1765780 - Consider always-inlining $ArrayValues/CreateArrayIterator to enable scalar replacement of iterator objects in more cases

Status: NEW

(Core :: JavaScript Engine: JIT, enhancement, P2)

Description

[André Bargull [:anba]]

To reproduce:

• Execute below test case with IONFLAGS=logs
• Run iongraph --final /tmp/ion.json.
• Observe that $ArrayValues wasn't inlined.

function g() {
  // $ArrayValues can be inlined when the array is small enough. (bug 1765779)
  // var a = [1, 2];

  // Larger arrays prevent inlining $ArrayValues, which then prevents
  // scalar replacement of the iterator object.
  var a = [1, 2, 3, 4, 5];

  var r = 0;
  for (var v of a) r += v;
  return r;
}

function f() {
  with ({});
  let r = 0;
  for (let i = 0; i < 100_000; ++i) {
    r += g();
  }
  print(r);
}

with ({});
for (let i = 0; i < 5; ++i) f();