Sink has been partially enabled since the creation of this bug. The Sink phase contains 2 parts, the first part analyze where instructions are consumed, while the second part decides how to modify these instructions.

Currently, we only modify instructions by flagging them as recovered as bailout if there is no consumer except ResumePoints.

What has been disabled in the end of 2014 is the ability to duplicate instructions in branches which are consuming these instructions while flagging existing instructions as being recovered on bailout.

Today, what is disable is the code which convert the following:

function titanic(a) {
  x = 1 + a;
  if (…) {
    print(x)
  } else {
    // does not use x.
  }
}

into:

function titanic(a) {
  // x = 1 + a; is flagged as RecoveredOnBailout.
  if (…) {
    x = 1 + a; // Cloned here
    print(x)
  } else {
    // does not use x.
  }
}

Iain, I will let you choose what to do with this bug. Either to drop it or to give it a chance.

Removing it would probably be as simple as trashing the following lines: https://searchfox.org/mozilla-central/source/js/src/jit/Sink.cpp#114-247

I think it's worth trying to get this working.

I'll test a local build with --ion-sink=on to see what fails. Once we're passing jit-tests, we can consider fuzzing it.

Existing jit-tests don't fail with --ion-sink=on. There's a failing testcase attached to bug 1907700, but it's unlikely to be the only culprit, since it depends on code added well after this bug was opened.