Title: [243299] trunk
- Revision
- 243299
- Author
- [email protected]
- Date
- 2019-03-21 10:42:41 -0700 (Thu, 21 Mar 2019)
Log Message
JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
https://bugs.webkit.org/show_bug.cgi?id=196078
<rdar://problem/35925380>
Reviewed by Mark Lam.
JSTests:
Add a new benchmark that allocates several objects and invokes put_by_val_direct
with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".
* microbenchmarks/put-by-val-direct-large-index.js: Added.
Source/_javascript_Core:
Unlike the other variations of putByIndex, it only checked if the index
was larger than MIN_SPARSE_ARRAY_INDEX when the indexingType was
ALL_BLANK_INDEXING_TYPES. This resulted in a huge butterfly being
allocated for object literals (e.g. `{[9e4]: ...}`) and objects parsed
from JSON.
* runtime/JSObject.cpp:
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (243298 => 243299)
--- trunk/JSTests/ChangeLog 2019-03-21 17:21:38 UTC (rev 243298)
+++ trunk/JSTests/ChangeLog 2019-03-21 17:42:41 UTC (rev 243299)
@@ -1,3 +1,16 @@
+2019-03-21 Tadeu Zagallo <[email protected]>
+
+ JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
+ https://bugs.webkit.org/show_bug.cgi?id=196078
+ <rdar://problem/35925380>
+
+ Reviewed by Mark Lam.
+
+ Add a new benchmark that allocates several objects and invokes put_by_val_direct
+ with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".
+
+ * microbenchmarks/put-by-val-direct-large-index.js: Added.
+
2019-03-21 Mark Lam <[email protected]>
Placate exception check validation in operationArrayIndexOfString().
Added: trunk/JSTests/microbenchmarks/put-by-val-direct-large-index.js (0 => 243299)
--- trunk/JSTests/microbenchmarks/put-by-val-direct-large-index.js (rev 0)
+++ trunk/JSTests/microbenchmarks/put-by-val-direct-large-index.js 2019-03-21 17:42:41 UTC (rev 243299)
@@ -0,0 +1,4 @@
+var acc = [];
+for (var i = 0; i < 1e6; i++) {
+ acc.push({[5e4 + (i % 1e4)]: true});
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (243298 => 243299)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-21 17:21:38 UTC (rev 243298)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-21 17:42:41 UTC (rev 243299)
@@ -1,5 +1,22 @@
2019-03-21 Tadeu Zagallo <[email protected]>
+ JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
+ https://bugs.webkit.org/show_bug.cgi?id=196078
+ <rdar://problem/35925380>
+
+ Reviewed by Mark Lam.
+
+ Unlike the other variations of putByIndex, it only checked if the index
+ was larger than MIN_SPARSE_ARRAY_INDEX when the indexingType was
+ ALL_BLANK_INDEXING_TYPES. This resulted in a huge butterfly being
+ allocated for object literals (e.g. `{[9e4]: ...}`) and objects parsed
+ from JSON.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
+
+2019-03-21 Tadeu Zagallo <[email protected]>
+
CachedUnlinkedSourceCodeShape::m_provider should be a CachedRefPtr
https://bugs.webkit.org/show_bug.cgi?id=196079
Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (243298 => 243299)
--- trunk/Source/_javascript_Core/runtime/JSObject.cpp 2019-03-21 17:21:38 UTC (rev 243298)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp 2019-03-21 17:42:41 UTC (rev 243299)
@@ -3055,7 +3055,7 @@
exec, i, value, attributes, mode,
ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
}
- if (i >= MIN_SPARSE_ARRAY_INDEX) {
+ if (indexIsSufficientlyBeyondLengthForSparseMap(i, 0) || i >= MIN_SPARSE_ARRAY_INDEX) {
return putDirectIndexBeyondVectorLengthWithArrayStorage(
exec, i, value, attributes, mode, createArrayStorage(vm, 0, 0));
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
