tor-browser

commit 3622a329e9ed8460261f88f94a522b6b70e82503
parent e5054797989f305ecb09f9242abb53d7a94218eb
Author: Iain Ireland <iireland@mozilla.com>
Date:   Mon,  6 Oct 2025 20:44:29 +0000

Bug 1991101: Transition to megamorphic when stub folding limit is reached r=jandem

This makes the microbenchmark in [this comment](https://bugzilla.mozilla.org/show_bug.cgi?id=1991101#c0) ~5x faster.

Differential Revision: https://phabricator.services.mozilla.com/D267131

Diffstat:
M
js/src/jit/BaselineCacheIRCompiler.cpp
 | 
4
++++
M
js/src/jit/ICState.h
 | 
12
++++++++----

2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/js/src/jit/BaselineCacheIRCompiler.cpp b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -2583,7 +2583,11 @@ static bool AddToFoldedStub(JSContext* cx, const CacheIRWriter& writer,
   }
 
   // Limit the maximum number of shapes we will add before giving up.
+  // If we give up, transition the stub.
   if (foldedShapes->length() == MaxFoldedShapes) {
+    MOZ_ASSERT(fallback->state().mode() != ICState::Mode::Generic);
+    fallback->state().forceTransition();
+    fallback->discardStubs(cx->zone(), icEntry);
     return false;
   }
 
diff --git a/js/src/jit/ICState.h b/js/src/jit/ICState.h
@@ -119,13 +119,17 @@ class ICState {
     if (!shouldTransition()) {
       return false;
     }
+    forceTransition();
+    return true;
+  }
+
+  MOZ_ALWAYS_INLINE void forceTransition() {
     if (numFailures_ >= maxFailures() || mode() == Mode::Megamorphic) {
       transition(Mode::Generic);
-      return true;
+    } else {
+      MOZ_ASSERT(mode() == Mode::Specialized);
+      transition(Mode::Megamorphic);
     }
-    MOZ_ASSERT(mode() == Mode::Specialized);
-    transition(Mode::Megamorphic);
-    return true;
   }
 
   void reset() {