[webkit-changes] [WebKit/WebKit] fcd2b8: [JSC] Object.assign empty object optimization shou...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: fcd2b898ec08eb8b922ff1a60adda7436a9e71de
      https://github.com/WebKit/WebKit/commit/fcd2b898ec08eb8b922ff1a60adda7436a9e71de
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-09-07 (Thu, 07 Sep 2023)

  Changed paths:
    A JSTests/stress/object-assign-empty.js
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/heap/TinyBloomFilter.h
    M Source/JavaScriptCore/runtime/Structure.h

  Log Message:
  -----------
  [JSC] Object.assign empty object optimization should check seenProperties instead of propertyHash
https://bugs.webkit.org/show_bug.cgi?id=261303
rdar://114990534

Reviewed by Mark Lam.

While seenProperties are monotonically increasing field with all the past possible property uids,
propertyHash is xor-ed past hash of properties. This means that we can accidentally hit 0 even though
we have actual properties. We should check seenProperties for quick check of emptiness of objects
instead of propertyHash.

* JSTests/stress/object-assign-empty.js: Added.
(shouldBe):
(test):
(i.shouldBe.JSON.stringify.test):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileObjectAssign):
* Source/JavaScriptCore/heap/TinyBloomFilter.h:
(JSC::TinyBloomFilter::offsetOfBits):
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::seenPropertiesOffset):

Canonical link: https://commits.webkit.org/267762@main