Optimize instanceof more

RESOLVED FIXED in mozilla37

Status

()

RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

unspecified
mozilla37
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
After some Shumway changes a few weeks ago, richards.swf now spends at least 48% (!) under js::HasInstance.

Ion optimizes instanceof in some cases, but here "rhs.prototype" is not a singleton so we fall back to MCallInstanceOf. This is a pretty bad perf cliff that we should fix.

Maybe we can use Baseline caches to inline more cases or use an idempotent GetPropertyIC to get the .prototype.

Also, we should probably be able to nop instanceof in some cases.
(In reply to Jan de Mooij [:jandem] from comment #0)
> Also, we should probably be able to nop instanceof in some cases.

That would be pretty great. Note that TypeScript is introducing union types and type guards into their type system, which will probably mean that TypeScript-compiled code is going to contain lots and lots of `instanceof` uses in the future.

In practice, here's what this will look like:

function foo(bar: Baz | Quux) {
  if (bar instanceof Baz) {
    // bar is inferred to be of type Baz here, treating it as a Quux is a compile-time error
  } else {
    // bar is inferred to be of type Quux here, treating it as a Baz is a compile-time error
  }
}

The compiled version will just strip type annotations and comments, but retain the instanceof; so it'll look like this:
function foo(bar) {
  if (bar instanceof Baz) {
  } else {
  }
}

Slightly more details: http://blogs.msdn.com/b/typescript/archive/2014/11/18/what-s-new-in-the-typescript-type-system.aspx
(Assignee)

Updated

4 years ago
Depends on: 1113677
(Assignee)

Comment 2

4 years ago
I think the best way to handle the Shumway case is as follows:

(1) Add a Baseline stub for |x instanceof JSFunction|. This stub will be specialized for (and guard on) a particular JSFunction + .prototype.

(2) In IonBuilder, if the TI-based path fails, get the information from the Baseline IC and inline the necessary guards. Then we know the JSFunction + .prototype and can still use the folding mechanism I added in bug 1113677.

Doing (1) is also nice to improve Baseline performance.
(Assignee)

Updated

4 years ago
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
(Assignee)

Updated

4 years ago
Blocks: 1001664
(Assignee)

Comment 3

4 years ago
Created attachment 8540679 [details] [diff] [review]
Patch

This does what I described in comment 2. We optimize "x instanceof function" in Baseline now and can use that in Ion.

Improves richards.swf from ~2700 to ~6100 on x86, faster than V8.

With --no-ion we go from 403 to 557.
Attachment #8540679 - Flags: review?(bhackett1024)
Attachment #8540679 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/47185628a395
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
You need to log in before you can comment on or make changes to this bug.