Basically, what we need to know is how much flexibility is required at each PIC site for GETPROP.

Here are the |length| usages in SS: --------+--------+----------+ | pc | op | key | base | count(*) | +-----------+------+--------+--------+----------+ | 0x128ce76 | p | length | object | 1000 | | 0x128d1c6 | p | length | object | 500 | | 0x128d776 | p | length | object | 500 | | 0x128e004 | l | length | string | 24 | | 0x128e016 | l | length | string | 2 | | 0x128efb7 | l | length | array | 63000 | | 0x128efd1 | l | length | array | 1880 | | 0x128f087 | l | length | array | 63000 | | 0x128f0a1 | l | length | array | 1880 | | 0x129050c | l | length | string | 6772 | | 0x129050c | p | length | object | 20000 | | 0x1292167 | l | length | string | 23334 | | 0x12921ac | l | length | string | 4878 | | 0x1292a5c | l | length | string | 32774 | | 0x1292c93 | l | length | array | 934 | | 0x1292cf2 | l | length | array | 56934 | | 0x1292d11 | l | length | array | 934 | | 0x129c8f8 | l | length | string | 1 | | 0x129d708 | l | length | string | 1 | | 0x129d7cb | l | length | string | 15825 | | 0x129da34 | l | length | array | 17 | | 0x129e268 | l | length | array | 227500 | | 0x129ea32 | l | length | string | 10065 | | 0x129ec5a | l | length | array | 21 | | 0x30c09a | l | length | array | 27 | | 0x30c0a9 | l | length | string | 1 | | 0x30c1c3 | l | length | array | 1 | | 0x30c247 | l | length | array | 27 | | 0x3104fe | l | length | array | 17084 | | 0x311d98 | l | length | array | 4 | | 0x31231a | l | length | array | 8 | | 0x81de39 | l | length | array | 159 | | 0x81e04e | l | length | array | 4 | | 0x821c75 | l | length | array | 4500 | | 0x82485a | l | length | array | 170 | | 0x825749 | l | length | array | 249 | | 0x831cf8 | l | length | array | 20295 | | 0x831eb4 | l | length | array | 1760 | | 0x83d8b2 | l | length | string | 448 | | 0x83e3b7 | l | length | string | 1 | | 0x83e462 | l | length | string | 1 | | 0x843d8b | l | length | array | 1 | | 0x843e85 | l | length | string | 1427 | | 0x843ea1 | l | length | array | 85 | | 0x844dc8 | l | length | string | 28000 | | 0x844dd6 | l | length | string | 2000 | | 0x8456e5 | l | length | array | 28 | | 0x845a4f | l | length | string | 2 | | 0x845bd7 | l | length | string | 1 | | 0x845bf3 | l | length | string | 1 | | 0x845c30 | l | length | array | 9 | | 0x84df04 | l | length | string | 29589 | | 0x84df99 | l | length | array | 2501 | +-----------+------+--------+--------+----------+ Note that at each site, either the base (|o| in |o.length|) is an array always, an object always, or a string always, not mixtures. Here are the totals: +--------+----------+ | base | count(*) | +--------+----------+ | array | 463012 | | object | 22000 | | string | 155147 | +--------+----------+ The array optimization looks more important.

Another key point about the above is that in SS, JSOP_LENGTH always gets an array or an string, never an object.

(SunSpider) Here are the non-fast-path GETELEM accesses: +-----------+-------+--------+-------+----------+ | pc | key | base | shape | count(*) | +-----------+-------+--------+-------+----------+ | 0x128ddaa | Y-m-d | object | 3823 | 8000 | | 0x128ddc7 | Y-m-d | object | 3887 | 8000 | | 0x1292307 | c | object | 4045 | 17 | | 0x129230e | a | object | 4045 | 17 | | 0x1292cd0 | a | object | 4045 | 175116 | | 0x12934d5 | tag | object | 4092 | 5000 | | 0x1294977 | d | object | 9017 | 9726 | | 0x30e687 | if | object | 8415 | 24180 | | 0x3126a7 | if | object | 6084 | 32974 | | 0x312757 | G | object | 6702 | 14586 | | 0x845c5b | B | object | 3966 | 11 | +-----------+-------+--------+-------+----------+ It looks like a PIC could be useful even here, given that the prop names don't seem to change.

