1641272 - `new Object` in tight loop much slower than in v8 shell

Status: RESOLVED DUPLICATE of bug 1262212

(Core :: JavaScript Engine, defect, P3)

Description

[Steve Fink [:sfink] [:s:]]

Calling new Object in a tight loop takes 2.4x as long in the JS shell as in the v8 shell:

% time ~/src/mozilla/obj-opt/dist/bin/js -e 'a=new Array(10**6); for (let i = 0; i < 10**8; i++) a[i % a.length] = new Object'
~/src/mozilla/obj-opt/dist/bin/js -e   35.51s user 4.77s system 103% cpu 38.832 total
% time d8 -e 'a=new Array(10**6); for (let i = 0; i < 10**8; i++) a[i % a.length] = new Object'
d8 -e   18.34s user 1.07s system 119% cpu 16.179 total

When I run very similar code in the GC microbenchmark suite, while measuring how many iterations of the loop we can run per frame while maintaining a 50% (60fps) frame drop rate, it estimates that V8 can allocate 21x as many objects per frame.

These could very well be separate issues. The 2.4x slowdown may just be from taking unoptimized paths. The 21x difference could be from our scheduling of minor GCs. I haven't looked closely yet, but running under perf I see 77% of the time spent in js::obj_construct, 24% of the time in js::Nursery::collect.

I will also note that 31% of the time (all of it under obj_construct) is spent on js::ObjectGroup::setAllocationSiteObjectGroup.

Comment 1

[Iain Ireland [:iain]]

It would be very interesting to see what would happen if you ran with --warp, which disables TI.

Comment 2

[André Bargull [:anba]]

--warp makes a similar µ-benchmark twice as fast for me. Ion is slow because new Object is not inlined, for example using Object.create(Object.prototype) is much faster.

Comment 3

[Steve Fink [:sfink] [:s:]]

Yeah, I tried Object.create(Object.prototype) too. The performance is near-identical between SM and v8 on that.

Comment 4

[Steve Fink [:sfink] [:s:]]

--warp doesn't change my results for new Object. It halves the speed for Object.create(Object.prototype).