1808925 - Move more TestVAndBranch code out-of-line

Status: NEW

(Core :: JavaScript Engine: JIT, task, P3)

Description

[Jan de Mooij [:jandem]]

When looking at bytes of JIT code generated (excluding OOL paths) per LIR instruction kind, LTestVAndBranch is the worst offender on Speedometer: we generate > 2 MB total for it on Linux x64 and on average 273 bytes per instruction. That's quite a lot of code.

A while ago, Iain added the observed-types mechanism to first handle types that we observed in Baseline. It's probably a good idea to move code for the unobserved types to an OOL path or to use a shared trampoline for the ToBoolean conversion (a bit more work and maybe not worth it).

It's hard to say how much this would help, but it'd probably improve our icache behavior a bit.

Comment 1

[Jan de Mooij [:jandem]]

Some more questions to investigate:

• Do these instructions usually have observed types attached? Or is it cold code?
• What if we only generate code for the observed types when that set is small (<= 2-3 types?)
• Are there common patterns of observed types that we could implement with a specialized MIR/LIR instruction?

Comment 2

[Iain Ireland [:iain]]

(In reply to Jan de Mooij [:jandem] from comment #1)

• What if we only generate code for the observed types when that set is small (<= 2-3 types?)

This option seems potentially promising. We can generate a bailout instead of the long tail of unobserved types, and then if that fails set a flag to generate the extra code next time. Provided that the success rate is high enough, it would cut out a lot of unnecessary code.