Remove IonBuilder and TI, part deux
Categories
(Core :: JavaScript Engine: JIT, task, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox86 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(48 files)
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review |
Assignee | ||
Comment 1•3 years ago
|
||
Assignee | ||
Comment 2•3 years ago
|
||
Depends on D99870
Assignee | ||
Comment 3•3 years ago
|
||
It was always true at this point.
Depends on D99871
Assignee | ||
Comment 4•3 years ago
|
||
We never used this with Warp.
Depends on D99872
Assignee | ||
Updated•3 years ago
|
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/dd7aff8d6f4e part 1 - Remove needsTypeBarrier from MegamorphicStoreSlot. r=iain https://hg.mozilla.org/integration/autoland/rev/ecc7dad55fae part 2 - Remove GuardObjectGroupNotPretenured CacheIR op. r=iain https://hg.mozilla.org/integration/autoland/rev/be46b71192f8 part 3 - Remove JitOptions.warpBuilder. r=iain https://hg.mozilla.org/integration/autoland/rev/899e65333586 part 4 - Remove MRootList. r=iain
Assignee | ||
Comment 6•3 years ago
|
||
This was used by IonBuilder/BaselineInspector.
Assignee | ||
Comment 7•3 years ago
|
||
Depends on D99992
Assignee | ||
Comment 8•3 years ago
|
||
Depends on D99993
Assignee | ||
Comment 9•3 years ago
|
||
Depends on D99994
Assignee | ||
Comment 10•3 years ago
|
||
collectCoverage and collectCoverageForDebug are equivalent after removing
collectCoverageForPGO. The patch kept collectCoverageForDebug because it had
more callers than collectCoverage.
Also remove the counter increment from the bailout code.
Depends on D99995
Assignee | ||
Comment 11•3 years ago
|
||
Depends on D99996
Assignee | ||
Comment 12•3 years ago
|
||
The Unconditionally type has been unused since bug 1614622, so we can inline
IfUnmarked::ShouldTrace directly and remove the abstraction.
Depends on D99997
Assignee | ||
Comment 13•3 years ago
|
||
Depends on D99998
Assignee | ||
Comment 14•3 years ago
|
||
This function never returned true in practice (tested by adding a MOZ_CRASH and
running jit-tests, Kraken, Octane, SunSpider) so is probably no longer relevant
without the MFilterTypeSet code that was removed earlier.
Depends on D99999
Assignee | ||
Comment 15•3 years ago
|
||
Without TI we can always just return |undefined| for missing properties.
Depends on D100000
Comment 16•3 years ago
|
||
bugherder |
Comment 17•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/ace4b47bc69c part 5 - Remove code for template objects for natives. r=iain https://hg.mozilla.org/integration/autoland/rev/39f87356de52 part 6 - Move AutoAccumulateReturns from MIRBuilderShared.h to WarpBuilder.cpp and mark MOZ_RAII. r=iain https://hg.mozilla.org/integration/autoland/rev/1ac0c1a59eaa part 7 - Move CallInfo from MIRBuilderShared.h to WarpBuilderShared.h, delete MIRBuilderShared.h. r=iain https://hg.mozilla.org/integration/autoland/rev/6f370df4c888 part 8 - Remove some dead code from CallInfo. r=iain https://hg.mozilla.org/integration/autoland/rev/efd4634dbe39 part 9 - Clean up coverage code a bit. r=iain https://hg.mozilla.org/integration/autoland/rev/04986d2d60e7 part 10 - Simplify MergeTypes, move MBox constructor to MIR.h. r=iain https://hg.mozilla.org/integration/autoland/rev/0c04df0acbbc part 11 - Remove ShouldTraceProvider abstraction from profiler JIT map. r=iain https://hg.mozilla.org/integration/autoland/rev/172464950902 part 12 - Remove empty-TypeSet code from phi specialization. r=iain https://hg.mozilla.org/integration/autoland/rev/4c684fa892fd part 13 - Remove IsPhiRedudantFilter (sic). r=iain https://hg.mozilla.org/integration/autoland/rev/ec44a2e66c38 part 14 - Remove handleMissing flag from megamorphic loads. r=iain
Assignee | ||
Comment 18•3 years ago
|
||
Assignee | ||
Comment 19•3 years ago
|
||
This isn't really relevant for fallback stubs because they're never discarded and
are always in the fallback space, so this lets us remove some confusing code.
