IonMonkey: Fallback after inlining failures caused by preliminary group objects.

NEW
Unassigned

Status

()

defect
P3
normal
3 years ago
2 years ago

People

(Reporter: nbp, Unassigned)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

3 years ago
Bug 1303399 added infrastructure for handling fallback on inlining failure caused by newly disabled scripts.

We should do the same for preliminary groups, as the alternative is to wait for another compilation cycle after we complete the preliminary group analysis.

#0  0x00007fb4f6ac8d05 in js::jit::MIRGenerator::addAbortedPreliminaryGroup
[…]
#3  0x00007fb4f6a2ee02 in js::jit::IonBuilder::shouldAbortOnPreliminaryGroups
#4  0x00007fb4f6a395db in js::jit::IonBuilder::jsop_length_fastPath
[…]
#8  0x00007fb4f6a135f9 in js::jit::IonBuilder::buildInline
[…]
#15 0x00007fb4f6a135f9 in js::jit::IonBuilder::buildInline
[…]
#22 0x00007fb4f6a135f9 in js::jit::IonBuilder::buildInline
[…]
#29 0x00007fb4f6a135f9 in js::jit::IonBuilder::buildInline
[…]
#37 0x00007fb4f6a0f231 in js::jit::IonBuilder::build
[…]
#41 0x00007fb4f6a0a0c2 in js::jit::IonCompileScriptForBaseline
(Reporter)

Updated

3 years ago
Depends on: 1286505
(Reporter)

Updated

2 years ago
Blocks: 1245279
You need to log in before you can comment on or make changes to this bug.