587397 - Don't allocate dslots[-1] for dense arrays

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicholas Nethercote [inactive]]

Dense array capacity used to be stored in dslots[-1], but it recently got moved to an fslot.  But dslots[-1] is still allocated, eg. in growDenseArrayElements(), shrinkDenseArrayElements().

I think/hope this is now unnecessary.  Assuming that's correct, we can change ARRAY_CAPACITY_MIN from 7 to 8, and change ensureDenseArrayElements() to use the sequence 8, 16, 32, ... instead of 7, 15, 31, ..., and any other required clean-up.

Comment 1

[Brendan Eich [:brendan]]

Bug 584917 has details on this -- Brian made the fix there as part of right-sizing fslots, and found some trace test jitstats dependencies that led to false positives. He fixed the test(s), IIRC.

/be

Comment 2

[Brendan Eich [:brendan]]

I should be careful with verb tense -- bug 584917 is not yet fixed, there's just a patch. I need to land bug 558451's monster queue (early next week) on tm.

/be

Comment 3

[Nicholas Nethercote [inactive]]

So dslots[-1] will be disappearing altogether?  Hooray!

I'll leave this bug open and dependent on bug 584917 just in case that doesn't entirely fix the matter.

Comment 4

[Steve Fink [:sfink] [:s:]]

The object size calculation from bug 584175 will require an update when this is landed (assuming 584175 lands first.)

Comment 5

[Paul Wright]

Can this be closed out?