Add a fixed-size property cache for megamorphic lookups
Categories
(Core :: JavaScript Engine: JIT, task, P3)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox99 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
(Blocks 1 open bug)
Details
Attachments
(8 files)
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details | |
|
(deleted),
text/x-phabricator-request
|
Details |
Megamorphic property lookups from JIT code are very common on modern JS workloads. We've seen GetNativeDataPropertyPure and similar functions show up in a lot of profiles.
We can optimize this with a per-thread fixed-size lookup cache based on the receiver object's shape + the property key. This works well in practice because JS code often accesses the same kind of objects repeatedly: the cache has a hit rate of > 80% on many websites. V8 has a similar cache, so this also helps us prevent certain perf cliffs in code optimized for Chrome.
Because this cache assumes things about prototype objects, we need to invalidate the cache when prototype objects are mutated in certain ways. This is where Watchtower comes in, it's now fairly easy for us to do that robustly.
This bug will add the cache but disabled by default.
|
Assignee | |
Comment 1•3 years ago
|
||
For the megamorphic cache we'll need to handle property mutation/removal. We can ignore
freeze/seal, but this adds the Watchtower machinery in case we need it later for other
optimizations.
Drive-by change: add AutoCheckShapeConsistency to NativeObject::freezeOrSealProperties.
|
|
Assignee | |
Comment 2•3 years ago
|
||
Depends on D137848
|
|
Assignee | |
Comment 3•3 years ago
|
||
Depends on D137849
|
|
Assignee | |
Comment 4•3 years ago
|
||
We got rid of almost all of the other JIT optimizations for typed objects. Supporting
them in HasNativeDataPropertyPure complicates later patches and it seems better for
these functions to be restricted to native objects (as implied by the name).
Depends on D137850
|
|
Assignee | |
Comment 5•3 years ago
|
||
Also use isInt instead of JSID_IS_INT while we're there.
Depends on D137851
|
|
Assignee | |
Comment 6•3 years ago
|
||
We can potentially reuse this pref for different Watchtower optimizations over time.
Because the megamorphic lookup path is so hot, we probably don't want to keep a pref
for that for too long, at least on non-Nightly/non-debug builds.
Depends on D137852
|
|
Assignee | |
Comment 7•3 years ago
|
||
Depends on D137853
|
|
Assignee | |
Comment 8•3 years ago
|
||
Depends on D137854
|
||
Updated•3 years ago
|
|
||
Comment 10•3 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/aeff3654959e
https://hg.mozilla.org/mozilla-central/rev/3bb6f9ea44f7
https://hg.mozilla.org/mozilla-central/rev/b57b87a024c0
https://hg.mozilla.org/mozilla-central/rev/f64a89bf9681
https://hg.mozilla.org/mozilla-central/rev/25fe67147f22
https://hg.mozilla.org/mozilla-central/rev/e292f8177315
https://hg.mozilla.org/mozilla-central/rev/917a7fc15044
https://hg.mozilla.org/mozilla-central/rev/250fa587c2b0
Description
•