Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8317f5c80ed481f795386bc0ad79a2295c183652
https://github.com/WebKit/WebKit/commit/8317f5c80ed481f795386bc0ad79a2295c183652
Author: Sosuke Suzuki <[email protected]>
Date: 2026-05-30 (Sat, 30 May 2026)
Changed paths:
A JSTests/stress/weak-map-weak-set-lazy-buffer.js
M Source/JavaScriptCore/b3/B3AbstractHeapRepository.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/JSWeakMap.h
M Source/JavaScriptCore/runtime/JSWeakSet.h
M Source/JavaScriptCore/runtime/WeakMapImpl.cpp
M Source/JavaScriptCore/runtime/WeakMapImpl.h
M Source/JavaScriptCore/runtime/WeakMapImplInlines.h
Log Message:
-----------
[JSC] Inline-allocate cells for `NewWeakMap` and `NewWeakSet`
https://bugs.webkit.org/show_bug.cgi?id=315814
Reviewed by Yusuke Suzuki.
NewWeakMap / NewWeakSet DFG nodes could not inline-allocate the cell because
WeakMapImpl eagerly allocates its hash buffer with fastMalloc in the constructor
(left as a FIXME when the nodes were added).
This patch makes the buffer lazily allocated. A freshly constructed
WeakMap/WeakSet
now points to a shared, immortal, all-zero buffer (g_emptyWeakMapBuffer) with
capacity 1. Since that buffer is always empty, every read path (C++, DFG, FTL)
works on it unchanged: lookups always miss and shrink/rehash never trigger. The
first add() (or addBucket(), which falls back to add() when it sees the shared
buffer) swaps in a real heap-allocated buffer with the usual initial capacity.
m_buffer becomes a raw pointer so the shared buffer is never freed; rehash() and
the destructor free only real buffers.
With that in place, compileNewWeakMap / compileNewWeakSet in DFG and FTL now
inline-allocate the JSWeakMap / JSWeakSet cell like NewMap / NewSet, storing the
shared empty buffer, capacity, and zeroed counters, with the existing operations
as the slow path.
TipOfTree Patched
weak-map-constructor-empty 43.9682+-2.5468 ^ 8.7839+-0.0804
^ definitely 5.0056x faster
weak-set-constructor-empty 42.6802+-0.9526 ^ 8.8691+-0.1928
^ definitely 4.8123x faster
weak-map-constructor 7.0352+-0.3864 6.6220+-0.3769
might be 1.0624x faster
weak-set-constructor 4.8727+-0.2691 ^ 4.4130+-0.1081
^ definitely 1.1042x faster
create-many-weak-map 23.4147+-0.3502 23.0340+-0.7137
might be 1.0165x faster
weak-map-key 36.4065+-1.3320 ? 36.7283+-1.1744
?
weak-set-key 33.7195+-0.9247 33.6985+-0.4455
<geometric> 21.0745+-0.3325 ^ 13.0612+-0.1327
^ definitely 1.6135x faster
* JSTests/stress/weak-map-weak-set-lazy-buffer.js: Added.
(assert):
(makeWeakMap):
(makeWeakSet):
(set for):
(makeFilledMap):
(SubWeakMap):
(makeSub):
(readHas):
* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/JSWeakMap.h:
* Source/JavaScriptCore/runtime/JSWeakSet.h:
* Source/JavaScriptCore/runtime/WeakMapImpl.cpp:
* Source/JavaScriptCore/runtime/WeakMapImpl.h:
(JSC::WeakMapBuffer::destroy):
(JSC::WeakMapImpl::emptyBuffer):
(JSC::WeakMapImpl::WeakMapImpl):
(JSC::WeakMapImpl::~WeakMapImpl):
(JSC::WeakMapImpl::offsetOfKeyCount):
(JSC::WeakMapImpl::offsetOfDeleteCount):
(JSC::WeakMapImpl::addInternal):
(JSC::WeakMapImpl::makeAndSetNewBuffer):
* Source/JavaScriptCore/runtime/WeakMapImplInlines.h:
(JSC::WeakMapImpl<WeakMapBucket>::add):
(JSC::WeakMapImpl<WeakMapBucket>::addBucket):
(JSC::WeakMapImpl<WeakMapBucket>::rehash):
Canonical link: https://commits.webkit.org/314218@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
