Bug 15850 – Failed array lookups cause excessive Identifier creation

• Component: JavaScriptCore
• Status: RESOLVED INVALID

[Eric Seidel (no email)]

Failed array lookups cause excessive Identifier creation

getOwnPropertySlot has a numeric lookup optimization.  However JSObject::getOwnPropertySlot(exec, unsigned, slot&) just defaults to converting the number back to an identifier and calling the original getOwnPropertySlot.

It turns out that we hit this slow JSObject path any time we fail a lookup in an array.

In SunSpider/tests/crypto-md5.js we have a line: bin[i >> 5] |= ....

which hits this all the time since the initial lookup from bin generally fails.

We end up making 2 or more identifier conversions in the failure case, instead of 0 in the success case. :(

Maciej suggested that in our getProperty loop, we just test the fast-numeric path on the object itself and then give up for the prototypes, converting to an Identifier in that function and calling the non-numeric getOwnPropertySlot as we walk the prototype chain.

[Eric Seidel (no email)]

Created attachment 17056 [details]
naive fix (1.1% slower on SunSpider)

[Eric Seidel (no email)]

Actually, looking at this again, I think we currently only do 1 conversion (I think we only walk down 1 prototype in the Array case), which is already best-case.

[Darin Adler]

A better way to solve this is to stay in the numeric case all the way up the prototype chain. All we need is some fast way to know that a given prototype has no numeric properties.

[Darin Adler]

I'm working on this.

[Darin Adler]

Created attachment 17111 [details]
another approach, but no measurable speed-up on SunSpider

[Alexey Proskuryakov]

Eric, is this bug still valid?

[Eric Seidel (no email)]

No clue.  I haven't worked on JSC in a long time.  I would expect this is no longer an issue though.