Skip to content

[JSC] Array profiles should not turn ordinary arrays into ArrayStorage (cherry-pick WebKit/WebKit#75376) - #785

Open
robobun wants to merge 1 commit into
mainfrom
robobun/f989c366/cherry-pick-webkit-75376
Open

robobun wants to merge 1 commit into
mainfrom
robobun/f989c366/cherry-pick-webkit-75376

[JSC] Array profiles should not turn ordinary arrays into `ArrayStorage`

76c588a
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Oct 9, 2026 in 27m 41s

Code review found 1 important issue

Found 10 candidates, confirmed 4. See review comments for details.

Details

Severity Count
🔴 Important 1
🟡 Nit 3
🟣 Pre-existing 0
Severity File:Line Issue
🔴 Important Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:12835 After a single sparse-index exit inside a for-of loop, every later DFG/FTL compile of that function force-exits at the l
🟡 Nit Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h:63 Hot array stores can be permanently downgraded to the generic IC path after one in-bounds store that needed a storage co
🟡 Nit Source/JavaScriptCore/dfg/DFGArrayMode.cpp:174 Hot functions that read one array at several sites and sometimes see a frozen array now jettison and recompile once per
🟡 Nit Source/JavaScriptCore/bytecode/ArrayProfile.cpp:133 Sites that mostly read frozen arrays and rarely see an ordinary one lose their ArrayStorage fast path for good after mer