Bug 1480524 - [Part 2] Remove Ion NewObject stub, and remove limitation on template object dynamic slots for fast path r=jandem
authorMatthew Gaudet <mgaudet@mozilla.com>
Tue, 07 Aug 2018 10:12:59 -0400
changeset 486686 ab47d3f47325f9c3a1575a406c4b0748e0eed333
parent 486685 2a09332be9ac7cc7c2b3bd224ad4be8bb408af96
child 486687 2e79db1588c29cf4767c92834e5e5ab1f250d07f
push id9719
push userffxbld-merge
push dateFri, 24 Aug 2018 17:49:46 +0000
treeherdermozilla-beta@719ec98fba77 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1480524
milestone63.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1480524 - [Part 2] Remove Ion NewObject stub, and remove limitation on template object dynamic slots for fast path r=jandem
js/public/TrackedOptimizationInfo.h
js/src/jit-test/tests/ion/recover-objects.js
js/src/jit/IonBuilder.cpp
js/src/jit/IonBuilder.h
--- a/js/public/TrackedOptimizationInfo.h
+++ b/js/public/TrackedOptimizationInfo.h
@@ -130,17 +130,16 @@ namespace JS {
     _(SetElemNonDenseNonTANotCached)                                    \
     _(NoSimdJitSupport)                                                 \
     _(SimdTypeNotOptimized)                                             \
     _(UnknownSimdProperty)                                              \
     _(NotModuleNamespace)                                               \
     _(UnknownProperty)                                                  \
     _(NoTemplateObject)                                                 \
     _(TemplateObjectIsUnboxedWithoutInlineElements)                     \
-    _(TemplateObjectIsPlainObjectWithDynamicSlots)                      \
     _(LengthTooBig)                                                     \
     _(SpeculationOnInputTypesFailed)                                    \
     _(RelationalCompare)                                                \
     _(OperandTypeNotBitwiseComparable)                                  \
     _(OperandMaybeEmulatesUndefined)                                    \
     _(LoosyUndefinedNullCompare)                                        \
     _(LoosyInt32BooleanCompare)                                         \
     _(CallsValueOf)                                                     \
--- a/js/src/jit-test/tests/ion/recover-objects.js
+++ b/js/src/jit-test/tests/ion/recover-objects.js
@@ -155,17 +155,17 @@ function dynamicSlots(i) {
         p31: i + 31, p32: i + 32, p33: i + 33, p34: i + 34, p35: i + 35, p36: i + 36, p37: i + 37, p38: i + 38, p39: i + 39, p40: i + 40,
         p41: i + 41, p42: i + 42, p43: i + 43, p44: i + 44, p45: i + 45, p46: i + 46, p47: i + 47, p48: i + 48, p49: i + 49, p50: i + 50
     };
     // Add a function call to capture a resumepoint at the end of the call or
     // inside the inlined block, such as the bailout does not rewind to the
     // beginning of the function.
     resumeHere(); bailout();
     assertEq(obj.p0 + obj.p10 + obj.p20 + obj.p30 + obj.p40, 5 * i + 100);
-    assertRecoveredOnBailout(obj, false);
+    assertRecoveredOnBailout(obj, true);
 }
 
 // Check that we can correctly recover allocations of new objects.
 function Point(x, y)
 {
     this.x = x;
     this.y = y;
 }
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6307,22 +6307,16 @@ IonBuilder::newObjectTryTemplateObject(b
     if (canTrackOptimization)
         trackOptimizationAttempt(TrackedStrategy::NewObject_TemplateObject);
     if (!templateObject) {
         if (canTrackOptimization)
             trackOptimizationOutcome(TrackedOutcome::NoTemplateObject);
         return Ok();
     }
 
-    if (templateObject->is<PlainObject>() && templateObject->as<PlainObject>().hasDynamicSlots()) {
-        if (canTrackOptimization)
-            trackOptimizationOutcome(TrackedOutcome::TemplateObjectIsPlainObjectWithDynamicSlots);
-        return Ok();
-    }
-
     // Emit fastpath.
 
