507683 - Trace native getters

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: WIP 1

This patch doesn't make JIT code call native getters directly. Instead they call a builtin function, GetPropertyById, which does OBJ_GET_PROPERTY, which repeats the whole lookup.  So, it's sloppy, but I'd like bz to give it a spin and maybe even land it, with a promise to improve upon this soon.  Passes trace-tests.

It hardly seems possible, but I think this is a win on SunSpider. I occasionally get a bench.sh run under 1000ms now, which didn't happen for me before.

This might even trace non-quick-stubbed getters, if we can get through XPConnect without deep-aborting/deep-bailing.

TODO: Add a few trace-tests; try to make the violence to TR::prop()'s interface a little less horrible; probably bring back the special case for str.length.

Comment 2

[Jason Orendorff [:jorendorff]]

Forgot to mention that this patch goes on top of the one in bug 507665.

Comment 3

[Jason Orendorff [:jorendorff]]

We won't trace non-quick-stubbed XPConnect getters. We'll deep-bail in js_InternalInvoke every time. Memo to myself: add a check to prevent this patch from trying to record the JSPROP_GETTER case.

Comment 4

[Jason Orendorff [:jorendorff]]

Attachment: WIP 2

This is what I'm sending to the Try server right about now.  (I can definitely squeeze a bit more speed out of it, but if it passes tests I'd rather land it and file the follow-up bug.)

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Little microbenchmark that exercises the .style getter

Comment 6

[Jason Orendorff [:jorendorff]]

Attachment: v3

This isn't much different from WIP 2. Unbitrotted and a few tweaks here and there.

This removes a special hack for obj.length where obj is a String wrapper object. Now that will result in a call to the length getter, instead of emitting hand-coded LIR. I hope we can live without that.

I'll check SunSpider and v8 benchmarks before landing, but this shouldn't affect them much either way. Dromaeo should see a win at the margins--we still lose big because it calls across window objects though.

Comment 7

[Jason Orendorff [:jorendorff]]

Bug 508310 is the follow-up bug to call getters directly, eliminating GetPropertyWithNativeGetter.

Comment 8

[Jason Orendorff [:jorendorff]]

Review ping.

Comment 9

[Andreas Gal :gal]

Comment on attachment 394153 [details] [diff] [review]
v3


{
   DeepBailState state; // or something like this? just a suggestion

}

>+    enterDeepBailCall();
>+    LIns* vp_ins = addName(lir->insAlloc(sizeof(jsval)), "vp");
>+    LIns* args[] = {vp_ins, INS_CONSTPTR(sprop), obj_ins, cx_ins};
>+    LIns* ok_ins = lir->insCall(&GetPropertyWithNativeGetter_ci, args);
>+    finishGetProp(obj_ins, vp_ins, ok_ins, outp);
>+    leaveDeepBailCall();
>+    return JSRS_CONTINUE;
>+}
>+

Comment 10

[Jason Orendorff [:jorendorff]]

Part the First:   http://hg.mozilla.org/tracemonkey/rev/b7ef4e4816ed
Part the Second:  http://hg.mozilla.org/tracemonkey/rev/8ca247a7d4ba

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/b7ef4e4816ed

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/8ca247a7d4ba

Comment 13

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/ec9d6d620204

Comment 14

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/27c557e1274b