Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 70eb5015aec426e421fad75c7df80b0e82417da6
https://github.com/WebKit/WebKit/commit/70eb5015aec426e421fad75c7df80b0e82417da6
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-17 (Mon, 17 Aug 2026)
Changed paths:
M Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp
M Source/JavaScriptCore/bytecode/PropertyInlineCache.h
Log Message:
-----------
[JSC] Move `PropertyInlineCache`'s buffered-structures set to
`RepatchingPropertyInlineCache`
https://bugs.webkit.org/show_bug.cgi?id=321903
Reviewed by Yusuke Suzuki.
m_bufferedStructures exists so that a repatching IC does not buffer the same
(Structure, identifier)
twice while it waits for bufferingCountdown before regenerating its stub.
Handler ICs never buffer:
they generate a handler as soon as they see a new case. But the set, its lock
and the countdown lived
in the shared base class, so every handler IC paid 24 bytes for them, plus a 64
or 256 byte Vector
buffer once it took the slow path twice.
Move them to RepatchingPropertyInlineCache and let
considerRepatchingCacheImpl() return true for
handler ICs after the countdown / cool-down checks. Handler ICs that fail to
cache a structure now
retry tryCache on the first few visits instead of skipping them; repatching ICs
are unchanged.
sizeof(HandlerPropertyInlineCache) 112 -> 88, embedded per IC site in Baseline
and DFG JITData.
Octane typescript x3, libpas Common Primitive Alloc after gc(): 27,657,088 ->
26,386,064 bytes (-1.27 MB).
* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:
(JSC::RepatchingPropertyInlineCache::RepatchingPropertyInlineCache):
(JSC::PropertyInlineCache::addAccessCase):
(JSC::PropertyInlineCache::reset):
(JSC::RepatchingPropertyInlineCache::visitBufferedStructures):
(JSC::RepatchingPropertyInlineCache::pruneDeadBufferedStructures):
(JSC::PropertyInlineCache::visitAggregateImpl):
(JSC::PropertyInlineCache::reconcileWeakReferencesAtGCEnd):
(JSC::HandlerPropertyInlineCache::initializeFromUnlinkedPropertyInlineCache):
(JSC::HandlerPropertyInlineCache::initializeFromDFGUnlinkedPropertyInlineCache):
* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:
(JSC::PropertyInlineCache::PropertyInlineCache):
(JSC::PropertyInlineCache::considerRepatchingCacheImpl):
(JSC::RepatchingPropertyInlineCache::considerBufferingStructure):
(JSC::PropertyInlineCache::clearBufferedStructures): Deleted.
Canonical link: https://commits.webkit.org/319282@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
