SpiderMonkey's optimizing JIT, IonMonkey, uses a number of different optimization strategies to speed up various operations. The most commonplace operations that are relevant for fast program execution are property accesses and function calls.
This page documents the meaning of different optimization outcomes.
General outcomes shared between various optimization strategies.
The optimization attempt failed, and the reason was not recorded.
Optimization succeeded.
The optimization has been explicitly disallowed.
Optimization failed because there was no type information associated with object containing the property. This failure mode is unlikely, and occurs if the target object is obtained in some roundabout way.
TODO
The baseline compiler recorded no usable shape information for this operation.
The type of the object is not known. This can happen if the operation sees many different types of objects, and so the type of the input to the operation cannot be resolved to a single type.
Optimization failed because the object containing the property was marked as having unknown properties. This can happen if too many properties are defined on the object, or if delete is used to remove one of the object's properties.
One of the types present in the typeset was a singleton type, preventing the optimization from being enabled.
Optimization failed because the object containing the property did not have a ‘singleton’ type. Singleton types are assigned to objects that are “one of a kind”, such as global objects, literal objects declared in the global scope, and top-level function objects.
The property being accessed is not stored at a known location in the object. This can occur if one of the expected types of objects to be used in this operation has unknown properties, or if different instances of the object store the property at different locations (for example, some instances have the property assigned in a different order than others).
The property being accessed is not stored at a known location in the object. This can occur if the operation is polymorphic on different object types and one or more of the object types contain the property at a different slot than the others.
Optimization failed because the stored in the property could potentially be a non-object value. Since only objects can be uniquely typed, the optimization strategy fails in this case.
The object holding the property is not a typed struct object.
The object whose property is being accessed is not formatted as an unboxed object.
The object whose property is being accessed was previously unboxed, but was deoptimized and converted to a native object.
The unboxed property being accessed does not correspond to a field on typed object.
The type of an unboxed field is not consistent across all the different types of objects it could be accessed from.
The offset of an unboxed field is not consistent across all the different types of objects it could be accessed from.
Optimization failed because somehow the property was accessed in a way that returned a different type than the expected constant. This is an unlikely failure mode, and should not occur.
The object whose property is being accessed is in dictionary mode. Objects which are used in ways that suggest they are hashtables, are turned into dictionary objects and their types marked as such.
A prototype object was not found for all the object used by this operation.
Objects used in this operation had differing prototypes.
The property being assigned to is not writable for some types of objects which are used in this operation.
The object being accessed has indexed properties that are exotic (for example, defined as a property on a prototype object and left as a hole in the underlying object).
The array being accessed may have flags that the optimization strategy cannot handle. For example, if the array has sparse indexes, or has indexes that overflow the array's length, the optimization strategy may fail.
The type-system indicates that some arrays at this site should be converted to packed arrays of doubles, while others should not. The optimization strategy fails for this condition.
Could not accurately calculate the range attributes of an inline array creation.
Arrays at this element access location have seen negative indexes.
The typed object being accessed at this location may have been neutered (a neutered typed object is one where the underlying byte buffer has been removed or transferred to a worker).
Failed to do range check of element access on a typed object.
The observed type of the target of the property access doesn't guarantee that it is a SIMD object.
The observed type of the target of the property access doesn't guarantee that it is a TypedObject.
The observed type of the target of the property access doesn't guarantee that it is a TypedArray.
The observed type of the target of the property access doesn't guarantee that it is a String.
Typed Arrays of uint32 values are not yet fully optimized.
The element access has been observed to be out of the length bounds of the string being accessed.
IonMonkey does not generate inline caches for element accesses on target values which may be strings.
IonMonkey does not generate inline caches for indexed element accesses on target values which may be non-native objects (e.g. DOM elements).
IonMonkey does not generate inline caches for element reads in which the keys have never been observed to be a String, Symbol, or Int32.
IonMonkey only generates inline caches for element accesses which are either on dense objects (e.g. dense Arrays), or Typed Arrays.
Optimization failed because SIMD JIT support was not enabled.
The type observed as being retrieved from this property access did not match an optimizable type.
The property being accessed on the object is not one of the optimizable property names.
Inlining was abandoned because the inlining call path was repeated. A repeated call path is indicative of a potentially mutually recursive function call chain.
Method has been successfully inlined.
Successfully optimized a call to a DOM getter or setter function.
Successfully optimized a guarded monomorphic property access. This property access is about twice as expensive as a definite property access. A guarded monomorphic property access is basically a direct memory load from an object, guarded by a type or shape check. In pseucodcode:
if HiddenType(obj) === CONSTANT_TYPE:
return obj[CONSTANT_SLOT_OFFSET]
else
BAILOUT()
Successfully optimized a guarded polymorphic property access. This property access is similar to a monomorphic property access, except that multiple different hidden types have been observed, and each of them are being checked for. In pseudocode:
if HiddenType(obj) === CONSTANT_TYPE_1:
return obj[CONSTANT_SLOT_OFFSET_1]
elif HiddenType(obj) === CONSTANT_TYPE_2:
return obj[CONSTANT_SLOT_OFFSET_2]
...
elif HiddenType(obj) === CONSTANT_TYPE_K:
return obj[CONSTANT_SLOT_OFFSET_K]
else
BAILOUT()
Outcomes describing inline cache stubs that were generated.
