1868857 - Suppress deleted properties using low-bit tags instead of removal

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement, P2)

Description

[Iain Ireland [:iain]]

We implement for-in enumeration using NativeIterator, an object with a trailing array of strings that we expect to return as keys. To handle cases where a property is deleted while we are iterating the object, we link NativeIterators into a linked list while active. When a property is deleted, we check to see if it is currently being iterated, and if so, we fix up the NativeIterator.

Currently we do so by mutating the trailing array to remove deleted keys (if we haven't already visited them). This unfortunately means that we can't reuse the iterator again for a subsequent object with the same shape. It also means that we can't simply reuse the cached NativeIterator to do scalar replacement of Object.keys.

Jan suggested that instead of removing keys entirely, we could simply tag them as deleted, and skip deleted keys in MoreIter. This lets us reuse the NativeIterator (by untagging all deleted keys when we're done iterating). It also lets Object.keys use the same NativeIterator, even if there's an active enumeration, by simply ignoring the tag bit. We end up with NativeIterators that are still mutable where necessary for for-in, but immutable from the point of view of Object.keys.

Comment 1

[Iain Ireland [:iain]]

Attachment: WIP: (WIP) Bug 1868857: Rewrite SuppressDeletedProperty

Comment 2

[Iain Ireland [:iain]]

Attachment: WIP: (WIP) Bug 1868857: Hacky barrier

Depends on D195807

Comment 3

[Alex Thayer [:alexical] (she/her)]

Attachment: Bug 1868857 - Mark deleted props instead of removing in NativeIterator r?jandem

This is adapted from Iain's patch in the linked bug. We want
to be able to scalar replace Object.keys when its result is just
going to be iterated over and not escape. We should be able to
use all the NativeIterator infrastructure for this purpose, but
a critical difference is that if properties are deleted in the
loop, a for in loop will skip those properties, while Object.keys,
being a snapshot, won't. This patch allows us to support both
cases by marking deleted properties with a flag which will be
utilized to filter when iterating normally, and ignored when
iterating an Object.keys result.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/38ad18e48ec3
https://hg.mozilla.org/integration/autoland/rev/2c3c9f7979f6
Mark deleted props instead of removing in NativeIterator r=jandem,jonco

Comment 5

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/2c3c9f7979f6