857360 - IonMonkey: LICM shouldn't hoist above instructions that restrict values

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

I've seen this before with shape guards being hoisted and suddenly always hitting, because they are hoisted out of an "if" that made sure only that type occured in that statement.

Now I'm hitting this when enabling inlining of loops. There is an TypeBarrier that gets hoisted and starting to always hit. That decreases our score on e-b 5x :(, because we are bailing on every loop.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Hmm.  So there are some things (e.g. [Constant] DOM getters) that we _do_ in fact want to hoist as much as we can, as long as we can hoist their prereqs...  I guess doing _that_ past conditionals might be hard.  :(