nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Backed out 2 changesets (bug 1850305) for causing assertion failures on TypePolicy.cpp CLOSED TREE

Browse source 
Backed out changeset 2689f838632f (bug 1850305)
Backed out changeset 5fda6c22e8e3 (bug 1850305)
This commit is contained in:
Norisz Fay 2023-09-04 21:11:12 +03:00
parent 8c65b0f5d2
commit e4a95dc345
5 changed files with 7 additions and 46 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

25
js/src/jit/TypePolicy.cpp
View file

@ -43,25 +43,6 @@ template <class T>
return replace->typePolicy()->adjustInputs(alloc, replace);
}
static void SetTypePolicyBailoutKind(MInstruction* newIns,
MInstruction* forIns) {
// Infallible ToFloat32 doesn't bail out.
if (newIns->isToFloat32() && !newIns->isGuard()) {
return;
}
// Ensure we're not introducing TypePolicy bailouts for transpiled CacheIR
// instructions. Unbox operations and other guards should have been inserted
// by the transpiler.
//
// This avoids a performance cliff because frequent TypePolicy bailouts will
// disable Warp compilation instead of invalidating the script.
// See bug 1850305.
MOZ_ASSERT(forIns->bailoutKind() != BailoutKind::TranspiledCacheIR);
newIns->setBailoutKind(BailoutKind::TypePolicy);
}
[[nodiscard]] static bool UnboxOperand(TempAllocator& alloc, MInstruction* def,
unsigned op, MIRType expected) {
MDefinition* in = def->getOperand(op);
@ -70,7 +51,7 @@ static void SetTypePolicyBailoutKind(MInstruction* newIns,
}
auto* replace = MUnbox::New(alloc, in, expected, MUnbox::Fallible);
SetTypePolicyBailoutKind(replace, def);
replace->setBailoutKind(BailoutKind::TypePolicy);
def->block()->insertBefore(def, replace);
def->replaceOperand(op, replace);
@ -132,7 +113,7 @@ bool ArithPolicy::adjustInputs(TempAllocator& alloc, MInstruction* ins) const {
replace = MToNumberInt32::New(alloc, in);
}
SetTypePolicyBailoutKind(replace, ins);
replace->setBailoutKind(BailoutKind::TypePolicy);
ins->block()->insertBefore(ins, replace);
ins->replaceOperand(i, replace);
@ -838,7 +819,7 @@ bool CallPolicy::adjustInputs(TempAllocator& alloc, MInstruction* ins) const {
if (func->type() != MIRType::Object) {
MInstruction* unbox =
MUnbox::New(alloc, func, MIRType::Object, MUnbox::Fallible);
SetTypePolicyBailoutKind(unbox, call);
unbox->setBailoutKind(BailoutKind::TypePolicy);
call->block()->insertBefore(call, unbox);
call->replaceCallee(unbox);

1
js/src/jit/WarpBuilder.cpp
View file

@ -1695,7 +1695,6 @@ bool WarpBuilder::build_EndIter(BytecodeLocation loc) {
bool WarpBuilder::build_CloseIter(BytecodeLocation loc) {
MDefinition* iter = current->pop();
iter = unboxObjectInfallible(iter);
return buildIC(loc, CacheKind::CloseIter, {iter});
}

15
js/src/jit/WarpBuilderShared.cpp
View file

@ -51,18 +51,6 @@ void WarpBuilderShared::pushConstant(const Value& v) {
current->push(cst);
}
MDefinition* WarpBuilderShared::unboxObjectInfallible(MDefinition* def) {
if (def->type() == MIRType::Object) {
return def;
}
MOZ_ASSERT(def->type() == MIRType::Value);
auto* unbox = MUnbox::New(alloc(), def, MIRType::Object, MUnbox::Infallible);
current->add(unbox);
return unbox;
}
MCall* WarpBuilderShared::makeCall(CallInfo& callInfo, bool needsThisCheck,
WrappedFunction* target, bool isDOMCall) {
auto addUndefined = [this]() -> MConstant* {
@ -85,10 +73,9 @@ MInstruction* WarpBuilderShared::makeSpreadCall(CallInfo& callInfo,
current->add(elements);
if (callInfo.constructing()) {
auto* newTarget = unboxObjectInfallible(callInfo.getNewTarget());
auto* construct =
MConstructArray::New(alloc(), target, callInfo.callee(), elements,
callInfo.thisArg(), newTarget);
callInfo.thisArg(), callInfo.getNewTarget());
if (isSameRealm) {
construct->setNotCrossRealm();
}

2
js/src/jit/WarpBuilderShared.h
View file

@ -420,8 +420,6 @@ class WarpBuilderShared {
MConstant* constant(const JS::Value& v);
void pushConstant(const JS::Value& v);
MDefinition* unboxObjectInfallible(MDefinition* def);
MCall* makeCall(CallInfo& callInfo, bool needsThisCheck,
WrappedFunction* target = nullptr, bool isDOMCall = false);
MInstruction* makeSpreadCall(CallInfo& callInfo, bool needsThisCheck,

10
js/src/jit/WarpCacheIRTranspiler.cpp
View file

@ -3853,10 +3853,7 @@ bool WarpCacheIRTranspiler::emitTypedArrayByteLengthDoubleResult(
auto* size = MTypedArrayElementSize::New(alloc(), obj);
add(size);
auto* sizeDouble = MToDouble::New(alloc(), size);
add(sizeDouble);
auto* mul = MMul::New(alloc(), lengthDouble, sizeDouble, MIRType::Double);
auto* mul = MMul::New(alloc(), lengthDouble, size, MIRType::Double);
mul->setCanBeNegativeZero(false);
add(mul);
@ -4952,7 +4949,7 @@ bool WarpCacheIRTranspiler::maybeCreateThis(MDefinition* callee,
MOZ_ASSERT(thisArg->type() == MIRType::MagicIsConstructing ||
thisArg->isPhi());
auto* newTarget = unboxObjectInfallible(callInfo_->getNewTarget());
MDefinition* newTarget = callInfo_->getNewTarget();
auto* createThis = MCreateThis::New(alloc(), callee, newTarget);
add(createThis);
@ -5313,8 +5310,7 @@ bool WarpCacheIRTranspiler::emitCallBoundScriptedFunction(
auto* boundArgs = MLoadFixedSlot::New(
alloc(), callee, BoundFunctionObject::firstInlineBoundArgSlot());
add(boundArgs);
auto* boundArgsObj = unboxObjectInfallible(boundArgs);
elements = MElements::New(alloc(), boundArgsObj);
elements = MElements::New(alloc(), boundArgs);
add(elements);
}