Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 8339909e6ce15eb0070e5ec79871bff7e7c76148
      
https://github.com/WebKit/WebKit/commit/8339909e6ce15eb0070e5ec79871bff7e7c76148
  Author: Sosuke Suzuki <[email protected]>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    A JSTests/microbenchmarks/object-spread-small-clone.js
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h

  Log Message:
  -----------
  [JSC] Avoid zero-filling and `gcSafeMemcpy` in `tryCreateObjectViaCloning`
https://bugs.webkit.org/show_bug.cgi?id=319850

Reviewed by Yusuke Suzuki.

tryCreateObjectViaCloning, which implements the fast path of object spread `{ 
...source }`,
was creating a JSFinalObject via createWithButterfly, which zero-fills the 
inline storage in
its constructor, and then copying source's inline storage over it with 
gcSafeMemcpy. Since the
zero-filled values are always overwritten by source's values, that memset is 
pure waste.

This patch adds a JSFinalObject constructor (and 
createWithButterflyCopyingInlineStorage)
which initializes the inline storage by copying from another object's inline 
storage instead
of zero-filling it. Because the new object is not exposed to anyone until this 
function
returns, the copy does not need to be gcSafeMemcpy either. Also, DeferGC and 
the out-of-line
capacity computation are now only performed when source actually has 
out-of-line properties.

                                             Baseline                  Patched

    object-spread-small-clone            11.7545+-0.1951     ^      
9.9040+-0.2022        ^ definitely 1.1868x faster
    clone-objects-via-spread-first       17.8918+-0.1675           
17.5364+-0.3234          might be 1.0203x faster
    clone-objects-via-spread             16.5543+-0.2060           
16.3735+-0.1780          might be 1.0110x faster

Test: JSTests/microbenchmarks/object-spread-small-clone.js

* JSTests/microbenchmarks/object-spread-small-clone.js: Added.
* Source/JavaScriptCore/runtime/JSObject.h:
(JSC::JSFinalObject::createWithButterflyCopyingInlineStorage):
* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::tryCreateObjectViaCloning):

Canonical link: https://commits.webkit.org/317659@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to