GenerationalGC: Baseline IC post barriers should check the value is in the nursery

RESOLVED FIXED in mozilla30

Status

()

defect
RESOLVED FIXED
6 years ago
7 months ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks 1 bug)

unspecified
mozilla30
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

A GGC build is at least 10% slower on Octane-TypeScript. We spend about 10% of the time in jit::PostWriteBarrier, compacting the store buffer over and over again.

Most of these store buffer entries are coming from Baseline ICs, because the barriers there only check whether the object is tenured and the value is an object. We should also check the value is in the nursery.

TypeScript spends more time in Baseline than most other benchmarks, because it has some huge functions and we are Ion-compiling a ton of code in the background.

Should be pretty easy to fix and should close at least half the gap with non-GGC builds.
Posted patch PatchSplinter Review
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8379728 - Flags: review?(terrence)
GGC build is green on Try: https://tbpl.mozilla.org/?tree=Try&rev=81deee4c30af

(I used a 32-bit GGC build locally and it also passes jit-tests.)
Comment on attachment 8379728 [details] [diff] [review]
Patch

Review of attachment 8379728 [details] [diff] [review]:
-----------------------------------------------------------------

Great find! It's also nice in general to bring this barrier closer in line with what Ion does. r=me
Attachment #8379728 - Flags: review?(terrence) → review+
https://hg.mozilla.org/mozilla-central/rev/ef89c710498d
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Blocks: 1507445
You need to log in before you can comment on or make changes to this bug.