Bug 142993

Summary: Use JITCompilationCanFail in more places, and make the fail path of JITCompilationMustSucceed a crash instead of attempting GC
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, benjamin, commit-queue, fpizlo, ggaren, kling, mmirman, msaboff, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
the patch.
fpizlo: review-
the patch
ggaren: review+
the patch mark.lam: review+

Mark Lam
Reported 2015-03-23 17:05:25 PDT
Because VM::releaseExecutableMemory() invokes the GC, we can sometimes get a failed RELEASE_ASSERT which is expecting to GC to be deferred. Here's an example of such a crash stack trace: Thread 0 Crashed: 0 JavaScriptCore 0x000000018362958c WTFCrash + 72 (Assertions.cpp:329) 1 JavaScriptCore 0x0000000183629580 WTFCrash + 60 (Assertions.cpp:267) 2 JavaScriptCore 0x00000001834b498c JSC::Heap::collect(JSC::HeapOperation) + 820 (Heap.cpp:987) 3 JavaScriptCore 0x000000018320f4d0 JSC::Heap::collectAllGarbage() + 44 (Heap.cpp:958) 4 JavaScriptCore 0x0000000183619144 JSC::VM::releaseExecutableMemory() + 864 (VM.cpp:599) 5 JavaScriptCore 0x000000018321bb74 JSC::ExecutableAllocator::allocate(JSC::VM&, unsigned long, void*, JSC::JITCompilationEffort) + 88 (ExecutableAllocatorFixedVMPool.cpp:170) 6 JavaScriptCore 0x000000018357746c JSC::LinkBuffer::allocate(unsigned long, void*, JSC::JITCompilationEffort) + 92 (LinkBuffer.cpp:200) 7 JavaScriptCore 0x0000000183577530 void JSC::LinkBuffer::copyCompactAndLinkCode<unsigned int>(JSC::MacroAssembler&, void*, JSC::JITCompilationEffort) + 48 (LinkBuffer.cpp:93) 8 JavaScriptCore 0x00000001835f9700 JSC::generateByIdStub(JSC::ExecState*, JSC::ByIdStubKind, JSC::Identifier const&, JSC::FunctionPtr, JSC::StructureStubInfo&, JSC::StructureChain*, unsigned long, int, JSC::Structure*, bool, JSC::WatchpointSet*, JSC::CodeLocationLabel, JSC::CodeLocationLabel, WTF::RefPtr<JSC::JITStubRoutine>&) + 4076 (LinkBuffer.h:95) 9 JavaScriptCore 0x00000001835f32c4 JSC::buildGetByIDList(JSC::ExecState*, JSC::JSValue, JSC::Identifier const&, JSC::PropertySlot const&, JSC::StructureStubInfo&) + 960 (Repatch.cpp:832) 10 JavaScriptCore 0x00000001832ca1f4 operationGetByIdBuildList + 1244 (JITOperations.cpp:147) 11 ??? 0x00000001416b323c 0 + 5392511548 12 JavaScriptCore 0x0000000183582974 llint_entry + 24564 13 ??? 0x0000000141720450 0 + 5392958544 14 ??? 0x0000000141ab3010 0 + 5396705296
Attachments
the patch. (4.43 KB, patch)
2015-03-23 17:34 PDT, Mark Lam 		fpizlo: review-
DetailsFormatted DiffDiff
the patch (30.59 KB, patch)
2015-03-25 11:46 PDT, Filip Pizlo 		ggaren: review+
DetailsFormatted DiffDiff
the patch (82.11 KB, patch)
2015-03-25 15:59 PDT, Filip Pizlo 		mark.lam: review+
DetailsFormatted DiffDiff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Mark Lam
Comment 1 2015-03-23 17:06:33 PDT
<rdar://problem/20246846>
Mark Lam
Comment 2 2015-03-23 17:34:03 PDT
Created attachment 249303 [details] the patch.
Filip Pizlo
Comment 3 2015-03-23 18:11:18 PDT
Comment on attachment 249303 [details] the patch. I'm strongly opposed to this solution. releaseExecutableMemory() should not be the mechanism by which we handle out-of-memory situations in the concurrent compilation thread. Please don't do this, and please solve the fundamental problem instead: the FTL should abort when it runs out of memory.
Filip Pizlo
Comment 4 2015-03-23 18:36:43 PDT
Comment on attachment 249303 [details] the patch. View in context: https://bugs.webkit.org/attachment.cgi?id=249303&action=review > Source/JavaScriptCore/runtime/VM.cpp:-535 > - heap.collectAllGarbage(); The way memory management for JITCode/CodeBlock works is that you need to GC to actually free memory. So, I suspect that you've just completely broken this functionality.
