GetPropertyOperation has a fast path for JSOP_LENGTH. This is important for strings because apparently it avoids creating lots of string objects. This patch factors it out and also calls it from js::GetProperty. Numbers for the micro-benchmark below: JM+TI (--no-ion) : 2 ms Ion (new) : 13 ms Ion (old) : 79 ms JM+TI is still much faster because its IC can handle the mixed object/string case, while Ion only uses an IC if the value is definitely an object. The attached patch is pretty straight-forward though and is a tiny date-format-xparb win. function f() { var x = new String("foo"); var res = 0; for (var i=0; i<1000000; i++) { res += x.length; x = "foo"; } return res; } var t = dateNow(); f(); print(dateNow() - t);

Worth a followup on improving the IC setup?

https://hg.mozilla.org/projects/ionmonkey/rev/e10b81f123e6 (In reply to Boris Zbarsky (:bz) [In and out Aug 1 - 10, out Aug 11-20] from comment #1) > Worth a followup on improving the IC setup? Fixing it wouldn't be noticeable on date-format-xparb, and I doubt this mixed object/string case is common in performance-critical code. So I'm inclined to wait until we know it really is a problem we have to fix.