The plan is to go ahead with this in the next cycle (Firefox 85), after Warp hits the release channel.

This will unblock a lot of cleanup and optimization work.

Fortunately most of the tests that used --no-warp now work with Warp. Likely
because we now bailout more on the first execution, similar to the Ion behavior.

A bit counterintuitive because we're keeping Warp and not Ion, but it's easiest
to make this change and later potentially rename the Ion prefs to Warp prefs.

Depends on D96987

Depends on D96988

15 files changed, 26 insertions(+), 21287 deletions(-)

This also marks some methods that are defined in InlineScriptTree-inl.h as inline
to fix a linker error.

The patch stack uses TODO(no-TI) to mark places that need follow-up cleanup.

Depends on D96989

This also removes resultTypeSet_ from MIR instructions.

Depends on D96990

GetAliasedVar and GetImport are no longer marked as JOF_IC and JOF_TYPESET.

Depends on D96991

Depends on D96992

The previous patch removed the TI code from Instance::callImport so we no longer
need the bidirectional link. JS functions always have a JIT entry point.

Depends on D96993

These patches remove about 28,000 lines of code so far. Mostly on the JIT side. There's still a ton of TI code to remove.

Depends on D96994

https://hg.mozilla.org/mozilla-central/rev/03b35d575361
https://hg.mozilla.org/mozilla-central/rev/d26e4dd982da
https://hg.mozilla.org/mozilla-central/rev/2f491d873cdf
https://hg.mozilla.org/mozilla-central/rev/a6d6dfbdcc2b
https://hg.mozilla.org/mozilla-central/rev/64dd0e96866f
https://hg.mozilla.org/mozilla-central/rev/7a6413cb45c4
https://hg.mozilla.org/mozilla-central/rev/4ec475e94461
https://hg.mozilla.org/mozilla-central/rev/cb856cdf7a0c

Depends on D97134

Depends on D97290

ObjectGroup::finalize is now an empty function so define it in the header.

The objectGroupsMallocHeap memory reporter can also be removed.

Depends on D97291

Because this removes a word from ObjectGroup, we have to change ZeroBits in
TenureCountCache::hash from 4 to 3 (for 64-bit platforms) or we get assertion
failures. ObjectGroup is now 40 bytes instead of 48 bytes so bit 4 can be non-zero.

Depends on D97292

The MacroAssembler had some delayed-read-barrier code for this that we no longer
need.

This leaves some empty shells in the TI code that we can sweep up in later patches.

Depends on D97293

Groups are now determined by proto and class so we no longer need to try to
combine them based on property types.

Depends on D97294

Depends on D97295

Depends on D97296

Depends on D97297

Without TI all groups have unknown properties and aren't using pre-tenuring, so
remove code based on that.

Depends on D97298

At this point ObjectGroup::sweep is a no-op, so remove AutoSweepObjectGroup and
ObjectGroup's generation flag.

Depends on D97299

Depends on D97300

Parts 9-21 have a combined diffstat of:

80 files changed, 341 insertions(+), 8005 deletions(-)

So we're at 35,000+ deleted lines of code.

At this point the core TI code is mostly gone, but there's still a lot of cleanup left around JitScript sweeping, ObjectGroup/singletons. Also some JSOps and MIR instructions are no longer needed...

Now that we have just one addendum kind, we don't need the abstraction anymore.

Depends on D97301

Also remove now-unused removeDefaultNewGroup and replaceDefaultNewGroup.

