SpiderMonkey's optimizing JIT, IonMonkey, uses different optimization strategies to speed up various operations. The most typical operations that are relevant for fast program execution are property accesses and function calls.
This page documents the meaning of different optimization outcomes.
General outcomes shared between various optimization strategies.
The optimization attempt failed, and the reason was not recorded.
Optimization succeeded.
The optimization has been explicitly disallowed.
Optimization failed because there was no type information associated with an object containing the property. This failure mode is unlikely and occurs if the target object is obtained in some roundabout way.
TODO
The baseline compiler recorded no usable shape information for this operation.
The type of the object is not known. This can happen if the operation sees many different types of objects, and so the type of the input to the operation cannot be resolved to a single type.
Optimization failed because the object containing the property was marked as having unknown properties. This can happen if too many properties are defined on the object, or if delete is used to remove one of the object's properties.
One of the types present in the typeset was a singleton type, preventing the optimization from being enabled.
Optimization failed because the object containing the property did not have a 'singleton' type. Singleton types are assigned to objects that are "one of a kind", such as global objects, literal objects declared in the global scope, and top-level function objects.
The property being accessed is not stored at a known location in the object. This can occur if one of the expected types of objects to be used in this operation has unknown properties, or if different instances of the object store the property at different locations (for example, some instances have the property assigned in a different order than others).
The property being accessed is not stored at a known location in the object. This can occur if the operation is polymorphic on different object types and one or more of the object types contain the property at a different slot than the others.
Optimization failed because the stored in the property could potentially be a non-object value. Since only objects can be uniquely typed, the optimization strategy fails in this case.
The object holding the property is not a typed struct object.
The object whose property is being accessed is not formatted as an unboxed object.
The object whose property is being accessed was previously unboxed but was deoptimized and converted to a native object.
The unboxed property being accessed does not correspond to a field on the typed object.
The type of an unboxed field is not consistent across all the different types of objects it could be accessed from.
The offset of an unboxed field is not consistent across all the different types of objects it could be accessed from.
Optimization failed because somehow the property was accessed in a way that returned a different type than the expected constant. This is an unlikely failure mode, and should not occur.
The object whose property is being accessed is in dictionary mode. Objects which are used in ways that suggest they are hashtables are turned into dictionary objects and their types marked as such.
A prototype object was not found for all the object used by this operation.
Objects used in this operation had differing prototypes.
The property being assigned to is not writable for some types of objects which are used in this operation.
The object being accessed has indexed properties that are exotic (for example, defined as a property on a prototype object and left as a hole in the underlying object).
The array being accessed may have flags that the optimization strategy cannot handle. For example, if the array has sparse indexes, or has indexes that overflow the array's length, the optimization strategy may fail.
The type-system indicates that some arrays at this site should be converted to packed arrays of doubles while others should not. The optimization strategy fails for this condition.
Could not accurately calculate the range attributes of an inline array creation.
Arrays at this element access location have seen negative indexes.
The typed object being accessed at this location may have been neutered (a neutered typed object is one where the underlying byte buffer has been removed or transferred to a worker).
Failed to do range check of element access on a typed object.
The observed type of the target of the property access doesn't guarantee that it is an SIMD object.
The observed type of the target of the property access doesn't guarantee that it is a TypedObject.
Optimization failed because SIMD JIT support was not enabled.
The type observed as being retrieved from this property access did not match an optimizable type.
The property being accessed on the object is not one of the optimizable property names.
Outcomes describing inline cache stubs that were generated.
Optimization outcomes of attempts to inline function calls.
Unable to inline function call. The callee (target) function, f in f(x), is not known at JIT time.
Unable to inline function call. The callee function is not an interpreted function. For example, it could be a native function for which Ion has no built-in specialization.
Unable to inline function call. The interpreted callee function could not be compiled by the Baseline compiler.
Unable to inline function call. The interpreted callee function has a lazy, compiled on-demand script instead of an already compiled script.
Unable to inline function call. Rare. The interpreted callee function is invoked with new but cannot be called as a constructor. Property accessors, Function.prototype, and arrow (=>) functions cannot be called as constructors.
Unable to inline function call. The interpreted callee function has been explicitly blacklisted against Ion compilation.
Unable to inline function call. The interpreted callee function either has too many parameters or is called with too many arguments. These thresholds are subject to change.
Unable to inline function call. The interpreted callee function recurs for more than one level. The first level of recursion is inlinable.
Unable to inline function call. The interpreted callee function contains variables bindings that are closed over. For example, function f() { var x; return function () { x++; } } closes over x in f.
Unable to inline function call. The interpreted callee function requires an arguments object to be created.
Unable to inline function call. The interpreted callee function is being debugged by the Debugger API.
Unable to inline function call. The engine knows nothing definite about the type of the callee function object.
Unable to inline function call. The call site has not been observed to have ever been executed. It lacks observed type information for its arguments, its return value, or both.
Unable to inline function call. The interpreted callee is a bound function generated from Function.prototype.bind that failed some sub-checks. (expand)
Unable to inline function call. Ion does not have built-in specialization for the native (implemented in C++) callee function.
Unable to inline function call. The native callee function was called with an unsupported number of arguments, or calling non-constructing functions with new.
Unable to inline function call. The native callee function was called with arguments with types that the built-in specialization does not support. For example, calling Math functions on objects.
Unable to inline function call. Cannot inline a native constructor (e.g., new Array) because no template object was cached by the Baseline compiler. (expand)