Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f37e63364972e1422369384acae46239389122eb
https://github.com/WebKit/WebKit/commit/f37e63364972e1422369384acae46239389122eb
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
A JSTests/microbenchmarks/object-values-row.js
A JSTests/stress/object-values-indexed-properties.js
A JSTests/stress/object-values-many-properties.js
M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
Log Message:
-----------
[JSC] Fill the result array of `Object.values` directly instead of via
`MarkedArgumentBuffer`
https://bugs.webkit.org/show_bug.cgi?id=323406
Reviewed by Yusuke Suzuki.
Object.values on a plain object with N enumerable properties currently
collects the N values into a MarkedArgumentBuffer and then copies them into
the result array. MarkedArgumentBuffer has 8 inline slots, so from the 9th
property every call pays a fastMalloc/fastFree pair plus an add/remove on
Heap::markListSet for the spilled buffer. Object.values on a 12 field object
is 2.3x slower than V8 on our benchmark, and 1.5x slower than the same call
on an 8 field object.
This patch counts the indexed properties and the enumerable string
properties first, allocates the result array at that size, and then writes
each value straight into the array's contiguous storage. The array is
created fully initialized (holes), so the second walk may safely
re-materialize the property table after a GC. The having-a-bad-time case now
takes the generic path instead, since the fast path fills contiguous storage
directly.
Baseline Patched
object-values 5.0333+-0.1520 ^ 1.5819+-0.0352
^ definitely 3.1818x faster
object-entries 18.3643+-0.1810 ? 18.4215+-0.1904
?
object-values-row 6.7000+-0.1198 ^ 2.9258+-0.0584
^ definitely 2.2900x faster
object-keys-map-values 14.1839+-0.1945 13.9498+-0.1343
might be 1.0168x faster
proxy-ownkeys-via-object-keys 54.2542+-0.3351 ? 54.5607+-0.2671
?
object-keys 6.8686+-0.0807 6.8571+-0.0720
Tests: JSTests/microbenchmarks/object-values-row.js
JSTests/stress/object-values-many-properties.js
* JSTests/microbenchmarks/object-values-row.js: Added.
(test):
* JSTests/stress/object-values-indexed-properties.js: Added.
(shouldBe):
(check):
* JSTests/stress/object-values-many-properties.js: Added.
(shouldBe):
(reference):
(check):
(1000.check.makeObject):
(check.get check):
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/320603@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