Depends on D97435

Depends on D97436

Depends on D97437

Depends on D97438

Depends on D97439

Depends on D97440

Depends on D97441

Depends on D97442

https://hg.mozilla.org/mozilla-central/rev/490f4f157ea65c29d96cb42e486dabb21d1d7c0e
https://hg.mozilla.org/mozilla-central/rev/9298d2de2813614c64533c57c2703df2a9ee4584
https://hg.mozilla.org/mozilla-central/rev/dbcc16d84227761523600aaefe38c18d2fdbb7e4
https://hg.mozilla.org/mozilla-central/rev/678cf10d9be337f69ae3b18c2d8e363239307527
https://hg.mozilla.org/mozilla-central/rev/d114b0ebe5f01fd169edf6483f260703a8179a15
https://hg.mozilla.org/mozilla-central/rev/7e6e7e3e5fed2179362d1c9ef94f1b59d70bffc5
https://hg.mozilla.org/mozilla-central/rev/9a53df9a977e1ed4abc60d317c0b1bae85aaa0f4
https://hg.mozilla.org/mozilla-central/rev/aa3d200b6f98f4013cc23c1c13bc1b9504c96e5f
https://hg.mozilla.org/mozilla-central/rev/d6cdc2a48fa7a24765684fe82771632cc6f59b79
https://hg.mozilla.org/mozilla-central/rev/66c92d861375bcf2e5d21b7e406b0fc742c0e689
https://hg.mozilla.org/mozilla-central/rev/fc68cf76fcfc5ff9a54f2339daf578414470191f
https://hg.mozilla.org/mozilla-central/rev/21a1840ffa4b55377d80b79c49ed17f36432a1a3
https://hg.mozilla.org/mozilla-central/rev/38d83f497e6bdcaa0a548aa804cb30416f811a12

This also gets rid of LStart and the unused entrySnapshot_ field.

Depends on D97576

Depends on D97577

At this point JitScript::sweepTypes is only used to sweep the inlinedCompilations
Vector, a list of Ion/Warp compilations that inlined the script. This patch replaces
that with a HashMap per JitZone so that we can then remove the type sweeping mechanism
in the next patch.

This also moves the TI invalidation code into jit/. This can be cleaned up more later.

Depends on D97578

Depends on D97579

Warp doesn't store nursery pointers in MIR instructions so we can remove some
code to support that.

Depends on D97580

https://hg.mozilla.org/mozilla-central/rev/3d4a6e960e75
https://hg.mozilla.org/mozilla-central/rev/11103564a384
https://hg.mozilla.org/mozilla-central/rev/8a4458c03edf
https://hg.mozilla.org/mozilla-central/rev/3a3723ac0152
https://hg.mozilla.org/mozilla-central/rev/fd704328f3e4
https://hg.mozilla.org/mozilla-central/rev/7aed8af44e9c
https://hg.mozilla.org/mozilla-central/rev/5c55c464dcfc
https://hg.mozilla.org/mozilla-central/rev/22c752fc5172
https://hg.mozilla.org/mozilla-central/rev/521391ead6f0

• Move DOMObjectKind to MIR.h
• Move ObjectGroupFlags to ObjectGroup.h. This can be cleaned up more later.
• Remove now-unnecessary assertion in BaselineFrame.h so we don't need to include JitOptions.h

Warp uses a different implementation shared with CacheIR. It always returns a Value
so remove LArrayPopShiftT and rename LArrayPopShiftV to LArrayPopShift.

Depends on D97764

https://hg.mozilla.org/mozilla-central/rev/136f05c1bbc4
https://hg.mozilla.org/mozilla-central/rev/c876a180dd57
https://hg.mozilla.org/mozilla-central/rev/fa9fd7ddf903
https://hg.mozilla.org/mozilla-central/rev/b651b7cf9447
https://hg.mozilla.org/mozilla-central/rev/94ca532df695
https://hg.mozilla.org/mozilla-central/rev/7e5bcf9488dd

Depends on D98143

Depends on D98144

There's one caller left.

Depends on D98145

Depends on D98146

Depends on D98147

Depends on D98148

The constructors that take a zone instead of context are no longer used.

Depends on D98149

The TypeInference-inl.h include in ObjectOperations-inl.h had to be removed to
break an include cycle. Unfortunately that was a load bearing include (the
TypeInference files pull in a lot of headers) so this adds various missing includes.

Depends on D98150

Replace with AutoSuppressGC, except in JSObject::makeLazyGroup where it's
not needed. It's not very obvious whether GC-suppression is needed in the
ObjectGroup code but for now leave it to be safe.

It's also not very clear where AutoSuppressAllocationMetadataBuilder is needed.
Leaving it out in most places seems to be fine. It's a debugger-only feature so
missing one shouldn't be too bad.

Depends on D98151

Depends on D98152

https://hg.mozilla.org/mozilla-central/rev/3f962e400b39
https://hg.mozilla.org/mozilla-central/rev/31c588b8277d

There's no need to change the group anymore. Later patches will make more changes
in this area.

