560995 - TM: specialized iterator for dense arrays without holes

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Andreas Gal :gal]

Iterating over arrays is a trail of tears. For every iteration, the integer index ("name of the property") has to be stringified, which even for small indexes allocates a string header. For large ones, there is also the integer to string conversion, a malloc, plus the header allocation.

This patch will introduce an optimize iterator for arrays that iterates from n to m (i.e. 0 to length-1). FOR_* pulls a number from the iterator and does IntToString on it. Since my new iterator code moves fetching the next value to the top of the loop, the trace can now reason over the type of this value (including deep inspecting that its really an int).

If we use xeq that bug 560994 will add, we can skip past the IntToString if the loop value is used in a numeric way (i.e. [] or math). This would avoid stringification in many case.

Comment 1

[Boris Zbarsky [:bzbarsky]]

> which even for small indexes allocates a string header.

It does?  We don't use the atomized strings for that?  Maybe we should fix that if so?

Comment 2

[Andreas Gal :gal]

I take that back. For small indexes we use pre-defined string headers. For non-small (> 256) we allocate.

Comment 3

[Igor Bukanov]

Maybe we should patch ValueToNumber to check for those predefined strings and quickly return the number?

Comment 4

[Andreas Gal :gal]

We are doing #3 already. But doing the right thing here avoids allocation completely, which is many times faster, an works for all numbers, not just 0..255.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.