Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6654fe520c0b94de12aff50be1839be853f9e15e
https://github.com/WebKit/WebKit/commit/6654fe520c0b94de12aff50be1839be853f9e15e
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths:
A JSTests/microbenchmarks/array-prototype-filter-int32.js
A JSTests/stress/new-array-with-size-vector-length-hint.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Use `vectorLengthHint` in `ArrayAllocationProfile` for
`NewArrayWithSize` node
https://bugs.webkit.org/show_bug.cgi?id=317466
Reviewed by Yusuke Suzuki.
Array.prototype.filter creates its result via op_new_array_with_species
with length 0, which the DFG converts to NewArrayWithSize(0). The
resulting JSArray has a tiny initial vector, so appending elements
repeatedly reallocates the butterfly (~56% of filter time spent in
ensureLengthSlow / reallocArrayRightIfPossible / memmove / memset).
ArrayAllocationProfile already learns the eventual vectorLength of the
last allocated array (capped at BASE_CONTIGUOUS_VECTOR_LEN_MAX = 25),
but NewArrayWithSize was not consuming it. This patch threads the
profile vectorLengthHint through NewArrayWithSpecies / NewArrayWithSize
into NewButterflyWithSize and uses it as the initial vectorLength while
keeping publicLength unchanged. Because the hint is adaptive and capped,
low-selectivity filters and small arrays do not over-allocate.
Baseline Patched
array-prototype-filter-int32 119.0802+-0.6515 ^ 70.6984+-1.3794
^ definitely 1.6843x faster
* JSTests/microbenchmarks/array-prototype-filter-int32.js: Added.
* JSTests/stress/new-array-with-size-vector-length-hint.js: Added.
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToNewArrayWithSize):
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::hasVectorLengthHint):
(JSC::DFG::Node::vectorLengthHint):
* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewButterflyWithSize):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNewButterflyWithSize):
Canonical link: https://commits.webkit.org/317563@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
