Make MaybeInIteration not depend on TI
Categories
(Core :: JavaScript Engine, task, P2)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox81 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
|
(deleted),
text/x-phabricator-request
|
Details |
We currently check OBJECT_FLAG_ITERATED in MaybeInIteration, it lets us optimize various Array builtins without worrying about deleted property suppression. Similar to the IsPackedArray changes in bug 1651645, we should add an ObjectElements flag for this that we can use instead. It's more precise, gets rid of a potential perf-cliff for Warp and it will make it possible to inline Array.prototype.pop/shift in CacheIR and Warp.
|
Assignee | |
Comment 1•4 years ago
|
||
With this patch we only use the ObjectGroup flag for inlining pop/shift in Ion.
The Array builtins now use a new MAYBE_IN_ITERATION flag on ObjectElements. This
could potentially also be used for optimizing pop/shift in CacheIR and Warp.
Because the new flag is per-object, it's more precise than the ObjectGroup flag.
It also ensures WarpBuilder (which disables TI) doesn't have perf cliffs for these
Array builtins.
AssertDenseElementsNotIterated was added to check correctness of the flag in
debug builds.
|
||
Comment 3•4 years ago
|
||
| bugherder | ||
Description
•