1323108 - RegExp.prototype.split may mis-optimize when RegExp.prototype.flags is deleted and Object.prototype.flags is added and then changed.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Tooru Fujisawa [:arai]]

from bug 1322319.

js::RegExpPrototypeOptimizableRaw checks flags getter in prototype chain, but it should check own property.

Comment 1

[Tooru Fujisawa [:arai]]

Attachment: Check own flags property in RegExpPrototypeOptimizableRaw.

Added GetOwnGetterPure that checks own getter, and used it in js::RegExpPrototypeOptimizableRaw to check flags getter.

Also, removed NativeObject* parameter from NativeGetGetterPureInline since it's not used.

Comment 2

[Hannes Verschore [:h4writer]]

Comment on attachment 8818145 [details] [diff] [review]
Check own flags property in RegExpPrototypeOptimizableRaw.

Review of attachment 8818145 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for the testcase!

Comment 3

[Tooru Fujisawa [:arai]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/98106f49ee61a352c18bd127554f375cddbc6f66
Bug 1323108 - Check own flags property in RegExpPrototypeOptimizableRaw. r=h4writer

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/98106f49ee61

Comment 5

[Tooru Fujisawa [:arai]]

Attachment: (mozilla-aurora) Check own flags property in RegExpPrototypeOptimizableRaw. r=h4writer

Approval Request Comment
> [Feature/Bug causing the regression]
bug 1263340

> [User impact if declined]
wrong behavior in JavaScript

> [Is this code covered by automated tests?]
Yes

> [Has the fix been verified in Nightly?]
Yes

> [Needs manual test from QE? If yes, steps to reproduce]
No

> [List of other uplifts needed for the feature/fix]
Bug 1322319 needs to be uplifted *before* this.

> [Is the change risky?]
No

> [Why is the change risky/not risky?]
It reduces the target of optimization, and fallback to normal path

> [String changes made/needed]
None

Comment 6

[Hannes Verschore [:h4writer]]

I'm seeing the following slowdowns on a browser build:

== Change summary for alert #4544 (as of December 17 2016 22:31 UTC) ==

Regressions:

197%  webaudio 0.2 Stereo Panning with Automation linux64 opt     357.08 -> 1062.17
 52%  kraken 1.1 audio-dft linux64 opt                            135.44 -> 205.69
 49%  massive 1.2 box2d-throughput-f32 linux64 opt                31473.8 -> 15982.12
 47%  massive 1.2 box2d-throughput linux64 opt                    28089.86 -> 15000.19
 41%  ss 1.0.2 math-partial-sums linux64 opt                      8.89 -> 12.53
 30%  unity-webgl 0.1 Particles linux64 opt                       121242.5 -> 84468.33
 28%  octane 2.0.1 Box2D linux64 opt                              48992.42 -> 35516
 26%  jetstream 1.0 box2d linux64 opt                             274.17 -> 202.8
  8%  massive 1.2 summary linux64 opt                             4358.91 -> 4024.49
  6%  kraken 1.1 summary linux64 opt                              1082.99 -> 1143.88

For up to date results, see: https://treeherder.mozilla.org/perf.html#/alerts?id=4544

The regression range is:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6f7b9683818ae3b5bc2ddb33460e7c75b6aec27c&tochange=98106f49ee61a352c18bd127554f375cddbc6f66

I'm not sure this regression is caused by this bug, but it looks like the only one I see that could have caused it. Can you take a look and see if you can reproduce this regression locally using treeherder builds and find out if this bug or another caused this?

Comment 7

[Tooru Fujisawa [:arai]]

locally, I don't confirm any regression on that range.
I've tested with automation build for 98106f49ee61 and 95bb4ca0e110 and 6f7b9683818a, for linux64 opt, and also with mozregression with [2016-12-01,2016-12-20] range.
tested on Linux 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19) x86_64 GNU/Linux

Comment 8

[Tooru Fujisawa [:arai]]

forgot to note that I've tested Kraken, sunspider and Octane on browser.

Comment 9

[Julien Cristau [:jcristau] (back April 22)]

Comment on attachment 8820508 [details] [diff] [review]
(mozilla-aurora) Check own flags property in RegExpPrototypeOptimizableRaw. r=h4writer

fix wrong behaviour in javascript, followup to bug 1322319, take in aurora52

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/eee45ae5b76b