Depends on D100105
Assignee | ||
Comment 20•3 years ago
|
||
Depends on D100106
Comment 21•3 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/ace4b47bc69c
https://hg.mozilla.org/mozilla-central/rev/39f87356de52
https://hg.mozilla.org/mozilla-central/rev/1ac0c1a59eaa
https://hg.mozilla.org/mozilla-central/rev/6f370df4c888
https://hg.mozilla.org/mozilla-central/rev/efd4634dbe39
https://hg.mozilla.org/mozilla-central/rev/04986d2d60e7
https://hg.mozilla.org/mozilla-central/rev/0c04df0acbbc
https://hg.mozilla.org/mozilla-central/rev/172464950902
https://hg.mozilla.org/mozilla-central/rev/4c684fa892fd
https://hg.mozilla.org/mozilla-central/rev/ec44a2e66c38
Comment 22•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/487ba3fa5f51 part 15 - Remove unused KindString. r=iain https://hg.mozilla.org/integration/autoland/rev/d0bc9d6413c9 part 16 - Move makesGCCalls to ICCacheIRStub. r=iain https://hg.mozilla.org/integration/autoland/rev/7b3211ee8d8c part 17 - Remove template group from ICNewArray_Fallback. r=iain
Assignee | ||
Comment 23•3 years ago
|
||
Assignee | ||
Comment 24•3 years ago
|
||
The disabled jit-tests now pass (likely from changes to the inlining heuristics).
Depends on D100676
Assignee | ||
Comment 25•3 years ago
|
||
Depends on D100677
Assignee | ||
Comment 26•3 years ago
|
||
Depends on D100678
Assignee | ||
Comment 27•3 years ago
|
||
- Rename CopyInitializerObject to CopyTemplateObject because it's also used for |new|.
- Change CopyTemplateObject to use the template object's proto instead of changing the group later.
- Change CreateThisWithTemplate to call CopyTemplateObject directly instead of going through NewObjectOperationWithTemplate.
Depends on D100679
Assignee | ||
Comment 28•3 years ago
|
||
Also remove a pointless isSingleton check in DoNewArrayFallback: at this point
only the global object is a singleton.
Depends on D100680
Assignee | ||
Comment 29•3 years ago
|
||
Depends on D100681
Assignee | ||
Comment 30•3 years ago
|
||
There are no any actual uses anymore. Later patches make more changes in this area.
Depends on D100682
Assignee | ||
Comment 31•3 years ago
|
||
Depends on D100683
Assignee | ||
Comment 32•3 years ago
|
||
Depends on D100684
Assignee | ||
Comment 33•3 years ago
|
||
Depends on D100685
Assignee | ||
Comment 34•3 years ago
|
||
This was mainly used to select between JSOp::NewObjectWithGroup and JSOp::NewObject.
Follow-up patches will make more changes in this area.
Depends on D100686
Assignee | ||
Comment 35•3 years ago
|
||
- Rename ObjLiteralFlag::NoValues to ObjLiteralFlag::Singleton and invert it.
- Update comments.
The code in emitObject is massively simpler now and less brittle without TI so
this also deletes the "don't change this" warning there.
Depends on D100687
Assignee | ||
Comment 36•3 years ago
|
||
When disabling/removing the COW-array code we accidentally disabled the
JSOp::Object optimization for array literals in singleton contexts. This patch
restores it.
