70777 2011-10-24 16:45:24 -0700 Object-or-other branch speculation may corrupt the state for OSR if the child of the branch is an integer 2011-10-25 16:25:07 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 70246 1 fpizlo webkit-unassigned oldest_to_newest 489767 0 fpizlo 2011-10-24 16:45:24 -0700 The "other" part of the speculation (i.e. null-or-undefined) masks on ~8 (null-or-undefined bit). But it does so in place. Hence, if the operand to the branch was 8 then the branch will take the wrong path in the old JIT. 489769 1 112274 fpizlo 2011-10-24 16:47:15 -0700 Created attachment 112274 the patch 489779 2 fpizlo 2011-10-24 16:58:22 -0700 Richards really benefits from the branch optimizations and seems to take a hit. But it's neutral overall. Benchmark report for SunSpider, V8, and Kraken. VMs tested: "TipOfTree" at /Volumes/Data/pizlo/OpenSource/WebKitBuild/Release/jsc "FixBranch" at /Volumes/Data/pizlo/secondary/OpenSource/WebKitBuild/Release/jsc Collected 12 samples per benchmark/VM, with 4 VM invocations per benchmark. Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds. TipOfTree FixBranch SunSpider: 3d-cube 7.9384+-0.0494 7.9363+-0.0518 3d-morph 8.6980+-0.1233 8.5521+-0.1579 might be 1.0171x faster 3d-raytrace 8.1432+-0.0727 ? 8.1729+-0.0985 ? access-binary-trees 1.6920+-0.0055 1.6919+-0.0060 access-fannkuch 7.8000+-0.0285 ^ 7.7445+-0.0225 ^ definitely 1.0072x faster access-nbody 4.5306+-0.0134 4.5245+-0.0027 access-nsieve 3.1673+-0.0173 ! 3.1966+-0.0087 ! definitely 1.0093x slower bitops-3bit-bits-in-byte 1.3210+-0.0104 1.3144+-0.0109 bitops-bits-in-byte 5.2722+-0.0163 5.2615+-0.0244 bitops-bitwise-and 3.4714+-0.0460 3.4662+-0.0625 bitops-nsieve-bits 5.6673+-0.0371 5.6670+-0.0352 controlflow-recursive 2.3539+-0.0264 2.3293+-0.0046 might be 1.0106x faster crypto-aes 7.6246+-0.0861 7.5438+-0.0482 might be 1.0107x faster crypto-md5 2.8773+-0.0218 2.8677+-0.0164 crypto-sha1 2.6731+-0.0174 ^ 2.6423+-0.0127 ^ definitely 1.0116x faster date-format-tofte 10.6837+-0.1644 10.6143+-0.1171 date-format-xparb 9.8756+-0.1156 ? 10.0095+-0.1667 ? might be 1.0136x slower math-cordic 7.7185+-0.2471 ? 7.8374+-0.2802 ? might be 1.0154x slower math-partial-sums 10.6491+-0.0487 10.5895+-0.0367 math-spectral-norm 2.8719+-0.0050 ? 2.8867+-0.0143 ? regexp-dna 13.3035+-0.1700 13.2140+-0.1360 string-base64 4.4205+-0.0191 4.4179+-0.0159 string-fasta 7.1307+-0.0658 7.1307+-0.0638 string-tagcloud 13.3751+-0.1564 13.2063+-0.1645 might be 1.0128x faster string-unpack-code 22.7722+-0.2173 ? 22.7769+-0.2030 ? string-validate-input 5.6223+-0.0528 ! 5.7518+-0.0505 ! definitely 1.0230x slower <arithmetic> * 6.9867+-0.0240 6.9748+-0.0161 <geometric> 5.6510+-0.0154 5.6437+-0.0107 <harmonic> 4.4720+-0.0112 4.4646+-0.0103 TipOfTree FixBranch V8: crypto 81.3570+-0.2335 ? 81.3984+-0.1635 ? deltablue 194.6537+-0.7664 ? 