[JSC] Make species constructor for TypedArray fast #2694

Constellation · 2022-07-24T09:02:52Z

`b4e6f93`

[JSC] Make species constructor for TypedArray fast
https://bugs.webkit.org/show_bug.cgi?id=243148

Reviewed by Saam Barati.

This patch accelerates TypedArray species-construct operation since it is consuming much time in TypedArray#slice.
The concept is that we should do the same optimization to ArraySpeciesCreate. But difficulty is that TypedArray
constructor is a bit awkwardly designed. So we need to carefully ensure the invariants.

TypedArray constructor's inheritance chain is that,

    Uint8Array (It does *not* have @@species getter)
    |
    v
    TypedArray (This *has* @@species getter)
    |
    v
    Function
    |
    v
    Object

And prototype is,

    Uint8Array.prototype (which has "constructor" property to Uint8Array)
    |
    v
    TypedArray.prototype (which has various TypedArray functions)
    |
    v
    ...

And in species construct, we first get "constructor" property of the instance, which looks up Uint8Array.prototype.constructor.
Then, from this constructor, we get @@species field (invoking a getter). It looks up TypedArray[@@species] and it returns |this|,
in this case, Uint8Array. And this is how species constructor is obtained.

In this patch, we have two WatchpointSet.

1. typedArraySpeciesWatchpointSet. It ensures that (1) Uint8Array constructor does not have @@species getter, (2) Uint8Array constructor's __proto__
   is TypedArray constructor, (3) and Uint8Array.prototype.constructor is Uint8Array constructor.
2. typedArrayConstructorSpeciesWatchpointSet. It ensures that TypedArray constructor has the default @@species getter.

For 1's (1) and (2), we track Uint8Array's @@species absence and its __proto__ via ObjectPropertyCondition::absence. We introduce ObjectAdaptiveStructureWatchpoint,
which looks similar to ObjectPropertyChangeAdaptiveWatchpoint, but it is usable for absence and presence. And 1's (3) is ensured by using ObjectPropertyChangeAdaptiveWatchpoint.
For 2, we use ObjectPropertyChangeAdaptiveWatchpoint.

If these conditions are met, we can skip "constructor" and @@species property lookups if (1) the instance does not have properties (which can shadow "constructor") and
(2) the instance's __proto__ is Uint8Array.prototype. speciesWatchpointIsValid checks them.

Attached microbenchmark showed 2x better score.

                                      ToT                     Patched

    typed-array-slice-hot      239.3897+-0.3691     ^    118.0493+-0.2077        ^ definitely 2.0279x faster

* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
* Source/JavaScriptCore/bytecode/Watchpoint.cpp:
* Source/JavaScriptCore/bytecode/Watchpoint.h:
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::speciesWatchpointIsValid):
(JSC::speciesConstruct):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):
(JSC::JSGlobalObject::tryInstallArraySpeciesWatchpoint):
(JSC::JSGlobalObject::tryInstallArrayBufferSpeciesWatchpoint):
(JSC::JSGlobalObject::tryInstallTypedArraySpeciesWatchpoint):
(JSC::JSGlobalObject::installTypedArrayConstructorSpeciesWatchpoint):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::typedArrayConstructorSpeciesWatchpoint):
(JSC::JSGlobalObject::typedArrayPrototypeConstructorWatchpoint):
(JSC::JSGlobalObject::typedArraySpeciesWatchpointSet):
(JSC::JSGlobalObject::typedArrayConstructorSpeciesWatchpointSet):
(JSC::JSGlobalObject::typedArrayPrototype const):
* Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp:
(JSC::JSTypedArrayViewConstructor::finishCreation):
* Source/JavaScriptCore/runtime/ObjectAdaptiveStructureWatchpoint.h: Added.
(JSC::ObjectAdaptiveStructureWatchpoint::install):
(JSC::ObjectAdaptiveStructureWatchpoint::fireInternal):
* JSTests/stress/typed-array-slice-constructor-replace.js: Added.
(shouldBe):
* JSTests/stress/typed-array-slice-own-extend-but-fast.js: Added.
(shouldBe):
* JSTests/stress/typed-array-slice-parent-replace.js: Added.
(shouldBe):
(Middle):
* JSTests/stress/typed-array-slice-parent-species-replace.js: Added.
(shouldBe):
* JSTests/stress/typed-array-slice-proto-constructor-replace.js: Added.
(shouldBe):
* JSTests/stress/typed-array-slice-proto-replace.js: Added.
(shouldBe):
* JSTests/stress/typed-array-slice-species-define.js: Added.
(shouldBe):

