1381461 - Fix some problems with PropertyReadNeedsTypeBarrier heuristics

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement)

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Part 1 - Don't skip the receiver object

The updateObserved code skipped the receiver object and so we could get bogus type information when a property exists both on the receiver and on some prototype object.

I also added breaks for a few other cases, it seems best to be conservative with these optimizations.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Part 1 - Don't skip the receiver object

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Part 2 - Remove ObjectSubsumes optimization

Brian, you removed this code as part of a larger patch (bug 1198861 part 2), but that patch got backed out for regressing Octane.

I don't see any regressions with this patch on any of the shell benchmarks and I don't trust this heuristic to not backfire on the polymorphic mess that's modern web frameworks, so I think we should try this again.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9f89cff48991
part 1 - Don't skip the receiver object in PropertyReadNeedsTypeBarrier. r=bhackett

Comment 5

[Jan de Mooij [:jandem]]

Landing these separately to make perf regressions easier to track down.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/922f398557af
part 2 - Remove the similar-objects heuristic in PropertyReadNeedsTypeBarrier. r=bhackett

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9f89cff48991

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/922f398557af