[meta] IonMonkey: inlining

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: cdleary, Assigned: cdleary)

Tracking

(Depends on: 1 bug, Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Basic procedure for inlining optimization:

1. Create "exit" block, so all CFGs have a single entry and exit point.
2. Extend the type oracle interface to pass back inlining targets.
3. Check inlining target for composability. (Initially this will mean precluding functions which use JSOP_ARGUMENTS and such.)
4. Recursively invoke the IonBuilder, resulting in the target CFG.
5. Switch all MReturns (that precede single exit point) into MGotos.
6. Split the caller block into pre-call and post-call.
7. Merge the callee MIRGraph entry block at the end of the pre-call block.
8. Merge the callee MIRGraph exit block at the start of the post-call block.

This means we'll need to add exit block support, extend the type oracle API to tell us call targets, and extend bailout snapshots to support a "inline frame number" designation for inline IonFrame bailouts.

Initial milestone intentionally avoids inlining hard things, and very first milestone is just inlining a single frame with proper bailout behavior.
We also have to check the receiver type |JSOP_THIS| matches or is appropriately renamed in cases where |JSOP_THIS| is used. Again, not for the very first milestone.
Depends on: 687901
Blocks: 688022
Blocks: 650180
No longer blocks: 688022
Depends on: 688022
Depends on: 703085

Updated

6 years ago
Depends on: 706472
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.