Filip Pizlo
Comment 5 2015-03-25 11:37:16 PDT
*** Bug 113620 has been marked as a duplicate of this bug. ***
Filip Pizlo
Comment 6 2015-03-25 11:42:49 PDT
By my audit, we had four kinds of callers into executable memory: 1) Those that already use JITCompilationCanFail. Hooray for those. I believe there were only two: baseline JIT and DFG JIT. 2) Those that use JITCompilationMustSucceed, cannot easily use JITCompilationCanFail (for example, host call thunk), and can tolerate a GC. 3) Those that use JITCompilationMustSucceed, cannot use JITCompilationCanFail at all (for example, OSR exit generation), and cannot tolerate a GC (GCing during OSR exit is super dangerous). 4) Those that uses JITCompilationMustSucceed, but could trivially have used JITCompilationCanFail, and wouldn't have been able to tolerate GC anyway (for example, repatching). (2) is the only case where it makes sense to use releaseExecutableMemory() as a fall-back for JIT allocation failing. I believe that (2) is almost the null set. It seems like host call thunk generation can almost generate GC, but for that, clearly the better solution is to do something else other than generating a thunk - the fact that we generate thunks for each native function is an optimization. I think that the only case of (2) is host call generation; all of the others get called from gnarly places where a GC would be a disaster. Also, (2) happens mostly at start-up so having a fallback path makes relatively little sense. So, the right solution is: - Make all of the cases in (2) and (3) simply crash on memory allocation failure. - Make all of the cases in (4) use JITCompilationCanFail. I will implement this.
Filip Pizlo
Comment 7 2015-03-25 11:46:13 PDT
Created attachment 249418 [details] the patch
Geoffrey Garen
Comment 8 2015-03-25 11:55:28 PDT
Comment on attachment 249418 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=249418&action=review r=me > Source/JavaScriptCore/ftl/FTLCompile.cpp:68 > + // Fake an allocation, since LLVM cannot handle hailures in the memory manager. failures
Mark Lam
Comment 9 2015-03-25 12:00:48 PDT
Comment on attachment 249418 [details] the patch Currently LinkBuffer's constructor specifies a default value for the effort arg to be JITCompilationMustSucceed. I recommend removing this default value especially since that is not the effort value we want used in most cases.
Filip Pizlo
Comment 10 2015-03-25 12:04:42 PDT
(In reply to comment #9) > Comment on attachment 249418 [details] > the patch > > Currently LinkBuffer's constructor specifies a default value for the effort > arg to be JITCompilationMustSucceed. I recommend removing this default > value especially since that is not the effort value we want used in most > cases. It depends on the definition of "most". The most frequent callers to LinkBuffer should use JITCompilationCanFail. But most of the callsites in our code base do use MustSucceed, and that's fine - because most of the callsites account for a tiny fraction of run-time calls. For example, we have tons of thunk generators, and each one will execute at most once during a VM's lifetime. So, I think that the default parameter actually sort of makes sense.
Filip Pizlo
Comment 11 2015-03-25 12:51:08 PDT
