Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bb73af4a4bcda38d1d98b734657b2194a9c18dd9
https://github.com/WebKit/WebKit/commit/bb73af4a4bcda38d1d98b734657b2194a9c18dd9
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-27 (Sun, 27 Sep 2026)
Changed paths:
M Source/JavaScriptCore/jit/BaselineJITRegisters.h
M Source/JavaScriptCore/jit/JITCall.cpp
Log Message:
-----------
[JSC] Inline the `FastArray` path of `op_iterator_next` in Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=325235
Reviewed by Yusuke Suzuki.
Since 321765@main, op_iterator_next in FastArray mode keeps the array and the
index in registers, but Baseline JIT still calls operationIteratorNextFastArray
for every element just to compare the index with the length, load the element,
and increment the index.
This patch emits that inline when the array has Int32 or Contiguous shape.
Everything else (other shapes, holes, the end of the iteration) still calls
the operation.
JSC_useDFGJIT=false:
Baseline
Patched
for-of-iterate-array-map-set 29.8900+-0.1581
29.7767+-0.1250
for-of-array 21.3112+-0.7852 ^
19.1718+-0.7054 ^ definitely 1.1116x faster
for-of-map-entries-small 31.3058+-0.7578 ^
25.4863+-0.4365 ^ definitely 1.2283x faster
destructuring-array-default-value-can-not-throw
170.3542+-1.0871 ^
113.9192+-3.2472 ^ definitely 1.4954x faster
for-of-iterate-array-keys 0.9467+-0.0339
0.9339+-0.0255 might be 1.0138x faster
destructuring-array-default-value-can-throw
179.2686+-3.1179 ^
126.0118+-3.2163 ^ definitely 1.4226x faster
for-of-iterate-array-values 0.8888+-0.0239 ^
0.5561+-0.0583 ^ definitely 1.5983x faster
set-for-of 1.0253+-0.0176
1.0091+-0.0119 might be 1.0161x faster
for-of-set-values 4.4899+-0.0644
4.4801+-0.0332
deltablue-for-of 25.5335+-0.4039 ^
23.4437+-0.1427 ^ definitely 1.0891x faster
destructuring-parameters-overridden-by-function
0.2070+-0.0222 ?
0.2132+-0.0263 ? might be 1.0299x slower
destructuring-swap 335.4416+-2.5862 ^
278.3527+-1.8559 ^ definitely 1.2051x faster
for-of-iterate-array-entries 2.0522+-0.0482 ^
1.7884+-0.0258 ^ definitely 1.1475x faster
map-iteration-and-array-destructuring 29.4760+-0.8300 ^
23.5075+-0.4101 ^ definitely 1.2539x faster
for-of-map-entries 29.2083+-0.4562 ^
23.4122+-0.2152 ^ definitely 1.2476x faster
object-rest-computed-destructuring 8.6250+-0.2854
8.5315+-0.4462 might be 1.0110x faster
destructuring-arguments 105.1418+-0.5262 ?
106.4515+-2.5054 ? might be 1.0125x slower
for-of-array-map-mixed 19.4434+-0.2318 ^
13.9534+-0.1980 ^ definitely 1.3935x faster
map-for-of 2.9923+-0.0680
2.9329+-0.1175 might be 1.0202x faster
default-value-destructuring-object 51.4118+-0.2075 ?
52.1104+-0.7272 ? might be 1.0136x slower
for-of-vs-for-each 149.6821+-1.2120 ^
129.7002+-1.4633 ^ definitely 1.1541x faster
for-of-array-set-mixed 14.8330+-0.1947 ^
9.3350+-0.2204 ^ definitely 1.5890x faster
object-rest-destructuring 5.6781+-0.1259 ?
5.7954+-0.3287 ? might be 1.0206x slower
for-of-set-values-small 6.0209+-0.1435
5.9992+-0.0675
default-value-destructuring-array 188.7240+-2.4567 ^
101.6277+-2.3645 ^ definitely 1.8570x faster
* Source/JavaScriptCore/jit/JITCall.cpp:
(JSC::JIT::emit_op_iterator_next):
Canonical link: https://commits.webkit.org/322033@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
