781145 - IonMonkey: js::GetProperty should have a fast path for string/array length access

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

GetPropertyOperation has a fast path for JSOP_LENGTH. This is important for strings because apparently it avoids creating lots of string objects. This patch factors it out and also calls it from js::GetProperty.

Numbers for the micro-benchmark below:

JM+TI (--no-ion) :  2 ms
Ion (new)        : 13 ms
Ion (old)        : 79 ms

JM+TI is still much faster because its IC can handle the mixed object/string case, while Ion only uses an IC if the value is definitely an object. The attached patch is pretty straight-forward though and is a tiny date-format-xparb win.

function f() {
    var x = new String("foo");
    var res = 0;
    for (var i=0; i<1000000; i++) {
        res += x.length;
        x = "foo";
    }
    return res;
}

var t = dateNow();
f();
print(dateNow() - t);

Comment 1

[Boris Zbarsky [:bzbarsky]]

Worth a followup on improving the IC setup?

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/e10b81f123e6

(In reply to Boris Zbarsky (:bz) [In and out Aug 1 - 10, out Aug 11-20] from comment #1)
> Worth a followup on improving the IC setup?

Fixing it wouldn't be noticeable on date-format-xparb, and I doubt this mixed object/string case is common in performance-critical code. So I'm inclined to wait until we know it really is a problem we have to fix.