Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0c5333c36c6de9b0c9af7ee2028eac34718d3a9e
https://github.com/WebKit/WebKit/commit/0c5333c36c6de9b0c9af7ee2028eac34718d3a9e
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
A JSTests/microbenchmarks/array-literal-tiny.js
A JSTests/microbenchmarks/array-map-tiny.js
A JSTests/microbenchmarks/new-array-variable-size-tiny.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/ButterflyInlines.h
Log Message:
-----------
[JSC] JIT Array butterfly allocation should follow to C++ behavior
https://bugs.webkit.org/show_bug.cgi?id=327138
rdar://189737731
Reviewed by Keith Miller.
JIT Array allocation uses the direct specified size for vector-length
while C++ can modify it to some size. In C++, when 0 is specified,
it uses BASE_CONTIGUOUS_VECTOR_LEN_EMPTY. When it is <
BASE_CONTIGUOUS_VECTOR_LEN, then it becomes BASE_CONTIGUOUS_VECTOR_LEN.
This difference causes performance issue since JIT allocation will go to
C++ slow path, but it allocates butterfly from different size-class, so
still the originally requested size-class MarkedBlock is not filled, we
repeatedly go to this slow path.
This patch fixes this inconsistency. Let's just use the C++'s rule
globally in JIT too.
This improes array-map-tiny / new-array-variable-size-tiny while not
hurting array-literal-tiny.
ToT Patched
array-map-tiny 28.7970+-1.0135 ^
17.8549+-1.4287 ^ definitely 1.6128x faster
array-literal-tiny 13.8644+-0.1024 13.7825+-0.0722
new-array-variable-size-tiny 17.4357+-0.2302 ^
7.9869+-0.0296 ^ definitely 2.1830x faster
Tests: JSTests/microbenchmarks/array-literal-tiny.js
JSTests/microbenchmarks/array-map-tiny.js
JSTests/microbenchmarks/new-array-variable-size-tiny.js
* JSTests/microbenchmarks/array-literal-tiny.js: Added.
(test):
* JSTests/microbenchmarks/array-map-tiny.js: Added.
(test):
* JSTests/microbenchmarks/new-array-variable-size-tiny.js: Added.
(test):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArraySlice):
(JSC::DFG::SpeculativeJIT::emitAllocateButterfly):
(JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/ButterflyInlines.h:
(JSC::Butterfly::optimalContiguousVectorLength):
Canonical link: https://commits.webkit.org/323411@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
