Bug 1384042 - Don't Ion-inline functions when the call has an empty type barrier. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 26 Jul 2017 16:03:12 +0200
changeset 420011 1455629cb663e28c373d3808dd605e749d03131b
parent 420010 cce9237283c936c62de6765a4aef690f848abc48
child 420012 5955de904e6a751fe9522b6ed0007755fadd667f
push id7566
push usermtabara@mozilla.com
push dateWed, 02 Aug 2017 08:25:16 +0000
treeherdermozilla-beta@86913f512c3c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1384042
milestone56.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1384042 - Don't Ion-inline functions when the call has an empty type barrier. r=bhackett
js/public/TrackedOptimizationInfo.h
js/src/jit/IonBuilder.cpp
--- a/js/public/TrackedOptimizationInfo.h
+++ b/js/public/TrackedOptimizationInfo.h
@@ -206,16 +206,17 @@ namespace JS {
     _(CantInlineNotHot)                                                 \
     _(CantInlineNotInDispatch)                                          \
     _(CantInlineUnreachable)                                            \
     _(CantInlineNativeBadForm)                                          \
     _(CantInlineNativeBadType)                                          \
     _(CantInlineNativeNoTemplateObj)                                    \
     _(CantInlineBound)                                                  \
     _(CantInlineNativeNoSpecialization)                                 \
+    _(CantInlineNoObservedTypes)                                        \
     _(HasCommonInliningPath)                                            \
                                                                         \
     _(GenericSuccess)                                                   \
     _(Inlined)                                                          \
     _(DOM)                                                              \
     _(Monomorphic)                                                      \
     _(Polymorphic)
 
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -415,21 +415,32 @@ IonBuilder::canInlineTarget(JSFunction* 
         }
 
         for (size_t i = 0; i < callInfo.argc(); i++) {
             if (callInfo.getArg(i)->emptyResultTypeSet()) {
                 trackOptimizationOutcome(TrackedOutcome::CantInlineUnreachable);
                 return DontInline(nullptr, "Empty TypeSet for argument");
             }
         }
+
+        // If we're going to add a TypeBarrier that always fails, it's not
+        // worth inlining this call as the script will be invalidated
+        // immediately.
+        if ((CodeSpec[*pc].format & JOF_TYPESET) &&
+            !BytecodeIsPopped(pc) &&
+            bytecodeTypes(pc)->empty())
+        {
+            trackOptimizationOutcome(TrackedOutcome::CantInlineNoObservedTypes);
+            return DontInline(nullptr, "Empty type barrier");
+        }
     }
 
     // Allow constructing lazy scripts when performing the definite properties
     // analysis, as baseline has not been used to warm the caller up yet.
-    if (target->isInterpreted() && info().analysisMode() == Analysis_DefiniteProperties) {
+    if (info().analysisMode() == Analysis_DefiniteProperties) {
         RootedFunction fun(analysisContext, target);
         RootedScript script(analysisContext, JSFunction::getOrCreateScript(analysisContext, fun));
         if (!script)
             return InliningDecision_Error;
 
         if (!script->hasBaselineScript() && script->canBaselineCompile()) {
             MethodStatus status = BaselineCompile(analysisContext, script);
             if (status == Method_Error)