Closed
Bug 1814711
Opened 3 years ago
Closed 2 years ago
Object.assign is faster in V8 than in Spidermonkey
Categories
(Core :: JavaScript Engine: JIT, enhancement, P2)
Core
JavaScript Engine: JIT
Tracking
()
RESOLVED
FIXED
People
(Reporter: jrmuizel, Unassigned)
References
(Depends on 1 open bug, Blocks 1 open bug)
Details
(Whiteboard: [sp3])
Attachments
(1 file)
|
836 bytes,
text/html
|
Details |
Running the following benchmark:
if (typeof console === "undefined") console = { log: print };
var _extends = Object.assign || function (target) {
for (var i = 1; i < arguments.length; i++) {
var source = arguments[i];
for (var key in source) {
if (Object.prototype.hasOwnProperty.call(source, key)) {
target[key] = source[key];
}
}
}
return target;
};
function do_extend(o) {
var result = Object.assign({}, o, {canvasOriginX: 0, canvasOriginY: 1 });
//var result = {...o, ...{canvasOriginX: 0, canvasOriginY: 1 }};
return result;
}
var o = { w: 0, x: 1, y: 2, z: 3 };
var n = 1e8/2;
function test(fn) {
var result;
for (var i = 0; i < n; ++i) result = fn(o);
return result;
}
test(do_extend);
var startTime = Date.now();
test(do_extend);
console.log("extend:", Date.now() - startTime, "ms.");
Gives:
V8: extend: 4602 ms.
https://share.firefox.dev/3joMfO4
SM: extend: 5049 ms.
https://share.firefox.dev/3wRL9O4
|
||
Updated•3 years ago
|
|
Reporter | |
Comment 1•3 years ago
|
||
Interestingly:
SM has 208,586 samples in the obj_assign builtin vs 49,366 elsewhere
V8 has 221,658 sample in the Builtins_ObjectAssign vs 14,107 elsewhere
|
|
Reporter | |
Comment 2•3 years ago
|
||
SM bytecode:
00000: 4 GetGName "Object" # Object
00005: 4 Dup # Object Object
00006: 4 GetProp "assign" # Object Object.assign
00011: 4 Swap # Object.assign Object
00012: 4 NewObject {} # Object.assign Object (intermediate value)
00017: 4 GetArg 0 # Object.assign Object (intermediate value) o
00020: 4 NewObject {canvasOriginX, canvasOriginY} # Object.assign Object (intermediate value) o (intermediate value)
00025: 4 Zero # Object.assign Object (intermediate value) o (intermediate value) 0
00026: 4 InitProp "canvasOriginX" # Object.assign Object (intermediate value) o (intermediate value)
00031: 4 One # Object.assign Object (intermediate value) o (intermediate value) 1
00032: 4 InitProp "canvasOriginY" # Object.assign Object (intermediate value) o (intermediate value)
00037: 4 Call 3 # Object.assign(...)
00040: 4 SetLocal 0 # Object.assign(...)
00044: 4 Pop #
00045: 6 GetLocal 0 # result
00049: 7 Return #
00050: 7 RetRval # !!! UNREACHABLE !!!
SM machinecode:
IonScript [8 blocks]:
BB #0 [00000,26,15] -> #2 :: 0 hits
[Parameter]
[Parameter]
[CheckOverRecursed]
movabsq $0x7f5940623ba8, %r11
cmpq %rsp, 0x0(%r11)
jae .Lfrom41
.set .Llabel41, .
[OsiPoint]
.set .Llabel41, .
.set .Llabel41, .
.set .Llabel41, .
[Value]
movabsq $0xfff9800000000000, %rdx
[Integer]
xorl %eax, %eax
[MoveGroup]
movq 0x20(%rbp), %r11
movq %r11, -0x8(%rbp)
[Goto]
jmp .Lfrom66
BB #1 [00006,26,18] -> #2 :: 0 hits
[OsrEntry]
subq $80, %rsp
[OsrReturnValue]
movabsq $0xfff9800000000000, %rbx
testl $0x1, -0x10(%rcx)
je .Lfrom107
movq -0x8(%rcx), %rbx
.set .Llabel111, .
.set .Lfrom107, .Llabel111
[Parameter]
[Parameter]
[OsrValue]
movq -0x50(%rcx), %rdx
[OsrValue]
movq -0x58(%rcx), %rsi
[Unbox:Int32]
movq %rsi, %r11
shrq $47, %r11
cmpl $0x1fff1, %r11d
jne .Lfrom139
movl %esi, %eax
[MoveGroup]
movq 0x20(%rbp), %r11
movq %r11, -0x8(%rbp)
[Goto]
BB #2 [00006,26,18] -> #3 :: 1 hits
[MoveGroup]
movq 0x28(%rbp), %rcx
[Unbox:Object]
movabsq $0xfffe000000000000, %r11
xorq %rcx, %r11
movq %r11, %rcx
shrq $47, %r11
jne .Lfrom193
[Pointer]
movabsq $0x21529875f628, %rbx
[GuardSpecificFunction]
cmpq %rbx, %rcx
jne .Lfrom212
[MoveGroup]
movq %rcx, -0x18(%rbp)
movq 0x28(%rbp), %r11
movq %r11, -0x10(%rbp)
movl %eax, -0x24(%rbp)
movq %rdx, -0x20(%rbp)
[Goto]
BB #3 [00006,26,18] -> #4 -> #7 :: 49995960 hits
[InterruptCheck]
movabsq $0x7f5940623b8c, %r11
cmpl $0x0, 0x0(%r11)
jne .Lfrom265
.set .Llabel265, .
