1763351 - Don't guard on prototype object identity for instanceof

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P3)

Description

[Jan de Mooij [:jandem]]

The CacheIR we generate to optimize instanceof currently guards on a specific .prototype object. I think IonBuilder (BaselineInspector) relied on this, but it's no longer necessary.

We can now generate CacheIR that guards the .prototype value is an object, and then pass that object to LoadInstanceOfObjectResult. This way we can deal better with certain forms of polymorphism.

This gets rid of most fallback hits for Ion ICs for instanceof on matrix-react-bench.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Bug 1763351 part 1 - Don't guard on a specific prototype object in instanceof CacheIR. r?iain!

We used to rely on knowing the specific .prototype object in BaselineInspector,
but now that we no longer do that there's no value in guarding on a specific object
here. By supporting any object we can handle polymorphism better.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1763351 part 2 - Always use a register for LInstanceOf* RHS. r?iain!

We can simplify the code a bit now that RHS is usually a register instead of a
constant.

A constant object can still show up for inlined isPrototypeOf, because that uses
the same CacheIR/MIR instruction, but this is uncommon (shows up on one jit-test
with --ion).

Depends on D143022

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3e0edc5c329a
part 1 - Don't guard on a specific prototype object in instanceof CacheIR. r=iain
https://hg.mozilla.org/integration/autoland/rev/9341ba02a8dc
part 2 - Always use a register for LInstanceOf* RHS. r=iain

Comment 4

[Cristina Cozmuta (:CrissCozmuta)]

https://hg.mozilla.org/mozilla-central/rev/3e0edc5c329a
https://hg.mozilla.org/mozilla-central/rev/9341ba02a8dc