Closed Bug 486213 Opened 16 years ago Closed 13 years ago

TM: unbox_jsval does not handle integers

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED WONTFIX

People

(Reporter: dvander, Unassigned)

References

Details

Attachments

(1 file, 1 obsolete file)

Brendan and I were debugging a patch with an inner-tree abort for this reason:

checking nested types 0x318a30: callee0=O/O this0=O/O vars0=I/I vars1=I/I vars2=I/I vars3=I/I vars4=D/I vars5=I/I vars6=O/O vars7=I/I vars8=I/I vars9=I/I vars10=I/I  (demotes 4)
adjusting will fail, vars7, slot 9
...etc

It turns out these failed slots are integers, for example jsval(1), and the tracker has a LIR_fcall(js_UnboxDouble).  It seems that unbox_jsval() doesn't specialize for integer GETELEM results like these.  The LIR filter changes to an UnboxInt32 when a DoubleToInt32 is present, but there is none here.
Improvement. Should be done as part of the speculative demotion patch.
David, this is the bug. The problem is really unbox_jsval, which is used by getprop/getelem and native calls. It should speculatively unpack as integer if the oracle doesn't say otherwise.
Attached patch perf loss (obsolete) (deleted) — Splinter Review
This is a quick mockup to see perf gains, so I'm not sure if it's correct. Passes trace-tests at least.

3d-raytrace got 30ms slower, 3d-cube got 5ms slower. both build more traces and get more exits.

fannkuch got 15ms faster though.
I think the key is better oracle feedback here. I will look at what extra side exits we get here.
Attached patch refresh (deleted) — Splinter Review
perma-paste: http://pastebin.mozilla.org/690129
Attachment #391810 - Attachment is obsolete: true
According to Julian's float-ops-that-are-useless profiler, this basically eliminated the millions of useless float ops on v8-richards. It's about a 70ms perf win on the SS version of the benchmark, and ~80 "perf points" or whatever the v8 harness measures.

So it seems we want to figure out a way to make this work on less friendlier cases.
Obsolete with the removal of tracejit.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: