831518 - Support definite slots in GameBoyCore context object

Status: RESOLVED DUPLICATE of bug 868042

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

gbemu.js stores emulator state in the context object |GameBoyCore|, which is stored in a global and manually threaded through most of the benchmark via |this| in the main loop at :7060. All accesses to this object are performed through polymorphic caches, which are slow: they should be accesses to definite slots.

Although the object has a hard-set layout defined properly by its constructor, the shape contains too many slots (~380) and therefore is set into dictionary mode. TI does not recognize these slots as being definite because there are too many, and although mjit caches only have the one shape, dictionary mode prevents us from doing monomorphic getprops in ion.

Brian looked into this earlier today, and discovered that we have enough free bits in the TI TYPE_FLAG_* bits to track up to 512 definite properties, with Bug 804676 freeing up even more bits. So we propose fixing this by having TI track the definiteness of a greater number of slots.

Comment 1

[Sean Stangl [:sstangl]]

Attachment: Use dictionary-mode shapes in monomorphic Ion caches

This test patch enables inlining GetProperty for dictionary-mode shapes that happen to also be lastProperty, which is most of them.

It's a major win on some contrived microbenchmarks, but when actually applied to gbemu.js, results in a minor slowdown due to a ~4x increase in the number of bailouts.

Comment 2

[Sean Stangl [:sstangl]]

Well, this is annoying. The context object is created with 282 slots, throwing it into dictionary mode. At a later point near the end of the benchmark, we add 8 new properties to it, which changes the shape and causes excessive recompilation. Then we re-run the benchmark, and the new context object has 282 slots again.

So it doesn't look like going with dictionary-mode support is the right way here. It does actually look like we want to be able to hardcode the specific slot referring to the designated property, regardless of what the inbound shape is.