Closed Bug 730111 Opened 12 years ago Closed 12 years ago

IonMonkey: Sunspider 3d-cube: bailing from bytecode: new, MIR: typebarrier, LIR: typebarrier

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: nbp, Assigned: nbp)

References

(Blocks 1 open bug)

Details

(Keywords: perf, testcase)

Attachments

(1 file)

A weird bailout on new, cause multiple un-desired recompilation of drawQube function of 3d-cube.js, the following minimal test case cause the same bailout when run with --ion -n --ion-osr=off .  (osr=off is used to avoid the compilation of the outer-loop, which does not change the miss-behaviour of the test-case, only reduce the output verbosity)


function DrawQube(j) {
   new Array();
}

for (var j = 0; j <= 100; j++) {
    DrawQube(j);
}
Summary: IonMonkey: Sunspider crypto-3d-cube: bailing from bytecode: new, MIR: typebarrier, LIR: typebarrier → IonMonkey: Sunspider 3d-cube: bailing from bytecode: new, MIR: typebarrier, LIR: typebarrier
The reason of the recompilation is caused by GetTypeCallerInitObject which is unaware of the pc & script location once called from Ion Code.

The functions returns a TypeObject which is not part of the typeSet the first time the jited code execute the new statement.

The worst thing is that TypeObjects are all set as the entry point into the Ion-Jitted code, which means that in addition to cause recompilation for every entry point, it also mess-up with monitored types.
- Add GetPcScript inside currentScript when the last frame is an IonFrame.
- Add getJit and extend assertJit to detect unexpected bailouts during tests.
Attachment #600587 - Flags: review?(dvander)
Comment on attachment 600587 [details] [diff] [review]
Handle Ion frames in ContextStack::currentScript

Review of attachment 600587 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch.
Attachment #600587 - Flags: review?(dvander) → review+
I moved the assertJit modification away from this patch because they caused other errors in the test suite, mostly because IonMonkey does not compile directly all the test suite.  To Fix this I open Bug 731683, such as we can check for bailouts and ensure that a function gets compiled.

I will land currentScript modifications as soon as the buildfarm approve.
https://hg.mozilla.org/projects/ionmonkey/rev/639a230456c7
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.