680951 - TI: Perf regression on primes benchmark since bug 669969 landed

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Alon Zakai (:azakai)]

Attachment: primes benchmark

(This is a regression of TI compared to itself, not TI compared to m-c.)

Attached is a simple prime-calculation benchmark. Running it with -m -j -p -n on JM, performance has decreased with the landing of bug 669969,

changeset    time (seconds)

dd84f621ca25 2.383
993716952d86 1.379

so that changeset decreased performance by 73%. That still leaves TI slightly faster than m-c (2.425 seconds), but previously it was massively faster.

Comment 1

[Brian Hackett [Laid off!]]

One of the main things bug 669969 did was generate type information lazily for objects with singleton types (builtin classes, natives, globals, ...).  When type information for a property was generated while that property was still undefined, the property was treated as possibly-undefined everywhere it is accessed, even if it becomes defined before code depending on it is compiled.  This was happening to a global 'ga' assigned Math.sqrt, and the possibly-undefined value mucked with our generating inline code for calls to ga(), which dominate the profile.

The handling for such undefined globals was a pretty gray area before bug 669969, and special cased just these globals.  This was probably broken in subtle ways, and the fix removes the special casing and clarifies how a property on a singleton which is undefined when lazily generated does not need dynamic type checks if it is defined by the time code using it is compiled.

I get these times:

js -m -n:     1080
js -m -j -p:  3451
d8:           3479

http://hg.mozilla.org/projects/jaegermonkey/rev/d60ffe67a13f

Comment 2

[Brian Hackett [Laid off!]]

Followup fix for a bug exposed by this patch.  On v8-deltablue this patch added a recompile triggered while compiling a function called from an inline frame, and we didn't expand the inline frame correctly, leading to a crash.  The fix reorders things so that state is correct when the recompilation is triggered.  This also removes the triggering recompilation, which shouldn't have been happening.

http://hg.mozilla.org/projects/jaegermonkey/rev/9a145389d570