195.6561+-1.0668 ? earley-boyer 110.5192+-0.3554 ! 112.0030+-0.6601 ! definitely 1.0134x slower raytrace 69.5256+-0.6573 68.9732+-0.4084 regexp 124.7805+-0.6029 124.2504+-0.3944 richards 143.3091+-0.2937 ! 146.3927+-0.5736 ! definitely 1.0215x slower splay 125.7630+-0.4251 125.5294+-0.5213 <arithmetic> 121.4154+-0.2404 ! 122.0290+-0.2727 ! definitely 1.0051x slower <geometric> * 115.4650+-0.2748 ? 115.8978+-0.2501 ? <harmonic> 109.7065+-0.3320 ? 109.9405+-0.2387 ? TipOfTree FixBranch Kraken: ai-astar 834.8711+-0.5610 825.2549+-11.2776 might be 1.0117x faster audio-beat-detection 211.5345+-1.7424 ! 215.8835+-1.7716 ! definitely 1.0206x slower audio-dft 260.0991+-2.9561 259.1979+-2.6525 audio-fft 135.5689+-0.5056 ^ 133.2889+-0.8830 ^ definitely 1.0171x faster audio-oscillator 291.1467+-1.0564 290.8358+-1.0879 imaging-darkroom 448.5026+-1.8551 ? 455.2396+-12.4493 ? might be 1.0150x slower imaging-desaturate 237.8334+-0.1012 ! 245.1353+-0.0802 ! definitely 1.0307x slower imaging-gaussian-blur 620.8662+-0.1434 ? 620.9534+-0.1802 ? json-parse-financial 70.5284+-0.3330 ^ 69.3177+-0.2861 ^ definitely 1.0175x faster json-stringify-tinderbox 79.6113+-0.3721 78.9564+-0.5766 stanford-crypto-aes 151.4079+-1.4399 ? 152.7339+-1.7077 ? stanford-crypto-ccm 114.7261+-0.5102 ? 115.1364+-0.6121 ? stanford-crypto-pbkdf2 236.8052+-1.6053 ? 240.0376+-2.1284 ? might be 1.0137x slower stanford-crypto-sha256-iterative 85.7031+-0.5468 ? 85.8561+-0.2754 ? <arithmetic> * 269.9432+-0.3567 ? 270.5591+-0.4353 ? <geometric> 205.3784+-0.3440 ? 205.8707+-0.4115 ? <harmonic> 161.6929+-0.2977 161.5167+-0.2929 TipOfTree FixBranch All benchmarks: <arithmetic> 102.3567+-0.1265 ? 102.6250+-0.1473 ? <geometric> 25.8277+-0.0535 ? 25.8422+-0.0311 ? <harmonic> 7.8802+-0.0196 7.8675+-0.0176 TipOfTree FixBranch Geomean of preferred means: <scaled-result> 60.1631+-0.1213 ? 60.2499+-0.0815 ? 489781 3 fpizlo 2011-10-24 16:59:31 -0700 Landed in http://trac.webkit.org/changeset/98299 112274 2011-10-24 16:47:15 -0700 2011-10-24 16:52:04 -0700 the patch branchother_patch_1.diff text/plain 5296 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTgyOTgpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAK KzIwMTEtMTAtMjQgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBP YmplY3Qtb3Itb3RoZXIgYnJhbmNoIHNwZWN1bGF0aW9uIG1heSBjb3JydXB0IHRoZSBzdGF0ZSBm b3IgT1NSIGlmIHRoZSBjaGlsZCBvZiB0aGUKKyAgICAgICAgYnJhbmNoIGlzIGFuIGludGVnZXIK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTcwNzc3CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBkZmcvREZH U3BlY3VsYXRpdmVKSVQ2NC5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6U3BlY3VsYXRpdmVKSVQ6 OmVtaXRPYmplY3RPck90aGVyQnJhbmNoKToKKwogMjAxMS0xMC0yNCAgRmlsaXAgUGl6bG8gIDxm cGl6bG9AYXBwbGUuY29tPgogCiAgICAgICAgIG9wX25ld19hcnJheV9idWZmZXIgaXMgbm90IGlu bGluZWQgY29ycmVjdGx5CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1 