Canonical link: https://commits.webkit.org/252847@main

saambarati · 2022-07-25T19:35:41Z

d9579ba

[JSC] Make species constructor for TypedArray fast
https://bugs.webkit.org/show_bug.cgi?id=243148

Reviewed by NOBODY (OOPS!).

This patch accelerates TypedArray species-construct operation since it is consuming much time in TypedArray#slice.
The concept is that we should do the same optimization to ArraySpeciesCreate. But difficulty is that TypedArray
constructor is a bit awkwardly designed. So we need to carefully ensure the invariants.

TypedArray constructor's inheritance chain is that,
Uint8Array (It does *not* have @@species getter)
|
v
TypedArray (This *has* @@species getter)
|
v
Function
|
v
Object
And prototype is,
Uint8Array.prototype (which has "constructor" property to Uint8Array)
|
v
TypedArray.prototype (which has various TypedArray functions)
|
v
...
And in species construct, we first get "constructor" property of the instance, which looks up Uint8Array.prototype.constructor.
Then, from this constructor, we get @@species field (invoking a getter). It looks up TypedArray[@@species] and it returns |this|,
in this case, Uint8Array. And this is how species constructor is obtained.

In this patch, we have two WatchpointSet.

typedArraySpeciesWatchpointSet. It ensures that (1) Uint8Array constructor does not have @@species getter, (2) Uint8Array constructor's proto
is TypedArray constructor, (3) and Uint8Array.prototype.constructor is Uint8Array constructor.

typedArrayConstructorSpeciesWatchpointSet. It ensures that TypedArray constructor has the default @@species getter.

For 1's (1) and (2), we track Uint8Array's @@species absence and its proto via ObjectPropertyCondition::absence. We introduce ObjectAdaptiveStructureWatchpoint,
which looks similar to ObjectPropertyChangeAdaptiveWatchpoint, but it is usable for absence and present. And 1's (3) is ensured by using ObjectPropertyChangeAdaptiveWatchpoint.

present -> presence

For 2, we use ObjectPropertyChangeAdaptiveWatchpoint.

If these conditions are met, we can skip "constructor" and @@species property lookups if (1) the instance does not have properties (which can shadow "constructor") and
(2) the instance's proto is Uint8Array.prototype. speciesWatchpointIsValid checks them.

Attached microbenchmark showed 2x better score.
                                  ToT                     Patched

typed-array-slice-hot      239.3897+-0.3691     ^    118.0493+-0.2077        ^ definitely 2.0279x faster
Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:

Source/JavaScriptCore/bytecode/Watchpoint.cpp:

Source/JavaScriptCore/bytecode/Watchpoint.h:

Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::speciesWatchpointIsValid):
(JSC::speciesConstruct):

Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):
(JSC::JSGlobalObject::tryInstallArraySpeciesWatchpoint):
(JSC::JSGlobalObject::tryInstallArrayBufferSpeciesWatchpoint):
(JSC::JSGlobalObject::tryInstallTypedArraySpeciesWatchpoint):
(JSC::JSGlobalObject::installTypedArrayConstructorSpeciesWatchpoint):

Source/JavaScriptCore/runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::typedArrayConstructorSpeciesWatchpoint):
(JSC::JSGlobalObject::typedArrayPrototypeConstructorWatchpoint):
(JSC::JSGlobalObject::typedArraySpeciesWatchpointSet):
(JSC::JSGlobalObject::typedArrayConstructorSpeciesWatchpointSet):
(JSC::JSGlobalObject::typedArrayPrototype const):

Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp:
(JSC::JSTypedArrayViewConstructor::finishCreation):

Source/JavaScriptCore/runtime/ObjectAdaptiveStructureWatchpoint.h: Added.
(JSC::ObjectAdaptiveStructureWatchpoint::install):
(JSC::ObjectAdaptiveStructureWatchpoint::fireInternal):

JSTests/stress/typed-array-slice-constructor-replace.js: Added.
(shouldBe):

JSTests/stress/typed-array-slice-own-extend-but-fast.js: Added.
(shouldBe):

JSTests/stress/typed-array-slice-parent-replace.js: Added.
(shouldBe):
(Middle):

JSTests/stress/typed-array-slice-parent-species-replace.js: Added.
(shouldBe):

JSTests/stress/typed-array-slice-proto-constructor-replace.js: Added.
(shouldBe):

JSTests/stress/typed-array-slice-proto-replace.js: Added.
(shouldBe):

JSTests/stress/typed-array-slice-species-define.js: Added.
(shouldBe):

saambarati · 2022-07-25T19:43:17Z

Source/JavaScriptCore/runtime/JSGlobalObject.cpp

+void JSGlobalObject::installTypedArrayConstructorSpeciesWatchpoint(JSTypedArrayViewConstructor* constructor)
+{
+    VM& vm = this->vm();
+    PropertySlot slot(constructor, PropertySlot::InternalMethodType::VMInquiry, &vm);
+    constructor->getOwnPropertySlot(constructor, this, vm.propertyNames->speciesSymbol.impl(), slot);
+    constructor->structure()->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
+    ObjectPropertyCondition speciesCondition = ObjectPropertyCondition::equivalence(vm, nullptr, constructor, vm.propertyNames->speciesSymbol.impl(), speciesGetterSetter());
+    m_typedArrayConstructorSpeciesWatchpoint = makeUnique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(this, speciesCondition, m_typedArrayConstructorSpeciesWatchpointSet);
+    m_typedArrayConstructorSpeciesWatchpoint->install(vm);


Can we assert somehow that this succeeds?

Yes, we can assert it since this function is called when TypedArrayConstructor is created.

Ah, it is already asserted in ObjectPropertyChangeAdaptiveWatchpoint::install.

saambarati · 2022-07-25T20:02:40Z

Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp

@@ -49,6 +49,7 @@ void JSTypedArrayViewConstructor::finishCreation(VM& vm, JSGlobalObject* globalO

    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->of, typedArrayConstructorOfCodeGenerator, static_cast<unsigned>(PropertyAttribute::DontEnum));
    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->from, typedArrayConstructorFromCodeGenerator, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    globalObject->installTypedArrayConstructorSpeciesWatchpoint(this);


don't we normally put these calls in JSGlobalObject itself?

We are managing these watchpoints in JSGlobalObject (1) to suppress size increase of these constructors and (2) these constructors are only created per JSGlobalObject. And we already have this kind of methods for different types in JSGlobalObject. So I think JSGlobalObject is the right place.

I'm asking if we should put this call inside JSGlobalObject instead of JSTypedArrayViewConstructor (just from a stylistic perspective)

I think here is fine since (1) Set / Map prototypes are already doing the same thing. And (2) for Set and Map, it is hard to call it nicely since they are batch-initialized via FOR_EACH_LAZY_BUILTIN_TYPE macro. So, for consistency, I think putting here is better.

Sounds good.

saambarati · 2022-07-25T20:04:30Z

Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

+    auto* prototype = globalObject->typedArrayPrototype(ViewClass::TypedArrayStorageType);
+
+    if (globalObject->typedArraySpeciesWatchpointSet(ViewClass::TypedArrayStorageType).state() == ClearWatchpoint) {
+        globalObject->tryInstallTypedArraySpeciesWatchpoint(ViewClass::TypedArrayStorageType);


If we only do this once, how do we guarantee that the __proto__ of something like Uint8Array is TypedArray?

tryInstallTypedArraySpeciesWatchpoint is checking this exact thing.

