[JSC] holesMustForwardToPrototype should be fast for normal arrays

https://bugs.webkit.org/show_bug.cgi?id=259239 rdar://112308103 Reviewed by Alexey Shvayka. We should quickly say `false` from Structure::holesMustForwardToPrototype if the target structure is original array and we are having array prototype sane chain (this means we have no indexed properties, and array prototype chain is solid). * Source/JavaScriptCore/runtime/Structure.cpp: (JSC::Structure::holesMustForwardToPrototypeSlow const): (JSC::Structure::holesMustForwardToPrototype const): Deleted. * Source/JavaScriptCore/runtime/Structure.h: * Source/JavaScriptCore/runtime/StructureInlines.h: (JSC::Structure::holesMustForwardToPrototype const): Canonical link: https://commits.webkit.org/266183@main
WebKit · Jul 20, 2023 · 9d3aa20 · 9d3aa20
1 parent 01b454a
commit 9d3aa20
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 2 deletions.
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -466,7 +466,7 @@ PropertyTable* Structure::materializePropertyTable(VM& vm, bool setPropertyTable
     return table;
 }
 
-bool Structure::holesMustForwardToPrototype(JSObject* base) const
+bool Structure::holesMustForwardToPrototypeSlow(JSObject* base) const
 {
     ASSERT(base->structure() == this);
 

diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
@@ -377,7 +377,7 @@ class Structure : public JSCell {
 
     inline bool mayInterceptIndexedAccesses() const;
 
-    bool holesMustForwardToPrototype(JSObject*) const;
+    inline bool holesMustForwardToPrototype(JSObject*) const;
 
     JSGlobalObject* globalObject() const { return m_globalObject.get(); }
 
@@ -1009,6 +1009,8 @@ class Structure : public JSCell {
 
     void clearCachedPrototypeChain();
 
+    bool holesMustForwardToPrototypeSlow(JSObject*) const;
+
     // These need to be properly aligned at the beginning of the 'Structure'
     // part of the object.
     TypeInfoBlob m_blob;

diff --git a/Source/JavaScriptCore/runtime/StructureInlines.h b/Source/JavaScriptCore/runtime/StructureInlines.h
@@ -125,6 +125,21 @@ inline bool Structure::mayInterceptIndexedAccesses() const
     return globalObject->isHavingABadTime();
 }
 
+inline bool Structure::holesMustForwardToPrototype(JSObject* base) const
+{
+    ASSERT(base->structure() == this);
+    if (typeInfo().type() == ArrayType) {
+        JSGlobalObject* globalObject = this->globalObject();
+        if (LIKELY(globalObject->isOriginalArrayStructure(const_cast<Structure*>(this)) && globalObject->arrayPrototypeChainIsSane()))
+            return false;
+    }
+
+    if (this->mayInterceptIndexedAccesses())
+        return true;
+
+    return holesMustForwardToPrototypeSlow(base);
+}
+
 inline JSObject* Structure::storedPrototypeObject() const
 {
     ASSERT(hasMonoProto());