[Webkit-unassigned] [Bug 185317] New: Eliminate ArrayClass and merge ArrayWithUndecided into it's bit pattern.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=185317

            Bug ID: 185317
           Summary: Eliminate ArrayClass and merge ArrayWithUndecided into
                    it's bit pattern.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: keith_miller at apple.com

As far is I know the only objects where the indexing type == ArrayClass, which I’ll call ArrayWithNoIndexingShape for now, are Array.prototype and RuntimeArray. Since we are getting tight(ish) on inline bits perhaps we should consider removing ArrayClass and converting the current bit pattern for ArrayWithUndecided into the ArrayClass pattern. My proposal is that we move Array.prototype into the current ArrayWithUndecided (it will have an empty butterfly other than the IndexingHeader). We can make a Watchpoint or something for RuntimeArrays that makes everything slow (maybe this isn’t totally needed but w/e basically no one uses RuntimeArray that I know of).

I think currently we rely on ArrayClass for some optimizations in the DFG/FTL. It’s not obvious why that’s needed, though, no indexed property will never be set on an ArrayWithUndecided.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180504/c318d0ba/attachment.html>