1786844 - Update scalar replacement of MNewCallObject for Warp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P1)

Description

[André Bargull [:anba]]

Bug 1073033 added scalar replacement support for MNewCallObject, but it needs to be updated to work in Warp, too.

Example:

function f() {
  var r = 0;
  for (var i = 0; i < 100; ++i) {
    var fn = i => () => i;
    r += fn(i)();
  }
  return r;
}

The generated graph is:

48 lambda newcallobject43:Object constant47:Object
53 guardtofunction lambda48:Object
54 guardfunctionscript guardtofunction53:Object
57 functionenvironment guardfunctionscript54:Object

Warp added MGuardToFunction and MGuardFunctionScript, which we now need to support during scalar replacement, so that we're able to scalar replace the MNewCallObject.

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1786844: Handle MGuardToFunction and MGuardFunctionScript during scalar replacement. r=iain!

This allows to scalar replace the MNewCallObject in cases like:

function f() {
  var r = 0;
  for (var i = 0; i < 100; ++i) {
    var fn = i => () => i;
    r += fn(i)();
  }
  return r;
}

This code is compiled to:

48 lambda newcallobject43:Object constant47:Object
53 guardtofunction lambda48:Object
54 guardfunctionscript guardtofunction53:Object
57 functionenvironment guardfunctionscript54:Object

MGuardToFunction and MGuardFunctionScript weren't present in Ion when scalar
replacement support for MNewCallObject was originally implemented. For Warp
we need to handle those two instructions, too.

There aren't any new tests, because MNewCallObject is an implementation detail
and can't be tested from JS. (The MLambda is already scalar replaced without
this change.)

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2a9f5a362029
Handle MGuardToFunction and MGuardFunctionScript during scalar replacement. r=iain

Comment 3

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/2a9f5a362029