797825 - IonMonkey: Inline Array.prototype.concat

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

See bug 797401 comment 6 and 7.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

The TI code is the most complicated, but it's just like the JM+TI implementation.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 668001 [details] [diff] [review]
Patch

Review of attachment 668001 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/MCallOptimize.cpp
@@ +313,5 @@
>  }
>  
>  IonBuilder::InliningStatus
> +IonBuilder::inlineArrayConcat(uint32 argc, bool constructing)
> +{

Wow, you're right: these checks are quite complicated. Is all of this to minimize the amount of guarding needed before taking the array_concat_dense path?

Seems fine for now, but very unfortunate. V8 doesn't seem to have to do any path like this, so I wonder if self-hosting could help.

::: js/src/ion/MIR.h
@@ +3754,5 @@
> +    TypePolicy *typePolicy() {
> +        return this;
> +    }
> +    AliasSet getAliasSet() const {
> +        return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);

Are these alias sets needed? Do the input arrays get modified, or are we just creating a new array?

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/497a3ed4573a

Try: https://tbpl.mozilla.org/?tree=Try&rev=c7e794ac8926

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/497a3ed4573a

Comment 5

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Comment on attachment 668001 [details] [diff] [review]
Patch

Review of attachment 668001 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/MCallOptimize.cpp
@@ +315,5 @@
>  IonBuilder::InliningStatus
> +IonBuilder::inlineArrayConcat(uint32 argc, bool constructing)
> +{
> +    if (argc != 1 || constructing)
> +        return InliningStatus_NotInlined;

argc != 1 or argc != 2?

Comment 6

[Jan de Mooij [:jandem]]

(In reply to :Ms2ger from comment #5)
> 
> argc != 1 or argc != 2?

argc != 1 is okay to handle x.concat(y). I also verified the patch helps some micro-benchmarks and bug 797401, if this check was wrong the patch wouldn't do anything.

Thanks for checking!