Bug 133356

Summary: Assertion failure at JSC::Structure::checkOffsetConsistency() const + 234 (StructureInlines.h:242)
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Mark Lam <mark.lam>
Status: RESOLVED FIXED    
Severity: Normal CC: fpizlo, mark.lam, mhahnenberg, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
the patch.
mhahnenberg: review+
2nd perf run
none
3rd perf run
none
inverse perf test - runs new code first, followed by baseline none

Mark Lam
Reported 2014-05-28 13:48:33 PDT
This causes js/primitive-property-access-edge-cases.html to be flaky and crash sometimes. See: http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK1%20(Tests)/r169424%20(14130)/results.html http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK1%20(Tests)/r169424%20(14130)/js/primitive-property-access-edge-cases-crash-log.txt. The crash backtrace: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000108dc623a WTFCrash + 42 (Assertions.cpp:333) 1 com.apple.JavaScriptCore 0x0000000108604eca JSC::Structure::checkOffsetConsistency() const + 234 (StructureInlines.h:242) 2 com.apple.JavaScriptCore 0x0000000108d46853 JSC::Structure::materializePropertyMap(JSC::VM&) + 867 (Structure.cpp:317) 3 com.apple.JavaScriptCore 0x00000001086c60c4 JSC::Structure::materializePropertyMapIfNecessary(JSC::VM&, JSC::DeferGC&) + 292 (Structure.h:432) 4 com.apple.JavaScriptCore 0x0000000108d49649 JSC::Structure::get(JSC::VM&, JSC::PropertyName, unsigned int&, JSC::JSCell*&) + 217 (Structure.cpp:908) 5 com.apple.JavaScriptCore 0x0000000108606dfd JSC::JSObject::inlineGetOwnPropertySlot(JSC::ExecState*, JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) + 93 (JSObject.h:1211) 6 com.apple.JavaScriptCore 0x000000010860051e JSC::JSObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 94 (JSObject.h:1231) 7 com.apple.JavaScriptCore 0x0000000108d383b0 JSC::StringObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 128 (StringObject.cpp:52) 8 com.apple.JavaScriptCore 0x0000000108607c04 JSC::JSObject::fastGetOwnPropertySlot(JSC::ExecState*, JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) + 164 (JSObject.h:1238) 9 com.apple.JavaScriptCore 0x00000001086079ae JSC::JSObject::getPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 110 (JSObject.h:1249) 10 com.apple.JavaScriptCore 0x000000010862c9ed JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const + 253 (JSCJSValueInlines.h:681) 11 com.apple.JavaScriptCore 0x0000000108a7411d operationGetByIdOptimize + 269 (JITOperations.cpp:157) 12 ??? 0x00005d090b02f085 0 + 102293420830853 13 ??? 0x00005d090b02e7f7 0 + 102293420828663 14 ??? 0x00005d090b00fc4d 0 + 102293420702797 15 ??? 0x00005d090b001fda 0 + 102293420646362 16 com.apple.JavaScriptCore 0x0000000108bd1ba7 llint_entry + 26033 17 com.apple.JavaScriptCore 0x0000000108bd1ba7 llint_entry + 26033 18 com.apple.JavaScriptCore 0x0000000108bd1ba7 llint_entry + 26033 19 com.apple.JavaScriptCore 0x0000000108bcb384 callToJavaScript + 356 20 com.apple.JavaScriptCore 0x0000000108a6721d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47) 21 com.apple.JavaScriptCore 0x0000000108a4b4bd JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 4733 (Interpreter.cpp:935) 22 com.apple.JavaScriptCore 0x00000001086f01b0 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 480 (Completion.cpp:82) 23 com.apple.WebCore 0x000000010d6d4975 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 69 (JSMainThreadExecState.h:62) 24 com.apple.WebCore 0x000000010e041e4d WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 317 (ScriptController.cpp:149) ...
Attachments
the patch. (3.75 KB, patch)
2014-06-09 19:47 PDT, Mark Lam 		mhahnenberg: review+
DetailsFormatted DiffDiff
2nd perf run (41.21 KB, text/plain)
2014-06-09 23:29 PDT, Mark Lam 		no flags
Details
3rd perf run (40.99 KB, text/plain)
2014-06-09 23:29 PDT, Mark Lam 		no flags
Details
inverse perf test - runs new code first, followed by baseline (40.67 KB, text/plain)
2014-06-10 09:29 PDT, Mark Lam 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2014-05-28 13:49:45 PDT
<rdar://problem/17055934>
Alexey Proskuryakov
Comment 2 2014-05-28 13:58:01 PDT
ASSERTION FAILED: numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize()
Mark Lam
Comment 3 2014-05-29 10:51:44 PDT
Declared js/primitive-property-access-edge-cases.html as flaky in <http://trac.webkit.org/r169454>. Please undo once this bug is fixed.
Mark Lam
Comment 4 2014-05-29 11:42:14 PDT
(In reply to comment #3) > Declared js/primitive-property-access-edge-cases.html as flaky in <http://trac.webkit.org/r169454>. Please undo once this bug is fixed. Corrected the expectation to be [Pass Crash] in r169459: <http://trac.webkit.org/r169459>.
Mark Lam
Comment 5 2014-06-09 19:47:03 PDT
Created attachment 232763 [details] the patch. This patch has passed the JSC tests and the layout tests.