Depends on D98322

These do exactly the same thing without TI.

Depends on D98323

NewDenseFullyAllocatedArray now does the same thing. The group was only used to
get the proto so it shouldn't be slower either.

Pass nullptr for proto to use Array.prototype as proto.

Delete the IonBuilder-specific template object code in CacheIR.cpp

Depends on D98324

Depends on D98325

Depends on D98326

Depends on D98327

Depends on D98328

Depends on D98329

Depends on D98330

Depends on D98331

Do some manual inlining for the NewArray_Fallback group, so that we can also
remove the ObjectGroup::defaultNewGroup overload that takes a JSProtoKey.

Simplify NewObjectOperation by deleting the group-related code.

Depends on D98332

A TI optimization to ensure there were no int32 values in certain double arrays.

Depends on D98333

Depends on D98334

Note that the SetAliasedVar and InitAliasedLexical code in jit::SetProperty is
dead since bug 1522051. These ops are now always inlined without ICs or VM calls.

Depends on D98335

COW elements are harder to implement efficiently without TI and were always pretty
complicated.

This also lets us remove the freeLaterList in JSFreeOp and the allowWrite_ flag in
HeapSlotArray.

Depends on D98336

Depends on D98337

https://hg.mozilla.org/mozilla-central/rev/14c1c7511765
https://hg.mozilla.org/mozilla-central/rev/5f7017f04d91
https://hg.mozilla.org/mozilla-central/rev/fd4b722e7239
https://hg.mozilla.org/mozilla-central/rev/3b38a02992e6
https://hg.mozilla.org/mozilla-central/rev/3022fe71dfb0
https://hg.mozilla.org/mozilla-central/rev/767b3496feae
https://hg.mozilla.org/mozilla-central/rev/a156856e89df
https://hg.mozilla.org/mozilla-central/rev/361a437dd1db
https://hg.mozilla.org/mozilla-central/rev/d27b03f6a30e
https://hg.mozilla.org/mozilla-central/rev/a5d27c1f1a79
https://hg.mozilla.org/mozilla-central/rev/edb1bb069772

We no longer need this API to create singleton objects. It was used to prevent
polluting type information.

Goal of these patches is to get to the point where only the global object is a
singleton. The global object is more tricky due to splicePrototype, but after
fixing that we can then remove singleton groups completely.

Depends on D98499

Depends on D98500

Depends on D98501

Depends on D98502

There are no singleton functions at this point, so CanReuseFunctionForClone
always returned false.

This means we can also remove SetPrototypeForClonedFunction, the HasBeenCloned
flag, and clearInferredName.

Rename CloneFunctionObjectIfNotSingleton to CloneFunctionObject because it always
clones now.

Depends on D98503

CanReuseScriptForClone returned false for singleton functions, but these are gone now.

Depends on D98504

Depends on D98505

To save memory, singleton objects started out with a lazy group. The actual (unique)
group was created lazily by JSObject::getGroup. Now that only global objects are
singletons (and groups store no property type information) we can remove this.

• In JSObject::setSingleton assert the object is a global object.
• Create the non-lazy singleton group directly in JSObject::setSingleton.
• Remove the lazyTable from ObjectGroupRealm now that all groups are non-lazy.
• Merge JSObject::groupRaw and JSObject::group into JSObject::group.

After fixing the prototype splicing code for the global object we can remove singletons
completely.

Depends on D98506

Depends on D98507

https://hg.mozilla.org/mozilla-central/rev/45a4af9d1ae1
https://hg.mozilla.org/mozilla-central/rev/ba4fd183d46b
https://hg.mozilla.org/mozilla-central/rev/cddfd7d73037
https://hg.mozilla.org/mozilla-central/rev/7790c66276d5
https://hg.mozilla.org/mozilla-central/rev/7299f2bc562a
https://hg.mozilla.org/mozilla-central/rev/71ff3283acec
https://hg.mozilla.org/mozilla-central/rev/562027bf7f82
https://hg.mozilla.org/mozilla-central/rev/a53ca1c2e350
https://hg.mozilla.org/mozilla-central/rev/b7de2bdc92ee
https://hg.mozilla.org/mozilla-central/rev/d106ad322efc
https://hg.mozilla.org/mozilla-central/rev/29d82cbb70c0
https://hg.mozilla.org/mozilla-central/rev/162b97e5fa7f
https://hg.mozilla.org/mozilla-central/rev/1d96d8c000f1
https://hg.mozilla.org/mozilla-central/rev/96be391e2370
https://hg.mozilla.org/mozilla-central/rev/8d0bce86dcda
https://hg.mozilla.org/mozilla-central/rev/5c49647b616b
https://hg.mozilla.org/mozilla-central/rev/4fc932c5974e

Now that all callers are in ObjectGroup.cpp we can make this private to that file.

