Closed Bug 1113643 Opened 5 years ago Closed 5 years ago

Optimize instanceof more

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla37

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

After some Shumway changes a few weeks ago, richards.swf now spends at least 48% (!) under js::HasInstance.

Ion optimizes instanceof in some cases, but here "rhs.prototype" is not a singleton so we fall back to MCallInstanceOf. This is a pretty bad perf cliff that we should fix.

Maybe we can use Baseline caches to inline more cases or use an idempotent GetPropertyIC to get the .prototype.

Also, we should probably be able to nop instanceof in some cases.
(In reply to Jan de Mooij [:jandem] from comment #0)
> Also, we should probably be able to nop instanceof in some cases.

That would be pretty great. Note that TypeScript is introducing union types and type guards into their type system, which will probably mean that TypeScript-compiled code is going to contain lots and lots of `instanceof` uses in the future.

In practice, here's what this will look like:

function foo(bar: Baz | Quux) {
  if (bar instanceof Baz) {
    // bar is inferred to be of type Baz here, treating it as a Quux is a compile-time error
  } else {
    // bar is inferred to be of type Quux here, treating it as a Baz is a compile-time error
  }
}

The compiled version will just strip type annotations and comments, but retain the instanceof; so it'll look like this:
function foo(bar) {
  if (bar instanceof Baz) {
  } else {
  }
}

Slightly more details: http://blogs.msdn.com/b/typescript/archive/2014/11/18/what-s-new-in-the-typescript-type-system.aspx
Depends on: 1113677
I think the best way to handle the Shumway case is as follows:

(1) Add a Baseline stub for |x instanceof JSFunction|. This stub will be specialized for (and guard on) a particular JSFunction + .prototype.

(2) In IonBuilder, if the TI-based path fails, get the information from the Baseline IC and inline the necessary guards. Then we know the JSFunction + .prototype and can still use the folding mechanism I added in bug 1113677.

Doing (1) is also nice to improve Baseline performance.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Blocks: 1001664
Attached patch PatchSplinter Review
This does what I described in comment 2. We optimize "x instanceof function" in Baseline now and can use that in Ion.

Improves richards.swf from ~2700 to ~6100 on x86, faster than V8.

With --no-ion we go from 403 to 557.
Attachment #8540679 - Flags: review?(bhackett1024)
Attachment #8540679 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/47185628a395
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
You need to log in before you can comment on or make changes to this bug.