Closed Bug 534493 Opened 11 years ago Closed 11 years ago

delete object.property in debug builds is O(object_size)

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

RESOLVED FIXED

People

(Reporter: igor, Assigned: igor)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

The changes from the bug 532096 has added the following debug code to jsobj.cpp, http://hg.mozilla.org/tracemonkey/annotate/64e56588265c/js/src/jsscope.cpp#l1596 :

#ifdef DEBUG
            for (JSScopeProperty *aprop = lastProp; aprop; aprop = aprop->parent)
                JS_ASSERT_IF(aprop != sprop, hasProperty(aprop));
#endif

That effectively makes the delete operation in debug builds O(object_size) leading in turn to extremely long execution time of the e4x/Regress/regress-354998.js test from the bug 354998. That test contains:

for (var i = 0; i != 1e6; ++i)
    Object.prototype[i] = i;

...

for (var i = 0; i != 1e6; ++i)
    delete Object.prototype[i];
Attached patch v1Splinter Review
The fix limits the number of iterations in the debug build to 50. This way the test from the bug 354998 runs just 1.5 times longer compared with the case of the removed debug loop.
Assignee: general → igor
Attachment #417329 - Flags: review?(brendan)
Blocks: 532096
No longer depends on: 532096
Comment on attachment 417329 [details] [diff] [review]
v1

Thanks -- that loop was helpful in finding a bug, but it's too expensive for big scopes. I should have seen this one coming!

/be
Attachment #417329 - Flags: review?(brendan) → review+
https://hg.mozilla.org/tracemonkey/rev/13259b2b26a7
Whiteboard: fixed-in-tracemonkey
I restored the previously disabled test - https://hg.mozilla.org/tracemonkey/rev/1f5613bbba7a
http://hg.mozilla.org/mozilla-central/rev/13259b2b26a7
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.