Last Comment Bug 1259927 - (CacheIR) [meta] CacheIR tracking bug
: [meta] CacheIR tracking bug
Status: NEW
: perf
Product: Core
Classification: Components
Component: JavaScript Engine: JIT (show other bugs)
: unspecified
: All All
P3 normal with 4 votes (vote)
: ---
Assigned To: Nobody; OK to take it and work on it
: Hannes Verschore [:h4writer]
Depends on: 1133423 1318285 1319087 1322783 1323094 1323099 1324561 1325358 1326437 1326438 1328140 1331136 1336579 1336580 1337763 1337764 1337773 1337812 1339207 1340153 1340496 1341067 1341071 1341261 1341782 1341789 965992 1091978 1255352 1258105 1259925 1266180 1266695 1267163 1310125 1313036 1317292 1317703 1319437 1320118 1320145 1320461 1320670 1322091 1322093 1322320 1323037 1323096 1323190 1324566 1326067 1328076 1328077 1328227 1329016 1329195 1331034 1332333 1332593 1332946 1333067 1333690 1334187 1334727 1335405 1337024 1338825 1338828 1340150
Blocks: 816159 917030 1139750 jsperf
  Show dependency treegraph
Reported: 2016-03-26 06:14 PDT by Jan de Mooij [:jandem]
Modified: 2017-02-22 12:37 PST (History)
12 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


User Story
From bug 1255352 comment 0:

Our current IC design has a number of problems, most importantly:

* Baseline and Ion ICs don't share much code. The same or similar logic and code is duplicated (often slightly differently and more than once per JIT).
* Ion ICs can handle cases that Baseline doesn't support, and vice versa.
* Baseline ICs are sometimes not 'flexible' enough: an example of this is the does-not-exist stub: Baseline does not attach a stub if an object on the proto chain has obj->hasUncacheableProto(), because it's really hard to support this case with the current ICs.
* It's hard to do something like: unwrap a (Window)Proxy, CCW, etc. and then optimize as a normal getprop, without duplicating/complicating a lot of code.
* ICs and Baseline stub classes are boilerplate-heavy (there are > 7000 lines of code in BaselineIC.h and SharedIC.h).
* Register allocation in ICs, especially Ion ICs, can be hard to get right.
* Adding ICs is a lot of work. I want to add an Ion IC for JSOP_IN. We also need ICs for the new |super| property accesses for ES6 classes (these are like normal GetProp/SetProp, but have an additional receiver argument).
* For Ion there's no good mechanism to discard or update stubs that are no longer valid, so we sometimes attach similar stubs multiple times.

I've been working on a design that addresses all of those issues. The idea is that we emit a very simple, linear (there are guards but no loops or branches) CacheIR bytecode, and generate Baseline and Ion IC code from it. The IR for a simple read-slot getprop looks like this:

  GuardIsObject 0
  GuardShape 0
  LoadFixedSlotResult 0

The generated CacheIR will be exactly the same for Baseline and Ion, but they will compile each op to different machine code and Ion can skip certain guards (if it knows they will never fail).

This ensures we optimize exactly the same cases in Baseline and Ion. We still need different CacheIR -> IC code generators, but at that point all the high-level decisions and VM bits are taken care of.

The actual shapes and slot offsets will be stored separately from the CacheIR. Ion can bake those directly into the JitCode, but (just like we do now) Baseline code will store them in the ICStub, allowing us to share IC stub code. Sharing Baseline stub code happens transparently with this design: stubs that have the same CacheIR can share JIT code.

We'll no longer need Baseline ICStub classes for each case, as the stubs are allocated dynamically. Stubs have a pointer to their (shared) CacheIR code, that allows Ion to optimize based on Baseline ICs. (Later on we could compile CacheIR we get from Baseline stubs to Ion MIR instructions, allowing us to inline and optimize more cases in IonBuilder without ICs).      
Description User image Jan de Mooij [:jandem] 2016-03-26 06:14:22 PDT
See bug 1255352 comment 0.

Filing a new meta bug to track the remaining work.

Note You need to log in before you can comment on or make changes to this bug.