860239 - IonMonkey: Handle OSR pc mismatches better

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

If a script has multiple loops, and we Ion-compile a script with an OSR-entry block for one of them, we can no longer enter the script at another loop. This means we can be stuck in Baseline if we don't hit the first loop again.

The attached patch adds a counter to IonScript and increments it whenever this happens. If it reaches 6000 it invalidates the script. 6000 is pretty high, but lower values regress audio-fft from 70 to 77 ms, and I think this is fine for now to avoid the pathological cases: the patch improves the AWFY-assorted Emscripten misc-skinning benchmark from 6000 to ~500 ms, a 12x improvement.

Comment 1

[Brian Hackett [Laid off!]]

Comment on attachment 735704 [details] [diff] [review]
Patch

Review of attachment 735704 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonCode.h
@@ +238,5 @@
>  
>      // Identifier of the compilation which produced this code.
>      types::RecompileInfo recompileInfo_;
>  
> +    uint32_t osrPcMismatchCounter_;

This field should have a short comment.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3e2e383695cf

Comment 3

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/3e2e383695cf