bGF0aXZlSklUNjQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcv REZHU3BlY3VsYXRpdmVKSVQ2NC5jcHAJKHJldmlzaW9uIDk4Mjk2KQorKysgU291cmNlL0phdmFT Y3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVDY0LmNwcAkod29ya2luZyBjb3B5KQpAQCAt NjgyLDcgKzY4Miw5IEBAIHZvaWQgU3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGVMb2dpY2FsTm90KE4K IHZvaWQgU3BlY3VsYXRpdmVKSVQ6OmVtaXRPYmplY3RPck90aGVyQnJhbmNoKE5vZGVJbmRleCBu b2RlSW5kZXgsIEJsb2NrSW5kZXggdGFrZW4sIEJsb2NrSW5kZXggbm90VGFrZW4sIHZvaWQgKnZw dHIsIGJvb2wgbmVlZFNwZWN1bGF0aW9uQ2hlY2spCiB7CiAgICAgSlNWYWx1ZU9wZXJhbmQgdmFs dWUodGhpcywgbm9kZUluZGV4KTsKKyAgICBHUFJUZW1wb3Jhcnkgc2NyYXRjaCh0aGlzKTsKICAg ICBHUFJSZWcgdmFsdWVHUFIgPSB2YWx1ZS5ncHIoKTsKKyAgICBHUFJSZWcgc2NyYXRjaEdQUiA9 IHNjcmF0Y2guZ3ByKCk7CiAgICAgCiAgICAgTWFjcm9Bc3NlbWJsZXI6Okp1bXAgbm90Q2VsbCA9 IG1faml0LmJyYW5jaFRlc3RQdHIoTWFjcm9Bc3NlbWJsZXI6Ok5vblplcm8sIHZhbHVlR1BSLCBH UFJJbmZvOjp0YWdNYXNrUmVnaXN0ZXIpOwogICAgIGlmIChuZWVkU3BlY3VsYXRpb25DaGVjaykK QEAgLTY5Miw4ICs2OTQsOSBAQCB2b2lkIFNwZWN1bGF0aXZlSklUOjplbWl0T2JqZWN0T3JPdGhl ckJyCiAgICAgbm90Q2VsbC5saW5rKCZtX2ppdCk7CiAgICAgCiAgICAgaWYgKG5lZWRTcGVjdWxh dGlvbkNoZWNrKSB7Ci0gICAgICAgIG1faml0LmFuZFB0cihNYWNyb0Fzc2VtYmxlcjo6VHJ1c3Rl ZEltbTMyKH5UYWdCaXRVbmRlZmluZWQpLCB2YWx1ZUdQUik7Ci0gICAgICAgIHNwZWN1bGF0aW9u Q2hlY2sobV9qaXQuYnJhbmNoUHRyKE1hY3JvQXNzZW1ibGVyOjpOb3RFcXVhbCwgdmFsdWVHUFIs IE1hY3JvQXNzZW1ibGVyOjpUcnVzdGVkSW1tUHRyKHJlaW50ZXJwcmV0X2Nhc3Q8dm9pZCo+KFZh bHVlTnVsbCkpKSk7CisgICAgICAgIG1faml0Lm1vdmUodmFsdWVHUFIsIHNjcmF0Y2hHUFIpOwor ICAgICAgICBtX2ppdC5hbmRQdHIoTWFjcm9Bc3NlbWJsZXI6OlRydXN0ZWRJbW0zMih+VGFnQml0 VW5kZWZpbmVkKSwgc2NyYXRjaEdQUik7CisgICAgICAgIHNwZWN1bGF0aW9uQ2hlY2sobV9qaXQu YnJhbmNoUHRyKE1hY3JvQXNzZW1ibGVyOjpOb3RFcXVhbCwgc2NyYXRjaEdQUiwgTWFjcm9Bc3Nl bWJsZXI6OlRydXN0ZWRJbW1QdHIocmVpbnRlcnByZXRfY2FzdDx2b2lkKj4oVmFsdWVOdWxsKSkp KTsKICAgICB9CiAgICAgaWYgKG5vdFRha2VuICE9IChtX2Jsb2NrICsgMSkpCiAgICAgICAgIGFk ZEJyYW5jaChtX2ppdC5qdW1wKCksIG5vdFRha2VuKTsKSW5kZXg6IExheW91dFRlc3RzL0NoYW5n ZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDk4Mjk4 KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcg QEAKKzIwMTEtMTAtMjQgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAg ICBPYmplY3Qtb3Itb3RoZXIgYnJhbmNoIHNwZWN1bGF0aW9uIG1heSBjb3JydXB0IHRoZSBzdGF0 ZSBmb3IgT1NSIGlmIHRoZSBjaGlsZCBvZiB0aGUKKyAgICAgICAgYnJhbmNoIGlzIGFuIGludGVn ZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTcwNzc3 CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0 L2pzL2RmZy1vdGhlci1icmFuY2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0 L2pzL2RmZy1vdGhlci1icmFuY2guaHRtbDogQWRkZWQuCisgICAgICAgICogZmFzdC9qcy9zY3Jp cHQtdGVzdHMvZGZnLW90aGVyLWJyYW5jaC5qczogQWRkZWQuCisgICAgICAgIChmb28pOgorICAg ICAgICAoYmFyKToKKwogMjAxMS0xMC0yNCAgSnVsaWVuIENoYWZmcmFpeCAgPGpjaGFmZnJhaXhA d2Via2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkIGdhcmRlbmluZy4KSW5kZXg6IExheW91 