Optimize ArgumentsObject allocation

RESOLVED FIXED in Firefox 50



3 years ago
3 years ago


(Reporter: jandem, Assigned: jandem)


(Blocks 1 bug, {perf})

Dependency tree / graph

Firefox Tracking Flags

(firefox50 fixed)



(5 attachments)



3 years ago
I've a set of patches to optimize the ArgumentsObject layout and then another patch to do the object allocation in JIT code (with a VM call for the ArgumentsData allocation and initialization).

ArgumentsData currently has a deletedBits vector with a bit for each argument. That is necessary to handle |delete arguments[i]| correctly, but outside of test suites and fuzzers, deleting arguments is very uncommon. So one of these patches adds a separate RareArgumentsData class that holds the deleted bits, and we only allocate that the first time we delete an element.

That + some other minor optimizations + JIT inlining improves the Foo1 benchmark in bug 1271473 from 95 ms to 34 ms, that's good enough for now.

Comment 2

3 years ago
ArgumentsData::callee is a HeapValue. This patch moves the callee to a reserved slot on the ArgumentsObject.

We had 1 unused slot so we might as well use it and shrink ArgumentsData a bit.
Attachment #8752462 - Flags: review?(luke)

Comment 3

3 years ago
This patch removes the JS_OVERWRITTEN_CALLEE Magic value and instead uses a "callee overridden" bit to indicate .callee was overridden.

Benefits are:

(1) We no longer overwrite the callee anywhere, so the next patch can get rid of ArgumentsData::script and simply get the script from the callee.

(2) It's more consistent with the similar bits we use for "overridden length", "overridden element", etc.
Attachment #8752463 - Flags: review?(luke)

Comment 4

3 years ago
Removes the 'script' and 'dataBytes' fields from ArgumentsData. They're now easy to derive from other information.
Attachment #8752464 - Flags: review?(luke)

Comment 5

3 years ago
Allocates ArgumentsObject in Ion code, with a VM call to allocate and initialize the ArgumentsData.

Luke, if you're too busy or don't feel confident reviewing these patches, feel free to forward to someone else.
Attachment #8752468 - Flags: review?(luke)
Comment on attachment 8752461 [details] [diff] [review]
Part 1 - Move deletedBits into RareArgumentsData

Review of attachment 8752461 [details] [diff] [review]:

Attachment #8752461 - Flags: review?(luke) → review+


3 years ago
Attachment #8752462 - Flags: review?(luke) → review+


3 years ago
Attachment #8752463 - Flags: review?(luke) → review+


3 years ago
Attachment #8752464 - Flags: review?(luke) → review+
Comment on attachment 8752468 [details] [diff] [review]
Part 5 - Allocate from JIT code

Review of attachment 8752468 [details] [diff] [review]:

Great work on these patches!

::: js/src/jit/MacroAssembler.cpp
@@ +1014,5 @@
>      if (nslots == 0)
>          return;
> +    if (templateObj->is<ArgumentsObject>()) {
> +        // The caller is responsible for initializing the reserved slots.

This is a bit implicit; how about another bool initReservedSlots (default true) so that way the caller can say this explicitly (and perhaps have a comment that the ABI call implies no GC is possible between alloc and init?
Attachment #8752468 - Flags: review?(luke) → review+

Comment 8

3 years ago
Should this get the "perf" keyword?


3 years ago
Keywords: perf

Comment 9

3 years ago
Pushed by jandemooij@gmail.com:
part 1 - Move ArgumentsObject deleted bits into a new RareArgumentsData class. r=luke
part 2 - Move ArgumentsData::callee to a reserved slot on the object. r=luke
part 3 - Remove JS_OVERWRITTEN_CALLEE. r=luke
part 4 - Remove script and dataBytes from ArgumentsData. r=luke
part 5 - Allocate arguments objects from Ion JIT code. r=luke
Depends on: 1280252
Depends on: 1297142
Depends on: 1308346


3 years ago
No longer depends on: 1308346
You need to log in before you can comment on or make changes to this bug.