780786 - JM: hoist [[HasProperty]] from loops over dense arrays

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Till Schneidereit [:till]]

In bug 462300 comment 92, dmandelin proposed hoisting [[HasProperty]] checks from array loops.

In JM, this would reduce the overhead of Array#forEach (and probably all other array extras containing the same core loop) by about 10% to 15%.

Comment 1

[Brian Hackett [Laid off!]]

(i in array) can't be readily hoisted from a loop which modifies i, as the expression's value can change across iterations.  JM+TI already has a fast path for 'i in array'.  Ion doesn't yet compile JSOP_IN, but the same fast path could be added.  Actually, Ion can do better here, as in cases when the array is statically known to be packed, 'i in array' reduces to 'i < initializedLength(array)' which can be hoisted using the bounds check logic for normal array accesses.

Comment 2

[Till Schneidereit [:till]]

(In reply to Brian Hackett (:bhackett) from comment #1)
> (i in array) can't be readily hoisted from a loop which modifies i, as the
> expression's value can change across iterations.  JM+TI already has a fast
> path for 'i in array'.  Ion doesn't yet compile JSOP_IN, but the same fast
> path could be added.  Actually, Ion can do better here, as in cases when the
> array is statically known to be packed, 'i in array' reduces to 'i <
> initializedLength(array)' which can be hoisted using the bounds check logic
> for normal array accesses.

That's about what I thought. The array extras pose another potential problem, though: they invoke a user-provided function in each iteration that can freely modify the array under iteration. While the used value for the length is stored before the loop and is thus guaranteed not to change, the array itself can change at any time. Do we have any options for guarding against that in a way that's compatible with hoisting the check?

Comment 3

[Brian Hackett [Laid off!]]

If the user provided function is inlined, both JM+TI and Ion can hoist from loops if that inlined function does not modify the array.

Comment 4

[Tom S [:evilpie]]

We optimize for |i in array| in ion. We can also hoist if the alias set allows it.