Mark Lam
Comment 6 2014-06-09 19:59:32 PDT
Here are the perf results: Conf#1 Conf#2 SunSpider: 3d-cube 7.6758+-0.2829 ? 7.8093+-0.8332 ? might be 1.0174x slower 3d-morph 9.5602+-0.5558 9.2842+-0.3009 might be 1.0297x faster 3d-raytrace 10.0385+-0.3633 ? 10.4318+-0.8708 ? might be 1.0392x slower access-binary-trees 2.8033+-0.3624 ? 3.2511+-0.4080 ? might be 1.1597x slower access-fannkuch 9.3883+-0.3730 ? 9.4203+-0.3884 ? access-nbody 4.8205+-0.1591 4.7460+-0.2593 might be 1.0157x faster access-nsieve 5.8022+-0.5123 5.7777+-0.2190 bitops-3bit-bits-in-byte 1.9525+-0.0912 ? 2.0358+-0.1799 ? might be 1.0427x slower bitops-bits-in-byte 6.4258+-0.2564 6.2815+-0.1502 might be 1.0230x faster bitops-bitwise-and 3.1458+-0.4272 ? 3.2328+-0.0950 ? might be 1.0276x slower bitops-nsieve-bits 5.9169+-0.2048 5.8787+-0.2595 controlflow-recursive 2.9981+-0.2744 2.9231+-0.3192 might be 1.0257x faster crypto-aes 6.4255+-0.1905 6.3701+-0.3408 crypto-md5 3.7275+-0.2409 ? 4.1144+-1.2146 ? might be 1.1038x slower crypto-sha1 3.6681+-0.0753 ? 3.6707+-0.3888 ? date-format-tofte 13.6455+-1.1166 ? 14.9688+-2.7256 ? might be 1.0970x slower date-format-xparb 9.3328+-0.7127 ? 9.4130+-0.4763 ? math-cordic 4.8698+-0.2273 4.8495+-0.3027 math-partial-sums 10.5707+-0.3699 10.5035+-0.6192 math-spectral-norm 3.3500+-0.1678 3.1427+-0.0744 might be 1.0660x faster regexp-dna 11.8608+-0.4181 11.5405+-0.1964 might be 1.0278x faster string-base64 6.7769+-0.9842 ? 7.2872+-0.3437 ? might be 1.0753x slower string-fasta 11.7344+-0.6594 11.2834+-0.3543 might be 1.0400x faster string-tagcloud 17.6355+-0.8040 15.8913+-1.6039 might be 1.1098x faster string-unpack-code 33.7907+-1.5421 ? 34.9437+-2.4211 ? might be 1.0341x slower string-validate-input 7.9498+-0.7827 7.8064+-0.8433 might be 1.0184x faster <arithmetic> * 8.3025+-0.1488 ? 8.3407+-0.1880 ? might be 1.0046x slower <geometric> 6.7172+-0.0922 ? 6.7674+-0.1476 ? might be 1.0075x slower <harmonic> 5.5576+-0.0894 ? 5.6394+-0.1751 ? might be 1.0147x slower Conf#1 Conf#2 LongSpider: 3d-cube 1363.4692+-29.5649 1360.0992+-35.3449 3d-morph 2200.8102+-59.1919 2177.9119+-61.0743 might be 1.0105x faster 3d-raytrace 1452.7106+-53.2629 ? 1458.9010+-84.1236 ? access-binary-trees 1902.3200+-180.4096 1845.9135+-175.7995 might be 1.0306x faster access-fannkuch 538.9900+-24.9310 519.9278+-45.7008 might be 1.0367x faster access-nbody 1227.9713+-37.8461 1221.4742+-37.4700 access-nsieve 1928.5615+-331.3353 1911.2037+-132.5335 bitops-3bit-bits-in-byte 59.4903+-1.2167 58.7163+-2.1304 might be 1.0132x faster bitops-bits-in-byte 377.9657+-4.2543 ? 384.3466+-16.7827 ? might be 1.0169x slower bitops-nsieve-bits 1234.7872+-131.5290 1178.7343+-72.9358 might be 1.0476x faster controlflow-recursive 834.5144+-20.8909 ? 851.3480+-24.8212 ? might be 1.0202x slower crypto-aes 1201.1626+-14.2309 1181.5767+-24.5228 might be 1.0166x faster crypto-md5 1072.6472+-55.7412 ? 1073.1192+-68.8354 ? crypto-sha1 1148.7267+-53.5988 ? 1151.8065+-43.6541 ? date-format-tofte 1249.5334+-45.6547 1191.8867+-74.9449 might be 1.0484x faster date-format-xparb 1609.3623+-108.8585 1598.8677+-55.1423 math-cordic 827.3528+-23.1785 823.9123+-24.6454 math-partial-sums 1236.5170+-31.7352 ? 1239.0373+-40.7250 ? math-spectral-norm 1277.0692+-44.9306 1252.7448+-27.0247 might be 1.0194x faster string-base64 626.9760+-36.7954 618.0417+-57.1514 might be 1.0145x faster string-fasta 1096.3477+-16.5854 1087.1813+-29.1451 string-tagcloud 396.9557+-18.7330 390.4305+-19.5780 might be 1.0167x faster <arithmetic> 1130.1928+-24.4544 1117.1446+-8.8758 might be 1.0117x faster <geometric> * 940.1942+-15.5984 930.0697+-5.5126 might be 1.0109x faster <harmonic> 564.7473+-6.0798 558.4238+-7.2547 might be 1.0113x faster Conf#1 Conf#2 V8Spider: crypto 85.2290+-2.3279 ? 85.4970+-4.3695 ? deltablue 104.3741+-10.8935 101.5805+-1.6064 might be 1.0275x faster earley-boyer 72.4753+-2.6129 ? 73.1296+-5.2393 ? raytrace 46.7830+-2.5874 46.3032+-3.7839 might be 1.0104x faster regexp 103.4971+-6.5607 ? 