456370 - TM: Flush the fragment cache more eagerly on global shape mismatch

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Right now we detect global shape mismatches only when we enter js_RecordTree or js_ExecuteTree.  If we do the detection in js_MonitorLoopEdge instead, we can save a few loops.  As things stand, right now we'll loop once, detect the mismatch on the js_RecordTree on the second loop, flush the cache and bail, then have to loop twice more to record, so we don't run the trace till the 5th loop.  If we flush before trying to get the fragment, we should run on the 3rd loop, as desired.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Like so

I wonder whether we still need the check in js_RecordTree with this change, though...

Comment 2

[Andreas Gal :gal]

With your path applied (DEBUG build).

FAILED: testHOTLOOPCorrectness,testRUNLOOPCorrectness
recorder: started(195), aborted(25), completed(206), different header(2), trees trashed(13), slot promoted(26), unstable loop variable(21), breaks(9), returns(5)
monitor: triggered(51190), exits(51122), type mismatch(68), global mismatch(0)

Comment 3

[Boris Zbarsky [:bzbarsky]]

Oh, the tests depend on the unrolled stuff in bug 456369.  There's no way they can pass with the current state of the jitstats stuff in trace-test.

Comment 4

[Andreas Gal :gal]

Verified no perf hit.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Pushed changeset 3a02053b2cff.

Comment 6

[Bob Clary [:bc] (inactive)]

test also included in js1_8_1/trace/trace-test.js