The equivalent C++ code has an optimization for one-level deep ropes, but the JIT code only supports this for the left child. This difference can cause performance issues, for example the micro-benchmark below improves from 195 ms to 34 ms with a patch for this.

function f(s) {
    var s1 = "123456789" + s;
    var res;
    for (var i = 0; i < 10_000_000; i++) {
        res = s1.charCodeAt(11 + (i % 8));
    }
    return res;
}
var t = new Date;
f("foobarbaz1234567890");
print(new Date - t);

If you don't already have written a patch, bug 1382639 has a patch, but probably needs to be rebased.

(In reply to André Bargull [:anba] from comment #1)

If you don't already have written a patch, bug 1382639 has a patch, but probably needs to be rebased.

Yeah I wrote the patch earlier today. I didn't know we had this on file already :)

I just compared it against the patch from bug 1382639, but bug 1382639 was before Spectre, so it was quite outdated. :-)

https://hg.mozilla.org/mozilla-central/rev/dc047eb790a0

(In reply to Pulsebot from comment #6)

Pushed by jdemooij@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/dc047eb790a0
Support loading from rope right-child in MacroAssembler::loadStringChar.
r=anba

== Change summary for alert #35212 (as of Thu, 25 Aug 2022 13:01:15 GMT) ==

Improvements:

For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=35212