836347 - BaselineCompiler: Make Call_Scripted IC stub not enter ionCode with bailoutExpected set on it.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Kannan Vijayan [:djvj]]

Discovered while attempting to bench Ion+Baseline combined performance.  Some ion scripts are repeatedly bailing out, and baseline is repeatedly re-entering it, because the Call_Scripted stub does not check the bailoutExpected flag of the IonScript it's about to enter.

This causes significant slowdowns and makes comparison of Ion+Baseline and Ion+JM infeasible.

Comment 1

[Jan de Mooij [:jandem]]

It would be really nice to have a "void *jitcode" pointer in JSScript that either points to ion->method()->raw() or baseline->method()->raw(). Then when we set bailoutExpected we can just switch that pointer to the baseline script, and we can avoid some loads and branches when doing calls.

Comment 2

[Kannan Vijayan [:djvj]]

We can do this when we change Ion's visitCallGeneric and friends to check for baseline jitcode.

Comment 3

[Kannan Vijayan [:djvj]]

Attachment: Patch

This makes bailoutExpected_ into an int32 for easier checks via masm.branch32(...).

Comment 4

[Kannan Vijayan [:djvj]]

https://hg.mozilla.org/projects/ionmonkey/rev/cc99db07f96c