The default bug view has changed. See this FAQ.

[meta] IonMonkey: inlining




JavaScript Engine
6 years ago
5 years ago


(Reporter: cdleary, Assigned: cdleary)


(Depends on: 1 bug, Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)


Basic procedure for inlining optimization:

1. Create "exit" block, so all CFGs have a single entry and exit point.
2. Extend the type oracle interface to pass back inlining targets.
3. Check inlining target for composability. (Initially this will mean precluding functions which use JSOP_ARGUMENTS and such.)
4. Recursively invoke the IonBuilder, resulting in the target CFG.
5. Switch all MReturns (that precede single exit point) into MGotos.
6. Split the caller block into pre-call and post-call.
7. Merge the callee MIRGraph entry block at the end of the pre-call block.
8. Merge the callee MIRGraph exit block at the start of the post-call block.

This means we'll need to add exit block support, extend the type oracle API to tell us call targets, and extend bailout snapshots to support a "inline frame number" designation for inline IonFrame bailouts.

Initial milestone intentionally avoids inlining hard things, and very first milestone is just inlining a single frame with proper bailout behavior.
We also have to check the receiver type |JSOP_THIS| matches or is appropriately renamed in cases where |JSOP_THIS| is used. Again, not for the very first milestone.
Depends on: 687901
Blocks: 688022
Blocks: 650180
No longer blocks: 688022
Depends on: 688022
Depends on: 703085


5 years ago
Depends on: 706472
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.