1193684 - 11% regression on dromaeo-object-array on May 30th

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine: JIT, defect)

Description

[Hannes Verschore [:h4writer]]

A regression/improvement was reported on AWFY:
- slave: Win 8 32-bit (i7-4700HQ, browser)
- mode: Ion

Regression(s)/Improvement(s):
- dromaeo: dromaeo-object-array: -11.03% (regression)

More details: http://arewefastyet.com/regressions/#/regression/1697289

I suspect:
Brian Hackett — Bug 1166678 - Optimize Array.prototype.slice in Ion, r=jandem.
https://hg.mozilla.org/integration/mozilla-inbound/rev/57bd26cc44b9

Looking at the source of dromaeo-object-array this seems plausible:
view-source:http://dromaeo.com/tests/dromaeo-object-array.html


>	test("Array Deconstruction, shift", function(){
>		var a = ret.slice();
>		for ( var j = 0; j < i; j++ )
>			tmp = a.shift();
>	});
>
>	test("Array Deconstruction, splice", function(){
>		var a = ret.slice();
>		for ( var j = 0; j < i; j++ )
>			tmp = a.splice(0,1);
>	});
>
>	test("Array Construction, push", function(){
>		ret = [];
>		for ( var j = 0; j < i * 25; j++ )
>			ret.push(j);
>	});
>
>	test("Array Deconstruction, pop", function(){
>		var a = ret.slice();
>		for ( var j = 0; j < i * 25; j++ )
>			tmp = a.pop();
>	});

Comment 1

[Hannes Verschore [:h4writer]]

Could it be this optimization that was introduced, threw something off in the dromaeo-object-array case?
Can you take a look?

Comment 2

[Brian Hackett [Laid off!]]

I tried running dromaeo-object-array in the shell (10.9 x86), and it seems to be maybe 5% faster (pretty noisy) when the Array.slice optimization is enabled than when it is disabled.

Comment 3

[Till Schneidereit [:till]]

The regression is still there, but it's been very long and it's not really actionable, so closing.