686595 - [meta] IonMonkey: inlining

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Chris Leary [:cdleary] (not checking bugmail)]

Basic procedure for inlining optimization:

1. Create "exit" block, so all CFGs have a single entry and exit point.
2. Extend the type oracle interface to pass back inlining targets.
3. Check inlining target for composability. (Initially this will mean precluding functions which use JSOP_ARGUMENTS and such.)
4. Recursively invoke the IonBuilder, resulting in the target CFG.
5. Switch all MReturns (that precede single exit point) into MGotos.
6. Split the caller block into pre-call and post-call.
7. Merge the callee MIRGraph entry block at the end of the pre-call block.
8. Merge the callee MIRGraph exit block at the start of the post-call block.

This means we'll need to add exit block support, extend the type oracle API to tell us call targets, and extend bailout snapshots to support a "inline frame number" designation for inline IonFrame bailouts.

Initial milestone intentionally avoids inlining hard things, and very first milestone is just inlining a single frame with proper bailout behavior.

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

We also have to check the receiver type |JSOP_THIS| matches or is appropriately renamed in cases where |JSOP_THIS| is used. Again, not for the very first milestone.