[IonMonkey] The __proto__ getter is not inlinable, while Object.getPrototypeOf is
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox77 | --- | fixed |
People
(Reporter: tcampbell, Assigned: anba)
References
Details
Attachments
(1 file)
(Reported by @pygy on the #perf matrix channel)
Hello, are there folks here interested in discussing the intricacies of JS perf? Specifically, >the fact that
x.__proto__is almost twice as slow asObject.getPrototypeOf(x)in a >polymorphic scenario (where theObject.prototype.__proto__getter ends up being hit, no >matter what)?
x is either a POJO or a DOM node with 50/50 probability
Either SpiderMonkey is unable to infer that the same getter ends up being hit, no matter >what, or the getter has some incredible overhead.
Profile: https://perfht.ml/2xJ2tdh
It looks like we are able to inline Object.getPrototypeOf fully in Ion via [1], while for the __proto__ case we always call the C++ getter.
|
Assignee | |
Comment 1•4 years ago
|
||
We don't support mixing self-hosted and native accessors in JSPropertySpec,
therefore we need to move the setter into self-hosted code, too, even though
we only need to have the getter self-hosted to be able to inline it.
|
||
Updated•4 years ago
|
Pushed by nerli@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/65bec75f5f10 Self-host Object.prototype.__proto__ accessors. r=tcampbell
|
||
Comment 3•4 years ago
|
||
| bugherder | ||
Description
•