Depends on D100688
Updated•3 years ago
|
Updated•3 years ago
|
Updated•3 years ago
|
Updated•3 years ago
|
Updated•3 years ago
|
Updated•3 years ago
|
Comment 37•3 years ago
|
||
bugherder |
Comment 38•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/538b3438ea17 part 18 - Remove loadDoubles flag from MLoadElement. r=iain https://hg.mozilla.org/integration/autoland/rev/cd28fb3ff964 part 19 - Remove isTypeInferenceEnabled testing function. r=iain https://hg.mozilla.org/integration/autoland/rev/c38229ecc9a4 part 20 - Remove unused group argument from StringSplitString. r=iain https://hg.mozilla.org/integration/autoland/rev/b7097bb2492d part 21 - Remove now-unused stringSplitStringGroup from ObjectGroupRealm. r=iain https://hg.mozilla.org/integration/autoland/rev/44024aa16de7 part 22 - Tidy up NewObjectOperationWithTemplate and CopyInitializerObject. r=iain https://hg.mozilla.org/integration/autoland/rev/e4b62ca3e934 part 23 - Remove unused script and pc arguments from NewArrayOperation. r=iain https://hg.mozilla.org/integration/autoland/rev/e29abe932823 part 24 - Remove NewArrayOperationWithTemplate. r=iain https://hg.mozilla.org/integration/autoland/rev/d17b081264ff part 25 - Remove ObjLiteralFlag::SpecificGroup. r=iain https://hg.mozilla.org/integration/autoland/rev/3d98e102d0a5 part 26 - Remove ObjLiteralFlag::IsInnerSingleton. r=iain https://hg.mozilla.org/integration/autoland/rev/5553826cc186 part 27 - Remove ObjLiteralFlag::ArrayCOW. r=iain https://hg.mozilla.org/integration/autoland/rev/fefd283bfc68 part 28 - Remove ObjLiteralFlag::Singleton. r=iain https://hg.mozilla.org/integration/autoland/rev/b465a27e6555 part 29 - Remove unused isInner arguments. r=iain https://hg.mozilla.org/integration/autoland/rev/3e9185713037 part 30 - Tidy up object literal code more. r=iain https://hg.mozilla.org/integration/autoland/rev/c69c83d5f6ca part 31 - Use JSOp::Object again for array literals. r=iain
Assignee | ||
Comment 39•3 years ago
|
||
This was also used to optimize object-or-null type barriers but now it's only
used for bounds checks.
Assignee | ||
Comment 40•3 years ago
|
||
Assignee | ||
Comment 41•3 years ago
|
||
This reverts a change made for IonBuilder loop restarts (to preserve loop header
phis when restarting a loop).
Then removeBlockIncludingPhis can be removed because removeBlock now always removes
phis too.
Depends on D100790
Comment 42•3 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/538b3438ea17
https://hg.mozilla.org/mozilla-central/rev/cd28fb3ff964
https://hg.mozilla.org/mozilla-central/rev/c38229ecc9a4
https://hg.mozilla.org/mozilla-central/rev/b7097bb2492d
https://hg.mozilla.org/mozilla-central/rev/44024aa16de7
https://hg.mozilla.org/mozilla-central/rev/e4b62ca3e934
https://hg.mozilla.org/mozilla-central/rev/e29abe932823
https://hg.mozilla.org/mozilla-central/rev/d17b081264ff
https://hg.mozilla.org/mozilla-central/rev/3d98e102d0a5
https://hg.mozilla.org/mozilla-central/rev/5553826cc186
https://hg.mozilla.org/mozilla-central/rev/fefd283bfc68
https://hg.mozilla.org/mozilla-central/rev/b465a27e6555
https://hg.mozilla.org/mozilla-central/rev/3e9185713037
https://hg.mozilla.org/mozilla-central/rev/c69c83d5f6ca
Comment 43•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/1e1bcd8fa525 part 32 - Remove some dead code from EliminateRedundantChecks. r=iain https://hg.mozilla.org/integration/autoland/rev/0744c8dac041 part 33 - Remove/change more IonBuilder-specific code and comments. r=iain https://hg.mozilla.org/integration/autoland/rev/c45cd62f221e part 34 - Discard phis completely in MBasicBlock::clear. r=iain
Assignee | ||
Comment 44•3 years ago
|
||
Assignee | ||
Comment 45•3 years ago
|
||
Before this patch, the global object was allocated as a singleton object (with its
own group) and after creating the global we changed this group's prototype in
splicePrototype.
With this patch splicePrototype give the object a new group for the new prototype.
This is nicer because it means groups are now almost immutable (there's still a
setProtoUnchecked in mergeRealms that will go away with Stencil).
This will let us remove singleton groups/objects completely in the next patch.
A later patch will clean up and document the code around prototype-splicing more.
Depends on D100906
Assignee | ||
Comment 46•3 years ago
|
||
This also removes ObjectGroup's flags field.
Depends on D100907
Assignee | ||
Comment 47•3 years ago
|
||
Moves splicePrototype from JSObject to GlobalObject.