105.1146+-8.0362 ? might be 1.0156x slower richards 105.4800+-4.7508 103.6182+-5.1368 might be 1.0180x faster splay 58.9835+-6.6264 58.2898+-8.2738 might be 1.0119x faster <arithmetic> 82.4031+-1.7170 81.9333+-2.6006 might be 1.0057x faster <geometric> * 79.0748+-1.7649 78.6217+-2.6408 might be 1.0058x faster <harmonic> 75.5071+-1.9842 75.0228+-2.7742 might be 1.0065x faster Conf#1 Conf#2 Octane: encrypt 0.43744+-0.01330 0.43545+-0.01702 decrypt 7.90888+-0.29070 7.88005+-0.39884 deltablue x2 0.43633+-0.01642 ? 0.44235+-0.00521 ? might be 1.0138x slower earley 0.95340+-0.05864 ? 0.96068+-0.04748 ? boyer 11.11037+-0.29158 ? 11.25531+-0.47150 ? might be 1.0130x slower navier-stokes x2 7.59547+-0.27920 ? 7.60737+-0.26970 ? raytrace x2 3.10482+-0.07834 3.05742+-0.18369 might be 1.0155x faster richards x2 0.22440+-0.01368 0.22228+-0.00988 splay x2 0.74399+-0.11409 0.74023+-0.04457 regexp x2 67.69771+-2.28641 ? 68.04937+-2.49421 ? pdfjs x2 96.65246+-8.29490 ? 99.66998+-6.06001 ? might be 1.0312x slower mandreel x2 102.73525+-1.72686 ? 103.55393+-4.15534 ? gbemu x2 70.14644+-3.72049 ? 73.18794+-4.23470 ? might be 1.0434x slower closure 0.88428+-0.03763 ? 0.89790+-0.03119 ? might be 1.0154x slower jquery 11.13645+-0.93463 ? 11.50981+-0.64001 ? might be 1.0335x slower box2d x2 28.64422+-1.68790 28.60846+-1.68475 zlib x2 782.63141+-27.91947 772.45514+-60.87699 might be 1.0132x faster typescript x2 1286.20795+-89.34885 ? 1315.08777+-90.34050 ? might be 1.0225x slower <arithmetic> 164.20239+-5.39989 ? 165.94346+-5.87918 ? might be 1.0106x slower <geometric> * 12.86980+-0.23011 ? 12.96610+-0.08330 ? might be 1.0075x slower <harmonic> 1.35988+-0.05058 1.35919+-0.02081 might be 1.0005x faster Conf#1 Conf#2 Kraken: ai-astar 560.363+-17.988 550.224+-14.522 might be 1.0184x faster audio-beat-detection 214.628+-13.087 ? 215.629+-12.857 ? audio-dft 372.061+-25.473 ^ 266.659+-36.269 ^ definitely 1.3953x faster audio-fft 135.017+-3.089 134.980+-3.993 audio-oscillator 379.454+-12.844 377.508+-9.727 imaging-darkroom 288.306+-10.526 ? 295.947+-17.872 ? might be 1.0265x slower imaging-desaturate 125.442+-2.958 123.336+-2.106 might be 1.0171x faster imaging-gaussian-blur 199.489+-1.313 195.868+-5.771 might be 1.0185x faster json-parse-financial 80.859+-3.209 ? 82.490+-1.978 ? might be 1.0202x slower json-stringify-tinderbox 107.398+-5.055 106.917+-6.579 stanford-crypto-aes 95.524+-4.772 93.709+-6.681 might be 1.0194x faster stanford-crypto-ccm 93.895+-19.796 87.521+-21.178 might be 1.0728x faster stanford-crypto-pbkdf2 245.184+-5.538 ? 246.729+-6.542 ? stanford-crypto-sha256-iterative 88.785+-4.197 85.214+-2.783 might be 1.0419x faster <arithmetic> * 213.315+-3.696 ^ 204.481+-2.670 ^ definitely 1.0432x faster <geometric> 176.194+-3.360 170.331+-3.495 might be 1.0344x faster <harmonic> 149.047+-3.842 145.182+-4.487 might be 1.0266x faster Conf#1 Conf#2 JSRegress: abs-boolean 5.3029+-0.1841 ? 5.3724+-0.1693 ? might be 1.0131x slower adapt-to-double-divide 20.2910+-0.8655 20.1403+-0.9032 aliased-arguments-getbyval 1.3195+-0.2377 1.2048+-0.0865 might be 1.0952x faster allocate-big-object 4.1301+-1.2169 3.9880+-1.2788 might be 1.0356x faster arity-mismatch-inlining 1.1738+-0.0835 ? 1.2963+-0.3589 ? might be 1.1044x slower array-access-polymorphic-structure 11.0485+-0.5341 ? 11.1607+-1.0572 ? might be 1.0102x slower array-nonarray-polymorhpic-access 62.2576+-1.7899 ? 62.9814+-1.8185 ? might be 1.0116x slower array-prototype-every 131.2160+-2.5915 128.2362+-4.5137 might be 1.0232x faster array-prototype-forEach 126.0688+-2.4921 125.6247+-4.4335 array-prototype-map 154.1981+-8.9514 ? 158.0093+-2.7974 ? might be 1.0247x slower array-prototype-some 124.9353+-1.4089 124.8405+-3.7430 array-splice-contiguous 68.1807+-1.9426 ? 69.4335+-5.2685 ? might be 1.0184x slower array-with-double-add 6.7755+-0.3425 ? 6.7966+-0.3080 ? array-with-double-increment 4.6190+-0.1808 ? 4.7286+-0.3591 ? might be 1.0237x slower array-with-double-mul-add 7.6332+-0.3199 ? 