(SunSpider) GETPROP accesses. It seems there is only one shape per site--it's hard for me to believe that, but maybe it's true. +-----------+-------+--------+----------+ | pc | shape | base | count(*) | +-----------+-------+--------+----------+ | 0x128ce76 | 293 | object | 1000 | | 0x128d1c6 | 293 | object | 500 | | 0x128d776 | 293 | object | 500 | | 0x128d95c | 218 | object | 1000 | | 0x128dc85 | 217 | object | 1 | | 0x128dda4 | 3884 | object | 8000 | | 0x128ddc1 | 3885 | object | 8000 | | 0x128df4f | 3885 | object | 2 | | 0x128df5d | 3885 | object | 2 | | 0x129050c | 293 | object | 20000 | | 0x1290e98 | 3885 | object | 1 | | 0x12915f8 | 3885 | object | 1 | | 0x12916e0 | 3885 | object | 4000 | | 0x12916f5 | 3885 | object | 4000 | | 0x12934b1 | 39 | object | 10001 | | 0x12934b4 | 4086 | object | 10001 | | 0x1293d99 | 4092 | object | 26617 | | 0x1293d9e | 4092 | object | 26617 | | 0x1293dad | 4092 | object | 13059 | | 0x1293db2 | 4092 | object | 13059 | | 0x1293ea3 | 39 | object | 1 | | 0x1293ea6 | 653 | object | 1 | | 0x1293eb0 | 148 | object | 1 | | 0x1293ebd | 17 | object | 1 | | 0x1293eca | 3885 | object | 1 | | 0x1293ed7 | 578 | object | 1 | | 0x1293ee4 | 39 | object | 1 | | 0x1293ef5 | 3855 | object | 1 | | 0x1294581 | 9045 | object | 12000 | | 0x30df16 | 411 | object | 204 | | 0x30e036 | 411 | object | 204 | | 0x30e156 | 411 | object | 204 | | 0x30e71c | 411 | object | 15 | | 0x30e72d | 411 | object | 15 | | 0x30e73f | 411 | object | 15 | | 0x30e9fc | 430 | object | 120 | | 0x30ff4d | 495 | object | 35000 | | 0x30ff59 | 495 | object | 35000 | | 0x30ff69 | 495 | object | 35000 | | 0x30ff6d | 495 | object | 35000 | | 0x30ff79 | 495 | object | 35000 | | 0x30ff89 | 495 | object | 35000 | | 0x30ff8f | 495 | object | 35000 | | 0x30ff94 | 495 | object | 35000 | | 0x30ffa0 | 495 | object | 35000 | | 0x30ffdd | 495 | object | 23336 | | 0x30fff8 | 495 | object | 23336 | | 0x310003 | 495 | object | 23336 | | 0x31000a | 495 | object | 23336 | | 0x310020 | 500 | object | 14041 | | 0x310027 | 500 | object | 14041 | | 0x3104ad | 505 | object | 16058 | | 0x3104fb | 505 | object | 17084 | | 0x310686 | 513 | object | 30 | | 0x310692 | 513 | object | 30 | | 0x3106a4 | 513 | object | 30 | | 0x3106b3 | 513 | object | 30 | | 0x3106d5 | 513 | object | 30 | | 0x3106e4 | 513 | object | 30 | | 0x310aa0 | 517 | object | 900 | | 0x310ab2 | 517 | object | 900 | | 0x310ad4 | 517 | object | 900 | | 0x310ae6 | 517 | object | 900 | | 0x311055 | 546 | object | 42072 | | 0x31105d | 546 | object | 21440 | | 0x311064 | 546 | object | 20632 | | 0x311068 | 546 | object | 20632 | | 0x311074 | 546 | object | 20632 | | 0x311d95 | 618 | object | 4 | | 0x311da6 | 618 | object | 20 | | 0x311db1 | 616 | object | 20 | | 0x311dbd | 616 | object | 20 | | 0x311dce | 616 | object | 20 | | 0x311ddf | 616 | object | 20 | | 0x311dfb | 618 | object | 4 | | 0x312317 | 618 | object | 8 | | 0x312328 | 618 | object | 40 | | 0x312339 | 616 | object | 40 | | 0x31233f | 616 | object | 40 | | 0x312344 | 616 | object | 40 | | 0x31234a | 616 | object | 40 | | 0x31234f | 616 | object | 40 | | 0x312356 | 616 | object | 40 | | 0x31235b | 616 | object | 40 | | 0x312375 | 618 | object | 80 | | 0x312380 | 616 | object | 80 | | 0x312385 | 616 | object | 80 | | 0x31238f | 616 | object | 80 | | 0x312394 | 616 | object | 80 | | 0x31239e | 616 | object | 80 | | 0x3123a3 | 616 | object | 80 | | 0x3123d5 | 616 | object | 80 | | 0x3123da | 616 | object | 80 | | 0x312691 | 10 | object | 1 | | 0x3126a4 | 10 | object | 1 | | 0x3126b1 | 357 | object | 1 | | 0x818c4d | 360 | object | 1852 | | 0x818c58 | 360 | object | 1852 | | 0x818c63 | 360 | object | 1852 | | 0x818c6e | 360 | object | 1852 | | 0x818d7f | 416 | array | 1852 | | 0x818d91 | 416 | array | 1852 | | 0x81c4b1 | 10 | object | 1 | | 0x821c72 | 618 | object | 4500 | | 0x821c83 | 618 | object | 22500 | | 0x821c9b | 618 | object | 45000 | | 0x821ca6 | 616 | object | 45000 | | 0x821cab | 616 | object | 45000 | | 0x821cb5 | 616 | object | 45000 | | 0x821cba | 616 | object | 45000 | | 0x821cc4 | 616 | object | 45000 | | 0x821cc9 | 616 | object | 45000 | | 0x821d0f | 616 | object | 45000 | | 0x821d15 | 616 | object | 45000 | | 0x821d28 | 616 | object | 45000 | | 0x821d2e | 616 | object | 45000 | | 0x821d41 | 616 | object | 45000 | | 0x821d47 | 616 | object | 45000 | | 0x821d5a | 616 | object | 45000 | | 0x821d60 | 616 | object | 45000 | | 0x821d73 | 616 | object | 45000 | | 0x821d79 | 616 | object | 45000 | | 0x821d8c | 616 | object | 45000 | | 0x821d92 | 616 | object | 45000 | | 0x821dc6 | 618 | object | 22500 | | 0x821dd5 | 616 | object | 22500 | | 0x821ddb | 616 | object | 22500 | | 0x821dea | 616 | object | 22500 | | 0x821df0 | 616 | object | 22500 | | 0x821dff | 616 | object | 22500 | | 0x821e05 | 616 | object | 22500 | | 0x82a417 | 3826 | object | 1 | | 0x82a456 | 3833 | object | 1 | | 0x82a463 | 3833 | object | 1 | | 0x82a470 | 3833 | object | 1 | | 0x82a47d | 3833 | object | 1 | | 0x82a48a | 3833 | object | 1 | | 0x82a497 | 3833 | object | 1 | | 0x82a4a4 | 3833 | object | 1 | | 0x82a4b1 | 3833 | object | 1 | | 0x82a4be | 3833 | object | 1 | | 0x82ad3f | 484 | object | 14 | | 0x82ad4b | 484 | object | 14 | | 0x82ad9e | 485 | object | 14 | | 0x82adb2 | 486 | object | 14 | | 0x82adcc | 487 | object | 14 | | 0x82f942 | 3931 | object | 31744 | | 0x82f95e | 3931 | object | 31744 | | 0x82f975 | 3931 | object | 31744 | | 0x82f98e | 3931 | object | 31744 | | 0x82f9a7 | 3931 | object | 31744 | | 0x82f9b8 | 3931 | object | 31744 | | 0x82f9c9 | 3931 | object | 31744 | | 0x82f9dc | 3931 | object | 31744 | | 0x831c9b | 505 | object | 18942 | | 0x831cf5 | 505 | object | 20295 | | 0x831d04 | 505 | object | 460 | | 0x831d09 | 505 | object | 460 | | 0x831d0e | 505 | object | 460 | | 0x831d18 | 500 | object | 893 | | 0x831d6d | 500 | object | 893 | | 0x831d8f | 495 | object | 98 | | 0x831d9d | -1 | array | 893 | | 0x831dea | 499 | array | 453 | | 0x831dfa | 505 | object | 440 | | 0x831dff | 505 | object | 440 | | 0x831e04 | 505 | object | 440 | | 0x831e1a | 505 | object | 1320 | | 0x831e98 | 506 | array | 1019 | | 0x831eb1 | 505 | object | 1760 | | 0x838169 | 513 | object | 1 | | 0x838180 | 513 | object | 1 | | 0x838197 | 513 | object | 1 | | 0x8381af | 513 | object | 1 | | 0x8381c7 | 513 | object | 1 | | 0x8381d1 | 513 | object | 1 | | 0x8381dc | 513 | object | 1 | | 0x8381e6 | 513 | object | 1 | | 0x8381f1 | 513 | object | 1 | | 0x8381fc | 513 | object | 1 | | 0x838208 | 513 | object | 1 | | 0x838213 | 513 | object | 1 | | 0x83a082 | 416 | array | 1248 | | 0x83a161 | 416 | array | 100 | | 0x83a182 | 416 | array | 100 | | 0x83a18d | 416 | array | 100 | | 0x83a1ae | 416 | array | 100 | | 0x83a1b9 | 416 | array | 100 | | 0x83a1da | 416 | array | 100 | | 0x83a1e5 | 416 | array | 100 | | 0x83a206 | 416 | array | 100 | | 0x83a21f | 416 | array | 208 | | 0x83a240 | 416 | array | 208 | | 0x83a24b | 416 | array | 208 | | 0x83a26c | 416 | array | 208 | | 0x83a277 | 416 | array | 208 | | 0x83a298 | 416 | array | 108 | | 0x83a2a3 | 416 | array | 208 | | 0x83a2c4 | 416 | array | 208 | | 0x83a2dd | 416 | array | 104 | | 0x83a309 | 416 | array | 104 | | 0x83a329 | 416 | array | 104 | | 0x83a334 | 416 | array | 104 | | 0x83a352 | 416 | array | 104 | | 0x83a35c | 416 | array | 104 | | 0x83a37c | 416 | array | 104 | | 0x83a395 | 416 | array | 204 | | 0x83a3b5 | 416 | array | 100 | | 0x83a3c0 | 416 | array | 204 | | 0x83a3e0 | 416 | array | 204 | | 0x83a3eb | 416 | array | 204 | | 0x83a40c | 416 | array | 104 | | 0x83a417 | 416 | array | 204 | | 0x83d880 | 356 | object | 208 | | 0x83d886 | 356 | object | 208 | | 0x83d895 | 356 | object | 204 | | 0x83d8c8 | 360 | object | 204 | | 0x83d8d4 | 360 | object | 204 | | 0x83d8e0 | 360 | object | 204 | | 0x83d936 | 360 | object | 204 | | 0x83d941 | 360 | object | 204 | | 0x83d94c | 360 | object | 204 | | 0x83d98d | 360 | object | 1836 | | 0x84568f | 371 | array | 24 | | 0x84569e | 371 | array | 24 | | 0x8456a8 | 360 | object | 24 | | 0x8456b1 | 371 | array | 24 | | 0x8456bb | 360 | object | 24 | | 0x8456c4 | 371 | array | 24 | | 0x8456cf | 360 | object | 24 | | 0x8456e2 | 371 | array | 28 | | 0x84572e | 413 | array | 5404 | | 0x845741 | 348 | object | 4 | | 0x845749 | 348 | object | 4 | | 0x845751 | 348 | object | 4 | | 0x845791 | 360 | object | 36 | | 0x845c12 | 673 | object | 9 | | 0x84a53a | 505 | object | 1 | | 0x84a54f | 505 | object | 1 | | 0x84a56a | 505 | object | 1 | | 0x84a57f | 505 | object | 1 | | 0x84a59a | 505 | object | 1 | | 0x84a5b0 | 505 | object | 1 | | 0x84bf36 | 10 | object | 1 | | 0x84bf52 | 10 | object | 1 | | 0x84bf5f | 357 | object | 1 | | 0x84bf6d | 10 | object | 1 | | 0x84bf7b | 357 | object | 1 | | 0x84deba | 4092 | object | 2500 | | 0x84df39 | 4092 | object | 2500 | +-----------+-------+--------+----------+

(SunSpider) GETPROP. This supersedes comment 4. I noticed a bug in my SQL. +-----------+-------+--------+-----------------+----------+ | pc | shape | base | key | count(*) | +-----------+-------+--------+-----------------+----------+ | 0x128ce76 | 293 | object | length | 1000 | | 0x128d1c6 | 293 | object | length | 500 | | 0x128d776 | 293 | object | length | 500 | | 0x128d95c | 218 | object | getFullYear | 1000 | | 0x128dc85 | 217 | object | prototype | 1 | | 0x128dda4 | 3884 | object | formatFunctions | 1 | | 0x128dda4 | 3885 | object | formatFunctions | 7999 | | 0x128ddc1 | 3885 | object | formatFunctions | 8000 | | 0x128df4f | 3885 | object | formatFunctions | 2 | | 0x128df5d | 3885 | object | formatFunctions | 2 | | 0x129050c | 293 | object | length | 20000 | | 0x1290e98 | 3885 | object | prototype | 1 | | 0x12915f8 | 3885 | object | prototype | 1 | | 0x12916e0 | 3885 | object | dayNames | 4000 | | 0x12916f5 | 3885 | object | monthNames | 4000 | | 0x12934b1 | 39 | object | prototype | 10001 | | 0x12934b4 | 4086 | object | hasOwnProperty | 10001 | | 0x1293d99 | 4092 | object | tag | 26617 | | 0x1293d9e | 4092 | object | tag | 26617 | | 0x1293dad | 4092 | object | tag | 13059 | | 0x1293db2 | 4092 | object | tag | 13059 | | 0x1293ea3 | 39 | object | prototype | 1 | | 0x1293ea6 | 653 | object | toJSONString | 1 | | 0x1293eb0 | 148 | object | prototype | 1 | | 0x1293ebd | 17 | object | prototype | 1 | | 0x1293eca | 3885 | object | prototype | 1 | | 0x1293ed7 | 578 | object | prototype | 1 | | 0x1293ee4 | 39 | object | prototype | 1 | | 0x1293ef5 | 3855 | object | prototype | 1 | | 0x1294581 | 9045 | object | endResult | 12000 | | 0x30df16 | 411 | object | PI | 204 | | 0x30e036 | 411 | object | PI | 204 | | 0x30e156 | 411 | object | PI | 204 | | 0x30e71c | 411 | object | PI | 15 | | 0x30e72d | 411 | object | sin | 15 | | 0x30e73f | 411 | object | PI | 15 | | 0x30e9fc | 430 | object | testOutput | 120 | | 0x30ff4d | 495 | object | axis | 30242 | | 0x30ff4d | 500 | object | axis | 45 | | 0x30ff4d | 518 | object | axis | 2378 | | 0x30ff4d | 519 | object | axis | 2335 | | 0x30ff59 | 495 | object | axis | 30242 | | 0x30ff59 | 500 | object | axis | 45 | | 0x30ff59 | 518 | object | axis | 2378 | | 0x30ff59 | 519 | object | axis | 2335 | | 0x30ff69 | 495 | object | axis | 30242 | | 0x30ff69 | 500 | object | axis | 45 | | 0x30ff69 | 518 | object | axis | 2378 | | 0x30ff69 | 519 | object | axis | 2335 | | 0x30ff6d | 495 | object | nu | 30242 | | 0x30ff6d | 500 | object | nu | 45 | | 0x30ff6d | 518 | object | nu | 2378 | | 0x30ff6d | 519 | object | nu | 2335 | | 0x30ff79 | 495 | object | nv | 30242 | | 0x30ff79 | 500 | object | nv | 45 | | 0x30ff79 | 518 | object | nv | 2378 | | 0x30ff79 | 519 | object | nv | 2335 | | 0x30ff89 | 495 | object | nd | 30242 | | 0x30ff89 | 500 | object | nd | 45 | | 0x30ff89 | 518 | object | nd | 2378 | | 0x30ff89 | 519 | object | nd | 2335 | | 0x30ff8f | 495 | object | axis | 30242 | | 0x30ff8f | 500 | object | axis | 45 | | 0x30ff8f | 518 | object | axis | 2378 | | 0x30ff8f | 519 | object | axis | 2335 | | 0x30ff94 | 495 | object | nu | 30242 | | 0x30ff94 | 500 | object | nu | 45 | | 0x30ff94 | 518 | object | nu | 2378 | | 0x30ff94 | 519 | object | nu | 2335 | | 0x30ffa0 | 495 | object | nv | 30242 | | 0x30ffa0 | 500 | object | nv | 45 | | 0x30ffa0 | 518 | object | nv | 2378 | | 0x30ffa0 | 519 | object | nv | 2335 | | 0x30ffdd | 495 | object | eu | 21672 | | 0x30ffdd | 500 | object | eu | 18 | | 0x30ffdd | 518 | object | eu | 831 | | 0x30ffdd | 519 | object | eu | 815 | | 0x30fff8 | 495 | object | ev | 21672 | | 0x30fff8 | 500 | object | ev | 18 | | 0x30fff8 | 518 | object | ev | 831 | | 0x30fff8 | 519 | object | ev | 815 | | 0x310003 | 495 | object | nu1 | 21672 | | 0x310003 | 500 | object | nu1 | 18 | | 0x310003 | 518 | object | nu1 | 831 | | 0x310003 | 519 | object | nu1 | 815 | | 0x31000a | 495 | object | nv1 | 21672 | | 0x31000a | 500 | object | nv1 | 18 | | 0x31000a | 518 | object | nv1 | 831 | | 0x31000a | 519 | object | nv1 | 815 | | 0x310020 | 495 | object | nu2 | 12798 | | 0x310020 | 500 | object | nu2 | 3 | | 0x310020 | 518 | object | nu2 | 831 | | 0x310020 | 519 | object | nu2 | 409 | | 0x310027 | 495 | object | nv2 | 12798 | | 0x310027 | 500 | object | nv2 | 3 | | 0x310027 | 518 | object | nv2 | 831 | | 0x310027 | 519 | object | nv2 | 409 | | 0x3104ad | 505 | object | triangles | 16058 | | 0x3104fb | 505 | object | triangles | 17084 | | 0x310686 | 513 | object | origin | 30 | | 0x310692 | 513 | object | origin | 30 | | 0x3106a4 | 513 | object | directions | 30 | | 0x3106b3 | 513 | object | directions | 30 | | 0x3106d5 | 513 | object | directions | 30 | | 0x3106e4 | 513 | object | directions | 30 | | 0x310aa0 | 517 | object | origin | 900 | | 0x310ab2 | 517 | object | origin | 900 | | 0x310ad4 | 517 | object | dir | 900 | | 0x310ae6 | 517 | object | dir | 900 | | 0x311055 | 546 | object | left | 42072 | | 0x31105d | 546 | object | item | 21440 | | 0x311064 | 546 | object | item | 20632 | | 0x311068 | 546 | object | left | 20632 | | 0x311074 | 546 | object | right | 20632 | | 0x311d95 | 618 | object | bodies | 4 | | 0x311da6 | 618 | object | bodies | 20 | | 0x311db1 | 616 | object | mass | 20 | | 0x311dbd | 616 | object | vx | 20 | | 0x311dce | 616 | object | vy | 20 | | 0x311ddf | 616 | object | vz | 20 | | 0x311dfb | 618 | object | bodies | 4 | | 0x312317 | 618 | object | bodies | 8 | | 0x312328 | 618 | object | bodies | 40 | | 0x312339 | 616 | object | mass | 40 | | 0x31233f | 616 | object | vx | 40 | | 0x312344 | 616 | object | vx | 40 | | 0x31234a | 616 | object | vy | 40 | | 0x31234f | 616 | object | vy | 40 | | 0x312356 | 616 | object | vz | 40 | | 0x31235b | 616 | object | vz | 40 | | 0x312375 | 618 | object | bodies | 80 | | 0x312380 | 616 | object | x | 80 | | 0x312385 | 616 | object | x | 80 | | 0x31238f | 616 | object | y | 80 | | 0x312394 | 616 | object | y | 80 | | 0x31239e | 616 | object | z | 80 | | 0x3123a3 | 616 | object | z | 80 | | 0x3123d5 | 616 | object | mass | 80 | | 0x3123da | 616 | object | mass | 80 | | 0x312691 | 10 | object | prototype | 1 | | 0x3126a4 | 10 | object | prototype | 1 | | 0x3126b1 | 357 | object | prototype | 1 | | 0x818c4d | 360 | object | V | 1852 | | 0x818c58 | 360 | object | V | 1852 | | 0x818c63 | 360 | object | V | 1852 | | 0x818c6e | 360 | object | V | 1852 | | 0x818d7f | 416 | array | LastPx | 1852 | | 0x818d91 | 416 | array | LastPx | 1852 | | 0x81c4b1 | 10 | object | prototype | 1 | | 0x821c72 | 618 | object | bodies | 4500 | | 0x821c83 | 618 | object | bodies | 22500 | | 0x821c9b | 618 | object | bodies | 45000 | | 0x821ca6 | 616 | object | x | 45000 | | 0x821cab | 616 | object | x | 45000 | | 0x821cb5 | 616 | object | y | 45000 | | 0x821cba | 616 | object | y | 45000 | | 0x821cc4 | 616 | object | z | 45000 | | 0x821cc9 | 616 | object | z | 45000 | | 0x821d0f | 616 | object | vx | 45000 | | 0x821d15 | 616 | object | mass | 45000 | | 0x821d28 | 616 | object | vy | 45000 | | 0x821d2e | 616 | object | mass | 45000 | | 0x821d41 | 616 | object | vz | 45000 | | 0x821d47 | 616 | object | mass | 45000 | | 0x821d5a | 616 | object | vx | 45000 | | 0x821d60 | 616 | object | mass | 45000 | | 0x821d73 | 616 | object | vy | 45000 | | 0x821d79 | 616 | object | mass | 45000 | | 0x821d8c | 616 | object | vz | 45000 | | 0x821d92 | 616 | object | mass | 45000 | | 0x821dc6 | 618 | object | bodies | 22500 | | 0x821dd5 | 616 | object | x | 22500 | | 0x821ddb | 616 | object | vx | 22500 | | 0x821dea | 616 | object | y | 22500 | | 0x821df0 | 616 | object | vy | 22500 | | 0x821dff | 616 | object | z | 22500 | | 0x821e05 | 616 | object | vz | 22500 | | 0x82a417 | 3826 | object | prototype | 1 | | 0x82a456 | 3833 | object | prototype | 1 | | 0x82a463 | 3833 | object | prototype | 1 | | 0x82a470 | 3833 | object | prototype | 1 | | 0x82a47d | 3833 | object | prototype | 1 | | 0x82a48a | 3833 | object | prototype | 1 | | 0x82a497 | 3833 | object | prototype | 1 | | 0x82a4a4 | 3833 | object | prototype | 1 | | 0x82a4b1 | 3833 | object | prototype | 1 | | 0x82a4be | 3833 | object | prototype | 1 | | 0x82ad3f | 484 | object | axis | 14 | | 0x82ad4b | 484 | object | axis | 14 | | 0x82ad9e | 485 | object | axis | 14 | | 0x82adb2 | 486 | object | axis | 14 | | 0x82adcc | 487 | object | axis | 14 | | 0x82f942 | 3931 | object | a2 | 31744 | | 0x82f95e | 3931 | object | a3 | 31744 | | 0x82f975 | 3931 | object | a4 | 31744 | | 0x82f98e | 3931 | object | a5 | 31744 | | 0x82f9a7 | 3931 | object | a6 | 31744 | | 0x82f9b8 | 3931 | object | a7 | 31744 | | 0x82f9c9 | 3931 | object | a8 | 31744 | | 0x82f9dc | 3931 | object | a9 | 31744 | | 0x831c9b | 505 | object | triangles | 18942 | | 0x831cf5 | 505 | object | triangles | 20295 | | 0x831d04 | 505 | object | background | 460 | | 0x831d09 | 505 | object | background | 460 | | 0x831d0e | 505 | object | background | 460 | | 0x831d18 | 495 | object | normal | 98 | | 0x831d18 | 500 | object | normal | 2 | | 0x831d18 | 518 | object | normal | 420 | | 0x831d18 | 519 | object | normal | 373 | | 0x831d6d | 495 | object | shader | 98 | | 0x831d6d | 500 | object | shader | 2 | | 0x831d6d | 518 | object | shader | 420 | | 0x831d6d | 519 | object | shader | 373 | | 0x831d8f | 495 | object | material | 98 | | 0x831d9d | -1 | array | reflection | 440 | | 0x831d9d | 499 | array | reflection | 453 | | 0x831dea | 499 | array | reflection | 453 | | 0x831dfa | 505 | object | ambient | 440 | | 0x831dff | 505 | object | ambient | 440 | | 0x831e04 | 505 | object | ambient | 440 | | 0x831e1a | 505 | object | lights | 1320 | | 0x831e98 | 506 | array | colour | 1019 | | 0x831eb1 | 505 | object | lights | 1760 | | 0x838169 | 513 | object | directions | 1 | | 0x838180 | 513 | object | directions | 1 | | 0x838197 | 513 | object | directions | 1 | | 0x8381af | 513 | object | directions | 1 | | 0x8381c7 | 513 | object | directions | 1 | | 0x8381d1 | 513 | object | directions | 1 | | 0x8381dc | 513 | object | directions | 1 | | 0x8381e6 | 513 | object | directions | 1 | | 0x8381f1 | 513 | object | directions | 1 | | 0x8381fc | 513 | object | directions | 1 | | 0x838208 | 513 | object | directions | 1 | | 0x838213 | 513 | object | directions | 1 | | 0x83a082 | 416 | array | Normal | 1248 | | 0x83a161 | 416 | array | Line | 100 | | 0x83a182 | 416 | array | Line | 100 | | 0x83a18d | 416 | array | Line | 100 | | 0x83a1ae | 416 | array | Line | 100 | | 0x83a1b9 | 416 | array | Line | 100 | | 0x83a1da | 416 | array | Line | 100 | | 0x83a1e5 | 416 | array | Line | 100 | | 0x83a206 | 416 | array | Line | 100 | | 0x83a21f | 416 | array | Line | 208 | | 0x83a240 | 416 | array | Line | 208 | | 0x83a24b | 416 | array | Line | 208 | | 0x83a26c | 416 | array | Line | 208 | | 0x83a277 | 416 | array | Line | 208 | | 0x83a298 | 416 | array | Line | 108 | | 0x83a2a3 | 416 | array | Line | 208 | | 0x83a2c4 | 416 | array | Line | 208 | | 0x83a2dd | 416 | array | Line | 104 | | 0x83a309 | 416 | array | Line | 104 | | 0x83a329 | 416 | array | Line | 104 | | 0x83a334 | 416 | array | Line | 104 | | 0x83a352 | 416 | array | Line | 104 | | 0x83a35c | 416 | array | Line | 104 | | 0x83a37c | 416 | array | Line | 104 | | 0x83a395 | 416 | array | Line | 204 | | 0x83a3b5 | 416 | array | Line | 100 | | 0x83a3c0 | 416 | array | Line | 204 | | 0x83a3e0 | 416 | array | Line | 204 | | 0x83a3eb | 416 | array | Line | 204 | | 0x83a40c | 416 | array | Line | 104 | | 0x83a417 | 416 | array | Line | 204 | | 0x83d880 | 356 | object | LoopCount | 208 | | 0x83d886 | 356 | object | LoopMax | 208 | | 0x83d895 | 356 | object | LoopCount | 204 | | 0x83d8c8 | 360 | object | V | 204 | | 0x83d8d4 | 360 | object | V | 204 | | 0x83d8e0 | 360 | object | V | 204 | | 0x83d936 | 360 | object | V | 204 | | 0x83d941 | 360 | object | V | 204 | | 0x83d94c | 360 | object | V | 204 | | 0x83d98d | 360 | object | V | 1836 | | 0x84568f | 371 | array | Normal | 6 | | 0x84568f | 416 | array | Normal | 18 | | 0x84569e | 371 | array | Edge | 6 | | 0x84569e | 416 | array | Edge | 18 | | 0x8456a8 | 360 | object | V | 24 | | 0x8456b1 | 371 | array | Edge | 6 | | 0x8456b1 | 416 | array | Edge | 18 | | 0x8456bb | 360 | object | V | 24 | | 0x8456c4 | 371 | array | Edge | 6 | | 0x8456c4 | 416 | array | Edge | 18 | | 0x8456cf | 360 | object | V | 24 | | 0x8456e2 | 371 | array | Edge | 7 | | 0x8456e2 | 416 | array | Edge | 21 | | 0x84572e | 413 | array | NumPx | 361 | | 0x84572e | 416 | array | NumPx | 5043 | | 0x845741 | 348 | object | V | 4 | | 0x845749 | 348 | object | V | 4 | | 0x845751 | 348 | object | V | 4 | | 0x845791 | 360 | object | V | 36 | | 0x845c12 | 673 | object | source | 9 | | 0x84a53a | 505 | object | lights | 1 | | 0x84a54f | 505 | object | lights | 1 | | 0x84a56a | 505 | object | lights | 1 | | 0x84a57f | 505 | object | lights | 1 | | 0x84a59a | 505 | object | lights | 1 | | 0x84a5b0 | 505 | object | lights | 1 | | 0x84bf36 | 10 | object | prototype | 1 | | 0x84bf52 | 10 | object | prototype | 1 | | 0x84bf5f | 357 | object | prototype | 1 | | 0x84bf6d | 10 | object | prototype | 1 | | 0x84bf7b | 357 | object | prototype | 1 | | 0x84deba | 4092 | object | tag | 2500 | | 0x84df39 | 4092 | object | popularity | 2500 | +-----------+-------+--------+-----------------+----------+

SunSpider, GETPROP, histogram of number of shapes per static GETPROP pc: +---------+----------+ | nshapes | count(*) | +---------+----------+ | 1 | 225 | | 2 | 8 | | 4 | 17 | +---------+----------+ SunSpider, GETPROP, histogram of number of dynamic accesses sites with a given number of shapes: +---------+------------+ | nshapes | sum(natpc) | +---------+------------+ | 1 | 1680263 | | 2 | 14421 | | 4 | 438212 | +---------+------------+

V8-V4, LENGTH. Here, only the array optimization is probably worthwhile. It kind of makes sense that programs loop over arrays element-by-element much more often than they do strings. PC jsop base type dynamic count 0x0020bc2a length array 8 0x0020bc39 length string 1 0x0020bd53 length array 1 0x0020bdd7 length array 8 0x00213f81 length array 256 0x0021443c length array 257 0x0021453f length array 224 0x002148c7 length string 8 0x002148ea length string 8 0x00214ba0 length string 16 0x00214ba9 length string 16 0x00214d92 length string 8 0x00214ea6 length array 8 0x00214eba length array 8 0x00214ee5 length array 112 0x00214f22 