IsPackedArray not inlined when Array.prototype.concat is called with non-arrays

NEW
Assigned to

Status

()

P3
normal
a year ago
8 months ago

People

(Reporter: anba, Assigned: evilpie)

Tracking

(Blocks: 1 bug)

Trunk
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

a year ago
Test case:
---
(function() {
    for (var i = 0; i < 10000; ++i) {
        [].concat({}, {});
    }
})();
---

If we break here [1] with |br MCallOptimize.cpp:1769 if clasp==0|, and then inspect the result-type set |p array->resultTypeSet_->getObjectCount()| resp. |p {array->resultTypeSet_->getObjectClass(0), array->resultTypeSet_->getObjectClass(1), array->resultTypeSet_->getObjectClass(2)}|, we see that the two object literals are included in the result-type set even though IsPackedArray isn't actually called with the objects. (IsPackedArray is only called for "concat-spreadable" objects [2].)

The same issue is also reproducible in Speedometer, which may explain the high call-count in bug 1365361 (third most called intrinsic).

I've also observed that IsPackedArray isn't inlined in React-TodoMVC and React-Redux-TodoMVC, because getInlineReturnType() returns MIRType::Value. I'm not sure if that's related to this issue or another problem.


[1] http://searchfox.org/mozilla-central/rev/3a3af33f513071ea829debdfbc628caebcdf6996/js/src/jit/MCallOptimize.cpp#1769
[2] http://searchfox.org/mozilla-central/rev/3a3af33f513071ea829debdfbc628caebcdf6996/js/src/builtin/Array.js#1045,1053
(Assignee)

Comment 1

a year ago
We should probably use types->forAllClasses(IsArray) here to optimize the ALL_FALSE case to a constant false.
I assume the the MIRType::Value return can happen when we never executed that function? Might be related if we never concat with a real array.
(Assignee)

Comment 2

a year ago
Created attachment 8890994 [details] [diff] [review]
WIP

We must have bad type information here, because we never get ALL_FALSE.
(Assignee)

Comment 3

a year ago
I also checked some real world websites, we never get ALL_FALSE. And MIXED almost always ends up not working, because the object flags don't check out.
(Reporter)

Comment 4

a year ago
(In reply to Limited Availabilty till Oct | Tom Schuster [:evilpie] from comment #3)
> And MIXED almost always ends up not working, because the object flags don't check out.

Not sure if it matters, but I think I added to many flags in inlineIsPackedArray(). The IsPackedArray() function in NativeObject-inl.h only checks for OBJECT_FLAG_NON_PACKED...
(Reporter)

Comment 5

a year ago
(In reply to André Bargull from comment #4)
> (In reply to Limited Availabilty till Oct | Tom Schuster [:evilpie] from
> comment #3)
> > And MIXED almost always ends up not working, because the object flags don't check out.
> 
> Not sure if it matters, but I think I added to many flags in
> inlineIsPackedArray(). The IsPackedArray() function in NativeObject-inl.h
> only checks for OBJECT_FLAG_NON_PACKED...

I've tested this and even only checking for OBJECT_FLAG_NON_PACKED won't help: We always end up with TypeSet::unknownObject() returning |true|, because the TYPE_FLAG_ANYOBJECT flag is set.
(Assignee)

Comment 6

a year ago
We should probably just support checking those flags from JIT code as well.

Updated

11 months ago
Priority: -- → P3
(Assignee)

Updated

8 months ago
Assignee: nobody → evilpies
You need to log in before you can comment on or make changes to this bug.