This appears perf-neutral. Benchmark report for SunSpider, LongSpider, V8Spider, Octane, Kraken, JSRegress, AsmBench, and CompressionBench on dethklok (MacBookPro9,1). VMs tested: "TipOfTree" at /Volumes/Data/pizlo/quartary/OpenSource/WebKitBuild/Release/jsc (r181966) "FixExecAlloc" at /Volumes/Data/pizlo/tertiary/OpenSource/WebKitBuild/Release/jsc (r181966) Collected 6 samples per benchmark/VM, with 6 VM invocations per benchmark. Emitted a call to gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds. TipOfTree FixExecAlloc SunSpider: 3d-cube 4.9319+-0.0734 ? 4.9397+-0.1048 ? 3d-morph 5.6198+-0.0524 ? 5.7629+-0.2162 ? might be 1.0255x slower 3d-raytrace 6.4594+-0.1480 6.4092+-0.1626 access-binary-trees 2.2889+-0.0645 2.2853+-0.1327 access-fannkuch 6.3670+-0.3331 6.0253+-0.0914 might be 1.0567x faster access-nbody 2.8452+-0.0477 ? 2.8610+-0.0630 ? access-nsieve 3.5765+-0.1689 3.3333+-0.0793 might be 1.0729x faster bitops-3bit-bits-in-byte 1.5643+-0.0264 1.5485+-0.0215 might be 1.0102x faster bitops-bits-in-byte 3.5659+-0.1003 ? 3.5864+-0.0567 ? bitops-bitwise-and 2.1749+-0.0689 2.1216+-0.0104 might be 1.0251x faster bitops-nsieve-bits 3.6430+-0.1061 3.6253+-0.0993 controlflow-recursive 2.1648+-0.0365 2.1261+-0.0215 might be 1.0182x faster crypto-aes 4.2881+-0.2280 4.1771+-0.0741 might be 1.0266x faster crypto-md5 2.4570+-0.0790 ? 2.4729+-0.1069 ? crypto-sha1 2.8170+-0.3020 2.5580+-0.1951 might be 1.1012x faster date-format-tofte 9.7291+-0.4471 9.6125+-0.0638 might be 1.0121x faster date-format-xparb 5.4394+-0.1680 5.3288+-0.1607 might be 1.0208x faster math-cordic 3.1342+-0.0284 ? 3.2190+-0.1028 ? might be 1.0270x slower math-partial-sums 5.1195+-0.1417 ? 5.1265+-0.1279 ? math-spectral-norm 1.9343+-0.0517 1.9150+-0.0618 might be 1.0101x faster regexp-dna 7.7383+-1.1836 ? 8.2639+-1.5164 ? might be 1.0679x slower string-base64 5.1104+-0.9128 4.6278+-0.3290 might be 1.1043x faster string-fasta 6.7598+-0.0792 6.7476+-0.1841 string-tagcloud 9.8566+-0.4897 9.5901+-0.2734 might be 1.0278x faster string-unpack-code 19.6764+-0.3263 19.6491+-0.9980 string-validate-input 5.0850+-0.1595 4.9677+-0.1143 might be 1.0236x faster <arithmetic> 5.1672+-0.0668 5.1108+-0.0656 might be 1.0110x faster TipOfTree FixExecAlloc LongSpider: 3d-cube 1107.0985+-21.9014 1102.7646+-27.1482 3d-morph 1531.4844+-6.1071 ? 1534.5778+-11.1205 ? 3d-raytrace 742.7244+-5.0604 736.4731+-13.9746 access-binary-trees 1017.4917+-6.4769 ? 1018.3831+-9.6025 ? access-fannkuch 342.2212+-13.1969 ? 352.6549+-7.5815 ? might be 1.0305x slower access-nbody 612.5606+-2.0086 ? 616.7539+-2.9707 ? access-nsieve 854.5521+-9.4090 ? 869.9028+-10.7551 ? might be 1.0180x slower bitops-3bit-bits-in-byte 44.9028+-1.5674 ? 44.9283+-1.4392 ? bitops-bits-in-byte 105.3486+-1.7166 ? 105.4038+-2.8395 ? bitops-nsieve-bits 686.6139+-2.9120 ! 693.5190+-2.4885 ! definitely 1.0101x slower controlflow-recursive 504.3485+-3.6632 503.0972+-1.7116 crypto-aes 722.2733+-9.5182 716.4621+-6.6964 crypto-md5 545.5156+-8.8915 ? 556.6328+-6.3281 ? might be 1.0204x slower crypto-sha1 602.9427+-4.6272 599.1253+-6.9707 date-format-tofte 784.6681+-16.8930 783.8028+-26.7819 date-format-xparb 737.7696+-29.2975 ? 744.3390+-21.7256 ? math-cordic 592.8127+-2.1429 590.9569+-0.8593 math-partial-sums 508.7074+-9.6094 506.2525+-3.8504 math-spectral-norm 567.7439+-4.9659 ? 576.1329+-22.2934 ? might be 1.0148x slower string-base64 363.5297+-4.7134 ? 367.6194+-4.4099 ? might be 1.0113x slower string-fasta 450.6478+-5.2655 450.0325+-4.7630 string-tagcloud 221.5258+-4.8599 215.8816+-1.9803 might be 1.0261x faster <geometric> 506.7659+-1.7870 ? 508.1018+-2.0467 ? might be 1.0026x slower TipOfTree FixExecAlloc V8Spider: crypto 54.7018+-2.0078 ? 55.2752+-1.5934 ? might be 1.0105x slower deltablue 96.5356+-4.4522 96.3319+-5.5536 earley-boyer 43.4984+-0.8368 43.2498+-2.3670 raytrace 37.7411+-2.5280 ? 38.8235+-1.0856 ? might be 1.0287x slower regexp 67.8561+-2.7434 ? 68.1401+-2.2491 ? richards 81.0260+-1.2110 79.2574+-1.6370 might be 1.0223x faster splay 38.7615+-1.5433 ? 38.8744+-1.3220 ? <geometric> 56.5089+-0.6930 ? 