Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 38411ab91e0177e045e7ec63d9d978d5c689aa2d
https://github.com/WebKit/WebKit/commit/38411ab91e0177e045e7ec63d9d978d5c689aa2d
Author: Sosuke Suzuki <[email protected]>
Date: 2026-01-19 (Mon, 19 Jan 2026)
Changed paths:
A JSTests/microbenchmarks/spread-set.js
A JSTests/stress/spread-set-dfg-ftl.js
A JSTests/stress/spread-set-having-a-bad-time.js
A JSTests/stress/spread-set-osr-exit.js
A JSTests/stress/spread-set.js
M Source/JavaScriptCore/bytecode/SpeculatedType.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.h
M Source/JavaScriptCore/dfg/DFGJITCode.cpp
M Source/JavaScriptCore/dfg/DFGJITCode.h
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGOperations.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/CommonSlowPathsInlines.h
M Source/JavaScriptCore/runtime/JSCellButterfly.cpp
M Source/JavaScriptCore/runtime/JSCellButterfly.h
Log Message:
-----------
[JSC] Optimize `[...set]`
https://bugs.webkit.org/show_bug.cgi?id=305446
Reviewed by Yusuke Suzuki.
This patch optimizes the spread syntax ([...set]) for Set objects by bypassing
the generic iterator protocol. Instead of calling Symbol.iterator and creating
{value, done} objects for each element, we directly iterate over the Set's
internal hash table storage.
TipOfTree Patched
spread-set 59.8129+-2.6835 ^ 22.9277+-0.0935 ^
definitely 2.6088x faster
* JSTests/microbenchmarks/spread-set.js: Added.
(const.set new):
* JSTests/stress/spread-set-dfg-ftl.js: Added.
(shouldBe):
(shouldBeArray):
(shouldBe.set shouldBe):
(shouldBe.const.set new):
(set let):
(test):
* JSTests/stress/spread-set-having-a-bad-time.js: Added.
(shouldBe):
(shouldBeArray):
* JSTests/stress/spread-set-osr-exit.js: Added.
(shouldBe):
(shouldBeArray):
(shouldBe.test):
(test):
(test.set return):
(set shouldBeArray):
(gen):
* JSTests/stress/spread-set.js: Added.
(shouldBe):
(shouldBeArray):
(shouldBe.test):
(test):
(Set.prototype.Symbol.iterator):
(setIteratorPrototype.next):
(MySet):
(sum):
* Source/JavaScriptCore/bytecode/SpeculatedType.h:
(JSC::isSetObjectSpeculation):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGJITCode.cpp:
(JSC::DFG::JITData::JITData):
(JSC::DFG::JITData::tryInitialize):
* Source/JavaScriptCore/dfg/DFGJITCode.h:
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateSetObject):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOperations.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileSpread):
* Source/JavaScriptCore/runtime/CommonSlowPathsInlines.h:
(JSC::CommonSlowPaths::trySpreadFast):
* Source/JavaScriptCore/runtime/JSCellButterfly.cpp:
(JSC::JSCellButterfly::createFromSet):
* Source/JavaScriptCore/runtime/JSCellButterfly.h:
Canonical link: https://commits.webkit.org/305845@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
