1147414 - IonMonkey: Accept RecoveredOnBailout assertions in Scalar Replacement escape analysis.

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Nicolas B. Pierron [:nbp] {away}]

We should use assertRecoveredOnBailout assertion in scalar replacement test cases.  Otherwise we would have no good way to ensure that the optimization is not going away, as there is no non-escaped object heavy benchmark in our benchmark suite.

Comment 1

[Nicolas B. Pierron [:nbp] {away}]

Attachment: Check of that Scalar Replacement is working as expected.

This patch add supports for AssertRecoveredOnBailout MIR instruction in the
IS*Escaped function, and instrument the test cases to make sure that we
don't break this optimization by accident.

Comment 2

[Hannes Verschore [:h4writer]]

Comment on attachment 8587502 [details] [diff] [review]
Check of that Scalar Replacement is working as expected.

Review of attachment 8587502 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/ScalarReplacement.cpp
@@ +684,5 @@
>                      // bailing on holes.
> +                    if (access->toStoreElement()->needsHoleCheck()) {
> +                        JitSpewDef(JitSpew_Escape, "Array ", ins);
> +                        JitSpewDef(JitSpew_Escape,
> +                                   "  has a store element which needs hole check\n", access);

has a store element with a hole check

Comment 3

[Nicolas B. Pierron [:nbp] {away}]

https://hg.mozilla.org/integration/mozilla-inbound/rev/87b6a9b5c012

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/87b6a9b5c012