1981133 - Support baking in constant property values for the global object

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P3)

Description

[Jan de Mooij [:jandem]]

For bug 1972572 I want start with just the global object and GetNameIRGenerator support. This will add most of the code to also use this for other objects later though.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 1 - Pass PropertyInfo to Watchtower::watchPropertyRemove. r?iain!

This will be used by a later patch to get the slot number of the removed property.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 2 - Rename HasFuseProperty ObjectFlag to HasRealmFuseProperty. r?iain!

This more clearly distinguishes it from the new ObjectFuse-based mechanism.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 3 - Save PropertyInfo in CheckLexicalNameConflict. r?iain!

This will be used later to invalidate Ion code depending on this particular
property's value.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 4 - Wrap code in a function in non262/extensions/collect-gray.js test. r?jonco!

Baking in constant property values for the global object was causing test failures
with eager JIT compilation, because of new GC edges from IC stubs for those constants.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 5 - Support LoadValue in the transpiler and Ion ICs. r?iain!

Bug 1977367 added nursery-values support so it should be possible to handle the
nursery case in the future if needed. What makes this a bit tricky is that we don't
know the Value type in that case in the transpiler so we'd either have to store
the type separately in the snapshot or in the ValueOrNurseryValueIndex, or load the
constant as an opaque boxed Value.

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 6 - Remove overzealous assertion in JS_SetReservedSlot. r?iain!

Watchtower only cares about JS property values, not reserved slots, so it doesn't
need to handle those slot changes.

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 7 - Add ObjectFuse and use it for the global object. r?iain!

Later patches will add JIT optimizations based on this.

For now this is only used to bake in constant property values for the global object,
but this could also be used for prototype objects in the future.

Comment 8

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 8 - Add memory reporting for object fuses. r?iain!

In GCHashTable.h, this changes map.sizeOfExcludingThis to map.shallowSizeOfExcludingThis
because the former doesn't compile (but is currently unused).

Comment 9

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 9 - Add IC optimization for constant global object properties. r?iain!

Comment 10

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 10 - Support GuardObjectFuseProperty in Warp. r?iain!

Comment 11

[Jan de Mooij [:jandem]]

Attachment: Bug 1981133 part 11 - Support optimizing SetProp for objects with an ObjectFuse. r?iain!

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/406c954a07ee
https://hg.mozilla.org/integration/autoland/rev/36f159efb12f
part 1 - Pass PropertyInfo to Watchtower::watchPropertyRemove. r=iain
https://github.com/mozilla-firefox/firefox/commit/13890b293ff2
https://hg.mozilla.org/integration/autoland/rev/650cbbf408f5
part 2 - Rename HasFuseProperty ObjectFlag to HasRealmFuseProperty. r=iain
https://github.com/mozilla-firefox/firefox/commit/1c384a0e771c
https://hg.mozilla.org/integration/autoland/rev/7f1f9bc812d6
part 3 - Save PropertyInfo in CheckLexicalNameConflict. r=iain
https://github.com/mozilla-firefox/firefox/commit/4b0de78e678a
https://hg.mozilla.org/integration/autoland/rev/2bb894bf879b
part 4 - Wrap code in a function in non262/extensions/collect-gray.js test. r=jonco
https://github.com/mozilla-firefox/firefox/commit/d924fd751e3b
https://hg.mozilla.org/integration/autoland/rev/db8bfed72beb
part 5 - Support LoadValue in the transpiler and Ion ICs. r=iain
https://github.com/mozilla-firefox/firefox/commit/4477c4eac694
https://hg.mozilla.org/integration/autoland/rev/ad4356e3aef4
part 6 - Remove overzealous assertion in JS_SetReservedSlot. r=iain

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2eba132fb701
https://hg.mozilla.org/integration/autoland/rev/785825832f94
part 7 - Add ObjectFuse and use it for the global object. r=iain
https://github.com/mozilla-firefox/firefox/commit/ca838a5a8c4c
https://hg.mozilla.org/integration/autoland/rev/a7b0a9940b39
part 8 - Add memory reporting for object fuses. r=iain
https://github.com/mozilla-firefox/firefox/commit/a24b05c4992f
https://hg.mozilla.org/integration/autoland/rev/2499e94d2177
part 9 - Add IC optimization for constant global object properties. r=iain
https://github.com/mozilla-firefox/firefox/commit/41375298f4c3
https://hg.mozilla.org/integration/autoland/rev/cee92ecf074b
part 10 - Support GuardObjectFuseProperty in Warp. r=iain
https://github.com/mozilla-firefox/firefox/commit/ed06997b0c38
https://hg.mozilla.org/integration/autoland/rev/8f373494031e
part 11 - Support optimizing SetProp for objects with an ObjectFuse. r=iain

Comment 14

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/36f159efb12f
https://hg.mozilla.org/mozilla-central/rev/650cbbf408f5
https://hg.mozilla.org/mozilla-central/rev/7f1f9bc812d6
https://hg.mozilla.org/mozilla-central/rev/2bb894bf879b
https://hg.mozilla.org/mozilla-central/rev/db8bfed72beb
https://hg.mozilla.org/mozilla-central/rev/ad4356e3aef4
https://hg.mozilla.org/mozilla-central/rev/785825832f94
https://hg.mozilla.org/mozilla-central/rev/a7b0a9940b39
https://hg.mozilla.org/mozilla-central/rev/2499e94d2177
https://hg.mozilla.org/mozilla-central/rev/cee92ecf074b
https://hg.mozilla.org/mozilla-central/rev/8f373494031e

Comment 15

[Mayank Bansal]

Improvements on JS2:
~0.5% overall
12.3% on mandreel
10% on richards
12% on crypto-sha1-sp
4% on delt-blue
Improvements on e-b and other crypto tests too.