Depends on D100908
Assignee | ||
Comment 48•3 years ago
|
||
Depends on D100909
Assignee | ||
Comment 49•3 years ago
|
||
Depends on D100910
Assignee | ||
Comment 50•3 years ago
|
||
Also replace the realm-switching code with an assertion and fix one caller.
Depends on D100911
Assignee | ||
Comment 51•3 years ago
|
||
Depends on D100912
Assignee | ||
Comment 52•3 years ago
|
||
Depends on D100913
Assignee | ||
Comment 53•3 years ago
|
||
We now set it in the constructor instead of calling setTypeDescr. Also use
GCPtr<> to simplify the GC tracing code.
Depends on D100914
Comment 54•3 years ago
|
||
bugherder |
Comment 55•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/0cbc0f8e342a part 35 - Remove some always-true flags from MArrayJoin and MArrayPopShift. r=iain https://hg.mozilla.org/integration/autoland/rev/50e1543242f6 part 36 - Stop allocating the global object as a singleton. r=iain https://hg.mozilla.org/integration/autoland/rev/700e1296e701 part 37 - Remove remaining code for singleton objects. r=iain https://hg.mozilla.org/integration/autoland/rev/f73a7602dac7 part 38 - Clean up prototype splicing code a bit more. r=iain https://hg.mozilla.org/integration/autoland/rev/a5bfda24c627 part 39 - Remove ObjectGroup::hasUncacheableProto. r=iain
Assignee | ||
Comment 56•3 years ago
|
||
Now that we don't have to worry about maintaining property types, we can share more code.
This moves the Baseline version to the base class. Also moves the ArrayPush code
because it uses some of the shared helper functions.
The Ion implementation had some minor differences:
- Typed value register (ported by the next patch).
- For StoreDenseElementHole it ignored the handleAdd flag but now we are consistent with Baseline.
- Ion used AutoSpectreBoundsScratchRegister for x86 but now we pass InvalidReg because the Baseline code does not have enough registers (hopefully fine for Ion IC code given decline of x86).
Assignee | ||
Comment 57•3 years ago
|
||
Depends on D101038
Comment 58•3 years ago
|
||
bugherder |
Comment 59•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/74966bf15b00 part 40 - Remove unused MCreateThisWithProto. r=iain https://hg.mozilla.org/integration/autoland/rev/1bc78a1cec49 part 41 - Fold CreateThisForFunctionWithProto into CreateThisForFunction. r=iain https://hg.mozilla.org/integration/autoland/rev/26a4fb91bce6 part 42 - Fold CreateThisForFunctionWithGroup into CreateThisForFunction. r=iain https://hg.mozilla.org/integration/autoland/rev/0ee0000c4d78 part 43 - Clean up TypeDescr code in ObjectGroup::defaultNewGroup. r=iain https://hg.mozilla.org/integration/autoland/rev/e5e6c7c18fa7 part 44 - Make ObjectGroup's typeDescr_ field immutable. r=iain
Comment 60•3 years ago
|
||
bugherder |
Comment 61•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/66a11f3b53f8 part 45 - Unify Baseline and Ion IC codegen for StoreDenseElement and StoreDenseElementHole. r=iain https://hg.mozilla.org/integration/autoland/rev/6f799a1c3066 part 46 - Add minor optimization back from the Ion version. r=iain
Comment 62•3 years ago
|
||
bugherder |
Assignee | ||
Comment 63•3 years ago
|
||
These functions use mightBeType for each type, but without TypeSets that always
returns true because the operand has MIRType::Value, so simplify based on that.
There are probably other calls to mightBeType that we can audit/change later as
we notice them, but these ones seemed particularly unnecessary.
Assignee | ||
Comment 64•3 years ago
|
||
Warp doesn't use this and there's a lot of complexity to support recompiling
an IonScript while continuing to use the current one.
It might make sense to add a similar hot tier to Warp at some point, but because
Warp uses trial inlining the implementation would likely be pretty different:
we could invalidate, flag the JitScript as supporting different inlining thresholds,
and go back to Baseline to gather information.
Depends on D101456
Comment 65•3 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/d59ce0d29da5 part 47 - Simplify testValueTruthyKernel and TypeOfV codegen. r=iain https://hg.mozilla.org/integration/autoland/rev/83c59ac4bcec part 48 - Remove Ion optimization levels. r=iain
Comment 66•3 years ago
|
||
bugherder |
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Updated•3 years ago
|
Description
•