7.7524+-0.0791 ? might be 1.0156x slower array-with-double-sum 5.1136+-0.3047 4.9720+-0.2612 might be 1.0285x faster array-with-int32-add-sub 11.8229+-0.3401 ? 11.8261+-0.1602 ? array-with-int32-or-double-sum 5.1572+-0.1449 5.0190+-0.1809 might be 1.0275x faster ArrayBuffer-DataView-alloc-large-long-lived 125.9213+-12.3356 ? 127.5858+-5.9731 ? might be 1.0132x slower ArrayBuffer-DataView-alloc-long-lived 34.3591+-1.6401 ? 36.0496+-1.9970 ? might be 1.0492x slower ArrayBuffer-Int32Array-byteOffset 5.3415+-0.4346 5.3403+-0.1617 ArrayBuffer-Int8Array-alloc-large-long-lived 128.4739+-15.4031 127.3635+-6.0669 ArrayBuffer-Int8Array-alloc-long-lived-buffer 57.9390+-3.5195 56.8052+-1.5243 might be 1.0200x faster ArrayBuffer-Int8Array-alloc-long-lived 30.7320+-1.9773 ? 31.2244+-2.9608 ? might be 1.0160x slower ArrayBuffer-Int8Array-alloc 27.7119+-1.2832 ? 28.9647+-3.5069 ? might be 1.0452x slower asmjs_bool_bug 10.2417+-0.5025 ? 10.3556+-0.3194 ? might be 1.0111x slower assign-custom-setter-polymorphic 4.9314+-0.2038 4.8875+-0.2318 assign-custom-setter 6.7968+-0.5674 6.6953+-0.1608 might be 1.0152x faster basic-set 15.6735+-0.6328 ! 17.4927+-0.6392 ! definitely 1.1161x slower big-int-mul 6.3817+-0.5604 6.3467+-0.3498 boolean-test 4.7720+-0.2004 4.7195+-0.1989 might be 1.0111x faster branch-fold 5.2257+-0.2059 5.1121+-0.1718 might be 1.0222x faster by-val-generic 14.5858+-0.6364 ? 14.7253+-1.6211 ? call-spread-apply 20.6047+-1.2532 ? 21.3599+-1.6191 ? might be 1.0367x slower call-spread-call 8.7717+-0.3141 ? 8.9935+-0.4091 ? might be 1.0253x slower captured-assignments 0.6090+-0.1543 ? 0.6744+-0.2164 ? might be 1.1073x slower cast-int-to-double 12.6562+-0.2247 ? 12.8856+-0.2913 ? might be 1.0181x slower cell-argument 10.9622+-0.6075 ? 11.2543+-0.2302 ? might be 1.0266x slower cfg-simplify 4.2393+-0.0941 ? 4.2740+-0.1675 ? chain-getter-access 32.0747+-0.9211 ? 32.1693+-0.6612 ? cmpeq-obj-to-obj-other 13.1130+-1.0986 13.0383+-0.2236 constant-test 8.5865+-0.2316 ? 8.8285+-0.2035 ? might be 1.0282x slower DataView-custom-properties 131.1437+-9.7624 128.6348+-12.5230 might be 1.0195x faster delay-tear-off-arguments-strictmode 3.9030+-0.1315 3.7648+-0.1285 might be 1.0367x faster destructuring-arguments 8.9213+-0.2965 ? 9.0786+-0.2909 ? might be 1.0176x slower destructuring-swap 9.0170+-0.4459 8.8306+-0.2061 might be 1.0211x faster direct-arguments-getbyval 1.3516+-0.0688 1.2532+-0.2945 might be 1.0785x faster div-boolean-double 6.3477+-0.2572 ? 6.3702+-0.1539 ? div-boolean 11.5569+-0.4645 11.4571+-0.2575 double-get-by-val-out-of-bounds 6.6640+-0.3410 ? 7.0280+-0.8331 ? might be 1.0546x slower double-pollution-getbyval 11.3032+-0.4037 11.1334+-0.1007 might be 1.0153x faster double-pollution-putbyoffset 6.7478+-1.3323 6.4629+-0.8782 might be 1.0441x faster double-to-int32-typed-array-no-inline 3.1142+-0.2706 3.0736+-0.1785 might be 1.0132x faster double-to-int32-typed-array 2.6921+-0.3144 2.5944+-0.2893 might be 1.0376x faster double-to-uint32-typed-array-no-inline 3.3549+-0.2735 3.1297+-0.1050 might be 1.0720x faster double-to-uint32-typed-array 2.8552+-0.1271 2.8467+-0.2468 empty-string-plus-int 10.4762+-0.9147 ? 11.2012+-0.9858 ? might be 1.0692x slower emscripten-cube2hash 57.0391+-4.7314 55.7321+-2.7186 might be 1.0235x faster external-arguments-getbyval 2.2790+-0.1644 ? 2.4577+-0.1667 ? might be 1.0784x slower external-arguments-putbyval 3.1782+-0.7235 ? 3.4443+-0.5739 ? might be 1.0837x slower fixed-typed-array-storage-var-index 1.6781+-0.1446 ? 1.7352+-0.2950 ? might be 1.0340x slower fixed-typed-array-storage 1.1757+-0.1455 ? 1.2761+-0.2042 ? might be 1.0854x slower Float32Array-matrix-mult 7.7477+-0.2880 ? 7.9578+-0.2301 ? might be 1.0271x slower Float32Array-to-Float64Array-set 88.7687+-3.6097 87.3907+-2.2501 might be 1.0158x faster Float64Array-alloc-long-lived 123.9927+-7.0652 113.0915+-17.2853 might be 1.0964x faster Float64Array-to-Int16Array-set 113.2252+-4.6138 ? 114.2654+-4.5831 ? fold-double-to-int 19.5590+-0.4316 ! 26.5398+-0.8806 ! definitely 1.3569x slower for-of-iterate-array-entries 10.1607+-1.1984 ? 