecode/BytecodeList.rb:
* Source/JavaScriptCore/bytecode/VariableWriteFireDetail.cpp:
(JSC::VariableWriteFireDetail::touch):
* Source/JavaScriptCore/bytecode/VariableWriteFireDetail.h:
* Source/JavaScriptCore/bytecode/Watchpoint.h:
(JSC::InlineWatchpointSet::inflatedSetConcurrently const):
(JSC::InlineWatchpointSet::offsetOfData):
(JSC::InlineWatchpointSet::thinFlag):
(JSC::InlineWatchpointSet::encodedThinState):
(JSC::InlineWatchpointSet::encodeState):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryGetConstantClosureVar):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::watchpointSet):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNotifyWrite):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
* Source/JavaScriptCore/jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::branchIfInlineWatchpointSetIsStillValid):
* Source/JavaScriptCore/jit/JIT.cpp:
(JSC::JIT::emitNotifyWriteWatchpoint):
* Source/JavaScriptCore/jit/JIT.h:
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:
* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:
* Source/JavaScriptCore/lol/LOLJITOperations.cpp:
(JSC::LOL::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/runtime/CommonSlowPathsInlines.h:
(JSC::CommonSlowPaths::cacheGlobalLexicalVar):
(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
* Source/JavaScriptCore/runtime/GetPutInfo.h:
(JSC::ResolveOp::ResolveOp):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::defineOwnProperty):
(JSC::JSGlobalObject::addStaticGlobals):
* Source/JavaScriptCore/runtime/JSSymbolTableObject.h:
(JSC::symbolTablePutTouchWatchpointSet):
(JSC::symbolTablePutInvalidateWatchpointSet):
(JSC::symbolTablePut):
* Source/JavaScriptCore/runtime/ProgramExecutable.cpp:
(JSC::ProgramExecutable::initializeGlobalProperties):
* Source/JavaScriptCore/runtime/ScopedArgumentsTable.cpp:
(JSC::ScopedArgumentsTable::trySetWatchpointSet):
* Source/JavaScriptCore/runtime/ScopedArgumentsTable.h:
* Source/JavaScriptCore/runtime/SymbolTable.cpp:
(JSC::SymbolTableEntry::inflateSlow):
(JSC::SymbolTable::hasScopedWatchpointSet):
(JSC::SymbolTableEntry::copySlow): Deleted.
(JSC::SymbolTableEntry::prepareToWatch): Deleted.
* Source/JavaScriptCore/runtime/SymbolTable.h:
(JSC::SymbolTableEntry::varOffsetFromBits):
(JSC::SymbolTableEntry::scopeOffsetFromBits):
(JSC::SymbolTableEntry::SymbolTableEntry):
(JSC::SymbolTableEntry::operator=):
(JSC::SymbolTableEntry::isWatchable const):
(JSC::SymbolTableEntry::prepareToWatch):
(JSC::SymbolTableEntry::watchpointSet):
(JSC::SymbolTableEntry::pack):
(JSC::SymbolTableEntry::disableWatching): Deleted.
* Source/JavaScriptCore/runtime/SymbolTableInlines.h:
(JSC::SymbolTableEntry::SymbolTableEntry):
(JSC::SymbolTableEntry::operator=):
(JSC::SymbolTable::prepareToWatchScopedArgument):
(JSC::SymbolTableEntry::inflate): Deleted.
Canonical link: https://commits.webkit.org/319646@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
