Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ae97aa471a12f25db388f1e95cc99f03a290d295
https://github.com/WebKit/WebKit/commit/ae97aa471a12f25db388f1e95cc99f03a290d295
Author: Tetsuharu Ohzeki <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/microbenchmarks/array-prototype-copyWithin-contiguous-has-hole.js
M JSTests/microbenchmarks/array-prototype-copyWithin-contiguous.js
A JSTests/microbenchmarks/array-prototype-copyWithin-double-has-hole.js
M JSTests/microbenchmarks/array-prototype-copyWithin-double.js
A JSTests/microbenchmarks/array-prototype-copyWithin-int32-has-hole.js
M JSTests/microbenchmarks/array-prototype-copyWithin-int32.js
A
JSTests/stress/array-prototype-copyWithin-contiguous-array-proto-has-indexed-props.js
M JSTests/stress/array-prototype-copyWithin-contiguous.js
A
JSTests/stress/array-prototype-copyWithin-double-array-proto-has-indexed-props.js
M JSTests/stress/array-prototype-copyWithin-double.js
A
JSTests/stress/array-prototype-copyWithin-int32-array-proto-has-indexed-props.js
M JSTests/stress/array-prototype-copyWithin-int32.js
M Source/JavaScriptCore/runtime/JSArray.cpp
Log Message:
-----------
[JSC] Use fast parh of `Array#copyWithIn` even if an array having a hole and
indexed as `ArrayWithInt32`, `ArrayWithDouble`, and `ArrayWithContiguous`
https://bugs.webkit.org/show_bug.cgi?id=323593
Reviewed by Yusuke Suzuki.
This change adds the support for array _having a hole_
to the fast path for [`Array#copyWithIn`][the spec] which was introduced in
https://commits.webkit.org/291766@main
Previously the fast path give up if the array has a hole conservatively.
We need to handle them as a part of the step 18c~18e in the spec.
However, we have a chance.
An array hole would be happen only in the following case.
- Initialized with a hole by constructor: `new Array(16)`
- Initialized with a hole by literal: `[, 1]`
- Extend `Array#length`: `var array = []; array.length = 100;`
- Delete an indexed property: `delete array[1]`
And an array hole is represnted as following internally for every cases:
- `JSC:ValueEmpty` : `ArrayWithInt32`, and `ArrayWithContiguous`.
- `JSC:PNaN`: `ArrayWithDouble`.
Thus we can use `memmoveSpan()`/`gcSafeMemmove()` for them.
This removes liner scan (`containsHole()`) from the fast path.
`ArrayWithArrayStorage` case also has the fast path but it does not follow this
optimization.
It's an out of scope of this change.
[the spec]: https://tc39.es/ecma262/2026/#sec-array.prototype.copywithin
The benchmark result is here:
```
TipOfTree
Patched
array-prototype-copyWithin-int32 1.2775+-0.0295 ^
0.6138+-0.0532 ^ definitely 2.0813x faster
array-prototype-copyWithin-double 1.4083+-0.0342 ^
0.6289+-0.0417 ^ definitely 2.2393x faster
array-prototype-copyWithin-contiguous-has-hole
29.2703+-1.1639 ^
0.6603+-0.0382 ^ definitely 44.3303x faster
array-prototype-copyWithin-int32-has-hole
29.2755+-1.1147 ^
0.6363+-0.0135 ^ definitely 46.0096x faster
array-prototype-copyWithin-contiguous 1.3071+-0.0339 ^
0.6790+-0.0131 ^ definitely 1.9251x faster
array-prototype-copyWithin-double-has-hole
30.9277+-0.3593 ^
0.6198+-0.0284 ^ definitely 49.9035x faster
<geometric> 6.2959+-0.0561 ^
0.6390+-0.0070 ^ definitely 9.8531x faster
```
* JSTests/microbenchmarks/array-prototype-copyWithin-contiguous-has-hole.js:
Added.
(test):
* JSTests/microbenchmarks/array-prototype-copyWithin-contiguous.js:
* JSTests/microbenchmarks/array-prototype-copyWithin-double-has-hole.js: Added.
(test):
* JSTests/microbenchmarks/array-prototype-copyWithin-double.js:
* JSTests/microbenchmarks/array-prototype-copyWithin-int32-has-hole.js: Added.
(test):
* JSTests/microbenchmarks/array-prototype-copyWithin-int32.js:
*
JSTests/stress/array-prototype-copyWithin-contiguous-array-proto-has-indexed-props.js:
Added.
(compareArray):
(2.compareArray):
* JSTests/stress/array-prototype-copyWithin-contiguous.js:
(compareArray):
*
JSTests/stress/array-prototype-copyWithin-double-array-proto-has-indexed-props.js:
Added.
(compareArray):
* JSTests/stress/array-prototype-copyWithin-double.js:
(compareArray):
*
JSTests/stress/array-prototype-copyWithin-int32-array-proto-has-indexed-props.js:
Added.
(compareArray):
* JSTests/stress/array-prototype-copyWithin-int32.js:
(compareArray):
* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::JSArray::fastCopyWithin):
Canonical link: https://commits.webkit.org/320775@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
