1246229 - Repeated bailout & recompilation caused by unboxing of unused loop variables

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Nicolas B. Pierron [:nbp]]

Currently, in our test suite the test name jit-test/tests/basic/testTypedArrayInit.js is slow, and is made even slower by Bug 1242462, as we allow to OSR multiple times even after a bailout.

Here is likely what happens:
  - We enter the loop a first time.
  - We decide to compile it while we are at the loop entry.
    - When see that one of the value of the loop is unused and replace it by a Magic(JS_OPTIMIZED_OUT)
  - We OSR into it with no issue.
  - We bailout from the loop.
  - We OSR again in the loop, and fail because we cannot unbox the Magic to an Object.

I suggest that if we replace a Phi node in the loop pre-header, we do the same for the OSR block.

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Enable DCE to remove OSR guards if their values are optimized-out.

The MTypeBarrier and the MUnbox of the OSR block are artificially added as a
way to ensure that we have the same inputs as the non-osr entry.  These
guards are only useful if there is anything which relies on them after.

As all the guards added in the OSR block are part of the data-flow, we can
just ignore the "isGuard" flag, and only rely on the uses of the instruction
to discard or not the MTypeBarrier and the MUnbox.

Comment 2

[Hannes Verschore [:h4writer]]

Comment on attachment 8717026 [details] [diff] [review]
Enable DCE to remove OSR guards if their values are optimized-out.

Review of attachment 8717026 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonAnalysis.cpp
@@ +950,5 @@
>  bool
>  js::jit::DeadIfUnused(const MDefinition* def)
>  {
> +    return !def->isEffectful() &&
> +           !(def->isGuard() && def->block() != def->block()->graph().osrBlock()) &&

Can you change this to:
(!def->isGuard() || def->block() == def->block()->graph().osrBlock())

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ad1e7fdc44b3

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ad1e7fdc44b3