Open Bug 622299 Opened 13 years ago Updated 2 years ago

Need a way to have better jit codegen for polymorphic callsites that in practice end up doing the same thing for all types

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect

Tracking

()

People

(Reporter: bzbarsky, Unassigned)

References

Details

The typical example is code like this:

  function doIt(node) {
    /* do something with node */
    for (var i = 0; i < node.childNodes.length; ++i) { 
      doIt(node.childNodes[i]);
    }
  }

Here, for example, the .childNodes gets are being done on objects with all sorts of shapes (and possibly different JSClasses, in the future).  But in practice, the same thing happens for all of them: we need to extract the nsINode from the |node| object and then call nsINode::GetChildNodes.  The question is how we can teach the jits about this.

Note that this is only an issue for real-world performance; most microbenchmarks tend to do stupid loops over the same node, so are monomorphic.  Some microbenchmarks do walk whole DOMs, though.
In particular, we need something like PICs or the propcache or something, but that will work well with the above setup.  Can we hang enough information off the JSClass of the relevant objects to make this work, or something?
Depends on: 827396
Assignee: general → nobody
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.