IonMonkey: avoid bailouts due to empty type sets at script entry

RESOLVED FIXED in mozilla26

Status

()

defect
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: bhackett, Unassigned)

Tracking

(Blocks 1 bug)

unspecified
mozilla26
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

Posted patch patchSplinter Review
Currently any script which is Ion compiled without its arguments/this types being monitored by a call after baseline compilation will bailout the first time it is called, as its argument and this type sets are empty.  In some cases we can do better than this:

- If the arguments in the script are not modified, their original values and potential types can be determined using the OSR frame.
- For asm.js code, the arguments are immediately converted to an int32 or double.  For long running functions, doing this conversion generically will not have noticeable overhead.

On one of the bullet.js asm.js demos we currently take 29 bailouts, fixing these (well, fixing the second one rather) reduces this to seven bailouts.
Attachment #786981 - Flags: review?(jdemooij)
Comment on attachment 786981 [details] [diff] [review]
patch

Review of attachment 786981 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +815,5 @@
>          return true;
>  
> +    // If we are doing OSR on a frame which initially executed in the
> +    // interpreter and didn't accumulate type information, try to use that OSR
> +    // frame to determine possible initial types for 'this' and parameters.

Very nice.

@@ +828,5 @@
>  
>      for (uint32_t i = 0; i < info().nargs(); i++) {
> +        types::StackTypeSet *argTypes = types::TypeScript::ArgTypes(script(), i);
> +        if (argTypes->empty() && baselineFrame_ &&
> +            script_->hasBaselineScript() &&

Nit: this check should always be |true|; we never destroy active baseline scripts.
Attachment #786981 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/01bc7a4d74b5
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Depends on: 930327
You need to log in before you can comment on or make changes to this bug.