1541708 - Jetstream3 ML does polymorphic calls

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Denis Palmeiro [:denispal]]

The "ML" test in Jetstream2 performs very poorly in Firefox compared to Chrome:

Firefox:
ML - 20.986
First - 17.361, Worst - 21.810, Average - 24.410

Chrome:
ML - 55.008
First - 27.174, Worst - 69.930, Average - 87.589

Profile is here: https://perfht.ml/2UfwPxP

Ion compilation aborts early due to:

[IonAbort] Unsupported opcode: checkreturn
[IonAbort] aborted @ file:///home/denis/src/JetStream2/ARES-6/ml/index.js
[IonAbort] Disabling Ion compilation of script file:///home/denis/src/JetStream2/ARES-6/ml/index.js:4554:19

On top of that, I see over 40,000 IC fallbacks in the same function almost all on "NewArray".

Comment 1

[Mayank Bansal]

Is this still an issue?

Comment 2

[Iain Ireland [:iain]]

We support JSOp::CheckReturn in Ion now, and I don't see any NewArray fallbacks.

We're still significantly slower, though. Taking a quick look at profiles, one thing that stands out is that the two get calls in mmul aren't inlined because they're both polymorphic. As far as I can tell, it's genuine polymorphism where we call two different functions.

One is Matrix.get:

        get(rowIndex, columnIndex) {
            return this[rowIndex][columnIndex];
        }

and the other is MatrixTransposeView.get:

        get(rowIndex, columnIndex) {
            return this.matrix.get(columnIndex, rowIndex);
        }

V8 does polymorphic inlining. This doesn't show up in comparison reports, because we disable inlining there, but it probably hurts us quite a bit.