Also remove the realm argument, all callers now passed cx->realm() so use that directly.

Depends on D98581

Depends on D98582

Depends on D98583

At this point it's equivalent to JSOp::NewObject.

Depends on D98584

Once upon a time GetElem and CallElem had different semantics, for example for the
non-standard noSuchMethod extension. IonBuilder/TI then relied on this for some
heuristics.

Depends on D98585

Depends on D98586

JSOp::Length was an alias for JSOp::GetProp "length". The two places that checked
for JSOp::Length can just compare the atom instead. This simplifies the frontend a bit.

Note that this doesn't affect bytecode size: JSOp::Length also included the "length" atom.

Depends on D98587

This was a hint for IonBuilder to prevent loop restarts. Although this still lets
us do an infallible unbox in Warp, there's not much of a perf improvement on a for-in
micro-benchmark so it's probably fine to remove this now.

Depends on D98588

https://hg.mozilla.org/mozilla-central/rev/36e6de3161a0
https://hg.mozilla.org/mozilla-central/rev/5068eea4c7e9
https://hg.mozilla.org/mozilla-central/rev/5cd837398fb5
https://hg.mozilla.org/mozilla-central/rev/4b4f4f9e09e3
https://hg.mozilla.org/mozilla-central/rev/7653eac7a4a5
https://hg.mozilla.org/mozilla-central/rev/75a4e21372bf
https://hg.mozilla.org/mozilla-central/rev/76e6a7631a63
https://hg.mozilla.org/mozilla-central/rev/9539b156ac4f
https://hg.mozilla.org/mozilla-central/rev/4fb9feabc15a
https://hg.mozilla.org/mozilla-central/rev/c7ad1bc20c8a

https://hg.mozilla.org/mozilla-central/rev/5e446294f555
https://hg.mozilla.org/mozilla-central/rev/092e052d6a89
https://hg.mozilla.org/mozilla-central/rev/6385df444ca2
https://hg.mozilla.org/mozilla-central/rev/d86afd2049ae
https://hg.mozilla.org/mozilla-central/rev/46de1e58eefd
https://hg.mozilla.org/mozilla-central/rev/2be103c43560
https://hg.mozilla.org/mozilla-central/rev/0163808b985e
https://hg.mozilla.org/mozilla-central/rev/dd69e5f3c4f9
https://hg.mozilla.org/mozilla-central/rev/30953134ae14

We no longer do argument type checks.

ICCacheIR_Regular should probably be renamed in later patches.

Depends on D98916

The pre-CacheIR IC infrastructure is no longer used since the type monitor/update stubs
were removed.

Depends on D98917

Also turn the availableGeneralRegs method into a stand-alone BaselineICAvailableGeneralRegs
function.

Removing the SharedICRegisters.h include from BaselineIC.h required adding some missing #includes.

Depends on D98918

Backed out 4 changesets (bug 1673553) for Build bustage in worker/checkouts/gecko/config/rules.mk. CLOSED TREE

Log:
https://treeherder.mozilla.org/logviewer?job_id=323912817&repo=autoland&lineNumber=23156

Push with failures:
https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&selectedTaskRun=FO_PDLOfSm6nbylZIVBFmg.0&revision=b072ba215e248c55b086318ab7f3898c4e3fee64

Backout:
https://hg.mozilla.org/integration/autoland/rev/b09a87ac113be1e76b583cdd60f2214786c45003

Fun, a build failure on one platform due to a now-missing #include.

https://hg.mozilla.org/mozilla-central/rev/6195a108b15d
https://hg.mozilla.org/mozilla-central/rev/077503eafee6
https://hg.mozilla.org/mozilla-central/rev/a5c7c19a25ed
https://hg.mozilla.org/mozilla-central/rev/d5c93dbdf613

Warp has let us remove the Baseline Type Monitor stubs that triggered the bug.
The workarounds also didn't stop the crashes.

