119874 2013-08-15 16:52:15 -0700 Sometimes, the DFG uses a GetById for typed array length accesses despite profiling data that indicates that it's a typed array length access 2013-08-16 10:17:40 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 fpizlo fpizlo barraclough ggaren mark.lam mhahnenberg msaboff oliver sam oldest_to_newest 917780 0 fpizlo 2013-08-15 16:52:15 -0700 It's a confusion between heuristics in DFG::ArrayMode that are assuming that you'll use ForceExit if array profiles are empty, the JIT creating empty profiles sometimes for typed array length accesses, and the FixupPhase assuming that a ForceExit ArrayMode means that it should continue using a generic GetById. 917781 1 208870 fpizlo 2013-08-15 16:53:14 -0700 Created attachment 208870 the patch 917782 2 208870 mhahnenberg 2013-08-15 17:03:50 -0700 Comment on attachment 208870 the patch r=me to fwiw. 917993 3 fpizlo 2013-08-16 10:17:40 -0700 Landed in http://trac.webkit.org/changeset/154157 208870 2013-08-15 16:53:14 -0700 2013-08-15 17:03:50 -0700 the patch blah.patch text/plain 3518 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU0MTUyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBA CisyMDEzLTA4LTE1ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg U29tZXRpbWVzLCB0aGUgREZHIHVzZXMgYSBHZXRCeUlkIGZvciB0eXBlZCBhcnJheSBsZW5ndGgg YWNjZXNzZXMgZGVzcGl0ZSBwcm9maWxpbmcgZGF0YSB0aGF0IGluZGljYXRlcyB0aGF0IGl0J3Mg YSB0eXBlZCBhcnJheSBsZW5ndGggYWNjZXNzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0xMTk4NzQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgIEl0IHdhcyBhIGNvbmZ1c2lvbiBiZXR3ZWVuIGhl dXJpc3RpY3MgaW4gREZHOjpBcnJheU1vZGUgdGhhdCBhcmUgYXNzdW1pbmcgdGhhdAorICAgICAg ICB5b3UnbGwgdXNlIEZvcmNlRXhpdCBpZiBhcnJheSBwcm9maWxlcyBhcmUgZW1wdHksIHRoZSBK SVQgY3JlYXRpbmcgZW1wdHkgcHJvZmlsZXMKKyAgICAgICAgc29tZXRpbWVzIGZvciB0eXBlZCBh cnJheSBsZW5ndGggYWNjZXNzZXMsIGFuZCB0aGUgRml4dXBQaGFzZSBhc3N1bWluZyB0aGF0IGEK KyAgICAgICAgRm9yY2VFeGl0IEFycmF5TW9kZSBtZWFucyB0aGF0IGl0IHNob3VsZCBjb250aW51 ZSB1c2luZyBhIGdlbmVyaWMgR2V0QnlJZC4KKworICAgICAgICBUaGlzIGZpeGVzIHRoZSBjb25m dXNpb24uCisKKyAgICAgICAgKiBkZmcvREZHRml4dXBQaGFzZS5jcHA6CisgICAgICAgIChKU0M6 OkRGRzo6Rml4dXBQaGFzZTo6Zml4dXBOb2RlKToKKwogMjAxMy0wOC0xNSAgRmlsaXAgUGl6bG8g IDxmcGl6bG9AYXBwbGUuY29tPgogCiAgICAgICAgIFJlbW92ZSBzb21lIGNvZGUgZHVwbGljYXRp b24uCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0ZpeHVwUGhhc2UuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHRml4dXBQaGFzZS5jcHAJ KHJldmlzaW9uIDE1NDE0MSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHRml4dXBQ aGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTcyNSw3ICs3MjUsOCBAQCBwcml2YXRlOgogICAg ICAgICAgICAgYnJlYWs7CiAgICAgICAgIH0KICAgICAgICAgICAgIAotICAgICAgICBjYXNlIEdl dEJ5SWQ6IHsKKyAgICAgICAgY2FzZSBHZXRCeUlkOgorICAgICAgICBjYXNlIEdldEJ5SWRGbHVz