And PropertyCondition::absence keeps guaranteeing this thing (see commit message for more detail) :)

saambarati · 2022-07-25T23:32:19Z

Source/JavaScriptCore/runtime/JSGlobalObject.h


 protected:
-    void tryInstallSpeciesWatchpoint(JSObject* prototype, JSObject* constructor, std::unique_ptr<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>& constructorWatchpoint, std::unique_ptr<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>& speciesWatchpoint, InlineWatchpointSet& speciesWatchpointSet);
+    enum class SpeciesEmpty : bool { Yes, No };


nit: I think I'd name this "HasSpecies" or "HasSpeciesProperty", and invert the uses of it

saambarati

r=me

saambarati · 2022-07-25T23:35:04Z

Source/JavaScriptCore/runtime/JSGlobalObject.cpp

+        speciesCondition = ObjectPropertyCondition::equivalence(vm, prototype, constructor, vm.propertyNames->speciesSymbol.impl(), speciesGetterSetter());
+        break;
+    case SpeciesEmpty::Yes:
+        speciesCondition = ObjectPropertyCondition::absence(vm, prototype, constructor, vm.propertyNames->speciesSymbol.impl(), jsDynamicCast<JSObject*>(constructor->getPrototypeDirect()));
+        break;


Why is the prototype the owner? Shouldn't it be the global object?

Actually, this is not so important since we do not need write-barrier. For now, just using this, but in the future, it should be nullptr (But I don't change it in this patch since I'm not planning to change all the other things too).

saambarati · 2022-07-25T23:38:54Z

Source/JavaScriptCore/runtime/JSGlobalObject.h

+    FOR_EACH_TYPED_ARRAY_TYPE(DECLARE_TYPED_ARRAY_TYPE_WATCHPOINT)
+#undef DECLARE_TYPED_ARRAY_TYPE_WATCHPOINT
+
+    std::unique_ptr<ObjectAdaptiveStructureWatchpoint>& typedArrayConstructorSpeciesWatchpoint(TypedArrayType type)


I know it's a bit verbose, but can we name this so it's clear it's the absence watchpoint? Same with ObjectAdaptiveStructureWatchpoint fields?

This is actually checking 2 things (species absence and constructor equivalence), and only one of that is absence. If we use absence here, it is a bit misleading since this watchpoint-set is also ensuring that constructor property's equivalence too.
I'll rename it to typedArrayConstructorSpeciesFastPathWatchpoint instead.

Ah, no, this is absence one, I'll change it to include absence.

This one is renamed to typedArrayConstructorSpeciesAbsenceWatchpoint

saambarati · 2022-07-25T23:43:39Z

Source/JavaScriptCore/runtime/JSGlobalObject.cpp

+    tryInstallSpeciesWatchpoint(arrayBufferPrototype(sharingMode), arrayBufferConstructor(sharingMode), m_arrayBufferPrototypeConstructorWatchpoints[index], m_arrayBufferConstructorSpeciesWatchpoints[index], arrayBufferSpeciesWatchpointSet(sharingMode), SpeciesEmpty::No);
+}
+
+void JSGlobalObject::tryInstallTypedArraySpeciesWatchpoint(TypedArrayType type)


Maybe we should also put absence in the name here

But this is not exclusive to absence. So renaming it to FastPath etc.

Ah, maybe, for now, it is good name for this function, since it is both ensuring things to make species construct fast. Including absence etc. is misleading.

This one is kept as is since it is not exclusive to absence one.

