Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 433704897995ae4b38b732d225c0e2f2eaf4f73c
https://github.com/WebKit/WebKit/commit/433704897995ae4b38b732d225c0e2f2eaf4f73c
Author: Yusuke Suzuki <[email protected]>
Date: 2026-04-27 (Mon, 27 Apr 2026)
Changed paths:
A JSTests/microbenchmarks/for-of-map-entries-small.js
A JSTests/microbenchmarks/for-of-map-entries.js
A JSTests/microbenchmarks/for-of-set-values-small.js
A JSTests/microbenchmarks/for-of-set-values.js
A JSTests/stress/iterator-dfg-fast-path-bad-time.js
A JSTests/stress/iterator-dfg-fast-path-mixed-modes.js
A JSTests/stress/iterator-dfg-fast-path-no-generic.js
M Source/JavaScriptCore/builtins/MapIteratorPrototype.js
M Source/JavaScriptCore/builtins/SetIteratorPrototype.js
M Source/JavaScriptCore/bytecode/IterationModeMetadata.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGMayExit.cpp
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/jit/JITOperations.h
M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
M Source/JavaScriptCore/runtime/IteratorOperations.cpp
M Source/JavaScriptCore/runtime/JSArray.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/MapPrototype.cpp
M Source/JavaScriptCore/runtime/MapPrototype.h
M Source/JavaScriptCore/runtime/SetPrototype.cpp
M Source/JavaScriptCore/runtime/SetPrototype.h
Log Message:
-----------
[JSC] Add Map / Set fast iteration
https://bugs.webkit.org/show_bug.cgi?id=313340
rdar://175613242
Reviewed by Yijia Huang.
Previously our iterator_open / iterator_next supports JSArray. This
patch extends this fast iteration protocol to JSMap and JSSet.
1. LLInt / Baseline JIT should just simply add JSMap and JSMapIterator
/ JSSet and JSSetIterator iteration code. We extend IterationMode to
have FastMap and FastSet. We also make constructArrayPair always
using Contiguous (or Slow ArrayStorage when have-a-bad-time happens)
to avoid frequent speculation failures when we inline them in DFG / FTL.
2. In DFG ByteCodeParser, we support JSMap / JSSet in iterator_open /
iterator_next DFG nodes emission. One of the most subtle thing is OSR
exit: MapIteratorNext changes the iterator, so after that, we cannot
do OSR exit except for throwing an error, otherwise, OSR exit will
advance the iterator again. We carefully emit DFG nodes which never
does normal OSR exits, so this is fine.
ToT Patched
for-of-map-entries-small 7.3828+-0.1328 ^ 6.4153+-0.1580
^ definitely 1.1508x faster
set-for-of 1.3589+-0.0724 ^ 0.6633+-0.0403
^ definitely 2.0486x faster
for-of-set-values 2.4183+-0.0569 ^ 1.7421+-0.1980
^ definitely 1.3881x faster
for-of-map-entries 6.9321+-0.1456 ^ 5.7206+-0.1448
^ definitely 1.2118x faster
map-for-of 1.8342+-0.0780 ^ 1.1539+-0.0725
^ definitely 1.5896x faster
for-of-set-values-small 2.5314+-0.0253 ^ 1.9055+-0.0841
^ definitely 1.3285x faster
Tests: JSTests/microbenchmarks/for-of-map-entries-small.js
JSTests/microbenchmarks/for-of-map-entries.js
JSTests/microbenchmarks/for-of-set-values-small.js
JSTests/microbenchmarks/for-of-set-values.js
JSTests/stress/iterator-dfg-fast-path-bad-time.js
JSTests/stress/iterator-dfg-fast-path-mixed-modes.js
JSTests/stress/iterator-dfg-fast-path-no-generic.js
* JSTests/microbenchmarks/for-of-map-entries-small.js: Added.
(test):
* JSTests/microbenchmarks/for-of-map-entries.js: Added.
(test):
* JSTests/microbenchmarks/for-of-set-values-small.js: Added.
* JSTests/microbenchmarks/for-of-set-values.js: Added.
* JSTests/stress/iterator-dfg-fast-path-bad-time.js: Added.
(shouldBe):
(sumMapEntries):
(sumSetValues):
(set add):
(set Object):
(set get for):
* JSTests/stress/iterator-dfg-fast-path-mixed-modes.js: Added.
(shouldBe):
(sumIterable):
(makeGeneric):
* JSTests/stress/iterator-dfg-fast-path-no-generic.js: Added.
(shouldBe):
(sumAny):
(runArrayMap):
(runArraySet.sumArrOrSet):
(runArraySet):
(runAllFastNoGeneric):
* Source/JavaScriptCore/builtins/MapIteratorPrototype.js:
(next):
* Source/JavaScriptCore/builtins/SetIteratorPrototype.js:
(next):
* Source/JavaScriptCore/bytecode/IterationModeMetadata.h:
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handleIteratorOpen):
(JSC::DFG::ByteCodeParser::handleIteratorNext):
* Source/JavaScriptCore/dfg/DFGMayExit.cpp:
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITOperations.h:
* Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:
(JSC::iteratorOpenTryFastImpl):
(JSC::iteratorNextTryFastImpl):
* Source/JavaScriptCore/runtime/IteratorOperations.cpp:
(JSC::getIterationMode):
* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::constructArrayPair):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildrenImpl):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
* Source/JavaScriptCore/runtime/MapPrototype.cpp:
(JSC::MapPrototype::finishCreation):
* Source/JavaScriptCore/runtime/MapPrototype.h:
* Source/JavaScriptCore/runtime/SetPrototype.cpp:
(JSC::SetPrototype::finishCreation):
* Source/JavaScriptCore/runtime/SetPrototype.h:
Canonical link: https://commits.webkit.org/312127@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
