1171405 - Ion GetElement IC doesn't handle unboxed objects

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

Noticed this issue on the Flux benchmark in bug 1169501. It spends some time in GetElementIC::update, we don't attach a stub there because GetElementIC::canAttachGetProp returns false.

For the testcase below I get:

js --no-unboxed-objects:   40 ms
js --no-ion            :  176 ms
js                     : 3386 ms

Based on these numbers, it looks like Baseline handles this case.

function O() {
    this.x = 1;
    this.y = 2;
}
function f() {
    var arr = [];
    for (var i=0; i<64; i++)
	arr.push(new O);
    var res;
    for (var i=0; i<10000000; i++) {
	var o = arr[i % 64];
	var p = (i & 1) ? "x" : "y";
	var res = o[p];
    }
    return res;
}
var t = new Date;
f();
print(new Date - t);

Comment 1

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #0)
> js --no-unboxed-objects:   40 ms
> js --no-ion            :  176 ms
> js                     : 3386 ms

Oops, the last one is a bit too pessimistic; I forgot I added some logging there. It should be more like 445 ms, still > 10x slower.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Actually, there are neither ion nor baseline IC stubs for this case.  Using --no-ion disables the new script properties analysis, which is needed to make the 'new O()' objects unboxed.  The attached patch adds ion and baseline IC stubs for GETELEM on both own and expando properties in unboxed objects.

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8617491 [details] [diff] [review]
patch

Review of attachment 8617491 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7ccb13e479c4

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7ccb13e479c4