Closed
Bug 730111
Opened 12 years ago
Closed 12 years ago
IonMonkey: Sunspider 3d-cube: bailing from bytecode: new, MIR: typebarrier, LIR: typebarrier
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: nbp, Assigned: nbp)
References
(Blocks 1 open bug)
Details
(Keywords: perf, testcase)
Attachments
(1 file)
6.92 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
A weird bailout on new, cause multiple un-desired recompilation of drawQube function of 3d-cube.js, the following minimal test case cause the same bailout when run with --ion -n --ion-osr=off . (osr=off is used to avoid the compilation of the outer-loop, which does not change the miss-behaviour of the test-case, only reduce the output verbosity) function DrawQube(j) { new Array(); } for (var j = 0; j <= 100; j++) { DrawQube(j); }
Assignee | ||
Updated•12 years ago
|
Summary: IonMonkey: Sunspider crypto-3d-cube: bailing from bytecode: new, MIR: typebarrier, LIR: typebarrier → IonMonkey: Sunspider 3d-cube: bailing from bytecode: new, MIR: typebarrier, LIR: typebarrier
Assignee | ||
Comment 1•12 years ago
|
||
The reason of the recompilation is caused by GetTypeCallerInitObject which is unaware of the pc & script location once called from Ion Code. The functions returns a TypeObject which is not part of the typeSet the first time the jited code execute the new statement. The worst thing is that TypeObjects are all set as the entry point into the Ion-Jitted code, which means that in addition to cause recompilation for every entry point, it also mess-up with monitored types.
Assignee | ||
Comment 2•12 years ago
|
||
- Add GetPcScript inside currentScript when the last frame is an IonFrame. - Add getJit and extend assertJit to detect unexpected bailouts during tests.
Attachment #600587 -
Flags: review?(dvander)
Comment on attachment 600587 [details] [diff] [review] Handle Ion frames in ContextStack::currentScript Review of attachment 600587 [details] [diff] [review]: ----------------------------------------------------------------- Nice catch.
Attachment #600587 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 4•12 years ago
|
||
I moved the assertJit modification away from this patch because they caused other errors in the test suite, mostly because IonMonkey does not compile directly all the test suite. To Fix this I open Bug 731683, such as we can check for bailouts and ensure that a function gets compiled. I will land currentScript modifications as soon as the buildfarm approve.
Assignee | ||
Comment 5•12 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/639a230456c7
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•