686000 - JM+TI: faster property access stubcalls

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Each property read (including NAME/etc.) C++ stubcall has a TypeScript::Monitor() at the end to report the result to TI.  These cost a lot of time on tests that make a lot of stubcalls.  This call has to look up the script's analysis info, figure out and get the type set storing the op's result, compute the type of the pushed value (bunch of branches), check if that type is in the set (bunch of loads and branches) and in the very rare case actually change the type set.  It would be *way* faster to do this in jitcode immediately after the stubcall returns, which can bake in almost everything above and reduce this to, in most cases, a handful of branches.

function foo(a) {
  for (var i = 0; i < 100000; i++) {
    for (var j = 0; j < 100; j++)
      a[j].f;
  }
}

a = [];
for (var i = 0; i < 100; i++) {
  a[i] = {};
  a[i][i] = i;
  a[i].f = i;
}

foo(a);

js -m     320
js -m -n  465
js -m -n (without TypeScript::Monitor call)  320

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 2

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/projects/jaegermonkey/rev/f1c585415dd4

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 559652 [details] [diff] [review]
patch

Review of attachment 559652 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/methodjit/Compiler.cpp
@@ +7549,5 @@
> +void
> +mjit::Compiler::testPushedType(RejoinState rejoin, int which, bool ool)
> +{
> +    if (!cx->typeInferenceEnabled() || !(js_CodeSpec[*PC].format & JOF_TYPESET))
> +        return;

When would it be called on a non-JOF_TYPESET opcode?

Comment 4

[Brian Hackett [Laid off!]]

(In reply to David Anderson [:dvander] from comment #3)
> Comment on attachment 559652 [details] [diff] [review]
> patch
> 
> Review of attachment 559652 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: js/src/methodjit/Compiler.cpp
> @@ +7549,5 @@
> > +void
> > +mjit::Compiler::testPushedType(RejoinState rejoin, int which, bool ool)
> > +{
> > +    if (!cx->typeInferenceEnabled() || !(js_CodeSpec[*PC].format & JOF_TYPESET))
> > +        return;
> 
> When would it be called on a non-JOF_TYPESET opcode?

Opcode fusions :(

Not many of these left though, thankfully.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/mozilla-central/rev/b961a248e94d