801915 - IonMonkey: Handle JSOP_IN

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

Dromaeo's CSSQuery-Dojo test attempts to compile a function but fails for lack on Ion JSOP_IN support. Welp.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Sounds like this could matter for performance, if just to compile the surrounding function.

Comment 2

[Sean Stangl [:sstangl]]

Attachment: Implement JSOP_IN using callVM.

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 672147 [details] [diff] [review]
Implement JSOP_IN using callVM.

Review of attachment 672147 [details] [diff] [review]:
-----------------------------------------------------------------

Nice. Both TM and JM+TI (bug 664824) have/had a fast path for "int32 in dense array". Can you file a follow-up bug so that we don't forget about it?

Comment 4

[Sean Stangl [:sstangl]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d3a655f609ca

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d3a655f609ca

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 672147 [details] [diff] [review]
Implement JSOP_IN using callVM.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 786160
User impact if declined: Significant performance regression on benchmarks
Testing completed (on m-c, etc.): Yes
Risk to taking this patch (and alternatives if risky): Very little, might expose existing JIT bugs by nature of allowing more to JIT.
String or UUID changes made by this patch:

Comment 7

[bhavana bajaj [:bajaj]]

Comment on attachment 672147 [details] [diff] [review]
Implement JSOP_IN using callVM.

Approving it on aurora as it has a significant perf impact

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/1faef77e84da