Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-10 03:45:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1384042 - Don't Ion-inline functions when the call has an empty type barrier. r=bhackett

Browse Source
This commit is contained in:
Jan de Mooij 2017-07-26 16:03:12 +02:00
parent fd842f1863
commit 082b9c8aed
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/public/TrackedOptimizationInfo.h
View File

@ -211,6 +211,7 @@ namespace JS {
_(CantInlineNativeNoTemplateObj) \
_(CantInlineBound) \
_(CantInlineNativeNoSpecialization) \
_(CantInlineNoObservedTypes) \
_(HasCommonInliningPath) \
\
_(GenericSuccess) \

13
js/src/jit/IonBuilder.cpp
View File

@ -420,11 +420,22 @@ IonBuilder::canInlineTarget(JSFunction* target, CallInfo& callInfo)
return DontInline(nullptr, "Empty TypeSet for argument");
}
}
// If we're going to add a TypeBarrier that always fails, it's not
// worth inlining this call as the script will be invalidated
// immediately.
if ((CodeSpec[*pc].format & JOF_TYPESET) &&
!BytecodeIsPopped(pc) &&
bytecodeTypes(pc)->empty())
{
trackOptimizationOutcome(TrackedOutcome::CantInlineNoObservedTypes);
return DontInline(nullptr, "Empty type barrier");
}
}
// Allow constructing lazy scripts when performing the definite properties
// analysis, as baseline has not been used to warm the caller up yet.
if (target->isInterpreted() && info().analysisMode() == Analysis_DefiniteProperties) {
if (info().analysisMode() == Analysis_DefiniteProperties) {
RootedFunction fun(analysisContext, target);
RootedScript script(analysisContext, JSFunction::getOrCreateScript(analysisContext, fun));
if (!script)