Closed Bug 1646036 Opened 1 year ago Closed 1 year ago

Warp: fix repeated bailouts from redundant bounds check elimination

Categories

(Core :: JavaScript Engine: JIT, task, P2)

task

Tracking

()

RESOLVED FIXED
mozilla79
Tracking Status
firefox79 --- fixed

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

This affects Octane-pdfjs.

IonBuilder avoids this by checking the failedBoundsCheck flag and marking the bounds check as non-movable (the bounds check optimization code checks isMovable).

For now we should probably reuse that approach, but longer-term I want to have more fine-grained bailout tracking for these kinds of issues. That should wait till IonBuilder is gone though.

This is necessary to fix some jit-test timeouts from bailout/recompile loops
with the patch to bail out for cold Baseline ICs. We're also hitting the bounds
check case on Octane-pdfjs already where it's slowing us down.

Hopefully these are the only cases we need to handle. For shape guards and other
guards derived from Baseline ICs I want to make other changes soon.

Eventually the bailout code should be made more obviously-correct but this should
do for now until IonBuilder is gone.

Pushed by jdemooij@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f4b0a007b4ff
Prevent bailout loops in Warp from bounds check and lexical check hoisting. r=iain
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla79
You need to log in before you can comment on or make changes to this bug.