824522 - ion::GetNameCache ends up resolving things over and over again on the Window object

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Consider this testcase:

<script>
  var count = 100000;
  var start = new Date;
  for (var i = 0; i < count; ++i)
    performance;
  var end = new Date;
  document.write((end - start) / count * 1e6);
</script>  

This ends up taking about 1us per loop iteration because ion::GetNameCache keeps calling the resolve hook on the Window...  I guess the basic worry here is that we find the property on the proto but later the resolve hook can find it on the window itself?  The problem is that this resolve hook promises to never do such things: it doesn't ever start shadowing proto properties (similar to a ListBase).

Is there any sane way we can teach ion about this special case?  Maybe it could assume sane behavior out of the resolve hook for dom globals?  Long-term (maybe weeks to months) I'm working on removing the resolve hook from Window, but if it's easy to hack around this in the meantime it might be worth it...

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Hrm, that's weird. If we find it on the proto we should be guarding on the shape of the window (or something). Is the IC failing to compile anything at all?

Comment 2

[Boris Zbarsky [:bzbarsky]]

I don't know.  How do I check?

Note that the window has a non-null resolve hook, in case it matters...

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Following up from IRC, the problem is that ion::GetNameCache immediately bails out if it finds the property on the prototype chain.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is being reported as a recurring problem; see bug 860980.  Anything we can do to get movement on this?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Eric, if you get a chance, could you look?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Looks like this is actually fixed-enough as filed, by three things:

1)  Bug 851109 made us actually IC this in ion, dropping the average time from 1000ns to
    200ns for me.  This is the real fix for this bug.
2)  The landing of the baseline compiler improved the time to 140ns (probably by running
    more of the testcase in ion, due to the lower threshold).
3)  Something in the http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=70e0955ccc87&tochange=b35170667a2f range.  No idea what.

Going to mark this fixed.  There's a remaining issue here for slotful props on the global's proto that Eric filed bug 918593 on.