[OsiPoint]
.set .Llabel265, .
.set .Llabel265, .
.set .Llabel265, .
[Pointer]
movabsq $0x21529873d038, %rax
[GuardShape]
xorl %ecx, %ecx
movabsq $0x21529873b060, %r11
cmpq %r11, 0x0(%rax)
jne .Lfrom296
cmovne %rcx, %rax
[LoadFixedSlotT]
movabsq $0xfffe000000000000, %rbx
xorq 0x18(%rax), %rbx
[GuardShape]
xorl %eax, %eax
movabsq $0x2152987609c0, %r11
cmpq %r11, 0x0(%rbx)
jne .Lfrom335
cmovne %rax, %rbx
[Slots]
movq 0x8(%rbx), %rdx
[LoadDynamicSlotAndUnbox]
cmpl $0xfff88000, 0x9bc(%rdx)
jne .Lfrom359
movl 0x9b8(%rdx), %eax
[MoveGroup]
movl -0x24(%rbp), %ecx
[CompareAndBranch:Lt]
cmpl %eax, %ecx
jge .Lfrom376
BB #4 [00027,26,18] -> #5 :: 49995959 hits
[LoadDynamicSlotV]
movq 0x9b0(%rdx), %rax
[MoveGroup]
movq %rax, -0x30(%rbp)
[KeepAliveObject]
[Goto]
BB #5 [00041,26,39] [inlined extend.js:15] -> #6 :: 49995959 hits
[LoadDynamicSlotV]
movq 0x0(%rdx), %rdx
[KeepAliveObject]
[Unbox:Object]
movabsq $0xfffe000000000000, %r11
xorq %rdx, %r11
movq %r11, %rcx
shrq $47, %r11
jne .Lfrom444
[GuardShape]
xorl %ebx, %ebx
movabsq $0x21529873b960, %r11
cmpq %r11, 0x0(%rcx)
jne .Lfrom465
cmovne %rbx, %rcx
[Slots]
movq 0x8(%rcx), %rcx
[LoadDynamicSlotAndUnbox]
movabsq $0xfffe000000000000, %r11
xorq 0x0(%rcx), %r11
movq %r11, %rdi
shrq $47, %r11
jne .Lfrom499
[NewPlainObject]
movabsq $0x2152987600c0, %r8
movabsq $0x7f5940618630, %rsi
movq 0x0(%rsi), %rbx
addq $64, %rbx
cmpq %rbx, 0x18(%rsi)
jb .Lfrom536
movq %rbx, 0x0(%rsi)
subq $56, %rbx
movabsq $0x7f5940637348, %r11
movq %r11, -0x8(%rbx)
movq %r8, 0x0(%rbx)
movabsq $0x56446ec81228, %r11
movq %r11, 0x8(%rbx)
movabsq $0x56446ec81200, %r11
movq %r11, 0x10(%rbx)
.set .Llabel588, .
[OsiPoint]
.set .Llabel588, .
.set .Llabel588, .
.set .Llabel588, .
[NewPlainObject]
movabsq $0x215298760240, %r9
movabsq $0x7f5940618630, %r8
movq 0x0(%r8), %rsi
addq $48, %rsi
cmpq %rsi, 0x18(%r8)
jb .Lfrom625
movq %rsi, 0x0(%r8)
subq $40, %rsi
movabsq $0x7f5940637348, %r11
movq %r11, -0x8(%rsi)
movq %r9, 0x0(%rsi)
movabsq $0x56446ec81228, %r11
movq %r11, 0x8(%rsi)
movabsq $0x56446ec81200, %r11
movq %r11, 0x10(%rsi)
.set .Llabel677, .
[OsiPoint]
.set .Llabel677, .
.set .Llabel677, .
.set .Llabel677, .
[MoveGroup]
movq %rsi, %rcx
[GuardShape]
xorl %r8d, %r8d
movabsq $0x215298760240, %r11
cmpq %r11, 0x0(%rcx)
jne .Lfrom702
cmovne %r8, %rcx
[StoreFixedSlotT]
movabsq $0xfff8800000000000, %r11
movq %r11, 0x18(%rcx)
[StoreFixedSlotT]
movabsq $0xfff8800000000001, %r11
movq %r11, 0x20(%rcx)
[Pointer]
movabsq $0x2152987403c0, %rcx
[GuardSpecificFunction]
cmpq %rcx, %rdi
jne .Lfrom753
[StackArgV]
movq %rdx, -0x50(%rbp)
[StackArgT]
movabsq $0xfffe000000000000, %r11
orq %rbx, %r11
movq %r11, -0x48(%rbp)
[StackArgV]
movq %rax, -0x40(%rbp)
[StackArgT]
movabsq $0xfffe000000000000, %r11
orq %rsi, %r11
movq %r11, -0x38(%rbp)
[CallNative]
movabsq $0xfffe2152987403c0, %r11
push %r11
movabsq $0x7f5940623200, %rdi
movl $0x3, %esi
movq %rsp, %rdx
push %rsi
push $0x0
movabsq $0x0, %rcx
push %rcx
.set .Llabel839, .
.set .Llabel839, .
push %rbp
movq 0x110(%rdi), %rcx
movq %rsp, 0x70(%rcx)
push $0x0
call .Lfrom858
testb $0xff, %al
je .Lfrom866
movq 0x28(%rsp), %rcx
lfence
addq $48, %rsp
[OsiPoint]
.set .Llabel878, .