56.6465+-1.0952 ? might be 1.0024x slower TipOfTree FixExecAlloc Octane: encrypt 0.20350+-0.00283 0.20337+-0.00073 decrypt 3.61993+-0.08779 3.61757+-0.10049 deltablue x2 0.20969+-0.00283 0.20754+-0.00182 might be 1.0104x faster earley 0.70394+-0.01258 0.70003+-0.00590 boyer 6.42713+-0.04838 6.42248+-0.02234 navier-stokes x2 5.23184+-0.05032 5.19142+-0.01106 raytrace x2 1.21642+-0.03220 ? 1.25095+-0.05580 ? might be 1.0284x slower richards x2 0.12274+-0.00179 0.12232+-0.00193 splay x2 0.38260+-0.00358 ? 0.38859+-0.00298 ? might be 1.0157x slower regexp x2 33.26042+-0.25913 33.03948+-0.43746 pdfjs x2 44.89037+-0.45654 44.71344+-0.61589 mandreel x2 49.95608+-0.38229 ? 50.48386+-0.78708 ? might be 1.0106x slower gbemu x2 39.85758+-0.41541 39.70704+-0.84669 closure 0.56890+-0.00842 ^ 0.55247+-0.00302 ^ definitely 1.0297x faster jquery 7.34571+-0.07948 ^ 7.12053+-0.07847 ^ definitely 1.0316x faster box2d x2 12.80929+-0.19253 12.80710+-0.11518 zlib x2 392.15609+-0.90749 391.44181+-14.81357 typescript x2 827.75684+-15.77111 816.50655+-18.98050 might be 1.0138x faster <geometric> 6.77185+-0.02649 6.75719+-0.04617 might be 1.0022x faster TipOfTree FixExecAlloc Kraken: ai-astar 265.440+-2.773 ? 267.207+-9.972 ? audio-beat-detection 106.406+-0.879 105.393+-1.019 audio-dft 149.783+-3.003 ? 150.152+-2.564 ? audio-fft 80.333+-3.186 ? 84.381+-5.094 ? might be 1.0504x slower audio-oscillator 209.691+-2.762 208.801+-2.428 imaging-darkroom 105.416+-1.681 104.447+-1.212 imaging-desaturate 65.042+-3.280 62.452+-0.598 might be 1.0415x faster imaging-gaussian-blur 113.789+-1.924 ? 113.969+-3.071 ? json-parse-financial 46.366+-1.602 45.578+-1.157 might be 1.0173x faster json-stringify-tinderbox 57.344+-1.766 57.185+-1.735 stanford-crypto-aes 63.524+-0.979 62.677+-2.276 might be 1.0135x faster stanford-crypto-ccm 50.745+-0.730 ? 51.688+-5.272 ? might be 1.0186x slower stanford-crypto-pbkdf2 168.085+-5.177 ? 169.615+-3.104 ? stanford-crypto-sha256-iterative 55.515+-1.464 54.626+-1.293 might be 1.0163x faster <arithmetic> 109.820+-0.704 ? 109.869+-0.617 ? might be 1.0005x slower TipOfTree FixExecAlloc JSRegress: abs-boolean 2.6001+-0.0109 ? 2.6163+-0.0242 ? adapt-to-double-divide 16.8252+-0.3291 16.6864+-0.2971 aliased-arguments-getbyval 0.8793+-0.0438 0.8448+-0.0306 might be 1.0408x faster allocate-big-object 2.6615+-0.1660 ? 2.7046+-0.0963 ? might be 1.0162x slower arguments-out-of-bounds 18.8714+-1.5317 17.7003+-1.5329 might be 1.0662x faster arity-mismatch-inlining 0.8039+-0.0132 ? 0.8192+-0.0453 ? might be 1.0190x slower array-access-polymorphic-structure 6.7362+-0.2675 6.7218+-0.3140 array-nonarray-polymorhpic-access 35.2811+-0.5318 34.5487+-1.6480 might be 1.0212x faster array-prototype-every 88.4610+-2.6864 87.9312+-1.7839 array-prototype-forEach 84.9402+-1.7821 ? 86.3113+-1.2559 ? might be 1.0161x slower array-prototype-map 96.1216+-2.5234 95.1988+-0.8620 array-prototype-some 86.6326+-2.0999 ? 87.5293+-1.4305 ? might be 1.0104x slower array-splice-contiguous 43.3032+-1.5979 42.2274+-1.8089 might be 1.0255x faster array-with-double-add 4.0852+-0.0294 ? 4.1915+-0.2977 ? might be 1.0260x slower array-with-double-increment 3.1829+-0.0720 ? 3.1855+-0.0525 ? array-with-double-mul-add 4.9821+-0.0526 ? 5.0000+-0.0223 ? array-with-double-sum 3.2347+-0.0298 ? 3.2764+-0.0530 ? might be 1.0129x slower array-with-int32-add-sub 6.8422+-0.3269 6.7272+-0.0500 might be 1.0171x faster array-with-int32-or-double-sum 3.3193+-0.0343 3.3141+-0.0406 ArrayBuffer-DataView-alloc-large-long-lived 37.7008+-1.9845 34.4089+-2.0241 might be 1.0957x faster ArrayBuffer-DataView-alloc-long-lived 15.8513+-2.9254 15.1808+-1.7999 might be 1.0442x faster ArrayBuffer-Int32Array-byteOffset 3.5073+-0.1269 ? 