10.2630+-0.7442 ? might be 1.0101x slower for-of-iterate-array-keys 4.3875+-0.4750 3.9055+-0.3443 might be 1.1234x faster for-of-iterate-array-values 3.9447+-0.2455 3.5635+-0.3041 might be 1.1070x faster fround 25.0003+-1.3386 24.2112+-2.0207 might be 1.0326x faster function-dot-apply 2.1831+-0.1068 ^ 1.8540+-0.0995 ^ definitely 1.1775x faster function-test 5.0759+-0.1895 5.0132+-0.2752 might be 1.0125x faster function-with-eval 44.9664+-2.4278 42.9635+-1.2390 might be 1.0466x faster get-by-id-chain-from-try-block 8.3142+-0.2266 8.1642+-0.3356 might be 1.0184x faster get-by-id-proto-or-self 23.9388+-1.5530 ? 24.8692+-0.8164 ? might be 1.0389x slower get-by-id-self-or-proto 24.4667+-1.2449 ? 26.5050+-4.0040 ? might be 1.0833x slower get-by-val-out-of-bounds 6.8075+-0.6037 ? 6.8595+-0.1713 ? get_callee_monomorphic 6.0641+-1.4194 6.0040+-1.3638 might be 1.0100x faster get_callee_polymorphic 5.2872+-0.7486 ? 5.6008+-0.6431 ? might be 1.0593x slower getter 18.2237+-0.6499 17.7967+-0.6650 might be 1.0240x faster global-var-const-infer-fire-from-opt 1.3915+-0.3197 ? 1.4939+-0.2908 ? might be 1.0736x slower global-var-const-infer 1.1424+-0.1996 ? 1.1805+-0.1045 ? might be 1.0334x slower HashMap-put-get-iterate-keys 39.5582+-1.7469 ? 40.0130+-1.5241 ? might be 1.0115x slower HashMap-put-get-iterate 40.5280+-2.3448 39.7251+-1.2539 might be 1.0202x faster HashMap-string-put-get-iterate 47.2607+-4.2066 46.0959+-4.3478 might be 1.0253x faster imul-double-only 11.4341+-1.5658 10.9482+-1.0111 might be 1.0444x faster imul-int-only 13.5126+-1.1189 ? 13.7590+-0.8199 ? might be 1.0182x slower imul-mixed 10.2897+-1.4164 ? 10.8368+-0.3566 ? might be 1.0532x slower in-four-cases 22.4727+-0.7416 ? 22.9611+-0.7274 ? might be 1.0217x slower in-one-case-false 12.6928+-0.5456 ? 12.6953+-0.3465 ? in-one-case-true 12.5855+-0.5419 ? 12.6163+-0.3325 ? in-two-cases 12.8969+-0.3818 ? 13.0817+-0.2134 ? might be 1.0143x slower indexed-properties-in-objects 4.6190+-0.1420 4.4064+-0.0863 might be 1.0482x faster infer-closure-const-then-mov-no-inline 5.2912+-0.2200 ? 5.3667+-0.4815 ? might be 1.0143x slower infer-closure-const-then-mov 29.4344+-0.7921 29.2222+-0.0798 infer-closure-const-then-put-to-scope-no-inline 17.7901+-0.1717 17.5663+-0.3919 might be 1.0127x faster infer-closure-const-then-put-to-scope 32.8831+-1.0319 ? 33.2209+-0.9231 ? might be 1.0103x slower infer-closure-const-then-reenter-no-inline 75.4556+-2.3415 ? 75.5199+-1.2116 ? infer-closure-const-then-reenter 32.8000+-0.9397 32.5042+-0.5799 infer-one-time-closure-ten-vars 16.4172+-0.6588 ? 16.6565+-0.5263 ? might be 1.0146x slower infer-one-time-closure-two-vars 15.7888+-1.0722 15.7470+-1.2549 infer-one-time-closure 15.4858+-0.4944 ? 15.6072+-1.3990 ? infer-one-time-deep-closure 28.0881+-0.7353 ? 28.4828+-0.8687 ? might be 1.0141x slower inline-arguments-access 1.7838+-0.1676 ? 1.8015+-0.3394 ? inline-arguments-aliased-access 2.1113+-0.3341 2.0153+-0.2858 might be 1.0476x faster inline-arguments-local-escape 20.6606+-1.7516 20.3068+-1.2343 might be 1.0174x faster inline-get-scoped-var 6.5948+-0.1474 ? 6.6330+-0.1415 ? inlined-put-by-id-transition 17.6805+-3.3922 ? 18.9510+-1.9752 ? might be 1.0719x slower int-or-other-abs-then-get-by-val 9.6387+-0.3774 ? 9.6569+-0.1113 ? int-or-other-abs-zero-then-get-by-val 33.1549+-1.4367 32.8996+-0.3943 int-or-other-add-then-get-by-val 10.8974+-0.2788 ? 11.0462+-0.2692 ? might be 1.0137x slower int-or-other-add 11.1516+-0.1896 11.0477+-0.4761 int-or-other-div-then-get-by-val 6.8044+-0.3617 ? 6.8268+-0.1321 ? int-or-other-max-then-get-by-val 7.8262+-0.5478 ? 7.8475+-0.3255 ? int-or-other-min-then-get-by-val 7.6660+-0.1285 ^ 7.5002+-0.0248 ^ definitely 1.0221x faster int-or-other-mod-then-get-by-val 7.2241+-2.0801 7.1630+-1.5930 int-or-other-mul-then-get-by-val 6.8137+-0.2023 ? 6.9348+-0.0817 ? might be 1.0178x slower int-or-other-neg-then-get-by-val 8.5050+-0.2346 8.4460+-0.1508 int-or-other-neg-zero-then-get-by-val 33.5958+-1.8910 31.9020+-0.5480 might be 1.0531x faster int-or-other-sub-then-get-by-val 11.3694+-0.2425 ? 