With TI the preliminary-object handling made this more difficult.

In the IonIC code we can also remove TryAttachIonStub's IC template parameter.

Depends on D99218

Drive-by change: add a MOZ_UNLIKELY for the OOM path as this code is somewhat hot.

Depends on D99219

Depends on D99220

The callers no longer need fixed registers, which should improve codegen a little.

In emitStoreDenseElementHole we can simplify the handleAdd case by merging the
"before type update IC" and "after type update IC" code.

In emitArrayPush use AutoOutputRegister, the old code loaded the value in R0 and
then relied on that register matching the IC's output register.

Depends on D99221

Depends on D99222

Depends on D99223

We can bring this back in the future if needed.

Depends on D99224

Now that every stub is a fallback stub except for CacheIR_Regular, we don't need
this trait value anymore. Later patches will make more changes in this area.

Depends on D99339

If a stub has a non-null next_, it's a CacheIR stub. Else it's a fallback stub.
This means the Kind is only relevant for fallback stubs and we can move it there,
removing a word from each CacheIR stub.

The use of CacheIR_Regular here is a bit awkward, a later patch will rename this to
ICCacheIRStub to make this more natural.

This also removes the extra_ field that's no longer used.

Depends on D99340

Drive-by change: remove dead ICStub::updateCode.

Depends on D99341

Depends on D99342

https://hg.mozilla.org/mozilla-central/rev/3380fdb08357
https://hg.mozilla.org/mozilla-central/rev/fdd89bf36294
https://hg.mozilla.org/mozilla-central/rev/302908606fc8
https://hg.mozilla.org/mozilla-central/rev/3eaf6aee7d31
https://hg.mozilla.org/mozilla-central/rev/f441d73f176f
https://hg.mozilla.org/mozilla-central/rev/b66fdf5d9cb8
https://hg.mozilla.org/mozilla-central/rev/c23de324fa69
https://hg.mozilla.org/mozilla-central/rev/a228c5d96260

This makes it more explicit where we're using fallback stubs vs CacheIR stubs.

It also lets us remove the cacheIRStubInfo and cacheIRStubData from ICStub.

• Move the next_ field to ICCacheIRStub; fallback stubs don't have a next stub.
• Move the enteredCount_ field to the base class instead of duplicating in derived classes.
• Use uint8_t instead of uint32_t for small bit fields in ICState to shrink sizeof(ICState)
• Shrink Kind from uint16_t to uint8_t. Remove the magic-value bits to simplify the code and we don't have many bits available.

This gets all Baseline IC stubs down to 4 words on 64-bit:

1. code_
2. enteredCount_ + isFallback_ flag
3. next_ (CacheIR stubs) or icEntry_ (fallback stubs)
4. stubInfo_ (CacheIR stubs) or state_ + kind_ (fallback stubs)

static_asserts are added to document/check the size of fallback and CacheIR stubs.

This should be pretty optimal. The second word has some padding so gives us space
to add more data/flags to each ICStub in the future without increasing the size.

Depends on D99464

https://hg.mozilla.org/mozilla-central/rev/d443615acd94
https://hg.mozilla.org/mozilla-central/rev/30837f20df57
https://hg.mozilla.org/mozilla-central/rev/516536a2d9a2
https://hg.mozilla.org/mozilla-central/rev/dfa21600860e
https://hg.mozilla.org/mozilla-central/rev/c34c5f277dcc

There's more to do but I'm going to continue this in a new bug.

https://hg.mozilla.org/mozilla-central/rev/6537b704ed64
https://hg.mozilla.org/mozilla-central/rev/0a977402aec1

Changing this from 86 to 85 because that's where the vast majority of changes landed.

We're seeing a considerable improvement to GC_SLICE_DURING_IDLE(_CONTENT) that seems to be the result of this work! This is great news.

== Change summary for alert #28294 (as of Wed, 30 Dec 2020 06:21:36 GMT) ==

Improvements:

For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=28294

== Change summary for alert #27956 (as of Thu, 03 Dec 2020 22:57:56 GMT) ==

Improvements:

For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=27956