(This is a regression of TI compared to itself, not TI compared to m-c.) Attached is a simple prime-calculation benchmark. Running it with -m -j -p -n on JM, performance has decreased with the landing of bug 669969, changeset time (seconds) dd84f621ca25 2.383 993716952d86 1.379 so that changeset decreased performance by 73%. That still leaves TI slightly faster than m-c (2.425 seconds), but previously it was massively faster.

One of the main things bug 669969 did was generate type information lazily for objects with singleton types (builtin classes, natives, globals, ...). When type information for a property was generated while that property was still undefined, the property was treated as possibly-undefined everywhere it is accessed, even if it becomes defined before code depending on it is compiled. This was happening to a global 'ga' assigned Math.sqrt, and the possibly-undefined value mucked with our generating inline code for calls to ga(), which dominate the profile. The handling for such undefined globals was a pretty gray area before bug 669969, and special cased just these globals. This was probably broken in subtle ways, and the fix removes the special casing and clarifies how a property on a singleton which is undefined when lazily generated does not need dynamic type checks if it is defined by the time code using it is compiled. I get these times: js -m -n: 1080 js -m -j -p: 3451 d8: 3479 http://hg.mozilla.org/projects/jaegermonkey/rev/d60ffe67a13f

Followup fix for a bug exposed by this patch. On v8-deltablue this patch added a recompile triggered while compiling a function called from an inline frame, and we didn't expand the inline frame correctly, leading to a crash. The fix reorders things so that state is correct when the recompilation is triggered. This also removes the triggering recompilation, which shouldn't have been happening. http://hg.mozilla.org/projects/jaegermonkey/rev/9a145389d570