aDogewogICAgICAgICAgICAgaWYgKCFub2RlLT5jaGlsZDEoKS0+c2hvdWxkU3BlY3VsYXRlQ2Vs bCgpKQogICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgc2V0VXNlS2luZEFuZFVu Ym94SWZQcm9maXRhYmxlPENlbGxVc2U+KG5vZGUtPmNoaWxkMSgpKTsKQEAgLTc0MSw5ICs3NDIs MTkgQEAgcHJpdmF0ZToKICAgICAgICAgICAgICAgICBDb25jdXJyZW50SklUTG9ja2VyIGxvY2tl cihwcm9maWxlZEJsb2NrLT5tX2xvY2spOwogICAgICAgICAgICAgICAgIGFycmF5UHJvZmlsZS0+ Y29tcHV0ZVVwZGF0ZWRQcmVkaWN0aW9uKGxvY2tlciwgcHJvZmlsZWRCbG9jayk7CiAgICAgICAg ICAgICAgICAgYXJyYXlNb2RlID0gQXJyYXlNb2RlOjpmcm9tT2JzZXJ2ZWQobG9ja2VyLCBhcnJh eVByb2ZpbGUsIEFycmF5OjpSZWFkLCBmYWxzZSk7Ci0gICAgICAgICAgICAgICAgYXJyYXlNb2Rl ID0gYXJyYXlNb2RlLnJlZmluZShub2RlLT5jaGlsZDEoKS0+cHJlZGljdGlvbigpLCBub2RlLT5w cmVkaWN0aW9uKCkpOwotICAgICAgICAgICAgfSBlbHNlCi0gICAgICAgICAgICAgICAgYXJyYXlN b2RlID0gYXJyYXlNb2RlLnJlZmluZShub2RlLT5jaGlsZDEoKS0+cHJlZGljdGlvbigpLCBub2Rl LT5wcmVkaWN0aW9uKCkpOworICAgICAgICAgICAgICAgIGlmIChhcnJheU1vZGUudHlwZSgpID09 IEFycmF5OjpVbnByb2ZpbGVkKSB7CisgICAgICAgICAgICAgICAgICAgIC8vIEZvciBub3JtYWwg YXJyYXkgb3BlcmF0aW9ucywgaXQgbWFrZXMgc2Vuc2UgdG8gdHJlYXQgVW5wcm9maWxlZAorICAg ICAgICAgICAgICAgICAgICAvLyBhY2Nlc3NlcyBhcyBGb3JjZUV4aXQgYW5kIGdldCBtb3JlIGRh dGEgcmF0aGVyIHRoYW4gdXNpbmcKKyAgICAgICAgICAgICAgICAgICAgLy8gcHJlZGljdGlvbnMg YW5kIHRoZW4gcG9zc2libHkgZW5kaW5nIHVwIHdpdGggYSBHZW5lcmljLiBCdXQgaGVyZSwKKyAg ICAgICAgICAgICAgICAgICAgLy8gd2UgdHJlYXQgYW55dGhpbmcgdGhhdCBpcyBVbnByb2ZpbGVk IGFzIEdlbmVyaWMgYW5kIGtlZXAgdGhlCisgICAgICAgICAgICAgICAgICAgIC8vIEdldEJ5SWQu IEkuZS4gRm9yY2VFeGl0ID0gR2VuZXJpYy4gU28sIHRoZXJlIGlzIG5vIGhhcm0gLSBhbmQgb25s eQorICAgICAgICAgICAgICAgICAgICAvLyBwcm9maXQgLSBmcm9tIHRyZWF0aW5nIHRoZSBVbnBy b2ZpbGVkIGNhc2UgYXMKKyAgICAgICAgICAgICAgICAgICAgLy8gU2VsZWN0VXNpbmdQcmVkaWN0 aW9ucy4KKyAgICAgICAgICAgICAgICAgICAgYXJyYXlNb2RlID0gQXJyYXlNb2RlKEFycmF5OjpT ZWxlY3RVc2luZ1ByZWRpY3Rpb25zKTsKKyAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICB9 CisgICAgICAgICAgICAKKyAgICAgICAgICAgIGFycmF5TW9kZSA9IGFycmF5TW9kZS5yZWZpbmUo bm9kZS0+Y2hpbGQxKCktPnByZWRpY3Rpb24oKSwgbm9kZS0+cHJlZGljdGlvbigpKTsKICAgICAg ICAgICAgIAogICAgICAgICAgICAgaWYgKGFycmF5TW9kZS50eXBlKCkgPT0gQXJyYXk6OkdlbmVy aWMpIHsKICAgICAgICAgICAgICAgICAvLyBDaGVjayBpZiB0aGUgaW5wdXQgaXMgc29tZXRoaW5n IHRoYXQgd2UgY2FuJ3QgZ2V0IGFycmF5IGxlbmd0aCBmb3IsIGJ1dCBmb3Igd2hpY2ggd2UKQEAg LTc3MSwxMiArNzgyLDYgQEAgcHJpdmF0ZToKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICB9 CiAgICAgICAgICAgICAKLSAgICAgICAgY2FzZSBHZXRCeUlkRmx1c2g6IHsKLSAgICAgICAgICAg IGlmIChub2RlLT5jaGlsZDEoKS0+c2hvdWxkU3BlY3VsYXRlQ2VsbCgpKQotICAgICAgICAgICAg ICAgIHNldFVzZUtpbmRBbmRVbmJveElmUHJvZml0YWJsZTxDZWxsVXNlPihub2RlLT5jaGlsZDEo KSk7Ci0gICAgICAgICAgICBicmVhazsKLSAgICAgICAgfQotICAgICAgICAgICAgCiAgICAgICAg IGNhc2UgQ2hlY2tFeGVjdXRhYmxlOgogICAgICAgICBjYXNlIENoZWNrU3RydWN0dXJlOgogICAg ICAgICBjYXNlIFN0cnVjdHVyZVRyYW5zaXRpb25XYXRjaHBvaW50Ogo=