Bug 1527148 part 1 - Fix an Ion polymorphic inlining issue. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Fri, 01 Mar 2019 22:17:41 +0000
changeset 520145 5e31168aa777bb9589a79f5bcfaf7f0efe9858f3
parent 520144 b78a82f30f4e002102d0925ddabbb800bf803c79
child 520146 7e2c495ba4ee1b918b04024ceb4ada1115fcd05e
push id10862
push userffxbld-merge
push dateMon, 11 Mar 2019 13:01:11 +0000
treeherdermozilla-beta@a2e7f5c935da [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1527148
milestone67.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1527148 part 1 - Fix an Ion polymorphic inlining issue. r=bhackett Differential Revision: https://phabricator.services.mozilla.com/D21540
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -4463,16 +4463,26 @@ AbortReasonOr<Ok> IonBuilder::selectInli
           inlineable = false;
         }
       }
     } else {
       // Non-function targets are not supported by polymorphic inlining.
       inlineable = false;
     }
 
+    // Only use a group guard and inline the target if we will recompile when
+    // the target function gets a new group.
+    if (inlineable && targets[i].group) {
+      ObjectGroup* group = targets[i].group;
+      TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(group);
+      if (!key->hasStableClassAndProto(constraints())) {
+        inlineable = false;
+      }
+    }
+
     choiceSet.infallibleAppend(inlineable);
     if (inlineable) {
       *numInlineable += 1;
     }
   }
 
   // If optimization tracking is turned on and one of the inlineable targets
   // is a native, track the type info of the call. Most native inlinings