1408058 - Investigate six-speed-super-es5 regression

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Tom S]

We had a pretty massive regression on six-speed-super-es5.

https://arewefastyet.com/#machine=29&view=single&suite=six-speed&subtest=super-es5

Comment 1

[Tom S]

I think this got even worse, the results are not extremely bimodal.

Comment 2

[Tom S]

s/not/now/

Comment 3

[Naveed Ihsanullah [:naveed]]

Jan can you please assign this to someone appropriate?

Comment 4

[Jan de Mooij [:jandem]]

evilpie and I talked about this - I doubt the regression is real but we should optimize the d.bar property access better in Ion; I'll fix soon.

Comment 5

[Jan de Mooij [:jandem]]

I have Ion/ScalarReplacement/CacheIR patches that let us inline the property access and then scalar replacement can no-op this benchmark.

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Part 1 - Track preliminary object stubs better

We currently set preliminaryObjectAction_ if |obj == holder|. This patch changes it to always set it - this ensures we get a single Baseline stub and ReceiverGuard in IonBuilder when we look up a property on the prototype of a preliminary and later unboxed object.

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Part 2 - Teach scalar replacement about GuardGroup and GuardUnboxedExpando

This is just based on the code for GuardShape.

Comment 8

[Jan de Mooij [:jandem]]

Attachment: Part 3 - Inline proto slot reads in Ion

This patch lets us inline slot reads on the proto chain based on Baseline ICs. We support multiple receivers, as long as there's a single holder.

Comment 9

[Tom S]

Comment on attachment 8921906 [details] [diff] [review]
Part 3 - Inline proto slot reads in Ion

Review of attachment 8921906 [details] [diff] [review]:
-----------------------------------------------------------------

Looks great. I am optimistic that this will help on real world content as well.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4b0d907b56a8
part 1 - Track preliminary object IC stubs better. r=evilpie
https://hg.mozilla.org/integration/mozilla-inbound/rev/3752c359fa86
part 2 - Teach scalar replacement about GuardGroup and GuardUnboxedExpando. r=nbp
https://hg.mozilla.org/integration/mozilla-inbound/rev/a903e6c2cf0f
part 3 - Inline slot reads on the prototype in Ion based on Baseline feedback. r=evilpie

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/4b0d907b56a8
https://hg.mozilla.org/mozilla-central/rev/3752c359fa86
https://hg.mozilla.org/mozilla-central/rev/a903e6c2cf0f