Bug 228919 - New single bytecode loop for-in is missing many inline asm optimizations in 32bit
Summary: New single bytecode loop for-in is missing many inline asm optimizations in 3...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-08-09 11:47 PDT by Keith Miller
Modified: 2021-08-18 09:15 PDT (History)
8 users (show)

See Also:


Attachments
for-in-infinite-loop.js (730 bytes, text/javascript)
2021-08-18 09:09 PDT, Mikhail R. Gadelha
no flags Details
for-in-undefined.js (730 bytes, text/javascript)
2021-08-18 09:10 PDT, Mikhail R. Gadelha
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Miller 2021-08-09 11:47:43 PDT
With the new bytecode format 32-bit is missing a bunch of inline assembly optimizations. Most of the code should be similar to the 64 bit code or the previous per-loop instructions.
Comment 1 Radar WebKit Bug Importer 2021-08-16 11:48:17 PDT
<rdar://problem/81991479>
Comment 2 Mikhail R. Gadelha 2021-08-18 09:09:38 PDT
Created attachment 435770 [details]
for-in-infinite-loop.js
Comment 3 Mikhail R. Gadelha 2021-08-18 09:10:19 PDT
Created attachment 435771 [details]
for-in-undefined.js
Comment 4 Mikhail R. Gadelha 2021-08-18 09:13:47 PDT
Comment on attachment 435770 [details]
for-in-infinite-loop.js

function makeobj(n) {
  var obj = {};
  for (var i = 0; i < n; ++i)
    obj[i] = i;
  return obj;
}

function testdelete(n) {
  for (var propToDelete = 0; propToDelete <= n; ++propToDelete) {
    for (var iterToDelete = 0; iterToDelete <= n; ++iterToDelete) {
      for (var iterToAdd = 0; iterToAdd <= n; ++iterToAdd) {

        print("testing with " + n + " properties");
        print("deleting property number " + propToDelete + " on iteration " +
              iterToDelete);
        print("adding a property on iteration " + iterToAdd);

        var iter = 0;
        var o = makeobj(n);

        for (var i in o) {
          if (iter == iterToDelete)
            delete o[propToDelete];

          if (iter == iterToAdd)
            o["xxx"] = 1;

          // print("iter: " + iter + "i: " + i);
          print(i)

          ++ iter;
        }
      }
    }
  }
}

testdelete(6);
Comment 5 Mikhail R. Gadelha 2021-08-18 09:15:20 PDT
Added a couple of reduced test cases where jsc starts to return unexpected results:

* for-in-infinite-loop.js: for-in seems to be stuck and doesn't increment the value

* for-in-undefined.js: for-in returns undefined object at iteration 94