1109195 - IonMonkey: Enable Sink by default.

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Nicolas B. Pierron [:nbp]]

Fix all issues causing Sink to be a top-crasher.  In the mean time, this optimization can be tested by running the JS shell with --ion-sink=on.

Comment 1

[Nicolas B. Pierron [:nbp]]

Sink has been partially enabled since the creation of this bug. The Sink phase contains 2 parts, the first part analyze where instructions are consumed, while the second part decides how to modify these instructions.

Currently, we only modify instructions by flagging them as recovered as bailout if there is no consumer except ResumePoints.

What has been disabled in the end of 2014 is the ability to duplicate instructions in branches which are consuming these instructions while flagging existing instructions as being recovered on bailout.

Today, what is disable is the code which convert the following:

function titanic(a) {
  x = 1 + a;
  if (…) {
    print(x)
  } else {
    // does not use x.
  }
}

into:

function titanic(a) {
  // x = 1 + a; is flagged as RecoveredOnBailout.
  if (…) {
    x = 1 + a; // Cloned here
    print(x)
  } else {
    // does not use x.
  }
}

Iain, I will let you choose what to do with this bug. Either to drop it or to give it a chance.

Removing it would probably be as simple as trashing the following lines: https://searchfox.org/mozilla-central/source/js/src/jit/Sink.cpp#114-247

Comment 2

[Iain Ireland [:iain]]

I think it's worth trying to get this working.

I'll test a local build with --ion-sink=on to see what fails. Once we're passing jit-tests, we can consider fuzzing it.