638015 - JM: Inline |this| creation for scripted constructors

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: v0

This patch inlines grabbing an object from the free list, and then bakes in most of the code that initializes the object.

It mostly only affects earley-boyer, where we spend 15% of the time constructing objects.

v8bench -m -j -p gains around 150 points, mostly in earley-boyer (which gains about 1,200 points).

There's still work to do but I just wanted to put the patch somewhere.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I just wanted to mention bug 606631, which is related but perhaps overly ambitious.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Ah, thanks! Maybe not ambitious, but we probably want to tackle inlining in a more general way.

This patch gets an overall win on v8, and even 1% on SS (1.3ms in access-binary-trees), but regresses v8-raytrace.

The problem with this approach is it guards on prototype identity. v8-raytrace closes over a constructor, so each has a new prototype object, but a single fast-path. Making it polymorphic past the entry-point seems sub-optimal, and making it generic is even slower since we'd need a multi-step guard on proto->emptyShapes.

One solution might be to generate multiple entry points, but I'm not sure where I could attach them. Two ideas:
 (1) Move JIT entry points to the funobj and out of JITScript.
 (2) Store the IC stub in the .prototype, like the emptyShapes cache:
   (a) load funobj.prototype
   (b) load and null-check (a).cached_ctor
   (c) jump to (b)

(1) saves a few branches

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: v1

Handles polymorphic functions now. Initially builds two stubs, a shape stub and a monomorphic object creation stub. After that it builds additional shape stubs as needed, and generates a second object creation stub that can take any proto. I also factored grabbing a freelist thing out so someone could inline JSOP_LAMBDA or something.

-m -a scores on v8:
Richards:    5135 -> 5153
DeltaBlue:   3840 -> 4056
Crypto:      4511 -> 4507
RayTrace:    6187 -> 6675
EarleyBoyer: 6623 -> 7327
Total:       5156 -> 5403

-m -j -p scores on v8:
Richards:    6747 -> 7246
DeltaBlue:   6166 -> 6155
Crypto:      5889 -> 5810
RayTrace:    6083 -> 6609
EarleyBoyer: 6294 -> 7286
Total:       6229 -> 6586

so, +340 v8 points

I can't take this bug right now, I don't have time to drive it into the tree, but it passes tests. If someone wants to take this I'd be grateful, if not, we can pull it out if we're in need of a small perf win in a random release.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: v1, actual patch

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Is this still wanted?

Comment 6

[Brian Hackett [Laid off!]]

JM+TI already does this.