.set .Llabel878, .
.set .Llabel878, .
[Goto]
BB #6 [00044,26,39] -> #3 :: 49995959 hits
[MoveGroup]
movl -0x24(%rbp), %eax
[AddI]
addl $1, %eax
[MoveGroup]
movl %eax, -0x24(%rbp)
[MoveGroup]
movq %rcx, -0x20(%rbp)
[Goto]
jmp .Llabel231
BB #7 [00065,26,25] :: 1 hits
[MoveGroup]
movq -0x20(%rbp), %rcx
[Return]
IonScript [8 blocks]:
BB #0 [00000,26,15] -> #2 :: 1 hits
[Parameter]
[Parameter]
[CheckOverRecursed]
movabsq $0x7f5940623ba8, %r11
cmpq %rsp, 0x0(%r11)
jae .Lfrom41
.set .Llabel41, .
[OsiPoint]
.set .Llabel41, .
.set .Llabel41, .
.set .Llabel41, .
[Value]
movabsq $0xfff9800000000000, %rdx
[Integer]
xorl %eax, %eax
[MoveGroup]
movq 0x20(%rbp), %r11
movq %r11, -0x8(%rbp)
[Goto]
jmp .Lfrom66
BB #1 [00006,26,18] -> #2 :: 0 hits
[OsrEntry]
subq $80, %rsp
[OsrReturnValue]
movabsq $0xfff9800000000000, %rbx
testl $0x1, -0x10(%rcx)
je .Lfrom107
movq -0x8(%rcx), %rbx
.set .Llabel111, .
.set .Lfrom107, .Llabel111
[Parameter]
[Parameter]
[OsrValue]
movq -0x50(%rcx), %rdx
[OsrValue]
movq -0x58(%rcx), %rsi
[Unbox:Int32]
movq %rsi, %r11
shrq $47, %r11
cmpl $0x1fff1, %r11d
jne .Lfrom139
movl %esi, %eax
[MoveGroup]
movq 0x20(%rbp), %r11
movq %r11, -0x8(%rbp)
[Goto]
BB #2 [00006,26,18] -> #3 :: 11 hits
[MoveGroup]
movq 0x28(%rbp), %rcx
[Unbox:Object]
movabsq $0xfffe000000000000, %r11
xorq %rcx, %r11
movq %r11, %rcx
shrq $47, %r11
jne .Lfrom193
[Pointer]
movabsq $0x21529875f628, %rbx
[GuardSpecificFunction]
cmpq %rbx, %rcx
jne .Lfrom212
[MoveGroup]
movq %rcx, -0x18(%rbp)
movq 0x28(%rbp), %r11
movq %r11, -0x10(%rbp)
movl %eax, -0x24(%rbp)
movq %rdx, -0x20(%rbp)
[Goto]
BB #3 [00006,26,18] -> #4 -> #7 :: 49995687 hits
[InterruptCheck]
movabsq $0x7f5940623b8c, %r11
cmpl $0x0, 0x0(%r11)
jne .Lfrom265
.set .Llabel265, .
[OsiPoint]
.set .Llabel265, .
.set .Llabel265, .
.set .Llabel265, .
[Pointer]
movabsq $0x21529873d038, %rax
[GuardShape]
xorl %ecx, %ecx
movabsq $0x21529873b060, %r11
cmpq %r11, 0x0(%rax)
jne .Lfrom296
cmovne %rcx, %rax
[LoadFixedSlotT]
movabsq $0xfffe000000000000, %rbx
xorq 0x18(%rax), %rbx
[GuardShape]
xorl %eax, %eax
movabsq $0x215298760220, %r11
cmpq %r11, 0x0(%rbx)
jne .Lfrom335
cmovne %rax, %rbx
[Slots]
movq 0x8(%rbx), %rdx
[LoadDynamicSlotAndUnbox]
cmpl $0xfff88000, 0x9bc(%rdx)
jne .Lfrom359
movl 0x9b8(%rdx), %eax
[MoveGroup]
movl -0x24(%rbp), %ecx
[CompareAndBranch:Lt]
cmpl %eax, %ecx
jge .Lfrom376
BB #4 [00027,26,18] -> #5 :: 49995676 hits
[LoadDynamicSlotV]
movq 0x9b0(%rdx), %rax
[MoveGroup]
movq %rax, -0x30(%rbp)
[KeepAliveObject]
[Goto]
BB #5 [00041,26,39] [inlined extend.js:15] -> #6 :: 49995676 hits
[LoadDynamicSlotV]
movq 0x0(%rdx), %rdx
[KeepAliveObject]
[Unbox:Object]
movabsq $0xfffe000000000000, %r11
xorq %rdx, %r11
movq %r11, %rcx
shrq $47, %r11
jne .Lfrom444
[GuardShape]
xorl %ebx, %ebx
movabsq $0x21529873b960, %r11
cmpq %r11, 0x0(%rcx)
jne .Lfrom465
cmovne %rbx, %rcx
[Slots]
movq 0x8(%rcx), %rcx
[LoadDynamicSlotAndUnbox]
movabsq $0xfffe000000000000, %r11
xorq 0x0(%rcx), %r11
movq %r11, %rdi
shrq $47, %r11
jne .Lfrom499
[NewPlainObject]
movabsq $0x2152987600c0, %r8
movabsq $0x7f5940618630, %rsi
movq 0x0(%rsi), %rbx
addq $64, %rbx
cmpq %rbx, 0x18(%rsi)
jb .Lfrom536
movq %rbx, 0x0(%rsi)
subq $56, %rbx
movabsq $0x7f5940637348, %r11
movq %r11, -0x8(%rbx)
movq %r8, 0x0(%rbx)
movabsq $0x56446ec81228, %r11
movq %r11, 0x8(%rbx)
movabsq $0x56446ec81200, %r11
movq %r11, 0x10(%rbx)
.set .Llabel588, .
