Closed Bug 902508 Opened 11 years ago Closed 11 years ago

IonMonkey: avoid bailouts due to empty type sets at script entry

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla26

People

(Reporter: bhackett1024, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Attached patch patch (deleted) — Splinter Review
Currently any script which is Ion compiled without its arguments/this types being monitored by a call after baseline compilation will bailout the first time it is called, as its argument and this type sets are empty. In some cases we can do better than this: - If the arguments in the script are not modified, their original values and potential types can be determined using the OSR frame. - For asm.js code, the arguments are immediately converted to an int32 or double. For long running functions, doing this conversion generically will not have noticeable overhead. On one of the bullet.js asm.js demos we currently take 29 bailouts, fixing these (well, fixing the second one rather) reduces this to seven bailouts.
Attachment #786981 - Flags: review?(jdemooij)
Comment on attachment 786981 [details] [diff] [review] patch Review of attachment 786981 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/IonBuilder.cpp @@ +815,5 @@ > return true; > > + // If we are doing OSR on a frame which initially executed in the > + // interpreter and didn't accumulate type information, try to use that OSR > + // frame to determine possible initial types for 'this' and parameters. Very nice. @@ +828,5 @@ > > for (uint32_t i = 0; i < info().nargs(); i++) { > + types::StackTypeSet *argTypes = types::TypeScript::ArgTypes(script(), i); > + if (argTypes->empty() && baselineFrame_ && > + script_->hasBaselineScript() && Nit: this check should always be |true|; we never destroy active baseline scripts.
Attachment #786981 - Flags: review?(jdemooij) → review+
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Depends on: 950452
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: