1009899 - Don't unnecessarily freeze inlining done during definite properties analysis

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

Bug 1008339 regressed octane-deltablue because some of the constraints it added caused definite property information to be invalidated on some important scripts.  These constraints aren't actually necessary though, as they are accounting for inlining done in the definite properties analysis which happens after all of the definite properties have been added.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 8422053 [details] [diff] [review]
patch

Review of attachment 8422053 [details] [diff] [review]:
-----------------------------------------------------------------

r=me with the assert below added.

::: js/src/jit/IonAnalysis.cpp
@@ +2375,5 @@
>          if (!handled)
>              break;
> +
> +        if (slotSpan != baseobj->slotSpan())
> +            lastAddedBlock = ins->block()->id();

Assert ins->block()->id() >= lastAddedBlock before this line.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/59ba25ff5a10

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/59ba25ff5a10