[OsiPoint]
.set .Llabel588, .
.set .Llabel588, .
.set .Llabel588, .
[NewPlainObject]
movabsq $0x215298760240, %r9
movabsq $0x7f5940618630, %r8
movq 0x0(%r8), %rsi
addq $48, %rsi
cmpq %rsi, 0x18(%r8)
jb .Lfrom625
movq %rsi, 0x0(%r8)
subq $40, %rsi
movabsq $0x7f5940637348, %r11
movq %r11, -0x8(%rsi)
movq %r9, 0x0(%rsi)
movabsq $0x56446ec81228, %r11
movq %r11, 0x8(%rsi)
movabsq $0x56446ec81200, %r11
movq %r11, 0x10(%rsi)
.set .Llabel677, .
[OsiPoint]
.set .Llabel677, .
.set .Llabel677, .
.set .Llabel677, .
[MoveGroup]
movq %rsi, %rcx
[GuardShape]
xorl %r8d, %r8d
movabsq $0x215298760240, %r11
cmpq %r11, 0x0(%rcx)
jne .Lfrom702
cmovne %r8, %rcx
[StoreFixedSlotT]
movabsq $0xfff8800000000000, %r11
movq %r11, 0x18(%rcx)
[StoreFixedSlotT]
movabsq $0xfff8800000000001, %r11
movq %r11, 0x20(%rcx)
[Pointer]
movabsq $0x2152987403c0, %rcx
[GuardSpecificFunction]
cmpq %rcx, %rdi
jne .Lfrom753
[StackArgV]
movq %rdx, -0x50(%rbp)
[StackArgT]
movabsq $0xfffe000000000000, %r11
orq %rbx, %r11
movq %r11, -0x48(%rbp)
[StackArgV]
movq %rax, -0x40(%rbp)
[StackArgT]
movabsq $0xfffe000000000000, %r11
orq %rsi, %r11
movq %r11, -0x38(%rbp)
[CallNative]
movabsq $0xfffe2152987403c0, %r11
push %r11
movabsq $0x7f5940623200, %rdi
movl $0x3, %esi
movq %rsp, %rdx
push %rsi
push $0x0
movabsq $0x0, %rcx
push %rcx
.set .Llabel839, .
.set .Llabel839, .
push %rbp
movq 0x110(%rdi), %rcx
movq %rsp, 0x70(%rcx)
push $0x0
call .Lfrom858
testb $0xff, %al
je .Lfrom866
movq 0x28(%rsp), %rcx
lfence
addq $48, %rsp
[OsiPoint]
.set .Llabel878, .
.set .Llabel878, .
.set .Llabel878, .
[Goto]
BB #6 [00044,26,39] -> #3 :: 49995676 hits
[MoveGroup]
movl -0x24(%rbp), %eax
[AddI]
addl $1, %eax
[MoveGroup]
movl %eax, -0x24(%rbp)
[MoveGroup]
movq %rcx, -0x20(%rbp)
[Goto]
jmp .Llabel231
BB #7 [00065,26,25] :: 1 hits
[MoveGroup]
movq -0x20(%rbp), %rcx
[Return]
--- END SCRIPT extend.js:24 ---
v8 bytecode:
[generated bytecode for function: do_extend (0x071e0019a2c9 <SharedFunctionInfo do_extend>)]
Bytecode length: 26
Parameter count 2
Register count 6
Frame size 48
Bytecode age: 0
0x71e0019a82e @ 0 : 21 00 00 LdaGlobal [0], [0]
0x71e0019a831 @ 3 : c2 Star2
0x71e0019a832 @ 4 : 2d f8 01 02 GetNamedProperty r2, [1], [2]
0x71e0019a836 @ 8 : c3 Star1
0x71e0019a837 @ 9 : 7d CreateEmptyObjectLiteral
0x71e0019a838 @ 10 : c1 Star3
0x71e0019a839 @ 11 : 7c 02 04 29 CreateObjectLiteral [2], [4], #41
0x71e0019a83d @ 15 : bf Star5
0x71e0019a83e @ 16 : 19 03 f6 Mov a0, r4
0x71e0019a841 @ 19 : 5c f9 f8 04 05 CallProperty r1, r2-r5, [5]
0x71e0019a846 @ 24 : c4 Star0
0x71e0019a847 @ 25 : a9 Return
Constant pool (size = 3)
0x71e0019a7f9: [FixedArray] in OldSpace
- map: 0x071e00002231 <Map(FIXED_ARRAY_TYPE)>
- length: 3
0: 0x071e00006935 <String[6]: #Object>
1: 0x071e00142171 <String[6]: #assign>
2: 0x071e0019a7dd <ObjectBoilerplateDescription[5]>
v8 machine code:
0x561300004200 0 8b59d0 movl rbx,[rcx-0x30]
0x561300004203 3 4903de REX.W addq rbx,r14
0x561300004206 6 f6431301 testb [rbx+0x13],0x1
0x56130000420a a 0f857093e41f jnz 0x56131fe4d580 (CompileLazyDeoptimizedCode) ;; near builtin entry
0x561300004210 10 55 push rbp
0x561300004211 11 4889e5 REX.W movq rbp,rsp
0x561300004214 14 56 push rsi
0x561300004215 15 57 push rdi
0x561300004216 16 50 push rax
0x561300004217 17 ba52000000 movl rdx,0x52
0x56130000421c 1c 41ff95284f0000 call [r13+0x4f28]
0x561300004223 23 cc int3l
0x561300004224 24 4883ec20 REX.W subq rsp,0x20
0x561300004228 28 488975b0 REX.W movq [rbp-0x50],rsi
0x56130000422c 2c 493b6520 REX.W cmpq rsp,[r13+0x20] (external value (StackGuard::address_of_jslimit()))
0x561300004230 30 0f8642020000 jna 0x561300004478 <+0x278>
0x561300004236 36 488b4dc8 REX.W movq rcx,[rbp-0x38]
