Bug 120796
| Summary: | REGRESSION(r155149): Fixing ToThis so that it is correct causes a 30% regression on LongSpider/3d-cube | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> |
| Component: | JavaScriptCore | Assignee: | Geoffrey Garen <ggaren> |
| Status: | NEW | ||
| Severity: | Normal | CC: | barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | All | ||
| OS: | All | ||
Filip Pizlo
We should fix it, and I'm not sure how - Geoff, do you have ideas since you introduced the new ToThis logic?
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Geoffrey Garen
Here’s a complete proposal:
(*) If a simple structure check will do, use it. It’s good to check structures because our check will likely CSE with a property access.
(*) If a simple array type check will do, use it. It’s good to check array types because our check will likely CSE with an indexed access.
(*) Otherwise, check a bit in Structure that says “I don’t need ToThis conversion”.
(*) For the global object:
(*) The only example we have where this matters is a five-year-old typo, so we should probably just fix the typo.
(*) But if we really care, we can add a specific check for global object => global this, and constant-fold it.