Generic success condition for generating an optimized inline cache stub.
An inline cache property read which loads a value from a known slot location within an object.
An inline cache property read which calls a getter function.
An inline cache property read which retrieves the length of an array object.
An inline cache property read which retrieves an value from an unboxed object.
An inline cache property read which retrieves an value from the expando component of an unboxed object.
An inline cache property read which retrieves the length of an unboxed array object.
An inline cache property read which retrieves the length of an typed array object.
An inline cache property read which retrieves a shadowed property from a DOM object. A shadowed property is an inbuilt DOM property that has been overwritten by JS code.
An inline cache property read which retrieves an unshadowed property from a DOM object.
An inline cache property read which retrieves the property by calling into a generic proxy trap.
An inline cache property read which reads the length value from an arguments object.
An inline cache property write which sets a value to a known slot location in an object.
An inline cache property write which sets the value by calling into a generic proxy trap.
An inline cache property write which sets a shadowed property from a DOM object. A shadowed property is an inbuilt DOM property that has been overwritten by JS code.
An inline cache property write which sets an unshadowed property on an DOM object.
An inline cache property write which calls a setter function on an object.
An inline cache property write which adds a new slot to an object, because the object is known to not have such a property already.
An inline cache property write which sets an unboxed value on an unboxed object.
An inline cache element read which loads a value from a known property slot in an object.
An inline cache element read which calls a getter function on the object.
An inline cache element read which loads an unboxed value from a known property slot on an unboxed object.
An inline cache element read which loads an element from a dense array.
An inline cache element read which loads an element from a dense array which might have a hole.
An inline cache element read which loads an element from a typed array.
An inline cache element read which loads an element from an arguments object.
An inline cache element read which loads an element from an arguments object in strict mode.
An inline cache element write which sets an element on a dense array.
An inline cache element write which sets an element on a typed array.
An inline cache element which loads a bare variable name from a slot on a scope chain object.
An inline cache element which loads a bare variable name by calling a getter function on the global object.
Optimization outcomes of attempts to inline function calls.
Generic failure-to-inline outcome.
Cannot inline a class constructor function.
Inlining stopped because inlining depth was exceeded.
Inlining stopped because the total bytecode length of all inlined functions exceeded a threshold.
Inlining was aborted because the caller function is very large.
Inlining was aborted because the callee function is very large.
Inlining was aborted because the callee is known to inline a lot of code.
Inlining was aborted because the callee is not hot enough.
This failure mode relates to inlining a method call of the form:
obj.method()
where a hidden type check on the target object reveals the method to be inlined. If the property access for method does not identify the method to be inlined, the inlining fails with this code.
Inlining attempt of native function was aborted because the hidden type for the function, or the result of the function, was not compatible with one of the known inline-able native functions.
Unable to inline function call. The callee (target) function, f in f(x), is not known at JIT time.
Unable to inline function call. The callee function is not an interpreted function. For example, it could be a native function for which Ion has no built-in specialization.
Unable to inline function call. The interpreted callee function could not be compiled by the Baseline compiler.
Unable to inline function call. The interpreted callee function has a lazy, compiled on-demand script instead of an already compiled script.
Unable to inline function call. Rare. The interpreted callee function is invoked with new but cannot be called as a constructor. Property accessors, Function.prototype, and arrow (=>) functions cannot be called as constructors.
Unable to inline function call. The interpreted callee function has been explicitly blacklisted against Ion compilation.
Unable to inline function call. The interpreted callee function either has too many parameters or is called with too many arguments. These thresholds are subject to change.
Unable to inline function call. The interpreted callee function recurs for more than one level. The first level of recursion is inlineable.
Unable to inline function call. The interpreted callee function contains variables bindings that are closed over. For example, function f() { var x; return function () { x++; } } closes over x in f.
Unable to inline function call. The interpreted callee function requires an arguments object to be created.
Unable to inline function call. The interpreted callee function is being debugged by the Debugger API.
Unable to inline function call. The engine knows nothing definite about the type of the callee function object.
Unable to inline function call. The call site has not been observed to have ever been executed. It lacks observed type information for its arguments, its return value, or both.
Unable to inline function call. The interpreted callee is a bound function generated from Function.prototype.bind that failed some sub-checks. (expand)
Unable to inline function call. Ion does not have built-in specialization for the native (implemented in C++) callee function.
Unable to inline function call. The native callee function was called with an unsupported number of arguments, or calling non-constructing functions with new.
Unable to inline function call. The native callee function was called with arguments with types that the built-in specialization does not support. For example, calling Math functions on objects.
Unable to inline function call. Cannot inline a native constructor (e.g., new Array) because no template object was cached by the Baseline compiler. (expand)