@species

https://bugs.webkit.org/show_bug.cgi?id=243148 Reviewed by Saam Barati. This patch accelerates TypedArray species-construct operation since it is consuming much time in TypedArray#slice. The concept is that we should do the same optimization to ArraySpeciesCreate. But difficulty is that TypedArray constructor is a bit awkwardly designed. So we need to carefully ensure the invariants. TypedArray constructor's inheritance chain is that, Uint8Array (It does *not* have @@species getter) | v TypedArray (This *has* @@species getter) | v Function | v Object And prototype is, Uint8Array.prototype (which has "constructor" property to Uint8Array) | v TypedArray.prototype (which has various TypedArray functions) | v ... And in species construct, we first get "constructor" property of the instance, which looks up Uint8Array.prototype.constructor. Then, from this constructor, we get @@species field (invoking a getter). It looks up TypedArray[@@species] and it returns |this|, in this case, Uint8Array. And this is how species constructor is obtained. In this patch, we have two WatchpointSet. 1. typedArraySpeciesWatchpointSet. It ensures that (1) Uint8Array constructor does not have @@species getter, (2) Uint8Array constructor's __proto__ is TypedArray constructor, (3) and Uint8Array.prototype.constructor is Uint8Array constructor. 2. typedArrayConstructorSpeciesWatchpointSet. It ensures that TypedArray constructor has the default @@species getter. For 1's (1) and (2), we track Uint8Array's @@species absence and its __proto__ via ObjectPropertyCondition::absence. We introduce ObjectAdaptiveStructureWatchpoint, which looks similar to ObjectPropertyChangeAdaptiveWatchpoint, but it is usable for absence and presence. And 1's (3) is ensured by using ObjectPropertyChangeAdaptiveWatchpoint. For 2, we use ObjectPropertyChangeAdaptiveWatchpoint. If these conditions are met, we can skip "constructor" and @@species property lookups if (1) the instance does not have properties (which can shadow "constructor") and (2) the instance's __proto__ is Uint8Array.prototype. speciesWatchpointIsValid checks them. Attached microbenchmark showed 2x better score. ToT Patched typed-array-slice-hot 239.3897+-0.3691 ^ 118.0493+-0.2077 ^ definitely 2.0279x faster * Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: * Source/JavaScriptCore/bytecode/Watchpoint.cpp: * Source/JavaScriptCore/bytecode/Watchpoint.h: * Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h: (JSC::speciesWatchpointIsValid): (JSC::speciesConstruct): * Source/JavaScriptCore/runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::JSGlobalObject): (JSC::JSGlobalObject::tryInstallSpeciesWatchpoint): (JSC::JSGlobalObject::tryInstallArraySpeciesWatchpoint): (JSC::JSGlobalObject::tryInstallArrayBufferSpeciesWatchpoint): (JSC::JSGlobalObject::tryInstallTypedArraySpeciesWatchpoint): (JSC::JSGlobalObject::installTypedArrayConstructorSpeciesWatchpoint): * Source/JavaScriptCore/runtime/JSGlobalObject.h: (JSC::JSGlobalObject::typedArrayConstructorSpeciesWatchpoint): (JSC::JSGlobalObject::typedArrayPrototypeConstructorWatchpoint): (JSC::JSGlobalObject::typedArraySpeciesWatchpointSet): (JSC::JSGlobalObject::typedArrayConstructorSpeciesWatchpointSet): (JSC::JSGlobalObject::typedArrayPrototype const): * Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp: (JSC::JSTypedArrayViewConstructor::finishCreation): * Source/JavaScriptCore/runtime/ObjectAdaptiveStructureWatchpoint.h: Added. (JSC::ObjectAdaptiveStructureWatchpoint::install): (JSC::ObjectAdaptiveStructureWatchpoint::fireInternal): * JSTests/stress/typed-array-slice-constructor-replace.js: Added. (shouldBe): * JSTests/stress/typed-array-slice-own-extend-but-fast.js: Added. (shouldBe): * JSTests/stress/typed-array-slice-parent-replace.js: Added. (shouldBe): (Middle): * JSTests/stress/typed-array-slice-parent-species-replace.js: Added. (shouldBe): * JSTests/stress/typed-array-slice-proto-constructor-replace.js: Added. (shouldBe): * JSTests/stress/typed-array-slice-proto-replace.js: Added. (shouldBe): * JSTests/stress/typed-array-slice-species-define.js: Added. (shouldBe): Canonical link: https://commits.webkit.org/252847@main

webkit-commit-queue · 2022-07-26T22:34:21Z

Committed 252847@main (b4e6f93): https://commits.webkit.org/252847@main

Reviewed commits have been landed. Closing PR #2694 and removing active labels.

