Closed
Bug 932800
Opened 11 years ago
Closed 11 years ago
IonMonkey always bails for string[string] GETELEM
Categories
(Core :: JavaScript Engine: JIT, defect)
Core
JavaScript Engine: JIT
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: jandem, Assigned: jandem)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
(deleted),
patch
|
h4writer
:
review+
|
Details | Diff | Splinter Review |
The jQuery event benchmark in bug 928318 has a "trigger" function that's bailing out from Ion to Baseline every time it's called: event = event[ jQuery.expando ] ? event : new jQuery.Event( type, typeof event === "object" && event ); The problem is that |event| is a string, and we try to convert jQuery.expando (also a string) to int32, but this will always bail because string to int32 is complicated. Instead, we should only try to optimize string[x] if x is int32.
Assignee | ||
Comment 1•11 years ago
|
||
This also fixes another issue that Nicolas fixed in bug 799818 but apparently got lost: don't optimize string[index] if the index has been out-of-bounds before to avoid frequent bailouts.
Comment 2•11 years ago
|
||
Was actually just looking into PDF.js and saw the same issue. This improves pdf.js with 4% (didn't test elaborate, so wait for awfy result.)
Blocks: 807162
Comment 3•11 years ago
|
||
Comment on attachment 824675 [details] [diff] [review] Patch Review of attachment 824675 [details] [diff] [review]: ----------------------------------------------------------------- Looks fine. The test for Undefined was unexpected, but does the job. Isn't Out-of-Bound access something that the baseline keeps track of? I think we only do this for writes now. But why not for reads?
Attachment #824675 -
Flags: review?(hv1989) → review+
Assignee | ||
Comment 4•11 years ago
|
||
(In reply to Hannes Verschore [:h4writer] from comment #3) > Looks fine. The test for Undefined was unexpected, but does the job. See also jsop_getelem_typed for instance. > Isn't > Out-of-Bound access something that the baseline keeps track of? I think we > only do this for writes now. But why not for reads? An out-of-bounds read will produce |undefined| (ignoring indexed properties on the prototype) so there's no need to track this separately.
Assignee | ||
Comment 5•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/29b8e502a296 (Try: https://tbpl.mozilla.org/?tree=Try&rev=f43d7e939533)
Comment 6•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/29b8e502a296
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
You need to log in
before you can comment on or make changes to this bug.
Description
•