11.4838+-0.2375 ? might be 1.0101x slower int-or-other-sub 9.8135+-0.2547 9.7766+-0.4709 int-overflow-local 6.8035+-0.2366 6.5674+-0.1600 might be 1.0359x faster Int16Array-alloc-long-lived 84.7465+-4.8537 79.8777+-8.2757 might be 1.0610x faster Int16Array-bubble-sort-with-byteLength 47.6054+-0.9034 47.0591+-3.4243 might be 1.0116x faster Int16Array-bubble-sort 47.0056+-2.8387 ? 47.0141+-0.8042 ? Int16Array-load-int-mul 2.1720+-0.1695 ? 2.3075+-0.2963 ? might be 1.0624x slower Int16Array-to-Int32Array-set 82.3089+-3.4334 ? 83.4912+-3.1336 ? might be 1.0144x slower Int32Array-alloc-large 57.7275+-9.8134 ? 64.5662+-1.6429 ? might be 1.1185x slower Int32Array-alloc-long-lived 95.3062+-12.7665 93.1479+-12.8945 might be 1.0232x faster Int32Array-alloc 5.1612+-0.9962 ? 5.6460+-0.8742 ? might be 1.0939x slower Int32Array-Int8Array-view-alloc 16.9727+-1.4727 ? 17.9792+-0.7123 ? might be 1.0593x slower int52-spill 11.2777+-0.6203 ? 11.2842+-0.6646 ? Int8Array-alloc-long-lived 75.3700+-5.3400 72.8400+-5.0274 might be 1.0347x faster Int8Array-load-with-byteLength 5.4902+-0.1036 ? 5.5422+-0.1453 ? Int8Array-load 5.4784+-0.2550 ? 5.4863+-0.1957 ? integer-divide 16.9575+-0.0854 16.7045+-0.4798 might be 1.0151x faster integer-modulo 3.1978+-0.0668 3.0948+-0.2612 might be 1.0333x faster large-int-captured 11.6662+-1.1132 10.7358+-1.7085 might be 1.0867x faster large-int-neg 23.8705+-0.5352 ? 24.8070+-2.2478 ? might be 1.0392x slower large-int 21.3873+-0.8562 21.0898+-0.3169 might be 1.0141x faster logical-not 6.8604+-0.2619 6.8417+-0.2198 lots-of-fields 16.5435+-0.9786 15.4993+-1.4554 might be 1.0674x faster make-indexed-storage 4.5422+-0.7789 ? 5.0680+-0.5331 ? might be 1.1157x slower make-rope-cse 7.7687+-1.5504 6.9913+-0.5677 might be 1.1112x faster marsaglia-larger-ints 59.5383+-2.9270 ? 60.0661+-3.1081 ? marsaglia-osr-entry 31.8362+-0.7412 31.1928+-1.3721 might be 1.0206x faster max-boolean 5.0364+-0.3502 4.9822+-0.3475 might be 1.0109x faster method-on-number 31.7434+-0.8686 30.6497+-1.9537 might be 1.0357x faster min-boolean 4.5656+-0.2243 ? 4.7244+-0.2993 ? might be 1.0348x slower minus-boolean-double 4.7694+-0.2106 4.7320+-0.2491 minus-boolean 3.6983+-0.2555 ? 3.7114+-0.1626 ? misc-strict-eq 59.7135+-1.2886 59.0293+-2.0532 might be 1.0116x faster mod-boolean-double 13.7410+-0.2790 13.7341+-0.3776 mod-boolean 10.3488+-0.2063 ? 10.6147+-0.1212 ? might be 1.0257x slower mul-boolean-double 5.4969+-0.1915 ? 5.6078+-0.2631 ? might be 1.0202x slower mul-boolean 4.0150+-0.1569 4.0079+-0.1669 neg-boolean 4.8952+-0.1228 4.8597+-0.2180 negative-zero-divide 0.5633+-0.1895 ? 0.6121+-0.1621 ? might be 1.0866x slower negative-zero-modulo 0.6472+-0.1164 0.5875+-0.1563 might be 1.1016x faster negative-zero-negate 0.5542+-0.1291 0.5309+-0.1594 might be 1.0438x faster nested-function-parsing 51.1905+-2.5119 ? 51.6163+-3.4386 ? new-array-buffer-dead 4.3148+-0.5251 4.1309+-0.3424 might be 1.0445x faster new-array-buffer-push 13.4410+-1.6674 ? 13.4442+-1.3523 ? new-array-dead 15.1098+-0.8445 15.0862+-0.5490 new-array-push 8.1160+-1.2027 7.2767+-0.6177 might be 1.1153x faster number-test 4.6978+-0.1168 4.6570+-0.2713 object-closure-call 8.7441+-0.4907 8.6766+-0.5160 object-test 4.8605+-0.2371 ? 4.9904+-0.2794 ? might be 1.0267x slower plus-boolean-arith 3.6704+-0.1795 ? 3.8461+-0.3100 ? might be 1.0479x slower plus-boolean-double 4.7266+-0.1537 ? 4.7530+-0.2990 ? plus-boolean 3.7678+-0.1093 3.6223+-0.2614 might be 1.0402x faster poly-stricteq 81.0771+-2.7834 ? 82.7434+-5.4841 ? might be 1.0206x slower polymorphic-array-call 2.5634+-0.5702 ? 3.0041+-0.2841 ? might be 1.1719x slower polymorphic-get-by-id 4.6797+-0.2052 ? 4.8693+-0.1696 ? might be 1.0405x slower polymorphic-put-by-id 97.1175+-66.2383 64.1154+-12.6442 might be 1.5147x faster polymorphic-structure 30.4745+-0.2326 30.3312+-0.7774 polyvariant-monomorphic-get-by-id 13.1732+-0.2741 ? 