768745 - IonMonkey: Fix v8-raytrace performance

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

It's hard to profile this right now since we need to optimize Function.apply first. So bug 735402 is the first order of business here.

Comment 1

[Jan de Mooij [:jandem]]

Bug 638794 (currently on inbound) will help v8-raytrace a lot and make Ion faster than JM+TI. The main reason is that we have better type information so we can inline more calls.

We seem to be inlining most monomorphic property accesses (bug 771130). There are still a number of hot SetPropertyCache instructions for adding (not setting) properties. Inlining this is harder and I don't know how much it will win (adding propertie modifies the shape, so it's harder to optimize the GuardShape).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This still needs investigating. IonMonkey gets about 10,000 points on raytrace compared to Crankshaft which gets around 20,000. An increase of 100% would mean about a 10% increase on the overall v8 score.

Comment 3

[Hannes Verschore [:h4writer]]

ion_cannon,raytrace.js:709:  1938945688 cycles (44%), called:  58794,   32978 cycles/call
ion_cannon,raytrace.js:680:   653186727 cycles (15%), called: 140034,    4664 cycles/call
jm_safepoint,raytrace.js:642: 366746944 cycles  (8%), called:     63, 5821380 cycles/call
jm_normal,raytrace.js:642:    356900963 cycles  (8%), called:    175, 2039434 cycles/call
jm_normal,raytrace.js:478:    180485505 cycles  (4%), called:  41030,    4398 cycles/call
ion_cannon,raytrace.js:259:    64223987 cycles  (1%), called: 359248,     178 cycles/call
ion_compile,raytrace.js:709:   58969365 cycles  (1%), called:      8, 7371170 cycles/call
jm_normal,raytrace.js:426:     58879556 cycles  (1%), called:  30200,    1949 cycles/call
gc:                            57346732 cycles  (1%), called:      9, 6371859 cycles/call

Note: inlined functions are reported as their caller and only cycles in the call are reported, not calls to other scripted functions.

Inlined functions:
raytrace.js:709
- raytrace.js:35
- raytrace.js:94
- raytrace.js:104
- raytrace.js:126
- raytrace.js:136
- raytrace.js:156
- raytrace.js:167
- raytrace.js:235
- raytrace.js:240
- raytrace.js:251
- raytrace.js:255
- raytrace.js:268
- raytrace.js:700

raytrace.js:680
- raytrace.js:35

raytrace.js:259
- raytrace.js:35

59% of the time is spend in IM script
 - raytrace.js:709, inlines 13+ functions, could explain the high share
 - raytrace.js:680, pretty small loop, strange the share is that high!
20% of the time is spend in JM script
 - raytrace.js:642, usecount is at max 9000, before gc wipes info. Never get IM compiled
 - raytrace.js:478, usecount gets high enough and gets IM compiled, BUT only ran once? I assume we invalidate on each run?

Comment 4

[Hannes Verschore [:h4writer]]

Ah, looks like raytrace.js:680 indeed inlines raytrace.js:478.

So the list of inlined functions for 680 is:
raytrace.js:680
- raytrace.js:478
- raytrace.js:35
- raytrace.js:244
- raytrace.js:251
- raytrace.js:255
- raytrace.js:268

Also explains the 15% running time reported

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Tracelogging profile

Improved profile. Also includes Ion to Ion calls (previous report didn't had that). So much more in-depth.

Comment 6

[Hannes Verschore [:h4writer]]

Removing myself as assignee. We hit parity with v8. Most bugs now are not worth the time yet. We have other places where bigger gains can get obtained. The biggest improvement here will now come from GGC.

Comment 7

[Guilherme Lima]

Raytrace is the best benchmark for Firefox, being 60~70% faster than Chrome.