Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e5a9344fbb6d6e72bf8250e8215b50da8528ffe5
https://github.com/WebKit/WebKit/commit/e5a9344fbb6d6e72bf8250e8215b50da8528ffe5
Author: Yusuke Suzuki <[email protected]>
Date: 2023-04-10 (Mon, 10 Apr 2023)
Changed paths:
A JSTests/microbenchmarks/object-assign-multiple.js
M Source/JavaScriptCore/builtins/BuiltinExecutables.cpp
M Source/JavaScriptCore/builtins/BuiltinExecutables.h
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
M Source/JavaScriptCore/bytecode/CodeBlock.h
M Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
M Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
M Source/JavaScriptCore/heap/Heap.cpp
M Source/JavaScriptCore/heap/Heap.h
M Source/JavaScriptCore/runtime/ArgList.h
M Source/JavaScriptCore/runtime/ErrorInstance.cpp
M Source/JavaScriptCore/runtime/ErrorInstance.h
M Source/JavaScriptCore/runtime/FunctionExecutable.h
M Source/JavaScriptCore/runtime/FunctionExecutableInlines.h
M Source/JavaScriptCore/runtime/GlobalExecutable.cpp
M Source/JavaScriptCore/runtime/GlobalExecutable.h
M Source/JavaScriptCore/runtime/InferredValue.h
M Source/JavaScriptCore/runtime/InferredValueInlines.h
M Source/JavaScriptCore/runtime/JSFinalizationRegistry.cpp
M Source/JavaScriptCore/runtime/JSFinalizationRegistry.h
M Source/JavaScriptCore/runtime/JSObject.cpp
M Source/JavaScriptCore/runtime/JSObject.h
M Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp
M Source/JavaScriptCore/runtime/JSWeakObjectRef.h
M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h
M Source/JavaScriptCore/runtime/Structure.cpp
M Source/JavaScriptCore/runtime/Structure.h
M Source/JavaScriptCore/runtime/StructureInlines.h
M Source/JavaScriptCore/runtime/StructureRareData.cpp
M Source/JavaScriptCore/runtime/StructureRareData.h
M Source/JavaScriptCore/runtime/StructureTransitionTable.h
M Source/JavaScriptCore/runtime/SymbolTable.h
M Source/JavaScriptCore/runtime/SymbolTableInlines.h
M Source/JavaScriptCore/runtime/WeakMapImpl.h
M Source/JavaScriptCore/runtime/WeakMapImplInlines.h
M Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h
Log Message:
-----------
[JSC] Make StructureTransitionTable link half-weak
https://bugs.webkit.org/show_bug.cgi?id=255137
rdar://107739562
Reviewed by Mark Lam.
This patch optimizes Object.assign by doing two things.
1. Add putOwnDataPropertyBatching. We batch the property additions by just
tracing structure transitions.
This offers a chance to remove unnecessary intermediate butterfly
allocations.
2. We found that now the hottest code in Object.assign is Structure transition
itself. This patch optimizes
this by rearchitect structure transition table mechanism. Previously we were
having Weak<Structure> for
single transition. But this is (1) too costly, Weak is generic and not so
efficient abstraction. Every
access to this field becomes double-pointer loading. And (2) too aggressive.
Most of Structure lives for
a long time while instances die quickly. We should allow keeping this
structure chain alive at least during
Eden collections. To make both work, this patch changes this link
"half-weak". During Eden collection, we
always mark it. But in full collection, we ignore this link, and GC End
phase clears it if this Structure
is collected. This way allows us to have good balance of Structure
book-keeping, plain simple field access
for structure transition, and not doing GC End phase clearing for Structures
in each Eden GC.
Object.assign gets 30% better.
ToT Patched
object-assign-multiple 134.7853+-0.4586 ^ 103.1172+-0.1968
^ definitely 1.3071x faster
* JSTests/microbenchmarks/object-assign-multiple.js: Added.
(extend1):
(test):
* Source/JavaScriptCore/builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::finalizeUnconditionally):
* Source/JavaScriptCore/builtins/BuiltinExecutables.h:
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finalizeUnconditionally):
* Source/JavaScriptCore/bytecode/CodeBlock.h:
* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:
(JSC::UnlinkedFunctionExecutable::finalizeUnconditionally):
* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h:
* Source/JavaScriptCore/heap/Heap.cpp:
(JSC::Heap::finalizeMarkedUnconditionalFinalizers):
(JSC::Heap::finalizeUnconditionalFinalizers):
* Source/JavaScriptCore/heap/Heap.h:
* Source/JavaScriptCore/runtime/ArgList.h:
* Source/JavaScriptCore/runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/ErrorInstance.h:
* Source/JavaScriptCore/runtime/FunctionExecutable.h:
* Source/JavaScriptCore/runtime/FunctionExecutableInlines.h:
(JSC::FunctionExecutable::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/GlobalExecutable.cpp:
(JSC::GlobalExecutable::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/GlobalExecutable.h:
* Source/JavaScriptCore/runtime/InferredValue.h:
* Source/JavaScriptCore/runtime/InferredValueInlines.h:
(JSC::InferredValue<JSCellType>::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/JSFinalizationRegistry.cpp:
(JSC::JSFinalizationRegistry::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/JSFinalizationRegistry.h:
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::putOwnDataPropertyBatching):
* Source/JavaScriptCore/runtime/JSObject.h:
* Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp:
(JSC::JSWeakObjectRef::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/JSWeakObjectRef.h:
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::objectAssignFast):
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::StructureTransitionTable::setSingleTransition):
(JSC::StructureTransitionTable::contains const):
(JSC::StructureTransitionTable::add):
(JSC::Structure::addNewPropertyTransition):
(JSC::Structure::removeNewPropertyTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::nonPropertyTransitionSlow):
(JSC::Structure::visitChildrenImpl):
(JSC::Structure::setBrandTransition):
(JSC::Structure::finalizeUnconditionally):
(): Deleted.
(JSC::singleSlotTransitionWeakOwner): Deleted.
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::shouldDoCacheableDictionaryTransitionForAdd):
(JSC::Structure::transitionCountEstimate const):
* Source/JavaScriptCore/runtime/StructureInlines.h:
(JSC::Structure::addPropertyTransitionToExistingStructureImpl):
(JSC::StructureTransitionTable::trySingleTransition const):
(JSC::StructureTransitionTable::get const):
(JSC::StructureTransitionTable::finalizeUnconditionally):
(JSC::StructureTransitionTable::singleTransition const): Deleted.
* Source/JavaScriptCore/runtime/StructureRareData.cpp:
(JSC::StructureRareData::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/StructureRareData.h:
* Source/JavaScriptCore/runtime/StructureTransitionTable.h:
(JSC::StructureTransitionTable::~StructureTransitionTable):
(JSC::StructureTransitionTable::setMap):
(JSC::StructureTransitionTable::StructureTransitionTable): Deleted.
(JSC::StructureTransitionTable::weakImpl const): Deleted.
* Source/JavaScriptCore/runtime/SymbolTable.h:
* Source/JavaScriptCore/runtime/SymbolTableInlines.h:
(JSC::SymbolTable::finalizeUnconditionally):
* Source/JavaScriptCore/runtime/WeakMapImpl.h:
* Source/JavaScriptCore/runtime/WeakMapImplInlines.h:
(JSC::WeakMapImpl<WeakMapBucket>::finalizeUnconditionally):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp:
(JSC::JSWebAssemblyModule::finalizeUnconditionally):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h:
Canonical link: https://commits.webkit.org/262809@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