13.2130+-0.5277 ? proto-getter-access 33.1493+-0.1556 32.9982+-0.2014 put-by-id 25.4875+-5.6633 23.9792+-3.3976 might be 1.0629x faster put-by-val-large-index-blank-indexing-type 12.3038+-1.8987 12.1073+-0.9926 might be 1.0162x faster put-by-val-machine-int 3.7102+-0.7314 ? 3.9397+-0.7833 ? might be 1.0619x slower rare-osr-exit-on-local 21.6300+-0.6974 ? 21.6371+-0.0725 ? register-pressure-from-osr 30.9243+-0.6205 ? 31.1858+-0.1265 ? setter 20.5754+-0.2067 20.2284+-0.7172 might be 1.0172x faster simple-activation-demo 34.9927+-1.7124 ? 35.1621+-0.8903 ? simple-getter-access 50.4938+-2.2456 ? 52.1249+-4.3584 ? might be 1.0323x slower sin-boolean 24.4758+-2.8429 ? 24.9770+-1.6644 ? might be 1.0205x slower slow-array-profile-convergence 4.3984+-0.5262 4.2360+-0.4923 might be 1.0383x faster slow-convergence 4.9499+-0.4180 ? 5.0544+-0.2205 ? might be 1.0211x slower sparse-conditional 1.6038+-0.1220 ? 1.6548+-0.2165 ? might be 1.0318x slower splice-to-remove 26.3163+-1.0174 ? 26.4495+-1.3811 ? string-char-code-at 25.0896+-0.4284 ? 25.2404+-0.6596 ? string-concat-object 3.5767+-1.1964 2.7910+-0.1196 might be 1.2815x faster string-concat-pair-object 3.8218+-1.0358 3.5770+-1.5052 might be 1.0684x faster string-concat-pair-simple 21.8845+-2.7769 ? 22.5010+-2.4573 ? might be 1.0282x slower string-concat-simple 21.8534+-4.7476 ? 23.5771+-0.5487 ? might be 1.0789x slower string-cons-repeat 14.9104+-1.9744 14.8358+-3.7772 string-cons-tower 13.5253+-1.3465 ? 15.1953+-1.9809 ? might be 1.1235x slower string-equality 26.4771+-0.8358 25.9532+-1.0259 might be 1.0202x faster string-get-by-val-big-char 14.1156+-1.0151 ? 14.2172+-0.7937 ? string-get-by-val-out-of-bounds-insane 6.3358+-0.2855 ? 6.3707+-0.1577 ? string-get-by-val-out-of-bounds 7.1590+-0.0622 7.1039+-0.0954 string-get-by-val 5.5657+-0.1857 5.4973+-0.2575 might be 1.0124x faster string-hash 3.2185+-0.1480 ? 3.2300+-0.1492 ? string-long-ident-equality 21.2392+-0.7846 ? 21.3912+-0.8045 ? string-repeat-arith 46.7794+-1.5032 ? 47.2325+-0.9186 ? string-sub 95.6171+-1.6782 94.5656+-2.7975 might be 1.0111x faster string-test 4.5732+-0.2912 ? 4.5981+-0.2548 ? string-var-equality 52.3887+-0.9135 52.0975+-0.3856 structure-hoist-over-transitions 3.9457+-0.6121 ? 4.2894+-0.7061 ? might be 1.0871x slower switch-char-constant 3.6726+-0.2489 3.5723+-0.0969 might be 1.0281x faster switch-char 9.0833+-0.1797 ? 9.1760+-0.2168 ? might be 1.0102x slower switch-constant 14.8043+-2.3979 ? 15.6763+-0.8345 ? might be 1.0589x slower switch-string-basic-big-var 24.2195+-1.7330 23.1232+-3.0632 might be 1.0474x faster switch-string-basic-big 29.9672+-0.7236 27.7518+-5.5180 might be 1.0798x faster switch-string-basic-var 30.3746+-1.0077 ? 30.7035+-1.2390 ? might be 1.0108x slower switch-string-basic 34.1287+-1.7974 32.4469+-5.5069 might be 1.0518x faster switch-string-big-length-tower-var 29.6438+-0.5127 ? 30.0594+-0.2044 ? might be 1.0140x slower switch-string-length-tower-var 23.3942+-0.7694 23.3727+-0.6723 switch-string-length-tower 18.7759+-4.8251 ? 19.4161+-4.9764 ? might be 1.0341x slower switch-string-short 18.9370+-5.5197 17.3602+-0.4110 might be 1.0908x faster switch 18.3485+-2.7915 ? 18.7390+-2.7508 ? might be 1.0213x slower tear-off-arguments-simple 2.8025+-0.2648 ? 2.8445+-0.6148 ? might be 1.0150x slower tear-off-arguments 4.0220+-0.2240 ? 4.1565+-0.1354 ? might be 1.0334x slower temporal-structure 19.8626+-1.7890 19.4424+-0.6420 might be 1.0216x faster to-int32-boolean 23.8640+-0.5261 23.7631+-0.7864 undefined-test 5.0320+-0.3513 4.8742+-0.2473 might be 1.0324x faster unprofiled-licm 30.9462+-1.6895 30.7285+-0.5830 weird-inlining-const-prop 3.0869+-0.2187 2.7861+-0.2269 might be 1.1080x faster <arithmetic> 22.4484+-0.1858 22.2802+-0.1374 might be 1.0075x faster <geometric> * 11.6390+-0.0811 11.6338+-0.0209 might be 1.0005x faster <harmonic> 5.9242+-0.0590 ? 5.9262+-0.1008 ? might be 1.0003x slower Conf#1 Conf#2 AsmBench: bigfib.cpp 829.8212+-45.3042 806.1873+-34.2029 might be 1.0293x faster cray.c 856.0281+-16.2969 842.4886+-15.5674 might be 1.0161x faster dry.c 800.0474+-66.6007 767.2623+-85.6775 might be 1.0427x faster FloatMM.c 1078.1230+-21.3068 ? 