909728 - Represent frozenness/sealness with a special shape

Status: RESOLVED DUPLICATE of bug 708641

(Core :: JavaScript Engine, defect)

Description

[David Bruant]

Unless it has at most one property (or such rare-case scenarios), calling Object.freeze on an object puts it in dictionary mode. This removes the benefit of sharing shape trees.

  function O(){
    this.a = 21;
    this.b = "yo";
    this.c = false;

    Object.freeze(this);
  }

  var o1 = new O();
  var o2 = new O();

Here, o1 and o2 have different shapes currently IIUC.

The idea of this bug is to have a special "frozenness" shape. When Object.freeze is called, just add this shape (note that it'll be the last time this shape will be added for this object by definition of the spec).
If frozenness is thus represented, o1 and o2 will share the exact same shape (so, use less memory and has smaller GC cost)

Among the benefits:
- Object.isFrozen can then return very quickly if the frozeness shape is the last shape (or fully compute the frozen predicate if not, but that the current cost and most likely a rare case).
- Part of the result of Object.getOwnPropertyDescriptor can be derived from this shape without shape lookup for the given property.
- Maybe enable frozenness-based optimizations? (which people have been talking about in theory but have not been true in practice)

Downsides:
- currently, configurable/writable informations are written in each "property shape". A frozenness shape may introduce inconsistency between the frozenness shape and parent shapes (a parent shape may describe the property as configurable). Problem may arise if some part of SpiderMonkey plays with shapes freely.
- other?

The same thing could be done for sealedness.

Comment 1

[Brian Hackett [Laid off!]]

The premise of this bug is off, we reuse shape trees when freezing/sealing objects so avoid performance/memory hazards in this case.

function O(){
    this.a = 21;
    this.b = "yo";
    this.c = false;

    Object.freeze(this);
}

var o1 = new O();
var o2 = new O();

print(shapeOf(o1) == shapeOf(o2));

> js test.js
true

Comment 2

[Eddy Bruel [:ejpbruel]]

My bad for not being aware of this. Fwiw, you can find an explanation of this fact in the comment at jsobj.cpp:1104.