Bug 15850 - Failed array lookups cause excessive Identifier creation
Summary: Failed array lookups cause excessive Identifier creation
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.4
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-11-06 00:27 PST by Eric Seidel (no email)
Modified: 2009-03-24 11:30 PDT (History)
2 users (show)

See Also:


Attachments
naive fix (1.1% slower on SunSpider) (1.27 KB, patch)
2007-11-06 00:36 PST, Eric Seidel (no email)
no flags Details | Formatted Diff | Diff
another approach, but no measurable speed-up on SunSpider (5.22 KB, patch)
2007-11-07 08:59 PST, Darin Adler
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Seidel (no email) 2007-11-06 00:27:46 PST
Failed array lookups cause excessive Identifier creation

getOwnPropertySlot has a numeric lookup optimization.  However JSObject::getOwnPropertySlot(exec, unsigned, slot&) just defaults to converting the number back to an identifier and calling the original getOwnPropertySlot.

It turns out that we hit this slow JSObject path any time we fail a lookup in an array.

In SunSpider/tests/crypto-md5.js we have a line: bin[i >> 5] |= ....

which hits this all the time since the initial lookup from bin generally fails.

We end up making 2 or more identifier conversions in the failure case, instead of 0 in the success case. :(

Maciej suggested that in our getProperty loop, we just test the fast-numeric path on the object itself and then give up for the prototypes, converting to an Identifier in that function and calling the non-numeric getOwnPropertySlot as we walk the prototype chain.
Comment 1 Eric Seidel (no email) 2007-11-06 00:36:22 PST
Created attachment 17056 [details]
naive fix (1.1% slower on SunSpider)
Comment 2 Eric Seidel (no email) 2007-11-06 00:39:58 PST
Actually, looking at this again, I think we currently only do 1 conversion (I think we only walk down 1 prototype in the Array case), which is already best-case.
Comment 3 Darin Adler 2007-11-06 15:26:49 PST
A better way to solve this is to stay in the numeric case all the way up the prototype chain. All we need is some fast way to know that a given prototype has no numeric properties.
Comment 4 Darin Adler 2007-11-06 16:09:58 PST
I'm working on this.
Comment 5 Darin Adler 2007-11-07 08:59:58 PST
Created attachment 17111 [details]
another approach, but no measurable speed-up on SunSpider
Comment 6 Alexey Proskuryakov 2009-03-24 10:57:23 PDT
Eric, is this bug still valid?
Comment 7 Eric Seidel (no email) 2009-03-24 11:30:22 PDT
No clue.  I haven't worked on JSC in a long time.  I would expect this is no longer an issue though.