Closed Bug 863518 Opened 7 years ago Closed 7 years ago

IonMonkey: Consider types added by loop body when unboxing OSR values

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: bhackett, Unassigned)

References

Details

Attachments

(1 file)

Attached patch patchSplinter Review
After bug 804676, OSR values are fallibly unboxed / type barriered according to the union of the types that the values could have when entering the loop with whatever values the OSR frame has during compilation.  This is fine when compiling on the main thread, as the values in the frame will be exactly those which are present when entering the compiled code.  However, with off thread compilation the variables could change in value between running IonBuilder and when the code is compiled and available to enter.  If a variable changes so that it is no longer in the above union, the compiled code bails out and gets stuck in baseline.

The attached patch fixes this situation by unboxing OSR values according to the union of the above two types *plus* the possible types accumulated for variables by compiling the loop body.  OSR unboxing is deferred until the end of compilation, when all the types for loop phis are known.

This doesn't seem to affect any benchmarks, but the nature of the failure --- likely to inflict large programs with massive and highly non-deterministic performance faults --- makes this worth fixing eagerly.
Attachment #739359 - Flags: review?(dvander)
Attachment #739359 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/9aff2a52d88b
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.