804929 - Ionmonkey: JM+Ion 5x slower on accessing not set property

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

Testcase:
var Camera = function() {}
for (var y = 0; y < 20000000; y++) {
  var scene = new Camera()
  scene.test
}

ion: 0m2.702s
jm:  0m0.527s
v8:  0m0.177s

Comment 1

[Jan de Mooij [:jandem]]

Good catch, we have to port the missing property IC to Ion. Luke added it to JM a few months ago (bug 777630).

Comment 3

[Nicolas B. Pierron [:nbp]]

I remove the duplicate status because Bug 792631 deals with 2 non-intersecting typesets and this test case deals with only one typeset.  Thus I assume the gap we see between JM and v8 is related to the usage of an IC instead of inlining it.  This imply modifying IonBuilder to check for non-existing properties and inline it as a known constant which value is UndefinedValue.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

v8 does not inline unknown properties, it uses an IC. When I hoist "var scene = ..." outside the loop, v8's score drops from 100ms to 173ms. With JM-only, the time drops from 436ms to 86ms. So this is mostly bug 792631, but our object allocation is also slow.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Of course, I have those numbers backwards - hoisting improves v8's score from 173ms to 100ms, which is a much smaller improvement than with JM+TI.

Comment 6

[Hannes Verschore [:h4writer]]

ion: 0m0.546s
jm:  0m0.618s
v8:  0m0.195s

This got fixed along the line. At least we are now on par with JM. V8 is much faster on this benchmark though, because V8's constructing calls are much faster. Not sure if we can improve on this in the short run (and if we want to, because I thought we are faster on operations on objects)