Bug 1527148 part 1 - Fix an Ion polymorphic inlining issue. r=bhackett a=RyanVM
authorJan de Mooij <jdemooij@mozilla.com>
Fri, 01 Mar 2019 22:17:41 +0000
changeset 516296 5d767f7d3d488c96e6df5e927cc0349fc969adb9
parent 516295 37e058d76eca1d1510bfdd4274e2b81742db4b0b
child 516297 b72048157f1839b41ea407be0606a8f3cee83e47
push id1953
push userffxbld-merge
push dateMon, 11 Mar 2019 12:10:20 +0000
treeherdermozilla-release@9c35dcbaa899 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, RyanVM
bugs1527148
milestone66.0
Bug 1527148 part 1 - Fix an Ion polymorphic inlining issue. r=bhackett a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D21540
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -4333,16 +4333,26 @@ AbortReasonOr<Ok> IonBuilder::selectInli
           inlineable = false;
         }
       }
     } else {
       // Non-function targets are not supported by polymorphic inlining.
       inlineable = false;
     }
 
+    // Only use a group guard and inline the target if we will recompile when
+    // the target function gets a new group.
+    if (inlineable && targets[i].group) {
+      ObjectGroup* group = targets[i].group;
+      TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(group);
+      if (!key->hasStableClassAndProto(constraints())) {
+        inlineable = false;
+      }
+    }
+
     choiceSet.infallibleAppend(inlineable);
     if (inlineable) {
       *numInlineable += 1;
     }
   }
 
   // If optimization tracking is turned on and one of the inlineable targets
   // is a native, track the type info of the call. Most native inlinings