632729 - sweeping native call ic prevents future native call ic formation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

After JITScript::sweepCallICs, swept call ics are left in a state that prevents the creation of future ic stubs.  For example, uncommenting 'gc()' in this test:

  function f(x) {
    for (var i = 0; i < x; ++i)
      Math.sin(1);
  }
  f(4);
  // gc();
  f(1000000)

produces a 60% slowdown.  callgrind confirms that the extra time is spent going through generateNativeStub.  Unless I'm missing something pernicious, the fix should be quite simple.

Comment 1

[Luke Wagner [:luke]]

Assigning at David's request.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Nice catch. The inline path starts with a funobj guard. If this guard fails, it can go to either an IC, or to the slow path. The bug is that while sweeping call ICs, we blindly relink this guard to the slow path. We don't have to be so pessimistic.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/641d4c7e217b

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/641d4c7e217b