899051 - IonMonkey: Constant boundscheck bailouts on setelem

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

Small testcase:

var obj = {}
fun = function(index, value)
{
  for(var i=0; i<4000; i++)
    i -= 0.1;

  obj[index] = value;
}
for (var i=0; i<20; i++)
{
  var rnd = Math.floor(Math.random() * 3000);
  fun(rnd, true);
}

Constant bailing on obj[index] = value;

The object is annotated being sparse, but we don't do anything with it. So I copied the same logic as we have for getelem (to check for sparse + boundscheck failure). This solves the issue.

Comment 1

[Hannes Verschore [:h4writer]]

Attachment: bug899051-boundscheck

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: bug899051-boundscheck

Updated to tip. There were some unrelated changes

Comment 3

[Yves Gwerder]

This change really improves the performance a lot in some situations.
I've changed the test-script a bit to make it a "benchmark-script".
For the function I tested in 0 A.D. there was no improvement, so there must be still another bug.


Modified testscript:
--------------------
var obj = {}

fun = function(index, value)
{
	for(var i=0; i<4000; i++)
		i -= 0.1;

	obj[index] = value;
}

var startTime = elapsed();
for (var i=0; i<10000; i++)
{
	var rnd = Math.floor(Math.random() * 20000);
	var value = false;
	if (rnd%500 === 0)
		value = true;
	fun(rnd, value);
}
var endTime = elapsed();
var timeElapsed = endTime - startTime;
print("time: " + timeElapsed);


Debug mode without patch (in microseconds):
-------------------------------------------
time: 12117303
time: 12030396
time: 12008570
-----------------
Average: 12052090


Debug mode with patch (in microseconds):
----------------------------------------
time: 309777
time: 308813
time: 307613
---------------
Average: 308734

Debug mode: now only takes 1/39 of the time


Release without patch (in microseconds):
----------------------------------------
time: 796801
time: 822047
time: 795438
---------------
Average: 804762


Release mode with patch (in microseconds):
------------------------------------------
time: 160410
time: 160823
time: 160517
---------------
Average: 160583

Release mode: now only takes 1/5 of the time

Comment 4

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d2e6989ff928

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d2e6989ff928