1234947 - Array element access is too slow when the Array length does not fit into int32_t.

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Tooru Fujisawa [:arai]]

derived from bug 1233642.

[[Has]] (and also [[Get]]) operation for Array element takes 50x longer time when the Array length does not fit into int32_t.

  function test(E) {
    var i = 0, k = 0, len = E.length;
    while (k < len) {
        if (k in E)
            i++;
        k++;
    }

    return i;
  }

  var t = elapsed();
  test(new Array(2**31 - 1));
  print(elapsed() - t);
  t = elapsed();
  test(new Array(2**31));      // this takes so long time
  print(elapsed() - t);

Comment 1

[Tooru Fujisawa [:arai]]

looks like it's because IonMonkey is optimized for an Array with length <= INT32_MAX.

https://dxr.mozilla.org/mozilla-central/rev/388bdc46ba51ee31da8b8abe977e0ca38d117434/js/src/vm/ArrayObject-inl.h#29
> inline void
> ArrayObject::setLength(ExclusiveContext* cx, uint32_t length)
> {
>     MOZ_ASSERT(lengthIsWritable());
> 
>     if (length > INT32_MAX) {
>         /* Track objects with overflowing lengths in type information. */
>         MarkObjectGroupFlags(cx, this, OBJECT_FLAG_LENGTH_OVERFLOW);
>     }
> 
>     getElementsHeader()->length = length;
> }

https://dxr.mozilla.org/mozilla-central/rev/388bdc46ba51ee31da8b8abe977e0ca38d117434/js/src/vm/UnboxedObject-inl.h#189
> inline void
> UnboxedArrayObject::setLength(ExclusiveContext* cx, uint32_t length)
> {
>     if (length > INT32_MAX) {
>         // Track objects with overflowing lengths in type information.
>         MarkObjectGroupFlags(cx, this, OBJECT_FLAG_LENGTH_OVERFLOW);
>     }
> 
>     length_ = length;
> }

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Times are similar enough for me that I'll call this fixed.