Closed
Bug 728445
Opened 12 years ago
Closed 12 years ago
IonMonkey: Defer to TI for baking in monomorphic call targets.
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Unassigned)
Details
Attachments
(1 file)
2.70 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following code (derived from SS-1.0's 3d-morph line 30) currently lowers to an LCallGeneric instead of LCallNative:
> function callnative() {
> var sin = Math.sin;
> for (var i = 0; i < 100; i++)
> sin(5);
> }
We enter this function via an OSR point above the loop, which causes the function input to the MCall to be MPhi(MConstant, MOsrValue). Although we got the single call target from TI during building, lowering's visitCall() assumed that having a single call target would imply an MConstant function object, which is not true in the OSR case.
This patch stores the TI-derived single call target in the MCall structure, and checks that during lowering instead of attempting to re-derive it.
The execution time for 3d-morph is halved (15.4ms -> 7.9ms).
Attachment #598393 -
Flags: review?(dvander)
Updated•12 years ago
|
Attachment #598393 -
Flags: review?(dvander) → review+
Reporter | ||
Comment 1•12 years ago
|
||
hg.mozilla.org/projects/ionmonkey/rev/6f0cf6e2bf8f
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•