1646036 - Warp: fix repeated bailouts from redundant bounds check elimination

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P2)

Description

[Jan de Mooij [:jandem]]

This affects Octane-pdfjs.

IonBuilder avoids this by checking the failedBoundsCheck flag and marking the bounds check as non-movable (the bounds check optimization code checks isMovable).

For now we should probably reuse that approach, but longer-term I want to have more fine-grained bailout tracking for these kinds of issues. That should wait till IonBuilder is gone though.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Bug 1646036 - Prevent bailout loops in Warp from bounds check and lexical check hoisting. r?iain!

This is necessary to fix some jit-test timeouts from bailout/recompile loops
with the patch to bail out for cold Baseline ICs. We're also hitting the bounds
check case on Octane-pdfjs already where it's slowing us down.

Hopefully these are the only cases we need to handle. For shape guards and other
guards derived from Baseline ICs I want to make other changes soon.

Eventually the bailout code should be made more obviously-correct but this should
do for now until IonBuilder is gone.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f4b0a007b4ff
Prevent bailout loops in Warp from bounds check and lexical check hoisting. r=iain

Comment 3

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/f4b0a007b4ff