Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 69b336c0ac0539338e0d764beba3da19bc58af3c
https://github.com/WebKit/WebKit/commit/69b336c0ac0539338e0d764beba3da19bc58af3c
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M
Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations
M Source/JavaScriptCore/parser/Parser.h
M Source/JavaScriptCore/parser/SourceProviderCacheItem.h
Log Message:
-----------
[JSC] `SourceProviderCacheItem::create` over-allocates the trailing
`PackedPtr` array
https://bugs.webkit.org/show_bug.cgi?id=321488
Reviewed by Yusuke Suzuki.
SourceProviderCacheItem stores its used-variable names in a trailing
PackedPtr<UniquedStringImpl> array, whose element is 6 bytes on 64-bit
macOS/Linux, but create() sized the allocation with
sizeof(UniquedStringImpl*) (8 bytes) per element, so every item carried 2
unused bytes per used variable. These items are created for each function
longer than 16 characters in a parsed source and live in the VM's
SourceProviderCache until the next full GC, so the slack accumulates.
Make SourceProviderCacheItem a TrailingArray of PackedRefPtr<UniquedStringImpl>
so that the allocation size, element construction and ref/deref all derive
from the declared element type instead of being hand-written. Moving the
element count into TrailingArray::m_size also lets isBodyArrowExpression share
a word with tokenType, shrinking the fixed part from 40 to 36 bytes on
macOS/Linux. Parsing a 17.8 MB bundle (64,830 items, 3.56 used variables per
item on average) goes from 4.80 MB to 4.22 MB of malloc'd
SourceProviderCacheItem storage after size-class rounding (4.46 MB with the
element size fix alone).
* Source/JavaScriptCore/parser/Parser.h:
(JSC::Scope::restoreFromSourceProviderCache):
* Source/JavaScriptCore/parser/SourceProviderCacheItem.h:
(JSC::SourceProviderCacheItem::create):
(JSC::SourceProviderCacheItem::SourceProviderCacheItem):
(JSC::SourceProviderCacheItem::endFunctionToken const): Deleted.
(JSC::SourceProviderCacheItem::lexicallyScopedFeatures const): Deleted.
(JSC::SourceProviderCacheItem::usedVariables const): Deleted.
(JSC::SourceProviderCacheItem::~SourceProviderCacheItem): Deleted.
Canonical link: https://commits.webkit.org/319014@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
