Comment #4 on issue 4380 by [email protected]: 'Array' is slower
than 'new Array'
https://code.google.com/p/v8/issues/detail?id=4380
Really interesting. The slowdown is for two reasons, one of which is just a
bug, the other is a difference in element transition feedback between "new
Array()" and "Array()."
The former is triggered by the latter.
With "new Array()" elements transition feedback is immediate. That is, the
first time you make the call, the object is tracked by an
AllocationMemento, and transition feedback influences the next call. In our
case, it's a change from SmiHoley to FastHoley elements kind.
By the time a keyed load operation in push$2() sees the object, the map is
the array map for the FastHoley case. So the keyed load is MONOMORPHIC, and
holey, and all is well.
On the other hand, when you use "Array()," the elements transition feedback
doesn't kick in until the second call. This is because of the way CallICs
work. They perform a "MISS" operation to the runtime, create an
AllocationSite, continue with the call, and the next call will benefit from
the allocation site now in place to begin gathering feedback.
This means that the crucial keyed load operation in push$2() sees two
different maps: SmiHoley and FastHoley. This polymorphic store is dealt
with in a special way, and here is where I see a bug:
The special code is method TryBuildConsolidatedElementLoad() in
hydrogen.cc, which is used to limit the complexity of polymorphic element
handling for our keyed load. Despite some careful work to find the right
elements kind to configure the load with, the method causes a DEOPT to
occur if the hole is seen in the array.
A simple fix is to do the same kind of careful determination of the keyed
load mode as is done elsewhere in Crankshaft.
This brings the difference down to about 10-20 us.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
