715772 - IonMonkey: Add Expected bailout MIR & LIR instructions.

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Nicolas B. Pierron [:nbp]]

Such instruction could be useful to continue the compilation for cases which are not yet implemented or for cases which won't be handled.  One pattern generated by adjustInput type policies is

MUnbox(boxAt(defWithUnexpectedType), expectedType, MUnbox::Fallible)

to produce failures.

Having a dedicated instruction could help collecting all MIR after it, which may reduce remove some basic block jumps in cases of infrequent branches such as:

for (let i = 0; i < 65535; i++) {
  if (i == 3000) {
    // some instruction where TypeSet are NULL which may produce such bailout.
  }
}

Comment 1

[kosver]

how can I assign myself?

Comment 2

[Nicolas B. Pierron [:nbp]]

Change the status below, and click on the (take) link on the right of "Assigned To".
Then save changes ;)

Comment 3

[kosver]

I can only comment / add patches, but can't change the status. I've had the same with bug717466. I had to ask my brother to assign it to me. Is this normal?

Comment 4

[Nicolas B. Pierron [:nbp]]

Check for permission (editbugs) in your preferences and check that you don't have a link to unfold details about the bug.

In the mean time, I assigned you to the bug.

Comment 5

[kosver]

Attachment: WIP (with debug cruft)

I see two ways in completing this:
1. Add the bailout and completely change the graph to reflect this bailout. So  remove instructions after the bailout, and update the successors and predecessor in the graph.
2. Just add the bailout and make sure the instructions after the bailout can be compiled. This is needed e.g. when a bailout was inserted in the TypeAnalisis phase. There is the fallible unbox used for doing the bailout. If you replace this by a proper bailout, the following instructions will expect a certain type. So therefor the bailout should adapt to the correct type.

I started with the full-blown method described in (1) and I'm already in pretty far stadium. But I'm looking for feedback if this is the implementation we should go for.

The patch does following changes:
- Add MBailout and LBailout
- Add function to MBasicBlock to convert it into a Bailout. Will remove successors (if it is only reachable from this MBasicBlock), remove instructions after the bailout, adapt kind when breaking loops, remove phis (when the uses are removed because of the removed instructions)
- In the SplitCriticalEdges phase, it will converts the inserted Bailouts from the ionbuilder phase
- The TypeAnalisis (conversion) phase is adapted, so it supports when the instructions are removed.
- MPhi is adapted, so the operands can be removed
- EliminateDeadPhis phase is adapted, so it also removes phis with only one operand

So far I have tested it successfully convert blocks into a bailout. Though there is still a problem with the generation of safepoints. With advanced graphs, it doesn't include all needed variables to bailout.

Comment 6

[Nicolas B. Pierron [:nbp]]

This bug was resolved with the addition of the bailout() shell function.