Closed Bug 674621 Opened 9 years ago Closed 8 years ago

TI: remove requirement that shape determines type

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: bhackett, Unassigned)

References

Details

Attachments

(1 file)

The extra shapes required by TI are all (or at least, should all be) due to the requirement that the shape of an object determines its type.  For perf, this now buys us little --- it is basically necessary only so that the shape guards in SETPROPs with an unknown lhs do not need to do both a shape and a type guard.  With the extra precision we get from having type barriers, I don't think there are many such SETPROPs anymore, and the extra overhead from adding a type guard in such circumstances would not be noticed.

The only remaining argument for keeping this requirement is that it allows JSObject::type to move into Shape or EmptyShape.  Moving things from JSObject into Shape is a good thing, but it hasn't happened yet and without a timeline I'm not sure it makes sense to bloat the number of shapes unnecessarily.

Also, the optimal object layout ('shape' 'dense-slots' 'expando-slots' trailed by inline slots) has an odd number of words, so maybe type will end up staying in JSObject anyways (after a brawl with 'flags' for the spot).
Attached patch patchSplinter Review
Update SETPROP ICs to include a type guard on monitored accesses, and remove all extra empty shapes created to enforce the property that shape determines type.
Attachment #549228 - Flags: review?(dmandelin)
Attachment #549228 - Flags: review?(dmandelin) → review+
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.