mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 16:07:47 +00:00
LibJS: Introduce "dictionary" mode for object shapes
This is similar to "unique" shapes, which were removed in commit
3d92c26445
.
The key difference is that dictionary shapes don't have a serial number,
but instead have a "cacheable" flag.
Shapes become dictionaries after 64 transitions have occurred, at which
point no further transitions occur.
As long as properties are only added to a dictionary shape, it remains
cacheable. (Since if we've cached the shape pointer in an IC somewhere,
we know the IC is still valid.)
Deleting a property from a dictionary shape causes it to become an
uncacheable dictionary.
Note that deleting a property from a non-dictionary shape still performs
a delete transition.
This fixes an issue on Discord where Object.freeze() would eventually
OOM us, since they add more than 16000 properties to a single object
before freezing it.
It also yields a 15% speedup on Octane/pdfjs.js :^)
This commit is contained in:
parent
8255a1a5ee
commit
1e90379008
4 changed files with 94 additions and 4 deletions
|
@ -12,6 +12,32 @@ namespace JS {
|
|||
|
||||
JS_DEFINE_ALLOCATOR(Shape);
|
||||
|
||||
NonnullGCPtr<Shape> Shape::create_cacheable_dictionary_transition()
|
||||
{
|
||||
auto new_shape = heap().allocate_without_realm<Shape>(m_realm);
|
||||
new_shape->m_dictionary = true;
|
||||
new_shape->m_cacheable = true;
|
||||
new_shape->m_prototype = m_prototype;
|
||||
ensure_property_table();
|
||||
new_shape->ensure_property_table();
|
||||
(*new_shape->m_property_table) = *m_property_table;
|
||||
new_shape->m_property_count = new_shape->m_property_table->size();
|
||||
return new_shape;
|
||||
}
|
||||
|
||||
NonnullGCPtr<Shape> Shape::create_uncacheable_dictionary_transition()
|
||||
{
|
||||
auto new_shape = heap().allocate_without_realm<Shape>(m_realm);
|
||||
new_shape->m_dictionary = true;
|
||||
new_shape->m_cacheable = true;
|
||||
new_shape->m_prototype = m_prototype;
|
||||
ensure_property_table();
|
||||
new_shape->ensure_property_table();
|
||||
(*new_shape->m_property_table) = *m_property_table;
|
||||
new_shape->m_property_count = new_shape->m_property_table->size();
|
||||
return new_shape;
|
||||
}
|
||||
|
||||
Shape* Shape::get_or_prune_cached_forward_transition(TransitionKey const& key)
|
||||
{
|
||||
if (!m_forward_transitions)
|
||||
|
@ -241,4 +267,27 @@ FLATTEN void Shape::add_property_without_transition(PropertyKey const& property_
|
|||
add_property_without_transition(property_key.to_string_or_symbol(), attributes);
|
||||
}
|
||||
|
||||
void Shape::set_property_attributes_without_transition(StringOrSymbol const& property_key, PropertyAttributes attributes)
|
||||
{
|
||||
VERIFY(is_dictionary());
|
||||
VERIFY(m_property_table);
|
||||
auto it = m_property_table->find(property_key);
|
||||
VERIFY(it != m_property_table->end());
|
||||
it->value.attributes = attributes;
|
||||
m_property_table->set(property_key, it->value);
|
||||
}
|
||||
|
||||
void Shape::remove_property_without_transition(StringOrSymbol const& property_key, u32 offset)
|
||||
{
|
||||
VERIFY(is_uncacheable_dictionary());
|
||||
VERIFY(m_property_table);
|
||||
if (m_property_table->remove(property_key))
|
||||
--m_property_count;
|
||||
for (auto& it : *m_property_table) {
|
||||
VERIFY(it.value.offset != offset);
|
||||
if (it.value.offset > offset)
|
||||
--it.value.offset;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue