Warp: support specialized calls and inlining of lambda clones
Categories
(Core :: JavaScript Engine: JIT, task, P2)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox82 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
(Blocks 1 open bug)
Details
Attachments
(6 files, 1 obsolete file)
The GuardSpecificFunction instruction doesn't work well when there are function clones. I have a patch that adds GuardFunctionScript to guard on the script instead of the function.
|
Assignee | |
Comment 1•4 years ago
|
||
We want GuardFunctionScript to compare the JSFunction field without any flag checks
but that only works if native functions are guaranteed to not have an identical value
stored there.
|
|
Assignee | |
Comment 2•4 years ago
|
||
Depends on D89136
|
|
Assignee | |
Comment 3•4 years ago
|
||
Depends on D89137
|
|
Assignee | |
Comment 4•4 years ago
|
||
Depends on D89138
|
|
Assignee | |
Comment 5•4 years ago
|
||
Because guarding on the Class and the BaseScript is quite a bit slower than
GuardSpecificFunction, try the function guard if we're attaching the first stub.
Make trial inlining ignore the unused stub so we can still inline. This is similar
to the heuristics WarpOracle uses but is still a bit more conservative.
Depends on D89139
|
|
Assignee | |
Comment 6•4 years ago
|
||
This matches what we do for the main script in IonCompile and could prevent problems
with nursery-allocated functions.
Depends on D89140
|
|
Assignee | |
Comment 7•4 years ago
|
||
This fixes an issue where we could inline twice at the same pc, confusing the
bailout code.
|
||
Updated•4 years ago
|
|
||
Comment 9•4 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/d0870e9a8b74
https://hg.mozilla.org/mozilla-central/rev/166f59b3f3b0
https://hg.mozilla.org/mozilla-central/rev/060f7da5ba7e
https://hg.mozilla.org/mozilla-central/rev/02d37579be32
https://hg.mozilla.org/mozilla-central/rev/a6f52a53ea98
https://hg.mozilla.org/mozilla-central/rev/2d9a913e6f1f
Description
•