1519795 - Inline polymorphic [[Construct]] calls to native functions again

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement)

Description

[André Bargull [:anba]]

Inlining polymorphic [[Construct]] calls to inline functions broke in bug 1472132, because the NewTarget of the copied CallInfo wasn't adjusted to hold the currently tested function.

Test case:

function f() {
    new Int32Array(8).slice(0);
    var ta = new Uint32Array(8);
    var r = 0
    var t = dateNow()
    for (var i = 0; i < 5000000; ++i){
        r += ta.slice(0).length;
    }
    return [dateNow() - t, r];
}
for (var i = 0; i < 5; ++i) print(f());

Before patch:

• First iteration: ~740ms
• Subsequent iterations: ~2600ms

With patch:

• All iterations: ~740ms

Comment 1

[André Bargull [:anba]]

Attachment: bug1519795.patch

Modifies the NewTarget of the cloned CallInfo to match the current function, similar to [1]. This ensures we don't reject inlining native functions at [2].

[1] https://searchfox.org/mozilla-central/rev/c43240cef5829b8a2dec118faff8a5e1fec6ae1b/js/src/jit/IonBuilder.cpp#4522-4525
[2] https://searchfox.org/mozilla-central/rev/c43240cef5829b8a2dec118faff8a5e1fec6ae1b/js/src/jit/MCallOptimize.cpp#71-76

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 9036284 [details] [diff] [review]
bug1519795.patch

Review of attachment 9036284 [details] [diff] [review]:
-----------------------------------------------------------------

Great catch, thanks!

Comment 3

[André Bargull [:anba]]

Try: https://hg.mozilla.org/try/rev/8f75b118e9b727d24f31c9e9ecbbfafa5f6993b8

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1d0d0fed3608
Adjust CallInfo::newTarget to allow inlining polymorphic construct-calls of native functions. r=jandem

Comment 5

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/1d0d0fed3608