Bug 99261

Summary: Baseline array profiling should be less accurate, and DFG OSR exit should update array profiles on CheckArray and CheckStructure failure
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on: 98997    
Bug Blocks: 98606    
Attachments:
Description Flags
the patch oliver: review+

Filip Pizlo
Reported 2012-10-13 23:07:46 PDT
This would make our various mechanisms of array speculation work as well as all of our other speculation modes.
Attachments
the patch (22.97 KB, patch)
2012-10-18 15:15 PDT, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2012-10-14 16:32:37 PDT
It appears that this might just work already. If we exit due to an invalid structure on an array access, then the baseline JIT will log *only* the invalid structure(s) in the array profile. Subsequent recompiles will see only one of the invalid structures, and LUBing will conclude that the structure has gone polymorphic. I will keep this open for now, but I suspect that this is not really a bug. I mean, it could be good to unify how speculations work and make everything use OSR exit profiling, but this doesn't really smell like a bug right now.
Filip Pizlo
Comment 2 2012-10-18 14:29:30 PDT
Actually. Right now array profiles are too accurate. They will catch *every* array type that flows through them, when what we really want is for them to catch the high probability array types. Renaming the bug.
Filip Pizlo
Comment 3 2012-10-18 15:15:03 PDT
Created attachment 169483 [details] the patch
Filip Pizlo
Comment 4 2012-10-19 12:47:13 PDT
Landed in http://trac.webkit.org/changeset/131868
Note You need to log in before you can comment on or make changes to this bug.