791219 - IonMonkey: SetProperty IC does not handle adding properties to function objects

Status: REOPENED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

For the micro-benchmark below I get these numbers:

JM     : 487 ms
JM+Ion : 752 ms
d8     :  48 ms

Both the JM and Ion IC's don't handle adding properties to function objects, since they have a custom resolve hook. We could probably just whitelist this resolve hook.

function test() {
    var result;
    for (var i = 0; i<1000000; i++) {
        result = function () { return i; };
        result.prop = 123; // **ADDED**
    }
    return result;
}

var t = new Date;
test();
print(new Date - t);

Comment 1

[Marco Castelluccio [:marco]]

Why is JM+Ion slower than JM only?

Comment 2

[Jan de Mooij [:jandem]]

I forgot to say this came up with a Scheme to JS compiler. See also bug 791220 for another problem here.

(In reply to Marco Castelluccio [:marco] from comment #1)
> Why is JM+Ion slower than JM only?

I was just going to post that :) The problem is that Ion calls GetPcScript under SetPropertyCache's slow path, and recovering the script/pc from Ion is very slow. See also bug 790386.

Comment 3

[Sean Stangl [:sstangl]]

It doesn't look like GetPcScript is terribly to blame here -- a patch that forwards the values from the IC to js_InferFlags() only decreases the runtime 937 -> 905.

Comment 4

[Sean Stangl [:sstangl]]

With Bug 794679 fixed, default and --no-ion have the same performance.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

It's good that the regression is fixed, but we should probably keep this open because we're still missing the IC functionality.

Comment 6

[Guilherme Lima]

I get almost the same result on Firefox 49 and Chrome 54 for the benchmark from comment 0