3.6113+-0.2099 ? might be 1.0296x slower ArrayBuffer-Int8Array-alloc-large-long-lived 35.0586+-1.4417 33.7565+-2.2925 might be 1.0386x faster ArrayBuffer-Int8Array-alloc-long-lived-buffer 25.7500+-1.9579 25.2627+-2.2489 might be 1.0193x faster ArrayBuffer-Int8Array-alloc-long-lived 13.8516+-0.8823 ? 14.0624+-1.5517 ? might be 1.0152x slower ArrayBuffer-Int8Array-alloc 12.7309+-1.8049 11.3566+-1.3511 might be 1.1210x faster asmjs_bool_bug 7.6406+-0.1827 ? 7.7068+-0.1871 ? assign-custom-setter-polymorphic 3.2160+-0.1628 ? 3.4524+-0.4734 ? might be 1.0735x slower assign-custom-setter 4.5000+-0.3114 4.3113+-0.0833 might be 1.0438x faster basic-set 8.4078+-0.3843 ? 8.6296+-0.5843 ? might be 1.0264x slower big-int-mul 3.9349+-0.0333 ? 3.9577+-0.0482 ? boolean-test 3.0147+-0.0169 ? 3.1200+-0.1467 ? might be 1.0349x slower branch-fold 3.7098+-0.1055 3.6709+-0.0476 might be 1.0106x faster by-val-generic 8.1844+-0.1699 ? 8.2073+-0.3252 ? call-spread-apply 16.7043+-0.4899 16.2773+-0.1556 might be 1.0262x faster call-spread-call 5.9163+-0.0585 ? 5.9746+-0.2188 ? captured-assignments 0.4575+-0.0138 0.4538+-0.0118 cast-int-to-double 5.3701+-0.2090 5.3209+-0.1810 cell-argument 8.7662+-0.3440 8.6962+-0.6026 cfg-simplify 2.9015+-0.1057 2.8630+-0.1234 might be 1.0135x faster chain-getter-access 10.2188+-0.3662 10.0915+-0.2299 might be 1.0126x faster cmpeq-obj-to-obj-other 11.3450+-0.9296 11.3135+-1.0458 constant-test 4.9307+-0.0262 4.9301+-0.0370 DataView-custom-properties 40.8457+-2.4803 38.5888+-1.9239 might be 1.0585x faster delay-tear-off-arguments-strictmode 22.6086+-2.4087 ? 24.8180+-2.3875 ? might be 1.0977x slower deltablue-varargs 181.9028+-2.1807 179.0732+-1.0747 might be 1.0158x faster destructuring-arguments 5.2249+-0.0787 5.1828+-0.0320 destructuring-swap 5.0962+-0.1805 5.0436+-0.0498 might be 1.0104x faster direct-arguments-getbyval 0.9191+-0.0685 0.9077+-0.0527 might be 1.0126x faster div-boolean-double 5.1813+-0.0181 5.1773+-0.0134 div-boolean 7.7912+-0.0522 7.7848+-0.0858 double-get-by-val-out-of-bounds 4.3716+-0.0374 ? 4.4109+-0.0908 ? double-pollution-getbyval 8.9212+-0.2406 8.8200+-0.0334 might be 1.0115x faster double-pollution-putbyoffset 4.0947+-0.0588 4.0822+-0.0881 double-to-int32-typed-array-no-inline 2.2194+-0.0599 2.2107+-0.0357 double-to-int32-typed-array 1.9718+-0.0612 1.9576+-0.1037 double-to-uint32-typed-array-no-inline 2.3113+-0.0329 2.3084+-0.0722 double-to-uint32-typed-array 2.0066+-0.0741 1.9816+-0.0337 might be 1.0126x faster elidable-new-object-dag 43.5015+-1.2526 ? 44.3413+-1.2554 ? might be 1.0193x slower elidable-new-object-roflcopter 45.9820+-0.6692 ? 46.6745+-0.9096 ? might be 1.0151x slower elidable-new-object-then-call 41.3115+-2.5009 ? 41.4688+-1.8455 ? elidable-new-object-tree 45.6320+-1.7253 45.4687+-0.5906 empty-string-plus-int 5.6075+-0.0826 ^ 5.3767+-0.1031 ^ definitely 1.0429x faster emscripten-cube2hash 38.9145+-1.9471 ? 39.7382+-1.7880 ? might be 1.0212x slower exit-length-on-plain-object 15.0810+-2.4819 14.7537+-1.6237 might be 1.0222x faster external-arguments-getbyval 1.4170+-0.1605 1.3916+-0.0921 might be 1.0183x faster external-arguments-putbyval 2.3378+-0.2055 ^ 2.0307+-0.0262 ^ definitely 1.1512x faster fixed-typed-array-storage-var-index 1.2210+-0.0234 ? 1.2402+-0.0836 ? might be 1.0157x slower fixed-typed-array-storage 0.9661+-0.1095 0.8684+-0.0163 might be 1.1125x faster Float32Array-matrix-mult 4.4649+-0.1995 4.2876+-0.0401 might be 1.0414x faster Float32Array-to-Float64Array-set 57.1182+-1.3049 ? 60.0044+-1.9564 ? might be 1.0505x slower Float64Array-alloc-long-lived 73.9788+-1.7970 73.3596+-1.5214 Float64Array-to-Int16Array-set 69.3556+-2.0624 ! 73.0426+-1.2061 ! definitely 1.0532x slower fold-double-to-int 16.1321+-1.3511 15.4978+-0.5525 might be 1.0409x faster fold-get-by-id-to-multi-get-by-offset-rare-int 10.2229+-1.2114 9.9859+-1.3522 might be 1.0237x faster fold-get-by-id-to-multi-get-by-offset 10.2367+-0.8585 ? 10.6207+-1.5431 ? might be 1.0375x slower fold-multi-get-by-offset-to-get-by-offset 9.1275+-1.0622 ? 9.3224+-1.4274 ? might be 1.0213x slower fold-multi-get-by-offset-to-poly-get-by-offset 8.7192+-0.7820 8.5640+-0.2596 might be 1.0181x faster fold-multi-put-by-offset-to-poly-put-by-offset 8.2083+-0.6042 ? 8.5467+-0.8461 ? might be 1.0412x slower fold-multi-put-by-offset-to-put-by-offset 4.5204+-0.1330 ? 4.5365+-0.9892 ? fold-multi-put-by-offset-to-replace-or-transition-put-by-offset 9.1915+-0.6396 9.1101+-0.3903 fold-put-by-id-to-multi-put-by-offset 9.9001+-0.8751 9.1758+-0.2511 might be 1.0789x faster fold-put-structure 4.5439+-0.7418 ? 5.1799+-1.2083 ? might be 1.1400x slower for-of-iterate-array-entries 4.6376+-0.3262 4.5562+-0.1212 might be 1.0179x faster for-of-iterate-array-keys 3.7269+-0.0596 ? 3.7598+-0.0745 ? for-of-iterate-array-values 3.6637+-0.1188 ? 3.6764+-0.0669 ? fround 20.7821+-0.5774 20.1875+-0.5640 might be 1.0295x faster ftl-library-inlining-dataview 78.5689+-2.0691 ? 80.0253+-2.1779 ? might be 1.0185x slower ftl-library-inlining 74.7209+-20.5364 67.2917+-0.7424 might be 1.1104x faster function-dot-apply 1.5219+-0.0479 1.5073+-0.0572 function-test 3.3574+-0.1106 3.3470+-0.0463 function-with-eval 133.9686+-5.8383 131.3882+-4.3393 might be 1.0196x faster gcse-poly-get-less-obvious 18.0733+-0.1385 ? 20.2671+-2.1002 ? might be 1.1214x slower gcse-poly-get 21.7969+-1.4711 ? 23.1963+-1.6123 ? might be 1.0642x slower gcse 4.2985+-0.0292 ? 4.3485+-0.0800 ? might be 1.0116x slower get-by-id-bimorphic-check-structure-elimination-simple 2.7321+-0.0332 ? 2.7941+-0.0769 ? might be 1.0227x slower get-by-id-bimorphic-check-structure-elimination 6.0373+-0.1054 ? 6.1720+-0.4026 ? might be 1.0223x slower get-by-id-chain-from-try-block 8.3572+-0.8785 8.1165+-0.6143 might be 1.0297x faster get-by-id-check-structure-elimination 5.1890+-0.1695 5.0483+-0.0560 might be 1.0279x faster get-by-id-proto-or-self 17.6200+-0.8053 ? 17.8766+-1.1641 ? might be 1.0146x slower get-by-id-quadmorphic-check-structure-elimination-simple 2.9555+-0.1261 2.8808+-0.0229 might be 1.0259x faster get-by-id-self-or-proto 17.9656+-1.2950 ? 18.5428+-0.9762 ? might be 1.0321x slower get-by-val-out-of-bounds 4.4972+-0.4015 4.3145+-0.1034 might be 1.0423x faster get_callee_monomorphic 3.5563+-0.0973 ? 3.5731+-0.0486 ? get_callee_polymorphic 3.7740+-0.2129 3.7343+-0.1102 might be 1.0106x faster getter-no-activation 4.4709+-0.5630 ? 4.8139+-0.7110 ? might be 1.0767x slower getter-richards 132.7810+-8.4755 132.7703+-3.5857 getter 5.1135+-0.0861 5.0576+-0.0575 might be 1.0111x faster global-var-const-infer-fire-from-opt 0.9028+-0.0874 0.8917+-0.0567 might be 1.0124x faster global-var-const-infer 0.8785+-0.1330 0.8249+-0.1141 might be 1.0650x faster HashMap-put-get-iterate-keys 26.8897+-0.9398 26.1495+-0.3754 might be 1.0283x faster HashMap-put-get-iterate 26.4159+-0.7635 26.2792+-0.6873 HashMap-string-put-get-iterate 28.1104+-1.3329 27.5844+-1.4143 might be 1.0191x faster hoist-make-rope 11.8280+-0.4368 11.8089+-1.1155 hoist-poly-check-structure-effectful-loop 5.1324+-0.2116 4.9956+-0.1337 might be 1.0274x faster hoist-poly-check-structure 3.6918+-0.0345 ? 3.6957+-0.0303 ? imul-double-only 8.3996+-0.1711 ? 8.4561+-0.5478 ? imul-int-only 10.0160+-0.6223 ? 10.0555+-0.6717 ? imul-mixed 8.2393+-0.4161 ? 8.2421+-0.3705 ? in-four-cases 18.7657+-0.1771 ? 19.4075+-1.5009 ? might be 1.0342x slower in-one-case-false 9.9202+-0.3847 ? 