1383643 - IsPackedArray not inlined when Array.prototype.concat is called with non-arrays

Status: RESOLVED DUPLICATE of bug 1652685

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[André Bargull [:anba]]

Test case:
---
(function() {
    for (var i = 0; i < 10000; ++i) {
        [].concat({}, {});
    }
})();
---

If we break here [1] with |br MCallOptimize.cpp:1769 if clasp==0|, and then inspect the result-type set |p array->resultTypeSet_->getObjectCount()| resp. |p {array->resultTypeSet_->getObjectClass(0), array->resultTypeSet_->getObjectClass(1), array->resultTypeSet_->getObjectClass(2)}|, we see that the two object literals are included in the result-type set even though IsPackedArray isn't actually called with the objects. (IsPackedArray is only called for "concat-spreadable" objects [2].)

The same issue is also reproducible in Speedometer, which may explain the high call-count in bug 1365361 (third most called intrinsic).

I've also observed that IsPackedArray isn't inlined in React-TodoMVC and React-Redux-TodoMVC, because getInlineReturnType() returns MIRType::Value. I'm not sure if that's related to this issue or another problem.


[1] http://searchfox.org/mozilla-central/rev/3a3af33f513071ea829debdfbc628caebcdf6996/js/src/jit/MCallOptimize.cpp#1769
[2] http://searchfox.org/mozilla-central/rev/3a3af33f513071ea829debdfbc628caebcdf6996/js/src/builtin/Array.js#1045,1053

Comment 1

[Tom S [:evilpie]]

We should probably use types->forAllClasses(IsArray) here to optimize the ALL_FALSE case to a constant false.
I assume the the MIRType::Value return can happen when we never executed that function? Might be related if we never concat with a real array.

Comment 2

[Tom S [:evilpie]]

Attachment: WIP

We must have bad type information here, because we never get ALL_FALSE.

Comment 3

[Tom S [:evilpie]]

I also checked some real world websites, we never get ALL_FALSE. And MIXED almost always ends up not working, because the object flags don't check out.

Comment 4

[André Bargull [:anba]]

(In reply to Limited Availabilty till Oct | Tom Schuster [:evilpie] from comment #3)
> And MIXED almost always ends up not working, because the object flags don't check out.

Not sure if it matters, but I think I added to many flags in inlineIsPackedArray(). The IsPackedArray() function in NativeObject-inl.h only checks for OBJECT_FLAG_NON_PACKED...

Comment 5

[André Bargull [:anba]]

(In reply to André Bargull from comment #4)
> (In reply to Limited Availabilty till Oct | Tom Schuster [:evilpie] from
> comment #3)
> > And MIXED almost always ends up not working, because the object flags don't check out.
> 
> Not sure if it matters, but I think I added to many flags in
> inlineIsPackedArray(). The IsPackedArray() function in NativeObject-inl.h
> only checks for OBJECT_FLAG_NON_PACKED...

I've tested this and even only checking for OBJECT_FLAG_NON_PACKED won't help: We always end up with TypeSet::unknownObject() returning |true|, because the TYPE_FLAG_ANYOBJECT flag is set.

Comment 6

[Tom S [:evilpie]]

We should probably just support checking those flags from JIT code as well.

Comment 7

[Tom S [:evilpie]]

The code here hasn't changed, but I am wondering if we still want to do this?

Comment 8

[Tom S [:evilpie]]

I am not working on this.

Comment 9

[Jan de Mooij [:jandem]]

Fixing this in bug 1652685.