1148661 - Optimize accesses to unboxed expandos in Ion

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

Bug 1137180 (extensible unboxed objects) regressed octane-box2d, due to what seems to be a lack of inline paths for accessing unboxed expando objects.  The attached patch adds these, and adds back baseline caches for SETPROP/ADDPROP on unboxed expandos, the former of which is necessary for this patch and the latter which still seems like it should be in place.  At least a fair amount of this is simplification (handling lists of receivers in IonBuilder, for example) instead of more unboxed objects related code metastasis.

This seems to have fixed the unreproducible linux x64 dt3 intermittent failure I got with the earlier baseline caches patch, but now there are some windows only intermittent devtools failures on try.  So I guess I'll just land this one in pieces until I can narrow down the problem.

Comment 1

[Brian Hackett [Laid off!]]

(In reply to Brian Hackett (:bhackett) from comment #0)
> This seems to have fixed the unreproducible linux x64 dt3 intermittent
> failure I got with the earlier baseline caches patch, but now there are some
> windows only intermittent devtools failures on try.  So I guess I'll just
> land this one in pieces until I can narrow down the problem.

Actually, the orange in the try push was preexisting from another bug.  Here's the push FWIW:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f67644a69017

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 8584869 [details] [diff] [review]
patch

Review of attachment 8584869 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/BaselineIC.h
@@ +3926,5 @@
>          return offsetof(ReceiverGuard, group_);
>      }
>  
>      // Bits to munge into IC compiler keys when that IC has a ReceiverGuard.
>      // This uses at two bits for data.

Nit: at most?

::: js/src/jit/MIR.cpp
@@ +4482,3 @@
>          const Shape *shape = this->shape(i);
> +        if (!shape)
> +            continue;

This is ok because StoreFixedSlot/StoreSlot are never used for unboxed properties?

Comment 3

[Brian Hackett [Laid off!]]

Yeah, StoreFixedSlot/StoreSlot are only used to store Values.

https://hg.mozilla.org/integration/mozilla-inbound/rev/b9da4b71accc

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b9da4b71accc