Changeset 47601 in webkit for trunk/JavaScriptCore/runtime/JSObject.h

Timestamp:

Aug 20, 2009, 3:36:36 PM (16 years ago)

Author:

[email protected]

Message:

REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
​https://bugs.webkit.org/show_bug.cgi?id=28332

Reviewed by Gavin Barraclough.

The method check optimisation made transitions aware of the value being
assigned when a transition was assigning a function. This had the side
effect of making every assignment of a function expression result in a
new transition, and thus a new Structure. The net result of this is that
the common JS idiom of

function MyObject() {

this.myFunction = function(...){...};

}
new MyObject();

Will produce a unique structure on every iteration, meaning that all
caching is defeated and there is a significant amount of structure churn.

The fix is to return the transition to its original form where it is
keyed off a property name + attributes tuple, but have each transition
support an optional transition on a specific value.

File:

• trunk/JavaScriptCore/runtime/JSObject.h (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSObject.h

@@ -468 +468 @@
     }
 
+    // If we have a specific function, we may have got to this point if there is
+    // already a transition with the correct property name and attributes, but
+    // specialized to a different function.  In this case we just want to give up
+    // and despecialize the transition.
+    // In this case we clear the value of specificFunction which will result
+    // in us adding a non-specific transition, and any subsequent lookup in
+    // Structure::addPropertyTransitionToExistingStructure will just use that.
+    if (specificFunction && m_structure->hasTransition(propertyName, attributes))
+        specificFunction = 0;
+
     RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
+
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());