Constellation self-assigned this Jul 24, 2022

Constellation added JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. WebKit Nightly Build labels Jul 24, 2022

Constellation force-pushed the eng/JSC-Make-species-constructor-for-TypedArray-fast branch 4 times, most recently from b28ac40 to 50fff08 Compare July 24, 2022 09:07

Constellation added Safari 15 and removed WebKit Nightly Build labels Jul 24, 2022

Constellation force-pushed the eng/JSC-Make-species-constructor-for-TypedArray-fast branch from 50fff08 to 6d9f674 Compare July 24, 2022 23:01

Constellation marked this pull request as ready for review July 24, 2022 23:01

Constellation requested a review from a team as a code owner July 24, 2022 23:01

Constellation mentioned this pull request Jul 24, 2022

[JSC] Add fast path to TypedArray.from #564

Merged

Constellation force-pushed the eng/JSC-Make-species-constructor-for-TypedArray-fast branch from 6d9f674 to d9579ba Compare July 25, 2022 00:27

saambarati reviewed Jul 25, 2022

View reviewed changes

Constellation requested a review from saambarati July 25, 2022 22:04

saambarati reviewed Jul 25, 2022

View reviewed changes

saambarati approved these changes Jul 25, 2022

View reviewed changes

saambarati reviewed Jul 25, 2022

View reviewed changes

Constellation force-pushed the eng/JSC-Make-species-constructor-for-TypedArray-fast branch from d9579ba to 2b33d61 Compare July 26, 2022 00:55

webkit-early-warning-system added the merging-blocked Applied to prevent a change from being merged label Jul 26, 2022

Constellation removed the merging-blocked Applied to prevent a change from being merged label Jul 26, 2022

Constellation force-pushed the eng/JSC-Make-species-constructor-for-TypedArray-fast branch 5 times, most recently from 206a1cc to 5f2b963 Compare July 26, 2022 19:23

Constellation added the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Jul 26, 2022

webkit-early-warning-system force-pushed the eng/JSC-Make-species-constructor-for-TypedArray-fast branch from 5f2b963 to b4e6f93 Compare July 26, 2022 22:34

webkit-early-warning-system merged commit b4e6f93 into WebKit:main Jul 26, 2022

webkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Jul 26, 2022

Constellation deleted the eng/JSC-Make-species-constructor-for-TypedArray-fast branch July 26, 2022 23:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[JSC] Make species constructor for TypedArray fast #2694

[JSC] Make species constructor for TypedArray fast #2694

Constellation commented Jul 24, 2022 •

edited by webkit-commit-queue

saambarati commented Jul 25, 2022

d9579ba

saambarati Jul 25, 2022

Constellation Jul 25, 2022

Constellation Jul 26, 2022

saambarati Jul 25, 2022

Constellation Jul 25, 2022

saambarati Jul 25, 2022

Constellation Jul 25, 2022

saambarati Jul 25, 2022

saambarati Jul 25, 2022

Constellation Jul 25, 2022

Constellation Jul 25, 2022

saambarati Jul 25, 2022

Constellation Jul 26, 2022

saambarati left a comment

saambarati Jul 25, 2022

Constellation Jul 26, 2022

saambarati Jul 25, 2022 •

edited

Constellation Jul 26, 2022

Constellation Jul 26, 2022

Constellation Jul 26, 2022

saambarati Jul 25, 2022

Constellation Jul 26, 2022

Constellation Jul 26, 2022 •

edited

Constellation Jul 26, 2022

webkit-commit-queue commented Jul 26, 2022

[JSC] Make species constructor for TypedArray fast #2694

[JSC] Make species constructor for TypedArray fast #2694

Conversation

Constellation commented Jul 24, 2022 • edited by webkit-commit-queue

saambarati commented Jul 25, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

saambarati left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

saambarati Jul 25, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Constellation Jul 26, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

webkit-commit-queue commented Jul 26, 2022

Constellation commented Jul 24, 2022 •

edited by webkit-commit-queue

saambarati Jul 25, 2022 •

edited

Constellation Jul 26, 2022 •

edited