This is now straightforward to do by snooping Baseline's ICs.

Adds two new instructions: GetPropertyPolymorphic and SetPropertyPolymorphic. These instructions use a list of shapes observed by the baseline IC. If the incoming object's shape matches one of these, we inline the property access, else we bailout. This wins at least 10% on Octane-deltablue (a few hundred points on the full Octane benchmark).

This patch is another approach I made on friday, it build a stackTypeSet based on the content of the baseline IC and does not require adding a new instruction. I think this is a better approach than adding new instructions, and we should improve our usage of typeset to benefit both TI based info and baseline based info. Sorry for highjacking this bug. This patch also provide 10% improvement on deltablue and our score on Bug 835306 benchmark.

(In reply to Nicolas B. Pierron [:nbp] from comment #2) > I think this is a better approach than adding new instructions, and we > should improve our usage of typeset to benefit both TI based info and > baseline based info. I think these patches fix different issues. For instance my patch also inlines polymorphic GETPROP (when there is a small number of shapes), there's no other way to do this. Also note that inlining SETPROP based on the TypeObject is only possible if the property is in a definite slot. We need the shape to inline non-definite properties, or if there are 2 TypeObject's with a different definite slot for a property.

Comment on attachment 743083 [details] [diff] [review] Patch Review of attachment 743083 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/IonBuilder.cpp @@ +7566,5 @@ > fixed->setNeedsBarrier(); > return resumeAfter(fixed); > } > > + Vector<Shape *> shapes(cx); You need a root vector of shapes, as … @@ +7601,5 @@ > + current->push(value); > + > + for (size_t i = 0; i < shapes.length(); i++) { > + RawShape objShape = shapes[i]; > + RawShape shape = objShape->search(cx, id); … this function call might trigger a GC.

Actually, we can never trigger GCs anywhere inside AutoEnterCompilation, which includes IonBuilder and all other compilation activity. Additionally, Shape::search can no longer trigger a GC (it can do a linear search if it tries to tableify and would otherwise require a GC).

https://hg.mozilla.org/integration/mozilla-inbound/rev/0d3a0ab31adf Try: https://tbpl.mozilla.org/?tree=Try&rev=59ce0a7bca4a Nicolas, would you mind filing a new bug for that patch? Thanks!

Comment on attachment 743194 [details] [diff] [review] Take baseline typeset when TI typeset is unknown Review of attachment 743194 [details] [diff] [review]: ----------------------------------------------------------------- Resetting review flag per comment 6.