Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ea3fbb33caa535e1284ece06efc997479ffe5896
https://github.com/WebKit/WebKit/commit/ea3fbb33caa535e1284ece06efc997479ffe5896
Author: Yijia Huang <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/JavaScriptCore/runtime/JSONObject.cpp
Log Message:
-----------
[JSC] Cache FastStringifier's buffer pointer and length across property
emission
https://bugs.webkit.org/show_bug.cgi?id=321452
rdar://184544084
Reviewed by Yusuke Suzuki.
append() writes the property name as buffer()[m_length] one character at a time,
and every store forces a reload of both members: m_dynamicBuffer has inline
capacity, so buffer() can point inside the object next to m_length, and a store
through it may alias them. The property-name block pays 19 reloads for 9 stores.
Cache both in locals for the two runs of writes that sit between capacity
checks,
and publish m_length once at the end. The locals are captured after
hasRemainingCapacity(), which can reallocate, and m_length is published before
every exit -- hasRemainingCapacity() computes m_capacity - m_length, so a stale
value there would over-report free space and skip a needed grow.
Hot instantiation (Latin1, DynamicBuffer, HasGap::No): 1712 -> 1648 bytes, loads
70 -> 56, member reloads 26 -> 12.
Canonical link: https://commits.webkit.org/318944@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
