1056446 - Eliminate allocations of objects that are only ever written to.

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Michael Bebenita [:mbx]]

The following array allocation is not optimized away by the ION compiler:

function foo() {
  var a = []; 
  a[0] = 0;
}

This pattern occurs in code generated by the TypeScript compiler for variadic functions.

function foo(x, y, z, ...args) {
  return;
}

compiles to:

function foo(x, y, z) {
  var args = [];
  for (var i = 0; i < (arguments.length - 3); _i++) {
    args[i] = arguments[i + 3];
  }
  return;
}

Here 'args' does not escape, is never read from and should be classified as dead code.

Comment 1

[Boris Zbarsky [:bzbarsky]]

> Here 'args' does not escape, is never read from and should be classified as dead code.

You can't actually statically determine that "args" is dead, unfortunately.  Consider a testcase that has a foo defined as you have it and then does:

  Object.defineProperty(Array.prototype, 0,
                        { set: function() { alert("hello"); }});
  foo(1, 2, 3, 4);                      

You can eliminate the "args" bits if you add a guard-and-recompile on the canonical Array.prototype and everything on its proto chain not having any indexed props defined, I guess...

Comment 2

[Nicolas B. Pierron [:nbp | PTO until 11/11]]

(In reply to Michael Bebenita [:mbx] from comment #0)
> The following array allocation is not optimized away by the ION compiler:
> 
> function foo() {
>   var a = []; 
>   a[0] = 0;
> }

This part is already handled, and is behind a preference of the JavaScript shell.
See Bug 1040027 for the implementation of it.

> function foo(x, y, z) {
>   var args = [];
>   for (var i = 0; i < (arguments.length - 3); _i++) {
>     args[i] = arguments[i + 3];
>   }
>   return;
> }

This is a different story, as the index is unknown.  Can you always prove that the index would always be an integer, and that it is safe for all integers?

  Object.defineProperty(Array.prototype, 42,
                        { set: function() { alert(this[41]); }});

If this is a problem I think we should rewrite the rest arguments to use Array.prototype.slice instead of a for-loop.

function foo(x, y, z) {
  var args = Array.prototype.slice.call(arguments, 3);
  return;
}

This would be easier to optimize in IonMonkey.

Comment 3

[Michael Bebenita [:mbx]]

Thanks, I filed a bug with the TypeScript team: https://github.com/Microsoft/TypeScript/issues/498