986155 - MPostWriteBarrier can inhibit some optimizations

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

See the micro-benchmark below. We're not able to hoist the element access due to MPostWriteBarrier not overriding getAliasSet.

Note that this is not GGC-specific as MPostWriteBarrier is also added in non-GGC builds.

function f() {
    var arr = [1, 2, 3];
    var obj = {x: arr};
    for (var i=0; i<100000000; i++) {
	var z = arr[1];
	obj.x = arr;
    }
}
var t = new Date;
f();
print(new Date - t);

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

MPostWriteBarrier is not movable, and doesn't override congruentTo, so this should work.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b980a3d22ced

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b980a3d22ced