902508 - IonMonkey: avoid bailouts due to empty type sets at script entry

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

Currently any script which is Ion compiled without its arguments/this types being monitored by a call after baseline compilation will bailout the first time it is called, as its argument and this type sets are empty.  In some cases we can do better than this:

- If the arguments in the script are not modified, their original values and potential types can be determined using the OSR frame.
- For asm.js code, the arguments are immediately converted to an int32 or double.  For long running functions, doing this conversion generically will not have noticeable overhead.

On one of the bullet.js asm.js demos we currently take 29 bailouts, fixing these (well, fixing the second one rather) reduces this to seven bailouts.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 786981 [details] [diff] [review]
patch

Review of attachment 786981 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +815,5 @@
>          return true;
>  
> +    // If we are doing OSR on a frame which initially executed in the
> +    // interpreter and didn't accumulate type information, try to use that OSR
> +    // frame to determine possible initial types for 'this' and parameters.

Very nice.

@@ +828,5 @@
>  
>      for (uint32_t i = 0; i < info().nargs(); i++) {
> +        types::StackTypeSet *argTypes = types::TypeScript::ArgTypes(script(), i);
> +        if (argTypes->empty() && baselineFrame_ &&
> +            script_->hasBaselineScript() &&

Nit: this check should always be |true|; we never destroy active baseline scripts.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/01bc7a4d74b5

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/01bc7a4d74b5