Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f72ea56abf5c63e3eef3ed11dcd052fe94d133bc
      
https://github.com/WebKit/WebKit/commit/f72ea56abf5c63e3eef3ed11dcd052fe94d133bc
  Author: Yusuke Suzuki <[email protected]>
  Date:   2026-05-29 (Fri, 29 May 2026)

  Changed paths:
    A JSTests/stress/iterator-helpers-fast-path-drain-and-reentrancy.js
    A JSTests/stress/map-iterator-fully-packed-table.js
    M Source/JavaScriptCore/runtime/ArrayConstructor.cpp
    M Source/JavaScriptCore/runtime/IteratorOperations.h
    M Source/JavaScriptCore/runtime/JSMapIterator.h
    M Source/JavaScriptCore/runtime/JSOrderedHashTableHelper.h
    M Source/JavaScriptCore/runtime/JSSetIterator.h

  Log Message:
  -----------
  [JSC] JSOrderedHashTable is overly allocating DataTable
https://bugs.webkit.org/show_bug.cgi?id=315829
rdar://178227340

Reviewed by Yijia Huang.

CloseTable (JSOrderedHashTable) has HashTable and DataTable. HashTable
manages indice, and DataTable is a vector of actual key-values so that
we can maintain insertion order in that vector side. This means that
DataTable size does not need to be the same to HashTable: load-factor is
typically 50% or 75%. So actually held key-values are only up to 75% of
size of HashTable.

This patch computes this and reduces the allocation of DataTable. But we
add one slot IterationSentinel at the end and keeping it empty. So
iterator can stop by detecting empty value. Previously overly allocated
DataTable was guaranteeing this empty sentinel. But now we may use full
of DataTable vector, thus we need this sentinel explicitly.

Also, we found several issues.

1. forEachInIteratorProtocol is introduced in 299358@main. While we are
   getting entry index from MapIterator / SetIterator, we are obtaining
   storage from iterated Map / Set, not MapIterator / SetIterator's current
   cursor.
2. forEachInIteratorProtocol is not draining an iterator, which is
   incorrect as for-of should drain it.
3. (1) and (2) exist in tryCreateArrayFromMapIterator as well.

Test: JSTests/stress/map-iterator-fully-packed-table.js

* JSTests/stress/iterator-helpers-fast-path-drain-and-reentrancy.js: Added.
(shouldEq):
(throw.new.Error):
(i.shouldEq.it.next):
* JSTests/stress/map-iterator-fully-packed-table.js: Added.
(assert):
(buildMap):
(buildSet):
(drainMap):
(drainSet):
* Source/JavaScriptCore/runtime/ArrayConstructor.cpp:
(JSC::tryCreateArrayFromMapIterator):
* Source/JavaScriptCore/runtime/IteratorOperations.h:
(JSC::forEachInIteratorProtocol):
* Source/JavaScriptCore/runtime/JSMapIterator.h:
* Source/JavaScriptCore/runtime/JSOrderedHashTableHelper.h:
(JSC::JSOrderedHashTableHelper::dataCapacity):
(JSC::JSOrderedHashTableHelper::dataTableSize):
(JSC::JSOrderedHashTableHelper::tableSize):
(JSC::JSOrderedHashTableHelper::tableSizeSlow):
(JSC::JSOrderedHashTableHelper::expandIfNeeded):
(JSC::JSOrderedHashTableHelper::transitAndNext):
* Source/JavaScriptCore/runtime/JSSetIterator.h:

Canonical link: https://commits.webkit.org/314169@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to