dFRlc3RzL2Zhc3QvanMvZGZnLW90aGVyLWJyYW5jaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmctb3RoZXItYnJhbmNoLWV4cGVjdGVkLnR4dAkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvanMvZGZnLW90aGVyLWJyYW5jaC1leHBlY3Rl ZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMjkgQEAKK1RoaXMgdGVzdHMgdGhhdCBzcGVj dWxhdGluZyBvdGhlciBvbiBhIGJyYW5jaCBkb2VzIG5vdCBjb3JydXB0IHN0YXRlLgorCitPbiBz dWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dl ZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBmb28oe2Y6aX0pIGlzICJubyIKK1BBU1Mg Zm9vKHtmOml9KSBpcyAieWVzIgorUEFTUyBmb28oe2Y6aX0pIGlzICJ5ZXMiCitQQVNTIGZvbyh7 ZjppfSkgaXMgInllcyIKK1BBU1MgZm9vKHtmOml9KSBpcyAieWVzIgorUEFTUyBmb28oe2Y6aX0p IGlzICJ5ZXMiCitQQVNTIGZvbyh7ZjppfSkgaXMgInllcyIKK1BBU1MgZm9vKHtmOml9KSBpcyAi eWVzIgorUEFTUyBmb28oe2Y6aX0pIGlzICJ5ZXMiCitQQVNTIGZvbyh7ZjppfSkgaXMgInllcyIK K1BBU1MgYmFyKHtmOml9KSBpcyB0cnVlCitQQVNTIGJhcih7ZjppfSkgaXMgZmFsc2UKK1BBU1Mg YmFyKHtmOml9KSBpcyBmYWxzZQorUEFTUyBiYXIoe2Y6aX0pIGlzIGZhbHNlCitQQVNTIGJhcih7 ZjppfSkgaXMgZmFsc2UKK1BBU1MgYmFyKHtmOml9KSBpcyBmYWxzZQorUEFTUyBiYXIoe2Y6aX0p IGlzIGZhbHNlCitQQVNTIGJhcih7ZjppfSkgaXMgZmFsc2UKK1BBU1MgYmFyKHtmOml9KSBpcyBm YWxzZQorUEFTUyBiYXIoe2Y6aX0pIGlzIGZhbHNlCitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBp cyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmct b3RoZXItYnJhbmNoLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmct b3RoZXItYnJhbmNoLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2pzL2Rm Zy1vdGhlci1icmFuY2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxMCBAQAorPCFET0NU WVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4K KzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9oZWFk PgorPGJvZHk+Cis8c2NyaXB0IHNyYz0ic2NyaXB0LXRlc3RzL2RmZy1vdGhlci1icmFuY2guanMi Pjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2Ny aXB0PgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9qcy9zY3JpcHQt dGVzdHMvZGZnLW90aGVyLWJyYW5jaC5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0 L2pzL3NjcmlwdC10ZXN0cy9kZmctb3RoZXItYnJhbmNoLmpzCShyZXZpc2lvbiAwKQorKysgTGF5 b3V0VGVzdHMvZmFzdC9qcy9zY3JpcHQtdGVzdHMvZGZnLW90aGVyLWJyYW5jaC5qcwkocmV2aXNp b24gMCkKQEAgLTAsMCArMSwyOCBAQAorZGVzY3JpcHRpb24oCisiVGhpcyB0ZXN0cyB0aGF0IHNw ZWN1bGF0aW5nIG90aGVyIG9uIGEgYnJhbmNoIGRvZXMgbm90IGNvcnJ1cHQgc3RhdGUuIgorKTsK KworZnVuY3Rpb24gZm9vKGEpIHsKKyAgICBpZiAoYS5mKQorICAgICAgICByZXR1cm4gInllcyI7 CisgICAgZWxzZQorICAgICAgICByZXR1cm4gIm5vIjsKK30KKworZnVuY3Rpb24gYmFyKGEpIHsK KyAgICByZXR1cm4gIWEuZjsKK30KKworZm9yICh2YXIgaSA9IDA7IGkgPCAxMDA7ICsraSkKKyAg ICBmb28oe2Y6dm9pZCgwKX0pOworCitmb3IgKHZhciBpID0gMDsgaSA8IDEwOyArK2kpCisgICAg c2hvdWxkQmUoImZvbyh7ZjppfSkiLCBpID8gIlwieWVzXCIiIDogIlwibm9cIiIpOworCitmb3Ig KHZhciBpID0gMDsgaSA8IDEwMDsgKytpKQorICAgIGJhcih7Zjp2b2lkKDApfSk7CisKK2ZvciAo dmFyIGkgPSAwOyBpIDwgMTA7ICsraSkKKyAgICBzaG91bGRCZSgiYmFyKHtmOml9KSIsIGkgPyAi ZmFsc2UiIDogInRydWUiKTsKKwordmFyIHN1Y2Nlc3NmdWxseVBhcnNlZCA9IHRydWU7Cg==