1113643 - Optimize instanceof more

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

After some Shumway changes a few weeks ago, richards.swf now spends at least 48% (!) under js::HasInstance.

Ion optimizes instanceof in some cases, but here "rhs.prototype" is not a singleton so we fall back to MCallInstanceOf. This is a pretty bad perf cliff that we should fix.

Maybe we can use Baseline caches to inline more cases or use an idempotent GetPropertyIC to get the .prototype.

Also, we should probably be able to nop instanceof in some cases.

Comment 1

[Till Schneidereit [:till]]

(In reply to Jan de Mooij [:jandem] from comment #0)
> Also, we should probably be able to nop instanceof in some cases.

That would be pretty great. Note that TypeScript is introducing union types and type guards into their type system, which will probably mean that TypeScript-compiled code is going to contain lots and lots of `instanceof` uses in the future.

In practice, here's what this will look like:

function foo(bar: Baz | Quux) {
  if (bar instanceof Baz) {
    // bar is inferred to be of type Baz here, treating it as a Quux is a compile-time error
  } else {
    // bar is inferred to be of type Quux here, treating it as a Baz is a compile-time error
  }
}

The compiled version will just strip type annotations and comments, but retain the instanceof; so it'll look like this:
function foo(bar) {
  if (bar instanceof Baz) {
  } else {
  }
}

Slightly more details: http://blogs.msdn.com/b/typescript/archive/2014/11/18/what-s-new-in-the-typescript-type-system.aspx

Comment 2

[Jan de Mooij [:jandem]]

I think the best way to handle the Shumway case is as follows:

(1) Add a Baseline stub for |x instanceof JSFunction|. This stub will be specialized for (and guard on) a particular JSFunction + .prototype.

(2) In IonBuilder, if the TI-based path fails, get the information from the Baseline IC and inline the necessary guards. Then we know the JSFunction + .prototype and can still use the folding mechanism I added in bug 1113677.

Doing (1) is also nice to improve Baseline performance.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

This does what I described in comment 2. We optimize "x instanceof function" in Baseline now and can use that in Ion.

Improves richards.swf from ~2700 to ~6100 on x86, faster than V8.

With --no-ion we go from 403 to 557.

Comment 4

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/47185628a395

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/47185628a395