Revision: 5008 Author: [email protected] Date: Fri Jul 2 04:27:57 2010 Log: Use the number of in-object properties when deciding how many fast properties to allow on an object. If there are many in-object properties it is unlikely that the object is used as a dictionary and we allow more map transitions to keep such objects in fast case.
Review URL: http://codereview.chromium.org/2818041 http://code.google.com/p/v8/source/detail?r=5008 Modified: /branches/bleeding_edge/src/objects-inl.h /branches/bleeding_edge/src/objects.cc /branches/bleeding_edge/src/objects.h ======================================= --- /branches/bleeding_edge/src/objects-inl.h Thu Jun 24 06:56:35 2010 +++ /branches/bleeding_edge/src/objects-inl.h Fri Jul 2 04:27:57 2010 @@ -1333,6 +1333,21 @@ WRITE_FIELD(this, offset, value); } } + + +bool JSObject::HasFastProperties() { + return !properties()->IsDictionary(); +} + + +int JSObject::MaxFastProperties() { + // Allow extra fast properties if the object has more than + // kMaxFastProperties in-object properties. When this is the case, + // it is very unlikely that the object is being used as a dictionary + // and there is a good chance that allowing more map transitions + // will be worth it. + return Max(map()->inobject_properties(), kMaxFastProperties); +} void Struct::InitializeBody(int object_size) { @@ -1341,11 +1356,6 @@ WRITE_FIELD(this, offset, value); } } - - -bool JSObject::HasFastProperties() { - return !properties()->IsDictionary(); -} bool Object::ToArrayIndex(uint32_t* index) { ======================================= --- /branches/bleeding_edge/src/objects.cc Wed Jun 30 00:40:40 2010 +++ /branches/bleeding_edge/src/objects.cc Fri Jul 2 04:27:57 2010 @@ -1276,7 +1276,7 @@ } if (map()->unused_property_fields() == 0) { - if (properties()->length() > kMaxFastProperties) { + if (properties()->length() > MaxFastProperties()) { Object* obj = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0); if (obj->IsFailure()) return obj; return AddSlowProperty(name, value, attributes); @@ -1474,7 +1474,7 @@ Object* new_value, PropertyAttributes attributes) { if (map()->unused_property_fields() == 0 && - properties()->length() > kMaxFastProperties) { + properties()->length() > MaxFastProperties()) { Object* obj = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0); if (obj->IsFailure()) return obj; return ReplaceSlowProperty(name, new_value, attributes); ======================================= --- /branches/bleeding_edge/src/objects.h Thu Jun 24 06:56:35 2010 +++ /branches/bleeding_edge/src/objects.h Fri Jul 2 04:27:57 2010 @@ -1367,6 +1367,7 @@ // Returns the index'th element. // The undefined object if index is out of bounds. Object* GetElementWithReceiver(JSObject* receiver, uint32_t index); + Object* GetElementWithInterceptor(JSObject* receiver, uint32_t index); Object* SetFastElementsCapacityAndLength(int capacity, int length); Object* SetSlowElements(Object* length); @@ -1547,6 +1548,11 @@ #endif Object* SlowReverseLookup(Object* value); + // Maximal number of fast properties for the JSObject. Used to + // restrict the number of map transitions to avoid an explosion in + // the number of maps for objects used as dictionaries. + inline int MaxFastProperties(); + // Maximal number of elements (numbered 0 .. kMaxElementCount - 1). // Also maximal value of JSArray's length property. static const uint32_t kMaxElementCount = 0xffffffffu; @@ -1568,8 +1574,6 @@ STATIC_CHECK(kHeaderSize == Internals::kJSObjectHeaderSize); - Object* GetElementWithInterceptor(JSObject* receiver, uint32_t index); - private: Object* GetElementWithCallback(Object* receiver, Object* structure, -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
