933289 - Optimize assignments to non-scalar properties of typed objects

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Niko Matsakis [:nmatsakis]]

Currently, if you have typed objects like:

    var PointType = new StructType(...);
    var LineType = new StructType({from: PointType, to: PointType});

and then you write:

    line.from = somePoint;

or

    line.from = {x: 22, y: 44};

The result is rather inefficient. Fully optimizing this can be done in two steps. Step one is this bug, which would be to have IonBuilder generate a call to the self-hosted helper ConvertAndCopyTo for such assignments. Hence line.from = {x: 22, y: 44} would be converted
to something roughly like:

    ConvertAndCopyTo(line, offsetof(Line, "from"), Point, {x: 22, y: 44})

This would be further optimized, but this further optimization is the subject of another bug.

Comment 1

[Niko Matsakis [:nmatsakis]]

Attachment: Bug933289.diff

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 826067 [details] [diff] [review]
Bug933289.diff

Review of attachment 826067 [details] [diff] [review]:
-----------------------------------------------------------------

Looks fine, just one issue that blocks off-thread IonBuilder.

::: js/src/jit/IonBuilder.cpp
@@ +9803,5 @@
> +    Rooted<GlobalObject *> global(cx, cx->global());
> +    RootedPropertyName nameRoot(cx, cx->names().ConvertAndCopyTo);
> +    RootedValue convertAndCopyToValue(cx, UndefinedValue());
> +    if (!global->tryGetIntrinsicValueNoClone(cx, nameRoot, &convertAndCopyToValue))
> +        return false;

Using cx in IonBuilder still works but Brian is actively eliminating uses of it. I don't think we need one here, see also bug 934526 where he changed IonBuilder::jsop_intrinsic to not require a cx, can you use that here? You also don't need the RootedFunction/MutableHandleFunction then I think (IonBuilder won't GC).

Comment 3

[Lars T Hansen [:lth]]

This will require some rebasing but we should try to land it.

Comment 4

[André Bargull [:anba]]

Another old bug related to JS typed objects -> No longer valid.