1488768 - SetElem hits IC fallback for out-of-order dense elements

Status: RESOLVED DUPLICATE of bug 1494537

(Core :: JavaScript Engine: JIT, enhancement, P1)

Description

[Ted Campbell [:tcampbell]]

This is occurring on gdocs in example from https://bugzilla.mozilla.org/show_bug.cgi?id=1488435#c3

At the very least we should have a fast-path for this using a callABI or VMCall, but it might be possible to be more clever.

Comment 1

[Kannan Vijayan [:djvj]]

I was analyzing gdocs fallback stub hits, and came up with the following numbers:

      1 READ_PROP ic=0x7fc5634288b0 ltDIL=0 ltDC=0   
      1 READ_PROP ic=0x7fc57156c1e8 ltDIL=1 ltDC=1   
      1 READ_PROP ic=0x7fc57df101e8 ltDIL=1 ltDC=1   
      2 READ_PROP ic=0x7fc5641858b0 ltDIL=0 ltDC=0   
      2 READ_PROP ic=0x7fc57df10320 ltDIL=0 ltDC=0   
      3 READ_PROP ic=0x7fc56f0a2320 ltDIL=0 ltDC=1   
      4 READ_PROP ic=0x7fc56e9361e8 ltDIL=1 ltDC=1   
      4 READ_PROP ic=0x7fc57df101e8 ltDIL=0 ltDC=0   
      5 READ_PROP ic=0x7fc57e3e65f0 ltDIL=0 ltDC=0   
      7 READ_PROP ic=0x7fc5634370b0 ltDIL=1 ltDC=1   
     11 READ_PROP ic=0x7fc56e9361e8 ltDIL=0 ltDC=0   
     12 READ_PROP ic=0x7fc57e3e6248 ltDIL=1 ltDC=1   
     17 READ_PROP ic=0x7fc5643598b0 ltDIL=0 ltDC=0   
     27 READ_PROP ic=0x7fc5634370b0 ltDIL=0 ltDC=0   
     36 READ_PROP ic=0x7fc57e3e6248 ltDIL=0 ltDC=0   
     45 READ_PROP ic=0x7fc56f0a2320 ltDIL=0 ltDC=0   
     85 READ_PROP ic=0x7fc56f0a2320 ltDIL=1 ltDC=1   
    491 WRITE_PROP ic=0x7fc56cfec200 ltDIL=1 ltDC=1 DIL=487 DC=510 ty=group:0x7fc5790c4f70
    705 WRITE_PROP ic=0x7fc56410b7f0 ltDIL=1 ltDC=1 DIL=487 DC=510 ty=group:0x7fc5790c4f70
    734 WRITE_PROP ic=0x7fc56410b7f0 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc578e11940
    755 WRITE_PROP ic=0x7fc56410b7f0 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc5790c45b0
    843 WRITE_PROP ic=0x7fc56410b7f0 ltDIL=1 ltDC=1 DIL=464 DC=510 ty=group:0x7fc5790bd850
   1569 WRITE_PROP ic=0x7fc56cd6d200 ltDIL=1 ltDC=1 DIL=487 DC=510 ty=group:0x7fc578e047f0
   3372 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=464 DC=510 ty=group:0x7fc578e047f0
   3873 WRITE_PROP ic=0x7fc56cfdc200 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc5790c45b0
   3894 WRITE_PROP ic=0x7fc56cfdc200 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc578e11940
   4215 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=464 DC=510 ty=group:0x7fc5790bd850
   5980 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=487 DC=510 ty=group:0x7fc5790c4f70
   7845 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=487 DC=510 ty=group:0x7fc578e047f0
   9256 WRITE_PROP ic=0x7fc56cd6d200 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc578e047f0
  23140 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc578e11940
  23140 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc5790c45b0
  46280 WRITE_PROP ic=0x7fc579b7f200 ltDIL=1 ltDC=1 DIL=940 DC=1022 ty=group:0x7fc578e047f0

To explain the log:

1. I'm printing fallback stub update hits are only recorded for reads/writes to Arrays which are in dictionary mode, and indexes are positive integers.

2. The ic=0x... is the raw pointer to the IC being hit.

3. The ltDIL and ltDC fields indicate whether the index was less than the DenseIndexedLength and DenseCapacity, respectively.  DIL and DC specify the actual values for those attributes.  The ty=... field indicates the type of the value being written.

This log is the number of fallback hits seen when typing the phrase "foobar" in a large gdocs document.  It averages to about 20k fallback hits per keypress.

Also note that for the majority of cases, the index being written to falls within the dense capacity and dense indexed length.

This should be eminently optimizable into a very fast stub.

Comment 2

[Kannan Vijayan [:djvj]]

The analysis in comment 1 is flawed due to errors in the print logic.  The hits are actually out-of-bounds of the initialized length.  Closing this as a dup of 1494537.