Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: db8790f1137d8124d16cca8c6d244cc336357dda
https://github.com/WebKit/WebKit/commit/db8790f1137d8124d16cca8c6d244cc336357dda
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-23 (Tue, 23 Jun 2026)
Changed paths:
A JSTests/microbenchmarks/object-freeze-blank-for-in.js
A JSTests/microbenchmarks/object-freeze-blank-is-frozen.js
A JSTests/microbenchmarks/object-freeze-blank-keys.js
A JSTests/microbenchmarks/object-freeze-blank.js
A JSTests/microbenchmarks/object-prevent-extensions-blank.js
A JSTests/microbenchmarks/object-seal-blank.js
A JSTests/stress/object-integrity-blank-indexing.js
M Source/JavaScriptCore/runtime/JSObject.cpp
Log Message:
-----------
[JSC] `Object.freeze`/`seal`/`preventExtensions` should not allocate
`ArrayStorage` for `NonArray` objects
https://bugs.webkit.org/show_bug.cgi?id=317479
Reviewed by Yusuke Suzuki.
enterDictionaryIndexingMode() eagerly allocated an empty ArrayStorage +
SparseArrayValueMap even for plain objects with no indexed properties
(indexingType() == NonArray). This is unnecessary: once the caller's
non-extensible structure transition runs, indexingShouldBeSparse() becomes
true and every indexed-write entry point already enters dictionary indexing
lazily on demand.
Staying NonArray also keeps hasIndexedProperties() false, so frozen plain
objects keep using the for-in enumerator cache and the Object.isFrozen /
isSealed fast path.
ArrayClass is left on the existing path because JSArray code
(setLengthWritable / pushInline / setLength) relies on
enterDictionaryIndexingMode having allocated ArrayStorage.
baseline patched
object-freeze-blank 0.5419+-0.0447 ^ 0.3077+-0.0140
^ definitely 1.7612x faster
object-seal-blank 0.4859+-0.0229 ^ 0.3171+-0.0238
^ definitely 1.5321x faster
object-prevent-extensions-blank 0.5033+-0.0342 ^ 0.2967+-0.0212
^ definitely 1.6963x faster
object-freeze-blank-for-in 1.3237+-0.0580 ^ 0.4573+-0.0244
^ definitely 2.8947x faster
object-freeze-blank-is-frozen 1.3314+-0.0561 ^ 0.4308+-0.0253
^ definitely 3.0908x faster
object-freeze-blank-keys 1.4120+-0.0712 ^ 0.4747+-0.0357
^ definitely 2.9748x faster
Tests: JSTests/microbenchmarks/object-freeze-blank-for-in.js
JSTests/microbenchmarks/object-freeze-blank-is-frozen.js
JSTests/microbenchmarks/object-freeze-blank-keys.js
JSTests/microbenchmarks/object-freeze-blank.js
JSTests/microbenchmarks/object-prevent-extensions-blank.js
JSTests/microbenchmarks/object-seal-blank.js
JSTests/stress/object-integrity-blank-indexing.js
* JSTests/microbenchmarks/object-freeze-blank-for-in.js: Added.
(test):
* JSTests/microbenchmarks/object-freeze-blank-is-frozen.js: Added.
(test):
* JSTests/microbenchmarks/object-freeze-blank-keys.js: Added.
(test):
* JSTests/microbenchmarks/object-freeze-blank.js: Added.
(test):
* JSTests/microbenchmarks/object-prevent-extensions-blank.js: Added.
(test):
* JSTests/microbenchmarks/object-seal-blank.js: Added.
(test):
* JSTests/stress/object-integrity-blank-indexing.js: Added.
(shouldBe):
(shouldThrow):
(i.shouldThrow):
(i.shouldBe):
(indexingMode):
(shouldBeNonArray):
(shouldBeArrayStorage):
(Object.freeze.get shouldBeArrayStorage):
(Object.freeze):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::enterDictionaryIndexingMode):
Canonical link: https://commits.webkit.org/315722@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
