503470 - 3D JavaScript demo (also known as Chrome Experiment "monster") doesn't perform

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jeff Balogh (:jbalogh)]

Not really a specific bug, just a script where FF can't keep up with Safari.  I couldn't find any references in bugzilla, wanted to make sure you guys are aware.

About 15 seconds into the demo at http://deanm.github.com/pre3d/monster.html js performance dies and the demo goes into slow motion (not a feature).  The code is at http://deanm.github.com/pre3d/monster.js but is currently obfuscated.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

bz with profiling FTW?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Maybe... 

So 28% of our time is spent in (not just under; that's 89%) js_Interpret.  That's an obvious issue right there.  Typical trace aborts:

abort: 6489: fp->scopeChain is not global or active call object
Abort recording of tree file:///Users/bzbarsky/test.js:567@30 at file:///Users/bzbarsky/test.js:574@97: callname.

and

abort: 9092: can't trace inherited property set
Abort recording of tree file:///Users/bzbarsky/test.js:1247@844 at file:///Users/bzbarsky/test.js:949@81: SetPropHit.

and

Abort recording of tree file:///Users/bzbarsky/test.js:498@237 at file:///Users/bzbarsky/test.js:505@284: No compatible inner tree.

and

abort: 10728: JSOP_BINDNAME must return global object on trace
Abort recording of tree file:///Users/bzbarsky/test.js:428@141 at file:///Users/bzbarsky/test.js:263@0: bindname.

Stats look like this after a short-ish run (just to the part where things get real slow):

recorder: started(123), aborted(47), completed(302), different header(0), trees trashed(0), slot promoted(0), unstable loop variable(86), breaks(0), returns(0), unstableInnerCalls(5), blacklisted(13)
monitor: triggered(349277), exits(349274), type mismatch(0), global mismatch(1)

ccing some folks who might know of specific bugs on the aborts above. Will attach a js-beautified testcase that I used to get the above output (yay not having all the code on one line).

Other than the 28% above, 11% of the time is js_NewObject (probably from all the object literals; about 1/3 of this is GC), 10% is fill() calls on the canvas, 8% is jitted code plus entering and leaving trace, 4.4% getting mutable scopes, 4% sorting arrays, 4% joining arrays, 4% js_NativeSet, 3% creating new jsdoubles, 25 js_NativeGet, 2% creating array objects, 1% array_extra and so forth; lots of things taking just a bit of time (canvas ops at the 0.5-1% level each, and there are 4-5 of them, that sort of thing).

Summary: we need to stay on trace, then reprofile.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: The script

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: testcase HTML

Comment 5

[David Mandelin [:dmandelin]]

abort: 6489: fp->scopeChain is not global or active call object
Abort recording of tree file:///Users/bzbarsky/test.js:567@30 at
file:///Users/bzbarsky/test.js:574@97: callname.

It would be helpful to know what the code looks like that causes this problem. I'm working on related stuff in JSOP_NAME, but I can't be sure my current patch will fix this particular problem without more info.

Comment 6

[Boris Zbarsky [:bzbarsky]]

> It would be helpful to know what the code looks like that causes this problem.

It's attached to this bug...  Line 574:

            var aK = b(aU, aV);

Here aU and aV are vars declared in the same loop.  b is a function.  The setup in general is sorta like this:

Soft3d = (function() {
  function b(x,y) {
    /* do stuff */
  }
  // ...
  B.prototype.rebuildMeta = function ap() {
    // ...
    for (var aN = 0; aN < aW; ++aN) {
      // ....
      var aK = b(aU, aV);
    }
  }

  return {};
})();

Comment 8

[deanm]

Pre3d is open source:

http://github.com/deanm/pre3d/tree/master

I would probably start by trying to profile spin_ring:

http://deanm.github.com/pre3d/demos/loader.html#spin_ring.js

Comment 9

[Boris Zbarsky [:bzbarsky]]

Current JM profile of this thing is something like (all percentages are "under" unless they
explicitly say "in"):

  20% in mjit-generated code
  20% Fill on the canvas
  10% NewInitObject + GC   9% painting
   5% SetName<0> (half is allocating slots and half is setting canvas styles)
   5% InitPropOrMethod
   4% stubs::CallName (mostly under NameOp getting call vars, looks like)
   3% array_join
   3% stubs::NewArray
   3% array_sort
   3% array_extra (mostly creating array objects)
   2% FillRect on canvas
   2% NewObject
   3% finalizer thread

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Very smooth with JM+TI on my Win7 D2D system. Not sure if there's more to do here or not.