The default bug view has changed. See this FAQ.

IonMonkey: Separate FreeList acquisition from getNewObject().

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: sstangl, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
getNewObject() is infallible except for freelist slot acquisition: if no slot exists, we call js_CreateThisForFunctionWithProto().

Instead, we could call a VM function that merely instantiates a new FreeList for our AllocKind, possibly causing a GC. Then object creation could reuse the inline path, which is significantly faster.

Likely only a small perf bump due to the relative rarity of the failure case.
(Reporter)

Comment 1

5 years ago
Created attachment 643617 [details] [diff] [review]
patch

Always perform initialization on the fast path. A microbenchmark of repeated calls to |new| shows a modest 3% perf improvement.
Attachment #643617 - Flags: review?(nicolas.b.pierron)
Comment on attachment 643617 [details] [diff] [review]
patch

Review of attachment 643617 [details] [diff] [review]:
-----------------------------------------------------------------

Apply nit about the oolCallVM and remove the OutOfLineNewGCThing class.
And r+.

::: js/src/ion/CodeGenerator.cpp
@@ +1459,5 @@
> +    JS_ASSERT(!lir->isCall());
> +    saveLive(lir);
> +
> +    pushArg(ImmWord(thingSize));
> +    pushArg(ImmWord((int)allocKind));

Use Imm32 and not ImmWord, because ImmWord are marked as relocatable except that these values are not pointers.

@@ +1512,2 @@
>  
> +    OutOfLineNewGCThing *ool = new OutOfLineNewGCThing(lir, allocKind, objReg);

Use oolCallVM, you will love it:

    typedef JSObject *(*pf)(JSContext *cx, gc::AllocKind allocKind, size_t thingSize);
    static const VMFunction NewGCThingInfo = FunctionInfo<pf>(js::ion::NewGCThing);

    size_t thingSize = gc::Arena::thingSize(allocKind);

    OutOfLineCode *ool = oolCallVM(NewGCThingInfo, lir,
                                  (ArgList(), Imm32((int)allocKind), Imm32(thingSize)),
                                  StoreRegisterTo(objReg));

::: js/src/ion/IonMacroAssembler.cpp
@@ +419,4 @@
>  
> +        int elementsOffset = JSObject::offsetOfFixedElements();
> +
> +        addPtr(Imm32(elementsOffset), obj);

This is not that important, but this is the kind of case where compiler and I usually prefer « lea ».

@@ +419,5 @@
>  
> +        int elementsOffset = JSObject::offsetOfFixedElements();
> +
> +        addPtr(Imm32(elementsOffset), obj);
> +        storePtr(obj, Address(obj, -elementsOffset + JSObject::offsetOfElements()));

oh, that hurts!
Attachment #643617 - Flags: review?(nicolas.b.pierron) → review+
(Reporter)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/8b0a7122b1aa
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.