Bug 117554 – DFG NewTypedArray should be a DCE candidate

• Component: JavaScriptCore
• Status: UNCONFIRMED

The attached page uses binary search to find the maximum size that the Uint8Array constructor accepts. In Firefox and Chrome the test completes in 4 seconds but with both Safari and WebKit Nightly the test takes 15 minutes and eats up 40gb of virtual memory. This is on a MacBook Air with 4gb of memory.

Created attachment 204465 [details]
typed-array-limit.html

[Alexey Proskuryakov]

Safari 7 says "Maximum is around 2048mb, found in 37.4 seconds". This is nowhere as horrible as before, but still still 10x slower than Firefox.

ToT is about 20% slower on top of that.

[Filip Pizlo]

I think that the title is a bit dramatic.  I suspect that all that we're missing is the compiler smarts to eliminate the allocation of the typed array entirely.  In this program, the statement:

    new Uint8Array(mid);

is trivially dead code.  Our optimizing compiler currently refuses to DCE typed array allocations because of (likely unfounded) paranoia about the typed array allocation having observable error checking.  It probably has no observable error checking if the constructor is known to be passed an integer and that integer is non-negative.