674621 - TI: remove requirement that shape determines type

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

The extra shapes required by TI are all (or at least, should all be) due to the requirement that the shape of an object determines its type.  For perf, this now buys us little --- it is basically necessary only so that the shape guards in SETPROPs with an unknown lhs do not need to do both a shape and a type guard.  With the extra precision we get from having type barriers, I don't think there are many such SETPROPs anymore, and the extra overhead from adding a type guard in such circumstances would not be noticed.

The only remaining argument for keeping this requirement is that it allows JSObject::type to move into Shape or EmptyShape.  Moving things from JSObject into Shape is a good thing, but it hasn't happened yet and without a timeline I'm not sure it makes sense to bloat the number of shapes unnecessarily.

Also, the optimal object layout ('shape' 'dense-slots' 'expando-slots' trailed by inline slots) has an odd number of words, so maybe type will end up staying in JSObject anyways (after a brawl with 'flags' for the spot).

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Update SETPROP ICs to include a type guard on monitored accesses, and remove all extra empty shapes created to enforce the property that shape determines type.

Comment 2

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/projects/jaegermonkey/rev/d37f88fa3713