637933 - Move JSObject::proto to Shape

Status: RESOLVED DUPLICATE of bug 619271

(Core :: JavaScript Engine, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This would save a pointer in JSObject.

Comment 1

[Brendan Eich [:brendan]]

Did you mean to EmptyShape? Moving a proto pointer to Shape does not make sense since there is a Shape for every property in an object.

/be

Comment 2

[Brendan Eich [:brendan]]

This move could hurt even if proto is moved EmptyShape, however. Right now to look up the prototype chain, one loops up via obj->proto. Moving proto to the empty shape at end of the shape list linked from obj->lastProp would require traversing that list first.

Also, non-natives, specifically proxies, need a proto slot.

Cc'ing Brian -- I seem to recall that he filed a bug already on consolidating type/proto/shape per-object fields.

/be

Comment 3

[Brian Hackett [Laid off!]]

(In reply to comment #1)
> Did you mean to EmptyShape? Moving a proto pointer to Shape does not make sense
> since there is a Shape for every property in an object.
> 
> /be

The shapes are shared between different objects, though, so as long as the number of distinct shapes is much less than the number of objects created this should still help when added to Shape.

But if we do make lots of Shapes in relation to the number of JSObjects, putting the proto on EmptyShape would also work; the length of the lastProp chains is k-limited for non-dictionaries (would need to do something special for dictionary objects). With type inference, few prototype lookups will be needed anyways so a bigger O(1) cost might not be too bad.

The type inference branch already consolidates object->type and object->proto, by storing the prototype on the type itself (shape determines type, type determines prototype).  It also moves emptyShapes to the type, but adds a 'union { newType; initializedLength; }' for no net change in the size of JSObject.

Comment 4

[Brian Hackett [Laid off!]]

Forgot: this shouldn't conflict with the changes being made in the jaegermonkey branch, since JSObject::type could also move to Shape/EmptyShape.

Comment 5

[Brendan Eich [:brendan]]

(In reply to comment #3)
> The type inference branch already consolidates object->type and object->proto,
> by storing the prototype on the type itself (shape determines type, type
> determines prototype).  It also moves emptyShapes to the type, but adds a
> 'union { newType; initializedLength; }' for no net change in the size of
> JSObject.

Cool, that was what I half-remembered. Hoping we can see some incremental patch landing -- possible?

In any case a coordinated plan that estimates the space tradeoffs would be good. Also, Shape itself should shrink. I will file a bug on that.

/be

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

The ObjShrink work moved proto to the type object, so I don't think there's anything to be done here.