0x56130000423a 3a f6c101 testb rcx,0x1
0x56130000423d 3d 0f853f030000 jnz 0x561300004582 <+0x382>
0x561300004243 43 81f900e1f505 cmpl rcx,0x5f5e100
0x561300004249 49 0f8c1e000000 jl 0x56130000426d <+0x6d>
0x56130000424f 4f 488b45d0 REX.W movq rax,[rbp-0x30]
0x561300004253 53 488b4de8 REX.W movq rcx,[rbp-0x18]
0x561300004257 57 488be5 REX.W movq rsp,rbp
0x56130000425a 5a 5d pop rbp
0x56130000425b 5b 4883f902 REX.W cmpq rcx,0x2
0x56130000425f 5f 7f03 jg 0x561300004264 <+0x64>
0x561300004261 61 c21000 ret 0x10
0x561300004264 64 415a pop r10
0x561300004266 66 488d24cc REX.W leaq rsp,[rsp+rcx*8]
0x56130000426a 6a 4152 push r10
0x56130000426c 6c c3 retl
0x56130000426d 6d 4c8b4518 REX.W movq r8,[rbp+0x18]
0x561300004271 71 41b959a51900 movl r9,0x19a559 ;; (compressed) object: 0x23520019a559 <JSFunction do_extend (sfi = 0x23520019a2c9)>
0x561300004277 77 453bc8 cmpl r9,r8
0x56130000427a 7a 0f8506030000 jnz 0x561300004586 <+0x386>
0x561300004280 80 49b96d45180052230000 REX.W movq r9,0x23520018456d ;; object: 0x23520018456d <JSFunction Object (sfi = 0x235200152d81)>
0x56130000428a 8a 458b5903 movl r11,[r9+0x3]
0x56130000428e 8e 478b5c1e07 movl r11,[r14+r11*1+0x7]
0x561300004293 93 4d8ba5c0d00000 REX.W movq r12,[r13+0xd0c0] (external value (Heap::NewSpaceAllocationTopAddress()))
0x56130000429a 9a 4d8d7c2430 REX.W leaq r15,[r12+0x30]
0x56130000429f 9f 4d39bdc8d00000 REX.W cmpq [r13+0xd0c8] (external value (Heap::NewSpaceAllocationLimitAddress())),r15
0x5613000042a6 a6 0f86f5010000 jna 0x5613000044a1 <+0x2a1>
0x5613000042ac ac 4d8d7c241c REX.W leaq r15,[r12+0x1c]
0x5613000042b1 b1 4d89bdc0d00000 REX.W movq [r13+0xd0c0] (external value (Heap::NewSpaceAllocationTopAddress())),r15
0x5613000042b8 b8 4983c401 REX.W addq r12,0x1
0x5613000042bc bc b85d481800 movl rax,0x18485d ;; (compressed) object: 0x23520018485d <Map[28](HOLEY_ELEMENTS)>
0x5613000042c1 c1 41894424ff movl [r12-0x1],rax
0x5613000042c6 c6 498b9d08020000 REX.W movq rbx,[r13+0x208] (root (empty_fixed_array))
0x5613000042cd cd 41895c2403 movl [r12+0x3],rbx
0x5613000042d2 d2 41895c2407 movl [r12+0x7],rbx
0x5613000042d7 d7 498b9540010000 REX.W movq rdx,[r13+0x140] (root (undefined_value))
0x5613000042de de 418954240b movl [r12+0xb],rdx
0x5613000042e3 e3 418954240f movl [r12+0xf],rdx
0x5613000042e8 e8 4189542413 movl [r12+0x13],rdx
0x5613000042ed ed 4189542417 movl [r12+0x17],rdx
0x5613000042f2 f2 498d7714 REX.W leaq rsi,[r15+0x14]
0x5613000042f6 f6 4989b5c0d00000 REX.W movq [r13+0xd0c0] (external value (Heap::NewSpaceAllocationTopAddress())),rsi
0x5613000042fd fd 4983c701 REX.W addq r15,0x1
0x561300004301 101 bea5a81900 movl rsi,0x19a8a5 ;; (compressed) object: 0x23520019a8a5 <Map[20](HOLEY_ELEMENTS)>
0x561300004306 106 418977ff movl [r15-0x1],rsi
0x56130000430a 10a 41895f03 movl [r15+0x3],rbx
0x56130000430e 10e 41895f07 movl [r15+0x7],rbx
0x561300004312 112 41c7470b00000000 movl [r15+0xb],0x0
0x56130000431a 11a 41c7470f02000000 movl [r15+0xf],0x2
0x561300004322 122 48bff545180052230000 REX.W movq rdi,0x2352001845f5 ;; object: 0x2352001845f5 <JSFunction assign (sfi = 0x235200152a69)>
0x56130000432c 12c 443bdf cmpl r11,rdi
0x56130000432f 12f 0f8555020000 jnz 0x56130000458a <+0x38a>
0x561300004335 135 448b5f0f movl r11,[rdi+0xf]
0x561300004339 139 4d03de REX.W addq r11,r14
0x56130000433c 13c 4157 push r15
0x56130000433e 13e 49bfb9c3040052230000 REX.W movq r15,0x23520004c3b9 ;; object: 0x23520004c3b9 <Object map = 0x23520019a6cd>
0x561300004348 148 4157 push r15
0x56130000434a 14a 4154 push r12
0x56130000434c 14c 4151 push r9
0x56130000434e 14e 498bf3 REX.W movq rsi,r11
0x561300004351 151 b804000000 movl rax,0x4
0x561300004356 156 4c8be0 REX.W movq r12,rax
