Closed Bug 680951 Opened 8 years ago Closed 8 years ago

TI: Perf regression on primes benchmark since bug 669969 landed

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: azakai, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Attached file primes benchmark
(This is a regression of TI compared to itself, not TI compared to m-c.)

Attached is a simple prime-calculation benchmark. Running it with -m -j -p -n on JM, performance has decreased with the landing of bug 669969,

changeset    time (seconds)

dd84f621ca25 2.383
993716952d86 1.379

so that changeset decreased performance by 73%. That still leaves TI slightly faster than m-c (2.425 seconds), but previously it was massively faster.
One of the main things bug 669969 did was generate type information lazily for objects with singleton types (builtin classes, natives, globals, ...).  When type information for a property was generated while that property was still undefined, the property was treated as possibly-undefined everywhere it is accessed, even if it becomes defined before code depending on it is compiled.  This was happening to a global 'ga' assigned Math.sqrt, and the possibly-undefined value mucked with our generating inline code for calls to ga(), which dominate the profile.

The handling for such undefined globals was a pretty gray area before bug 669969, and special cased just these globals.  This was probably broken in subtle ways, and the fix removes the special casing and clarifies how a property on a singleton which is undefined when lazily generated does not need dynamic type checks if it is defined by the time code using it is compiled.

I get these times:

js -m -n:     1080
js -m -j -p:  3451
d8:           3479

http://hg.mozilla.org/projects/jaegermonkey/rev/d60ffe67a13f
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Followup fix for a bug exposed by this patch.  On v8-deltablue this patch added a recompile triggered while compiling a function called from an inline frame, and we didn't expand the inline frame correctly, leading to a crash.  The fix reorders things so that state is correct when the recompilation is triggered.  This also removes the triggering recompilation, which shouldn't have been happening.

http://hg.mozilla.org/projects/jaegermonkey/rev/9a145389d570
Duplicate of this bug: 682168
Depends on: 684662
You need to log in before you can comment on or make changes to this bug.