LibJS: Promote Holey arrays to Packed when all holes are filled

Arrays created via new Array(N) or by setting .length start as Holey
since their elements are not present. After sequential fill (e.g.
for (i=0; i<N; i++) a[i]=v), all holes are filled but the array
remained Holey, preventing the Packed fast paths in the asm
interpreter from triggering.

Now, whenever indexed_put() writes to the last index of a Holey
array, we scan for remaining holes and promote to Packed if none
are found. Only checking on writes to the last index avoids O(N^2)
scanning on partial fills while still catching the common
sequential fill pattern.
This commit is contained in:
Andreas Kling 2026-03-17 10:02:34 -05:00 committed by Andreas Kling
parent 5895cacc21
commit 5f586ae406

View file

@ -1857,6 +1857,20 @@ void Object::indexed_put(u32 index, Value value, PropertyAttributes attributes)
m_indexed_storage_kind = IndexedStorageKind::Holey;
m_indexed_elements[index] = value;
// Promote Holey -> Packed when filling the last hole.
// Only check when writing to the last index to avoid O(N^2) scanning.
if (m_indexed_storage_kind == IndexedStorageKind::Holey && index == m_indexed_array_like_size - 1) {
bool has_holes = false;
for (u32 i = 0; i < m_indexed_array_like_size; ++i) {
if (m_indexed_elements[i].is_special_empty_value()) {
has_holes = true;
break;
}
}
if (!has_holes)
m_indexed_storage_kind = IndexedStorageKind::Packed;
}
}
bool Object::indexed_has(u32 index) const