Kraken
Atleast 1.5%-2% overall
8% on audio-oscillator
11% on imaginf-gaussian-blur

Octane (which is similar for corresponding tests on JS2/JS3)
3.7% on crypto
9% on e-b
13.3% on Mandreel
5.2% on mandreel-latency
4.4% on Richards

Comment 16

[Jan de Mooij [:jandem]]

(In reply to Mayank Bansal from comment #15)

Kraken
[...]
11% on imaging-gaussian-blur

Ah yeah this optimization does well there. In this function now height, width, kernelSize, squidImageData, kernel, Math are all constants.

So for example for this loop:

for (var j = 1 - kernelSize; j < kernelSize; ++j) {

we now bake in kernelSize (= 7) so we can generate machine code that just loops from -6 to 6:

[Integer]
movl       $0xfffffffa, %r13d # -6
...
[CompareAndBranch:Lt]
cmpl       $0x7, %r13d
jge        .Lfrom764

Similar for the * width expressions, we can now multiply by a constant for that:

imull      $400, %r14d, %r14d

The only global we can't optimize is kernelSum because of how that one gets initialized but that's expected.

Comment 17

[Mayank Bansal]

some improvements on six-speed
~10% on map-string-es5
~5% on arrow-args-es5
5% arrow-args-es6
~5% on destructuring
~5% for spread-generator

Comment 18

[Mayank Bansal]

12% improvement on sync-fs only on Linux (and maybe slightly on OSX)

Comment 19

[Acasandrei Beatrice (needinfo me)]

(In reply to Pulsebot from comment #13)

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2eba132fb701
https://hg.mozilla.org/integration/autoland/rev/785825832f94
part 7 - Add ObjectFuse and use it for the global object. r=iain
https://github.com/mozilla-firefox/firefox/commit/ca838a5a8c4c
https://hg.mozilla.org/integration/autoland/rev/a7b0a9940b39
part 8 - Add memory reporting for object fuses. r=iain
https://github.com/mozilla-firefox/firefox/commit/a24b05c4992f
https://hg.mozilla.org/integration/autoland/rev/2499e94d2177
part 9 - Add IC optimization for constant global object properties. r=iain
https://github.com/mozilla-firefox/firefox/commit/41375298f4c3
https://hg.mozilla.org/integration/autoland/rev/cee92ecf074b
part 10 - Support GuardObjectFuseProperty in Warp. r=iain
https://github.com/mozilla-firefox/firefox/commit/ed06997b0c38
https://hg.mozilla.org/integration/autoland/rev/8f373494031e
part 11 - Support optimizing SetProp for objects with an ObjectFuse. r=iain

Perfherder has detected a talos performance change from push 8f373494031ed192dd97c5019b5ffa7076b0548a.

If you have any questions, please reach out to a performance sheriff. Alternatively, you can find help on Slack by joining #perf-help, and on Matrix you can find help by joining #perftest.

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)
2%	kraken	windows11-64-24h2-shippable	e10s fission stylo webrender	474.08 -> 464.27

Details of the alert can be found in the alert summary, including links to graphs and comparisons for each of the affected tests.

If you need the profiling jobs you can trigger them yourself from treeherder job view or ask a performance sheriff to do that for you.

You can run all of these tests on try with ./mach try perf --alert 46199

The following documentation link provides more information about this command.

Comment 20

[Acasandrei Beatrice (needinfo me)]

(In reply to Pulsebot from comment #13)

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2eba132fb701
https://hg.mozilla.org/integration/autoland/rev/785825832f94
part 7 - Add ObjectFuse and use it for the global object. r=iain
https://github.com/mozilla-firefox/firefox/commit/ca838a5a8c4c
https://hg.mozilla.org/integration/autoland/rev/a7b0a9940b39
part 8 - Add memory reporting for object fuses. r=iain
https://github.com/mozilla-firefox/firefox/commit/a24b05c4992f
https://hg.mozilla.org/integration/autoland/rev/2499e94d2177
part 9 - Add IC optimization for constant global object properties. r=iain
https://github.com/mozilla-firefox/firefox/commit/41375298f4c3
https://hg.mozilla.org/integration/autoland/rev/cee92ecf074b
part 10 - Support GuardObjectFuseProperty in Warp. r=iain
https://github.com/mozilla-firefox/firefox/commit/ed06997b0c38
https://hg.mozilla.org/integration/autoland/rev/8f373494031e
part 11 - Support optimizing SetProp for objects with an ObjectFuse. r=iain

Perfherder has detected a browsertime performance change from push 8f373494031ed192dd97c5019b5ffa7076b0548a.

If you have any questions, please reach out to a performance sheriff. Alternatively, you can find help on Slack by joining #perf-help, and on Matrix you can find help by joining #perftest.

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)	Performance Profiles
9%	speedometer3 React-Stockcharts-SVG/PanTheChart/Sync	macosx1470-64-nightlyasrelease	fission webrender	8.19 -> 7.46	Before/After
3%	speedometer3 React-Stockcharts-SVG/total	linux1804-64-shippable-qr	fission webrender	215.23 -> 207.72	Before/After
3%	speedometer3 React-Stockcharts-SVG/PanTheChart/Async	linux1804-64-shippable-qr	fission webrender	20.02 -> 19.41	Before/After

Details of the alert can be found in the alert summary, including links to graphs and comparisons for each of the affected tests.

If you need the profiling jobs you can trigger them yourself from treeherder job view or ask a performance sheriff to do that for you.

You can run all of these tests on try with ./mach try perf --alert 46246

The following documentation link provides more information about this command.