Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: 1cece1c3565e74d68509aa7b14592138754be400 https://github.com/WebKit/WebKit/commit/1cece1c3565e74d68509aa7b14592138754be400 Author: Yusuke Suzuki <ysuz...@apple.com> Date: 2024-04-09 (Tue, 09 Apr 2024)
Changed paths: A JSTests/microbenchmarks/object-is-object.js M JSTests/stress/arguments-define-property-throws-out-of-memory.js M Source/JavaScriptCore/jit/ThunkGenerators.cpp M Source/JavaScriptCore/jit/ThunkGenerators.h M Source/JavaScriptCore/runtime/JSCJSValueInlines.h M Source/JavaScriptCore/runtime/VM.cpp Log Message: ----------- [JSC] Add some fast path to Object.is https://bugs.webkit.org/show_bug.cgi?id=272375 rdar://126115187 Reviewed by Alexey Shvayka. We found some use of Object.is's baseline function. So this patch adds a fast path in front of C++ function. With explicitly disabling DFG JIT, we can see the following result. ToT Patched object-is-object 56.3458+-0.2533 ^ 49.5551+-0.2161 ^ definitely 1.1370x faster JSTests/microbenchmarks/object-is-object.js is updated because we no longer ensure that sameValue will always resolve strings. That assumption is wrong. * JSTests/microbenchmarks/object-is-object.js: Added. (test): * Source/JavaScriptCore/jit/ThunkGenerators.cpp: (JSC::objectIsThunkGenerator): * Source/JavaScriptCore/jit/ThunkGenerators.h: * Source/JavaScriptCore/runtime/JSCJSValueInlines.h: (JSC::sameValue): * Source/JavaScriptCore/runtime/VM.cpp: (JSC::thunkGeneratorForIntrinsic): Canonical link: https://commits.webkit.org/277258@main To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes