Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 752e7e8b0d05a5b13ce3d573bb75e7e8c86ad019
https://github.com/WebKit/WebKit/commit/752e7e8b0d05a5b13ce3d573bb75e7e8c86ad019
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/has-own-property-call-for-in-loop.js
A JSTests/stress/for-in-has-own-property-call-edge-cases.js
A JSTests/stress/for-in-has-own-property-call.js
M Source/JavaScriptCore/dfg/DFGNode.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
Log Message:
-----------
[JSC] Convert `HasOwnProperty` on the current for-in property name to
`EnumeratorHasOwnProperty`
https://bugs.webkit.org/show_bug.cgi?id=318528
Reviewed by Yusuke Suzuki.
Object.prototype.hasOwnProperty.call(o, p) is a common guard inside `for (p in
o)`
(eslint's no-prototype-builtins rewrites o.hasOwnProperty(p) into this form).
However, op_enumerator_has_own_property is not emitted for it: the recognition
happens only in the parser, which matches the exact syntactic form
`o.hasOwnProperty(p)`, so the .call spelling (and Object.hasOwn) falls back to
the generic HasOwnProperty node that hashes the key on every iteration.
This patch additionally converts HasOwnProperty to EnumeratorHasOwnProperty in
DFG strength reduction, when the key is the EnumeratorNextUpdatePropertyName of
an enumeration whose GetPropertyEnumerator base is the same node as the object.
This makes the guard a structure ID comparison regardless of spelling.
Baseline
Patched
object-has-own-for-in-loop 4.7828+-0.0548 ^
4.0638+-0.0909 ^ definitely 1.1769x faster
has-own-property-call-for-in-loop 12.0470+-0.2778 ^
9.5166+-0.2442 ^ definitely 1.2659x faster
Tests: JSTests/microbenchmarks/has-own-property-call-for-in-loop.js
JSTests/stress/for-in-has-own-property-call-edge-cases.js
JSTests/stress/for-in-has-own-property-call.js
* JSTests/microbenchmarks/has-own-property-call-for-in-loop.js: Added.
(assert):
(test1.count):
(test1):
* JSTests/stress/for-in-has-own-property-call-edge-cases.js: Added.
(assert):
(oracle):
(deleteCurrent):
(deleteCurrentHasOwn):
(clobber):
(guardAfterClobber):
(differential):
(reassign):
(nested):
(proxyGuard):
(proxyThrow):
(polyBase):
(makeLarge):
(i.assert.guardAfterClobber):
(i.assert):
(i.p.string_appeared_here.Object.setPrototypeOf):
(i.assert.nested):
(i.assert.polyBase):
(i.assert.polyBase.Object.freeze):
* JSTests/stress/for-in-has-own-property-call.js: Added.
(assert):
(countOwn):
(countHasOwn):
(crossCheck):
(deleteDuring):
(countIndexed):
* Source/JavaScriptCore/dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToEnumeratorHasOwnProperty):
* Source/JavaScriptCore/dfg/DFGNode.h:
* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
Canonical link: https://commits.webkit.org/316538@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