9.9235+-0.3589 ? in-one-case-true 10.2119+-0.8606 9.9176+-0.3505 might be 1.0297x faster in-two-cases 10.2616+-0.3705 ? 10.3212+-0.3963 ? indexed-properties-in-objects 2.8962+-0.0155 ! 2.9405+-0.0246 ! definitely 1.0153x slower infer-closure-const-then-mov-no-inline 3.6370+-0.0337 ? 3.6707+-0.0515 ? infer-closure-const-then-mov 19.4253+-1.1613 19.2017+-1.2744 might be 1.0116x faster infer-closure-const-then-put-to-scope-no-inline 11.6715+-0.1486 11.5420+-0.1501 might be 1.0112x faster infer-closure-const-then-put-to-scope 22.5467+-1.0751 ? 23.4775+-1.5056 ? might be 1.0413x slower infer-closure-const-then-reenter-no-inline 49.3102+-1.5741 48.6271+-0.6173 might be 1.0140x faster infer-closure-const-then-reenter 23.3623+-1.7145 22.6539+-1.5383 might be 1.0313x faster infer-constant-global-property 30.5823+-0.3716 ? 31.0291+-1.9735 ? might be 1.0146x slower infer-constant-property 2.7088+-0.0205 ? 2.7260+-0.0365 ? infer-one-time-closure-ten-vars 12.2631+-0.2836 ? 12.6808+-0.5068 ? might be 1.0341x slower infer-one-time-closure-two-vars 11.9055+-0.1584 ? 12.2964+-1.1690 ? might be 1.0328x slower infer-one-time-closure 11.9235+-0.4774 11.8003+-0.1876 might be 1.0104x faster infer-one-time-deep-closure 22.1810+-1.5411 21.5754+-1.0005 might be 1.0281x faster inline-arguments-access 1.3953+-0.0211 1.3904+-0.0165 inline-arguments-aliased-access 1.7511+-0.0738 1.6600+-0.0370 might be 1.0549x faster inline-arguments-local-escape 13.6817+-1.5288 ? 13.8828+-1.6980 ? might be 1.0147x slower inline-get-scoped-var 4.6628+-0.0767 4.6016+-0.0992 might be 1.0133x faster inlined-put-by-id-transition 10.4521+-0.1524 ? 11.1973+-0.7474 ? might be 1.0713x slower int-or-other-abs-then-get-by-val 4.9512+-0.0269 ? 4.9840+-0.0931 ? int-or-other-abs-zero-then-get-by-val 17.5459+-1.3780 17.2491+-0.8220 might be 1.0172x faster int-or-other-add-then-get-by-val 4.3648+-0.0819 4.3435+-0.0871 int-or-other-add 5.3878+-0.1310 5.2957+-0.0266 might be 1.0174x faster int-or-other-div-then-get-by-val 4.2778+-0.0923 4.2425+-0.1096 int-or-other-max-then-get-by-val 4.3817+-0.1458 4.3210+-0.0651 might be 1.0141x faster int-or-other-min-then-get-by-val 4.4076+-0.0679 ? 4.4163+-0.0527 ? int-or-other-mod-then-get-by-val 3.9370+-0.1089 3.8962+-0.0761 might be 1.0105x faster int-or-other-mul-then-get-by-val 4.0042+-0.1325 3.9831+-0.0641 int-or-other-neg-then-get-by-val 4.7056+-0.1378 4.6583+-0.0710 might be 1.0102x faster int-or-other-neg-zero-then-get-by-val 17.5655+-0.7890 17.5214+-1.2957 int-or-other-sub-then-get-by-val 4.4184+-0.1390 4.3890+-0.0570 int-or-other-sub 3.5170+-0.0551 3.5068+-0.0516 int-overflow-local 4.2268+-0.0469 ? 4.2355+-0.0714 ? Int16Array-alloc-long-lived 50.7617+-1.3554 ? 50.8176+-1.8869 ? Int16Array-bubble-sort-with-byteLength 21.6579+-1.0494 ? 21.6780+-0.7265 ? Int16Array-bubble-sort 25.7211+-4.1805 22.4766+-1.7153 might be 1.1443x faster Int16Array-load-int-mul 1.4578+-0.0127 1.4565+-0.0174 Int16Array-to-Int32Array-set 58.5250+-1.9218 ? 61.0232+-1.8831 ? might be 1.0427x slower Int32Array-alloc-large 24.9014+-1.3073 24.6901+-1.3612 Int32Array-alloc-long-lived 57.5260+-1.5943 56.8445+-1.7209 might be 1.0120x faster Int32Array-alloc 3.4110+-0.2362 ? 3.4552+-0.4199 ? might be 1.0130x slower Int32Array-Int8Array-view-alloc 8.0359+-1.3117 ? 8.3383+-1.2530 ? might be 1.0376x slower int52-spill 6.8350+-0.2268 6.5522+-0.0789 might be 1.0432x faster Int8Array-alloc-long-lived 47.2504+-2.2087 46.4594+-1.0901 might be 1.0170x faster Int8Array-load-with-byteLength 3.3118+-0.0620 ? 3.3700+-0.1327 ? might be 1.0176x slower Int8Array-load 3.3453+-0.0720 3.2944+-0.0605 might be 1.0154x faster integer-divide 11.2611+-0.2677 ? 11.3786+-0.4267 ? might be 1.0104x slower integer-modulo 2.0662+-0.1117 ? 