0x561300004359 159 e8e23eeb1f call 0x56131feb8240 (ObjectAssign) ;; near builtin entry
0x56130000435e 15e 488b4dc8 REX.W movq rcx,[rbp-0x38]
0x561300004362 162 d1f9 sarl rcx, 1
0x561300004364 164 83c101 addl rcx,0x1
0x561300004367 167 0f8021020000 jo 0x56130000458e <+0x38e>
0x56130000436d 16d 493b6520 REX.W cmpq rsp,[r13+0x20] (external value (StackGuard::address_of_jslimit()))
0x561300004371 171 0f8657010000 jna 0x5613000044ce <+0x2ce>
0x561300004377 177 660f1f840000000000 nop
0x561300004380 180 48bff545180052230000 REX.W movq rdi,0x2352001845f5 ;; object: 0x2352001845f5 <JSFunction assign (sfi = 0x235200152a69)>
0x56130000438a 18a 498b9540010000 REX.W movq rdx,[r13+0x140] (root (undefined_value))
0x561300004391 191 49b86d45180052230000 REX.W movq r8,0x23520018456d ;; object: 0x23520018456d <JSFunction Object (sfi = 0x235200152d81)>
0x56130000439b 19b 49bfb9c3040052230000 REX.W movq r15,0x23520004c3b9 ;; object: 0x23520004c3b9 <Object map = 0x23520019a6cd>
0x5613000043a5 1a5 4d8b9d08020000 REX.W movq r11,[r13+0x208] (root (empty_fixed_array))
0x5613000043ac 1ac 41bca5a81900 movl r12,0x19a8a5 ;; (compressed) object: 0x23520019a8a5 <Map[20](HOLEY_ELEMENTS)>
0x5613000043b2 1b2 41b95d481800 movl r9,0x18485d ;; (compressed) object: 0x23520018485d <Map[28](HOLEY_ELEMENTS)>
0x5613000043b8 1b8 81f980f0fa02 cmpl rcx,0x2faf080
0x5613000043be 1be 0f8daf000000 jge 0x561300004473 <+0x273>
0x5613000043c4 1c4 418b4003 movl rax,[r8+0x3]
0x5613000043c8 1c8 418b440607 movl rax,[r14+rax*1+0x7]
0x5613000043cd 1cd 498b9dc0d00000 REX.W movq rbx,[r13+0xd0c0] (external value (Heap::NewSpaceAllocationTopAddress()))
0x5613000043d4 1d4 488d7330 REX.W leaq rsi,[rbx+0x30]
0x5613000043d8 1d8 48894d98 REX.W movq [rbp-0x68],rcx
0x5613000043dc 1dc 4939b5c8d00000 REX.W cmpq [r13+0xd0c8] (external value (Heap::NewSpaceAllocationLimitAddress())),rsi
0x5613000043e3 1e3 0f8618010000 jna 0x561300004501 <+0x301>
0x5613000043e9 1e9 488d731c REX.W leaq rsi,[rbx+0x1c]
0x5613000043ed 1ed 4989b5c0d00000 REX.W movq [r13+0xd0c0] (external value (Heap::NewSpaceAllocationTopAddress())),rsi
0x5613000043f4 1f4 4883c301 REX.W addq rbx,0x1
0x5613000043f8 1f8 44894bff movl [rbx-0x1],r9
0x5613000043fc 1fc 44895b03 movl [rbx+0x3],r11
0x561300004400 200 44895b07 movl [rbx+0x7],r11
0x561300004404 204 89530b movl [rbx+0xb],rdx
0x561300004407 207 89530f movl [rbx+0xf],rdx
0x56130000440a 20a 895313 movl [rbx+0x13],rdx
0x56130000440d 20d 895317 movl [rbx+0x17],rdx
0x561300004410 210 488d4e14 REX.W leaq rcx,[rsi+0x14]
0x561300004414 214 49898dc0d00000 REX.W movq [r13+0xd0c0] (external value (Heap::NewSpaceAllocationTopAddress())),rcx
0x56130000441b 21b 488d4e01 REX.W leaq rcx,[rsi+0x1]
0x56130000441f 21f 448961ff movl [rcx-0x1],r12
0x561300004423 223 44895903 movl [rcx+0x3],r11
0x561300004427 227 44895907 movl [rcx+0x7],r11
0x56130000442b 22b c7410b00000000 movl [rcx+0xb],0x0
0x561300004432 232 c7410f02000000 movl [rcx+0xf],0x2
0x561300004439 239 3bc7 cmpl rax,rdi
0x56130000443b 23b 0f8551010000 jnz 0x561300004592 <+0x392>
0x561300004441 241 8b770f movl rsi,[rdi+0xf]
0x561300004444 244 4903f6 REX.W addq rsi,r14
0x561300004447 247 51 push rcx
0x561300004448 248 4157 push r15
0x56130000444a 24a 53 push rbx
0x56130000444b 24b 4150 push r8
0x56130000444d 24d b804000000 movl rax,0x4
0x561300004452 252 e8e93deb1f call 0x56131feb8240 (ObjectAssign) ;; near builtin entry
0x561300004457 257 488b4d98 REX.W movq rcx,[rbp-0x68]
0x56130000445b 25b 83c101 addl rcx,0x1
0x56130000445e 25e 0f8032010000 jo 0x561300004596 <+0x396>
0x561300004464 264 493b6520 REX.W cmpq rsp,[r13+0x20] (external value (StackGuard::address_of_jslimit()))
