Changeset 243299 in webkit

Timestamp:

Mar 21, 2019, 10:42:41 AM (7 years ago)

Author:

Tadeu Zagallo

Message:

JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
​https://bugs.webkit.org/show_bug.cgi?id=196078
<rdar://problem/35925380>

Reviewed by Mark Lam.

JSTests:

Add a new benchmark that allocates several objects and invokes put_by_val_direct
with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".

• microbenchmarks/put-by-val-direct-large-index.js: Added.

Source/JavaScriptCore:

Unlike the other variations of putByIndex, it only checked if the index
was larger than MIN_SPARSE_ARRAY_INDEX when the indexingType was
ALL_BLANK_INDEXING_TYPES. This resulted in a huge butterfly being
allocated for object literals (e.g. {[9e4]: ...}) and objects parsed
from JSON.

• runtime/JSObject.cpp:

(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/put-by-val-direct-large-index.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-03-21  Tadeu Zagallo  <tzagallo@apple.com>
+
+        JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
+        https://bugs.webkit.org/show_bug.cgi?id=196078
+        <rdar://problem/35925380>
+
+        Reviewed by Mark Lam.
+
+        Add a new benchmark that allocates several objects and invokes put_by_val_direct
+        with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".
+
+        * microbenchmarks/put-by-val-direct-large-index.js: Added.
+
 2019-03-21  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-21  Tadeu Zagallo  <tzagallo@apple.com>
+
+        JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
+        https://bugs.webkit.org/show_bug.cgi?id=196078
+        <rdar://problem/35925380>
+
+        Reviewed by Mark Lam.
+
+        Unlike the other variations of putByIndex, it only checked if the index
+        was larger than MIN_SPARSE_ARRAY_INDEX when the indexingType was
+        ALL_BLANK_INDEXING_TYPES. This resulted in a huge butterfly being
+        allocated for object literals (e.g. `{[9e4]: ...}`) and objects parsed
+        from JSON.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
+
 2019-03-21  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -3056 +3056 @@
                 ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
         }
-        if (i >= MIN_SPARSE_ARRAY_INDEX) {
+        if (indexIsSufficientlyBeyondLengthForSparseMap(i, 0) || i >= MIN_SPARSE_ARRAY_INDEX) {
             return putDirectIndexBeyondVectorLengthWithArrayStorage(
                 exec, i, value, attributes, mode, createArrayStorage(vm, 0, 0));