1590120 - Lots of bailouts when showing suggestions in the awesomebar

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Florian Quèze [:florian]]

A profile shared in bug 1579334 shows lots of 'Bailout' markers while running code that displays suggestions in the awesomebar. This feels like a bug. I'm not sure if it's a JS engine bug or a bug in the way the front-end code is implemented, but I'm hoping someone here can clarify what's happening. See this profile: https://perfht.ml/2W1sbRR

Comment 1

[André Bargull [:anba]]

The bailouts happen in this line when evaluating the template string expression. Template strings use the jsop_tostring byte code op, which Ion compiles to MToString. MToString is lowered to LValueToString, which always bails out for objects.

---

As a workaround "UrlbarMuxerUnifiedComplete.jsm" could be changed to use

logger.debug(`Buckets: ${String(buckets)}`);

or if buckets is known to be an array with a toString method (this option should be faster than calling String):

logger.debug(`Buckets: ${buckets.toString()}`);

Comment 2

[André Bargull [:anba]]

(In reply to Florian Quèze [:florian] from comment #0)

This feels like a bug. I'm not sure if it's a JS engine bug [...]

Yes, repeated bailouts are generally considered a JS engine bug.

Comment 3

[Marco Bonardo [:mak] (Away Apr 25 - May 5)]

(In reply to André Bargull [:anba] from comment #1)

or if buckets is known to be an array with a toString method (this option should be faster than calling String):

yes, buckets should always be an Array.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1590120 - Avoid repeated bailouts when MToString is used for jsop_tostring or the ToString intrinsic. r?anba!

In these stand-alone cases we can handle objects/symbols by calling ToStringSlow.
The TypePolicy uses of MToString will still bail out to Baseline.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/45d661faa404
Avoid repeated bailouts when MToString is used for jsop_tostring or the ToString intrinsic. r=anba

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/45d661faa404