length array 896 0x00215198 length string 16 0x002151a1 length string 16 0x00216296 length array 32705 0x00216d9d length array 2794185 0x008178fc length array 8 0x008178fc length string 136 0x008b47ba length array 1 0x008ec075 length array 13752 0x00955abf length array 32 0x009566cd length array 4 0x00956764 length array 4 0x009567ca length array 4 0x0095890b length array 4 0x00958913 length array 4 0x009589ba length array 4 0x009589c2 length array 4 0x009589ca length array 4 0x07b01e06 length array 1 0x09804806 getprop object 16742 0x09807e21 length array 4 0x09807fd3 length array 4304 0x09817390 length array 48 0x09817950 length array 32 0x098187f5 length array 4 0x0c66384e length array 79872

V8-V4, GETPROP, shape variation. #shapes #sites #execs 1 1240 85143982 2 73 1700639 3 41 1185392 4 15 4060595 5 19 2184436 10 20 8628540 14 1 399566 #shapes = number of shapes at a given getprop pc #sites = number of static getprop pcs with #shapes different shapes #execs = number of getprop ops executed at pcs with #shapes diff. shapes

I looked at GETELEM for v8-v4. I found that there are very few (~30,000) accesses that don't hit dense arrays, and those don't have many shapes in common (usually a different shape each time) so I think there we just need a fast path for dense arrays. As we already know, we aren't getting dense arrays for all the numeric code there, so being more aggressive about that would also help.

Conclusions: - For |.length| accesses, the PIC only needs to generate one stub, either for strings or arrays, and then go to the slow path always after that. - For |.foo| accesses, SunSpider requires only 4 stubs per site, but V8 can require up to 14 stubs per site. Whether that actually makes things faster requires another test. - For |[foo]| accesses, it's not worth caching, except possibly if |foo| is a constant non-numeric string.

A question I haven't treated yet is what kind of variation we see in prototype chains. In particular, WebKit always generates only self stubs, direct proto stubs, or proto chain stubs for a given PIC, and I want to know if this is sufficient. Here are stats for SunSpider: Histogram of chain lengths (dynamic): len count 1 2109348 2 23009 This means there are 2.1M dynamic accesses with chain length 1 (i.e., self property) and 23K with chain length 2 (i.e., direct proto). Nothing more is needed for SS, apparently. Histogram of chain length combinations (static): lens count (1,) 567405 (2,) 14010 This means there are .5M getprop sites where the chain length is always 1, and 14K where it is always 2. Thus, at each site we have only proto accesses or only self accesses, never both. Histogram of chains (s/d): 1 225 1680715 2 7 13528 3 1 795 4 16 437319 This is like the histograms above except it is for every shape on the chain, not just the base object. Not surprisingly, given the preponderance of self accesses, it's about the same as the original result.

Proto chain counts for v8: Histogram of chain lengths (dynamic): 1 102894899 2 426671 Histogram of chain length combinations (static): (1,) 1397 (1, 2) 8 (2,) 2 Histogram of chains (s/d): 0 1237 85143142 1 65 1596759 2 49 1291790 3 7 3917685 4 11 247246 5 16 2080100 6 20 8628540 7 1 16742 8 1 399566 Not sure why the shapes don't quite match up with the earlier results. Another thing to note is that this didn't find any chains longer than 2. We know some chains are in there because we had to improve handling of them to get stuff to trace. Maybe those are for callprops. v8, at least, looks like it might benefit from being able to have both self and proto entries at a given site.

Check gmail. As noted in bug 411630 comment 2 it used to have very deep chains, and varying length for a given site. This was (and I believe is still) due to the closure compiler. Google open-sourced that last year. /be