Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d126a37a66b1639268a94da0647988bc565a6a99
https://github.com/WebKit/WebKit/commit/d126a37a66b1639268a94da0647988bc565a6a99
Author: Alexey Shvayka <[email protected]>
Date: 2023-04-26 (Wed, 26 Apr 2023)
Changed paths:
M JSTests/microbenchmarks/object-get-own-property-symbols.js
M JSTests/microbenchmarks/reflect-own-keys.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGNodeType.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/Intrinsic.h
M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
M Source/JavaScriptCore/runtime/ObjectConstructor.h
M Source/JavaScriptCore/runtime/ReflectObject.cpp
M Source/JavaScriptCore/runtime/ReflectObject.h
M Source/JavaScriptCore/runtime/StructureRareData.h
Log Message:
-----------
[JSC] Expand existing property names caching onto Reflect.ownKeys() /
Object.getOwnPropertySymbols()
https://bugs.webkit.org/show_bug.cgi?id=255935
<rdar://problem/108512520>
Reviewed by Yusuke Suzuki.
This change expands existing Object.keys() / Object.getOwnPropertyNames()
StructureRareData-based
property names caching onto Reflect.ownKeys() / Object.getOwnPropertySymbols().
Vue.js v3 traps "ownKeys" on all reactive objects (except Map / Set) to merely
forward the call to
Reflect.ownKeys(), while web developers often destructure / call
Object.assign() on those Proxy objects.
Also, this change enables a follow-up optimization of Proxy objects without
"ownKeys" traps,
hence the renaming of CachedPropertyNamesKind that unties enumerators from
ObjectConstructor methods.
As for Object.getOwnPropertySymbols(), some older code on the web uses it
conditionally instead of
polyfilling Reflect.ownKeys(), and optimizing it along with Reflect.ownKeys()
brought convenience
of removing std::optional and a few conditions.
The downside of this patch is sizeof(StructureRareData) increase from 80 to 96.
ToT patch
reflect-own-keys-proxy 18.8444+-0.1230 ? 18.9896+-0.1170
?
reflect-own-keys-proxy-2 23.4113+-0.1775 ^ 21.2813+-0.1835
^ definitely 1.1001x faster
reflect-own-keys-function 8.3105+-0.0650 ^ 6.4431+-0.0452
^ definitely 1.2898x faster
reflect-own-keys 31.3966+-0.1861 ^ 0.9040+-0.0209
^ definitely 34.7312x faster
object-get-own-property-symbols 18.6633+-0.1597 ^ 1.0756+-0.0218
^ definitely 17.3512x faster
<geometric> 18.4640+-0.0749 ^ 4.7893+-0.0312
^ definitely 3.8553x faster
* JSTests/microbenchmarks/object-get-own-property-symbols.js:
* JSTests/microbenchmarks/reflect-own-keys.js:
Makes the property keys count way more real-world.
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::cachedPropertyNamesKind const):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
(JSC::DFG::operationOwnPropertyKeysVariant):
(JSC::DFG::operationOwnPropertyKeysVariantObject):
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h:
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::abstractHeapForOwnPropertyKeysCache):
(JSC::FTL::DFG::LowerDFGToB3::compileOwnPropertyKeysVariant):
(JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames):
Deleted.
* Source/JavaScriptCore/runtime/Intrinsic.h:
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::inferCachedPropertyNamesKind):
(JSC::ownPropertyKeys): Merely removes PropertyNameMode check, de-indents, and
extracts copyPropertiesToBuffer() helper.
* Source/JavaScriptCore/runtime/ObjectConstructor.h:
* Source/JavaScriptCore/runtime/ReflectObject.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/StructureRareData.h:
Canonical link: https://commits.webkit.org/263441@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