0x561300004468 268 0f8712ffffff ja 0x561300004380 <+0x180>
0x56130000446e 26e e9e1000000 jmp 0x561300004554 <+0x354>
0x561300004473 273 e9dbfdffff jmp 0x561300004253 <+0x53>
0x561300004478 278 b9f0000000 movl rcx,0xf0
0x56130000447d 27d 51 push rcx
0x56130000447e 27e 48bb50b5d69213560000 REX.W movq rbx,0x561392d6b550
0x561300004488 288 b801000000 movl rax,0x1
0x56130000448d 28d 48bec13b180052230000 REX.W movq rsi,0x235200183bc1 ;; object: 0x235200183bc1 <NativeContext[273]>
0x561300004497 297 e82461ed1f call 0x56131feda5c0 (CEntry_Return1_ArgvOnStack_NoBuiltinExit) ;; near builtin entry
0x56130000449c 29c e995fdffff jmp 0x561300004236 <+0x36>
0x5613000044a1 2a1 4c895da8 REX.W movq [rbp-0x58],r11
0x5613000044a5 2a5 ba30000000 movl rdx,0x30
0x5613000044aa 2aa e81197e41f call 0x56131fe4dbc0 (AllocateRegularInYoungGeneration) ;; near builtin entry
0x5613000044af 2af 4c8d60ff REX.W leaq r12,[rax-0x1]
0x5613000044b3 2b3 4c8b5da8 REX.W movq r11,[rbp-0x58]
0x5613000044b7 2b7 4c8b4518 REX.W movq r8,[rbp+0x18]
0x5613000044bb 2bb 49b96d45180052230000 REX.W movq r9,0x23520018456d ;; object: 0x23520018456d <JSFunction Object (sfi = 0x235200152d81)>
0x5613000044c5 2c5 488b4dc8 REX.W movq rcx,[rbp-0x38]
0x5613000044c9 2c9 e9defdffff jmp 0x5613000042ac <+0xac>
0x5613000044ce 2ce 48bb80b0d69213560000 REX.W movq rbx,0x561392d6b080
0x5613000044d8 2d8 488945a0 REX.W movq [rbp-0x60],rax
0x5613000044dc 2dc 33c0 xorl rax,rax
0x5613000044de 2de 48bec13b180052230000 REX.W movq rsi,0x235200183bc1 ;; object: 0x235200183bc1 <NativeContext[273]>
0x5613000044e8 2e8 48894d98 REX.W movq [rbp-0x68],rcx
0x5613000044ec 2ec 4c8bc0 REX.W movq r8,rax
0x5613000044ef 2ef e8cc60ed1f call 0x56131feda5c0 (CEntry_Return1_ArgvOnStack_NoBuiltinExit) ;; near builtin entry
0x5613000044f4 2f4 488b45a0 REX.W movq rax,[rbp-0x60]
0x5613000044f8 2f8 488b4d98 REX.W movq rcx,[rbp-0x68]
0x5613000044fc 2fc e97ffeffff jmp 0x561300004380 <+0x180>
0x561300004501 301 488945a8 REX.W movq [rbp-0x58],rax
0x561300004505 305 ba30000000 movl rdx,0x30
0x56130000450a 30a e8b196e41f call 0x56131fe4dbc0 (AllocateRegularInYoungGeneration) ;; near builtin entry
0x56130000450f 30f 488d58ff REX.W leaq rbx,[rax-0x1]
0x561300004513 313 41b95d481800 movl r9,0x18485d ;; (compressed) object: 0x23520018485d <Map[28](HOLEY_ELEMENTS)>
0x561300004519 319 48bff545180052230000 REX.W movq rdi,0x2352001845f5 ;; object: 0x2352001845f5 <JSFunction assign (sfi = 0x235200152a69)>
0x561300004523 323 498b9540010000 REX.W movq rdx,[r13+0x140] (root (undefined_value))
0x56130000452a 32a 49b86d45180052230000 REX.W movq r8,0x23520018456d ;; object: 0x23520018456d <JSFunction Object (sfi = 0x235200152d81)>
0x561300004534 334 49bfb9c3040052230000 REX.W movq r15,0x23520004c3b9 ;; object: 0x23520004c3b9 <Object map = 0x23520019a6cd>
0x56130000453e 33e 488b45a8 REX.W movq rax,[rbp-0x58]
0x561300004542 342 4d8b9d08020000 REX.W movq r11,[r13+0x208] (root (empty_fixed_array))
0x561300004549 349 41bca5a81900 movl r12,0x19a8a5 ;; (compressed) object: 0x23520019a8a5 <Map[20](HOLEY_ELEMENTS)>
0x56130000454f 34f e995feffff jmp 0x5613000043e9 <+0x1e9>
0x561300004554 354 488945a0 REX.W movq [rbp-0x60],rax
0x561300004558 358 48894da8 REX.W movq [rbp-0x58],rcx
0x56130000455c 35c 488b1d6dffffff REX.W movq rbx,[rip+0xffffff6d]
0x561300004563 363 33c0 xorl rax,rax
0x561300004565 365 48bec13b180052230000 REX.W movq rsi,0x235200183bc1 ;; object: 0x235200183bc1 <NativeContext[273]>
0x56130000456f 36f e84c60ed1f call 0x56131feda5c0 (CEntry_Return1_ArgvOnStack_NoBuiltinExit) ;; near builtin entry
0x561300004574 374 488b45a0 REX.W movq rax,[rbp-0x60]
0x561300004578 378 488b4da8 REX.W movq rcx,[rbp-0x58]
0x56130000457c 37c e9fffdffff jmp 0x561300004380 <+0x180>
