Changeset 47601 in webkit for trunk/JavaScriptCore/runtime/Structure.h

Timestamp:

Aug 20, 2009, 3:36:36 PM (16 years ago)

Author:

[email protected]

Message:

REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
​https://bugs.webkit.org/show_bug.cgi?id=28332

Reviewed by Gavin Barraclough.

The method check optimisation made transitions aware of the value being
assigned when a transition was assigning a function. This had the side
effect of making every assignment of a function expression result in a
new transition, and thus a new Structure. The net result of this is that
the common JS idiom of

function MyObject() {

this.myFunction = function(...){...};

}
new MyObject();

Will produce a unique structure on every iteration, meaning that all
caching is defeated and there is a significant amount of structure churn.

The fix is to return the transition to its original form where it is
keyed off a property name + attributes tuple, but have each transition
support an optional transition on a specific value.

File:

• trunk/JavaScriptCore/runtime/Structure.h (modified) (4 diffs)

trunk/JavaScriptCore/runtime/Structure.h

@@ -106 +106 @@
             return get(propertyName._ustring.rep(), attributes, specificValue);
         }
+        bool transitionedFor(const JSCell* specificValue)
+        {
+            return m_specificValueInPrevious == specificValue;
+        }
+        bool hasTransition(UString::Rep* rep, unsigned attributes);
+        bool hasTransition(const Identifier& propertyName, unsigned attributes)
+        {
+            return hasTransition(propertyName._ustring.rep(), attributes);
+        }
 
         void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
@@ -167 +176 @@
         RefPtr<Structure> m_previous;
         RefPtr<UString::Rep> m_nameInPrevious;
+        JSCell* m_specificValueInPrevious;
 
         union {
@@ -172 +182 @@
             StructureTransitionTable* table;
         } m_transitions;
-        JSCell* m_specificValueInPrevious;
 
         RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
@@ -232 +241 @@
         }
     }
-
+    
+    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+    {
+        const TransitionTable::iterator find = m_table.find(key);
+        if (find == m_table.end()) {
+            ASSERT(!m_table.contains(key));
+            return false;
+        }
+        return find->second.first || find->second.second->transitionedFor(specificValue);
+    }
+
+    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+    {
+        Transition transition = m_table.get(key);
+        if (transition.second && transition.second->transitionedFor(specificValue))
+            return transition.second;
+        return transition.first;
+    }
 } // namespace JSC