1079.5433+-25.5499 ? gcc-loops.cpp 7419.3102+-127.0723 7411.9954+-112.1792 n-body.c 1990.3752+-57.1305 1979.9704+-53.2465 Quicksort.c 661.7217+-5.7647 661.2761+-24.1724 stepanov_container.cpp 6334.2307+-689.0652 ? 6430.7390+-669.3982 ? might be 1.0152x slower Towers.c 479.6274+-14.0508 ? 480.0175+-17.6876 ? <arithmetic> 2272.1428+-71.2831 ? 2273.2755+-72.5992 ? might be 1.0005x slower <geometric> * 1379.7624+-7.5225 1368.0262+-16.1855 might be 1.0086x faster <harmonic> 1005.9465+-12.9371 993.8437+-3.4567 might be 1.0122x faster Conf#1 Conf#2 All benchmarks: <arithmetic> 175.0942+-2.8274 173.9424+-2.1089 might be 1.0066x faster <geometric> 19.8107+-0.1054 19.7805+-0.0775 might be 1.0015x faster <harmonic> 5.1365+-0.0825 ? 5.1420+-0.0796 ? might be 1.0011x slower Conf#1 Conf#2 Geomean of preferred means: <scaled-result> 83.0307+-0.3330 82.3720+-0.8857 might be 1.0080x faster
Mark Lam
Comment 7 2014-06-09 23:29:20 PDT
Created attachment 232773 [details] 2nd perf run
Mark Lam
Comment 8 2014-06-09 23:29:47 PDT
Created attachment 232774 [details] 3rd perf run
Mark Lam
Comment 9 2014-06-09 23:32:00 PDT
In all the perf runs, we see that there's a consistent significant degradation in JSRegress' fold-double-to-int benchmark. I'll take a look tomorrow to see if there's a way to resolve that.
Mark Lam
Comment 10 2014-06-10 08:56:23 PDT
(In reply to comment #9) > In all the perf runs, we see that there's a consistent significant degradation in JSRegress' fold-double-to-int benchmark. I'll take a look tomorrow to see if there's a way to resolve that. Strange. fold-double-to-int doesn't even trigger a nonPropertyTransition. There should be no effect. Will check a few more things.
Mark Lam
Comment 11 2014-06-10 09:29:04 PDT
Created attachment 232790 [details] inverse perf test - runs new code first, followed by baseline All I did in the inverse perf test is that I specified the new code as conf 1 and the baseline as conf 2 (swapped from how I specified them for the other perf runs). With this configuration, the results confirm that there is no significant perf different in the fold-double-to-int benchmark component. The perf difference in the previous runs must be due to noise.
Geoffrey Garen
Comment 12 2014-06-10 11:22:47 PDT
Comment on attachment 232763 [details] the patch. Usually, it is the caller's responsibility not to try to transition from a dictionary structure. Notice that other Structure transition functions ASSERT that the Structure is not a dictionary, to enforce this invariant. Why did you make non-property transitions different? What would it take to follow the idiom and make this the caller's responsibility?
Mark Hahnenberg
Comment 13 2014-06-10 11:23:50 PDT
Comment on attachment 232763 [details] the patch. r=me
Mark Hahnenberg
Comment 14 2014-06-10 11:25:56 PDT
(In reply to comment #13) > (From update of attachment 232763 [details]) > r=me After addressing Geoff's questions :-)
Geoffrey Garen
Comment 15 2014-06-10 11:29:18 PDT
Comment on attachment 232763 [details] the patch. If we do want to build in automatic support for dictionaries in Structure::nonPropertyTransition, then I think the right solution is to modify the existing structure and return early, rather than allocate a new structure. It doesn't really make sense to record a transition away from a dictionary. The whole point of dictionary status is that it means "I do not transition -- I just update myself".
Mark Lam
Comment 16 2014-06-10 13:25:35 PDT
As discussed offline, it is proper for nonPropertyTransition to transition dictionary structures to other structure because JIT structure checks need to be able to tell is the indexed type has changed. Will proceed with landing this patch.
Mark Lam
Comment 17 2014-06-10 13:30:46 PDT
Landed in r169758: <http://trac.webkit.org/r169758>.
Note You need to log in before you can comment on or make changes to this bug.