Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b718c65267c607f8086ddb4b0f51e254a3491c87
https://github.com/WebKit/WebKit/commit/b718c65267c607f8086ddb4b0f51e254a3491c87
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
A JSTests/stress/json-parse-object-key-matches-transition.js
M Source/JavaScriptCore/runtime/LiteralParser.cpp
M Source/JavaScriptCore/runtime/LiteralParser.h
Log Message:
-----------
[JSC] Using single-transition entry as a cache for the next identifier in
JSON.parse
https://bugs.webkit.org/show_bug.cgi?id=325179
rdar://188311479
Reviewed by Keith Miller.
JSON.parse may encounter many "same-shaped" object creations. This is
very common like this.
`[ { "name": "hello", "value": 42 }, { "name": "world", "value", 45 } ]`
As a result, when baking a new object, likely, its Structure's
single-transition key is the next identifier. So use it as a cache. We
add a fast path, directly comparing the source with the cached
identifier, to make lexing fast (and avoid atomization). We also make
sure that structure are efficiently tracked by combining putDirectWithoutBarrier
and setStructureIDDirectly.
Test: JSTests/stress/json-parse-object-key-matches-transition.js
* JSTests/stress/json-parse-object-key-matches-transition.js: Added.
(shouldBe):
(keysOf):
(check):
* Source/JavaScriptCore/runtime/LiteralParser.cpp:
(JSC::reviverMode>::Lexer::consumeColon):
(JSC::reviverMode>::Lexer::tryConsumeStringEqualTo):
(JSC::requires):
* Source/JavaScriptCore/runtime/LiteralParser.h:
Canonical link: https://commits.webkit.org/321841@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