0x561300004581 381 90 nop
0x561300004582 382 41ff5548 call [r13+0x48]
0x561300004586 386 41ff5548 call [r13+0x48]
0x56130000458a 38a 41ff5548 call [r13+0x48]
0x56130000458e 38e 41ff5548 call [r13+0x48]
0x561300004592 392 41ff5548 call [r13+0x48]
0x561300004596 396 41ff5548 call [r13+0x48]
0x56130000459a 39a 41ff5550 call [r13+0x50]
0x56130000459e 39e 41ff5550 call [r13+0x50]
0x5613000045a2 3a2 41ff5550 call [r13+0x50]
0x5613000045a6 3a6 41ff5550 call [r13+0x50]
0x5613000045aa 3aa 41ff5550 call [r13+0x50]
0x5613000045ae 3ae 6690 nop
|
||
Comment 3•3 years ago
|
||
(In reply to Jeff Muizelaar [:jrmuizel] from comment #1)
SM has 208,586 samples in the
obj_assignbuiltin vs 49,366 elsewhere
V8 has 221,658 sample in theBuiltins_ObjectAssignvs 14,107 elsewhere
Yeah this is what I wondered about when I saw your test. It's possible our Object.assign is fast enough but we have more overhead elsewhere (I see Spectre mitigations in your JIT code dump for example).
I've done multiple rounds of Object.assign optimizations the past years. There's not a whole lot of low-hanging fruit left there.
|
|
Reporter | |
Comment 4•3 years ago
•
|
||
What do the Spectre mitigations show up as in the the JIT code dump? The lfence?
Disabling specter mitigations makes a big difference in the amount of time spent in the Ion compiled test function. (17k samples vs 45k samples).
However V8 manages to spend only 10k samples there.
FWIW, V8 has about ~53 instructions in the hot section of the function vs. ~107 insns in SM w/ specter disabled .
|
|
Reporter | |
Comment 5•3 years ago
|
||
It looks like a pretty big chunk of the Spectre mitigation cost is the lfence. (i.e. setting spectreJitToCxxCalls=false brings the benchmark time from 4.8s down to 4.4s)
Is the lfence mitigation still necessary? It seems like the holes that it's trying to plug a mostly theoretical and now that we have Fission we're in a much better position to plug anything practical that comes up or in the worst case re-enable it. From looking at the V8 source it looks like they've never used lfence in a similar way. (They had some unused code that could generate lfence but it's now been mostly removed)
|
|
||
Comment 6•3 years ago
|
||
(In reply to Jeff Muizelaar [:jrmuizel] from comment #4)
What do the Spectre mitigations show up as in the the JIT code dump? The
lfence?
There are multiple mitigations, the lfence you found but also the cmovne for the GuardShape instruction for example.
The lfence overhead is a known performance issue and I've been considering turning that off, but we're also getting to the point where we can disable all mitigations in Fission content processes (bug 1707955). There's a javascript.options.spectre.disable_for_isolated_content pref for this.
|
||
Updated•3 years ago
|
Severity: -- → N/A
Priority: -- → P2
|
|
Reporter | |
Comment 7•3 years ago
|
||
Here's a comparison from getHostProps in shell react-todomvc where Object.assign shows up: SM: https://share.firefox.dev/3ZuzKAA V8: https://share.firefox.dev/3IMh8Vo
|
||
Updated•3 years ago
|
Whiteboard: [sp3]
|
||
Updated•3 years ago
|
See Also: → https://mozilla-hub.atlassian.net/browse/SP3-247
|
|
||
Comment 8•2 years ago
|
||
Attaching a browser version of the micro-benchmark in comment 0.
On my M1 I get:
Nightly: 2650 ms
Chrome Canary: 2910 ms
Safari: 3217 ms
|
|
||
Comment 9•2 years ago
|
||
Closing considering the Spectre issue has been fixed and we're now faster on the test case.
We've also optimized Object.assign since this was filed (bug 1853467, bug 1855705).
You need to log in
before you can comment on or make changes to this bug.
Description
•