975125 - GenerationalGC: Baseline IC post barriers should check the value is in the nursery

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

A GGC build is at least 10% slower on Octane-TypeScript. We spend about 10% of the time in jit::PostWriteBarrier, compacting the store buffer over and over again.

Most of these store buffer entries are coming from Baseline ICs, because the barriers there only check whether the object is tenured and the value is an object. We should also check the value is in the nursery.

TypeScript spends more time in Baseline than most other benchmarks, because it has some huge functions and we are Ion-compiling a ton of code in the background.

Should be pretty easy to fix and should close at least half the gap with non-GGC builds.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 2

[Jan de Mooij [:jandem]]

GGC build is green on Try: https://tbpl.mozilla.org/?tree=Try&rev=81deee4c30af

(I used a 32-bit GGC build locally and it also passes jit-tests.)

Comment 3

[Terrence Cole [:terrence]]

Comment on attachment 8379728 [details] [diff] [review]
Patch

Review of attachment 8379728 [details] [diff] [review]:
-----------------------------------------------------------------

Great find! It's also nice in general to bring this barrier closer in line with what Ion does. r=me

Comment 4

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ef89c710498d

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/ef89c710498d