1046176 - UnsafeSetReservedSlot post barrier always bails

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

Using callInfo.thisArg() instead of callInfo.getArg(0) means we'll always bail (thisArg() is undefined and MPostWriteBarrier expects an object).

With this patch, the for-of micro-benchmark below improves from 152 to 12 ms. This affects all for-of loops so we should fix it on branches as well.

function f(arr) {
    var t = new Date;
    for (var i=0; i<100000; i++) {
	for (var e of arr) {}
    }
    print(new Date - t);
}
f([1, 2, 3]);

Comment 1

[Jan de Mooij [:jandem]]

[Tracking Requested - why for this release]:

Pretty serious performance issue (see numbers in comment 0) with a trivial fix. GGC will be enabled in 32, so this only affects beta and later.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f578233e4d2c

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f578233e4d2c

Comment 4

[Jan de Mooij [:jandem]]

Comment on attachment 8464739 [details] [diff] [review]
Patch

Approval Request Comment
[Feature/regressing bug #]: Bug 928140, but it only affects versions with GGC (Firefox 32+) 
[User impact if declined]: Pretty serious performance issues in some cases
[Describe test coverage new/current, TBPL]: Patch is on m-c; trivial fix
[Risks and why]: Very low risk; one-liner
[String/UUID change made/needed]: None

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/0b313f36277f
https://hg.mozilla.org/releases/mozilla-beta/rev/247751fedbeb