     MNewObject::Mode mode;
     if (JSOp(*pc) == JSOP_NEWOBJECT || JSOp(*pc) == JSOP_NEWINIT)
         mode = MNewObject::ObjectLiteral;
     else
         mode = MNewObject::ObjectCreate;
 
@@ -6338,50 +6332,16 @@ IonBuilder::newObjectTryTemplateObject(b
 
     if (canTrackOptimization)
         trackOptimizationSuccess();
     *emitted = true;
     return Ok();
 }
 
 AbortReasonOr<Ok>
-IonBuilder::newObjectTrySharedStub(bool* emitted)
-{
-    MOZ_ASSERT(*emitted == false);
-
-    // TODO: Support tracking optimizations for inlining a call and regular
-    // optimization tracking at the same time. Currently just drop optimization
-    // tracking when that happens.
-    bool canTrackOptimization = !IsCallPC(pc);
-
-    // Try to emit a shared stub cache.
-
-    if (JitOptions.disableSharedStubs)
-        return Ok();
-
-    if (canTrackOptimization)
-        trackOptimizationAttempt(TrackedStrategy::NewObject_SharedCache);
-
-    MInstruction* stub = MNullarySharedStub::New(alloc());
-    current->add(stub);
-    current->push(stub);
-
-    MOZ_TRY(resumeAfter(stub));
-
-    MUnbox* unbox = MUnbox::New(alloc(), current->pop(), MIRType::Object, MUnbox::Infallible);
-    current->add(unbox);
-    current->push(unbox);
-
-    if (canTrackOptimization)
-        trackOptimizationSuccess();
-    *emitted = true;
-    return Ok();
-}
-
-AbortReasonOr<Ok>
 IonBuilder::newObjectTryVM(bool* emitted, JSObject* templateObject)
 {
     // Emit a VM call.
     MOZ_ASSERT(JSOp(*pc) == JSOP_NEWOBJECT || JSOp(*pc) == JSOP_NEWINIT);
 
     trackOptimizationAttempt(TrackedStrategy::NewObject_Call);
 
     gc::InitialHeap heap = gc::DefaultHeap;
@@ -6409,22 +6369,17 @@ IonBuilder::newObjectTryVM(bool* emitted
 AbortReasonOr<Ok>
 IonBuilder::jsop_newobject()
 {
     bool emitted = false;
     startTrackingOptimizations();
 
     JSObject* templateObject = inspector->getTemplateObject(pc);
 
-    if (!forceInlineCaches()) {
-        MOZ_TRY(newObjectTryTemplateObject(&emitted, templateObject));
-        if (emitted)
-            return Ok();
-    }
-    MOZ_TRY(newObjectTrySharedStub(&emitted));
+    MOZ_TRY(newObjectTryTemplateObject(&emitted, templateObject));
     if (emitted)
         return Ok();
 
     MOZ_TRY(newObjectTryVM(&emitted, templateObject));
     if (emitted)
         return Ok();
 
     MOZ_CRASH("newobject should have been emited");
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -337,17 +337,16 @@ class IonBuilder
                                           MDefinition* right);
 
     // jsop_newarray helpers.
     AbortReasonOr<Ok> newArrayTryTemplateObject(bool* emitted, JSObject* templateObject,
                                                 uint32_t length);
     AbortReasonOr<Ok> newArrayTryVM(bool* emitted, JSObject* templateObject, uint32_t length);
 
     // jsop_newobject helpers.
-    AbortReasonOr<Ok> newObjectTrySharedStub(bool* emitted);
     AbortReasonOr<Ok> newObjectTryTemplateObject(bool* emitted, JSObject* templateObject);
     AbortReasonOr<Ok> newObjectTryVM(bool* emitted, JSObject* templateObject);
 
     // jsop_in/jsop_hasown helpers.
     AbortReasonOr<Ok> inTryDense(bool* emitted, MDefinition* obj, MDefinition* id);
     AbortReasonOr<Ok> hasTryNotDefined(bool* emitted, MDefinition* obj, MDefinition* id, bool ownProperty);
     AbortReasonOr<Ok> hasTryDefiniteSlotOrUnboxed(bool* emitted, MDefinition* obj, MDefinition* id);