Closed Bug 686595 Opened 12 years ago Closed 11 years ago

[meta] IonMonkey: inlining


(Core :: JavaScript Engine, defect)

Not set





(Reporter: cdleary, Assigned: cdleary)


(Depends on 1 open bug, Blocks 1 open bug)


Basic procedure for inlining optimization:

1. Create "exit" block, so all CFGs have a single entry and exit point.
2. Extend the type oracle interface to pass back inlining targets.
3. Check inlining target for composability. (Initially this will mean precluding functions which use JSOP_ARGUMENTS and such.)
4. Recursively invoke the IonBuilder, resulting in the target CFG.
5. Switch all MReturns (that precede single exit point) into MGotos.
6. Split the caller block into pre-call and post-call.
7. Merge the callee MIRGraph entry block at the end of the pre-call block.
8. Merge the callee MIRGraph exit block at the start of the post-call block.

This means we'll need to add exit block support, extend the type oracle API to tell us call targets, and extend bailout snapshots to support a "inline frame number" designation for inline IonFrame bailouts.

Initial milestone intentionally avoids inlining hard things, and very first milestone is just inlining a single frame with proper bailout behavior.
We also have to check the receiver type |JSOP_THIS| matches or is appropriately renamed in cases where |JSOP_THIS| is used. Again, not for the very first milestone.
Depends on: 687901
Depends on: 703085
Depends on: 706472
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.