2.0785+-0.1156 ? large-int-captured 7.0632+-0.9626 ? 7.9183+-1.2729 ? might be 1.1211x slower large-int-neg 16.5372+-0.6038 16.4826+-0.1298 large-int 15.5238+-0.6765 ? 15.5732+-1.6558 ? logical-not 4.4869+-0.0603 ? 4.4875+-0.0303 ? lots-of-fields 12.6720+-0.1917 ? 13.0357+-0.4853 ? might be 1.0287x slower make-indexed-storage 3.0221+-0.0739 ? 3.0345+-0.2045 ? make-rope-cse 4.7828+-0.4370 ? 4.8902+-0.6919 ? might be 1.0225x slower marsaglia-larger-ints 35.6429+-0.7238 ? 36.2355+-2.1198 ? might be 1.0166x slower marsaglia-osr-entry 24.0787+-1.5933 23.0045+-0.4736 might be 1.0467x faster max-boolean 2.4683+-0.0493 2.4328+-0.0391 might be 1.0146x faster method-on-number 17.4268+-0.7808 ? 17.5625+-0.4277 ? min-boolean 2.4648+-0.0273 ? 2.5074+-0.1770 ? might be 1.0173x slower minus-boolean-double 3.1860+-0.0797 3.1735+-0.0623 minus-boolean 2.3269+-0.0454 2.3044+-0.0202 misc-strict-eq 37.8010+-1.3550 ? 39.6995+-2.4889 ? might be 1.0502x slower mod-boolean-double 10.9938+-0.1535 ? 11.4011+-0.6953 ? might be 1.0370x slower mod-boolean 7.8195+-0.0418 ? 7.8219+-0.1154 ? mul-boolean-double 3.7025+-0.0673 ? 3.7223+-0.0916 ? mul-boolean 2.9434+-0.0701 ? 2.9987+-0.3133 ? might be 1.0188x slower neg-boolean 3.2484+-0.1568 3.1690+-0.0252 might be 1.0251x faster negative-zero-divide 0.3567+-0.0064 0.3517+-0.0096 might be 1.0142x faster negative-zero-modulo 0.3681+-0.0268 0.3580+-0.0398 might be 1.0282x faster negative-zero-negate 0.3302+-0.0179 0.3219+-0.0268 might be 1.0258x faster nested-function-parsing 22.2548+-0.5590 22.1814+-0.7303 new-array-buffer-dead 2.8212+-0.1239 2.7967+-0.0496 new-array-buffer-push 6.9593+-0.8457 ? 6.9904+-0.7952 ? new-array-dead 12.2464+-0.2815 ? 12.6441+-0.3986 ? might be 1.0325x slower new-array-push 3.8676+-0.0780 3.8309+-0.0496 number-test 3.0397+-0.1014 2.9731+-0.0328 might be 1.0224x faster object-closure-call 5.6075+-0.0415 ? 5.6958+-0.3183 ? might be 1.0157x slower object-test 3.1073+-0.0542 3.0774+-0.0299 obvious-sink-pathology-taken 146.0761+-2.5228 145.5109+-2.1439 obvious-sink-pathology 143.3328+-2.6902 141.8153+-1.0992 might be 1.0107x faster obviously-elidable-new-object 36.0353+-1.3837 35.0599+-1.2489 might be 1.0278x faster plus-boolean-arith 2.5038+-0.0202 ? 2.5065+-0.0256 ? plus-boolean-double 3.1668+-0.0407 ? 3.2060+-0.0650 ? might be 1.0124x slower plus-boolean 2.3670+-0.0129 ? 2.3713+-0.0218 ? poly-chain-access-different-prototypes-simple 3.3048+-0.0511 ? 3.3450+-0.0970 ? might be 1.0122x slower poly-chain-access-different-prototypes 2.8513+-0.2010 ? 2.8949+-0.2051 ? might be 1.0153x slower poly-chain-access-simpler 3.2921+-0.0524 ? 3.3417+-0.1025 ? might be 1.0151x slower poly-chain-access 2.8462+-0.0904 ? 2.8485+-0.1271 ? poly-stricteq 58.9006+-1.8908 58.1188+-1.2876 might be 1.0135x faster polymorphic-array-call 1.2338+-0.0584 1.2162+-0.0358 might be 1.0145x faster polymorphic-get-by-id 3.0741+-0.0458 ? 3.1753+-0.1415 ? might be 1.0329x slower polymorphic-put-by-id 29.8521+-2.1486 29.4155+-1.3125 might be 1.0148x faster polymorphic-structure 15.3306+-0.5829 15.2631+-0.9901 polyvariant-monomorphic-get-by-id 8.6608+-0.2640 8.5903+-0.1957 proto-getter-access 10.0338+-0.1832 ? 10.1449+-0.2221 ? might be 1.0111x slower put-by-id-replace-and-transition 8.6461+-0.5449 8.6077+-0.2477 put-by-id-slightly-polymorphic 2.8335+-0.0475 ? 2.8442+-0.0230 ? put-by-id 13.6107+-0.8556 13.4442+-0.3773 might be 1.0124x faster put-by-val-direct 0.5841+-0.0214 0.5671+-0.0158 might be 1.0301x faster put-by-val-large-index-blank-indexing-type 6.3783+-0.8228 6.2695+-0.9228 might be 1.0174x faster put-by-val-machine-int 2.5583+-0.0759 2.5556+-0.0381 rare-osr-exit-on-local 15.1091+-0.3426 ? 15.2471+-0.4379 ? register-pressure-from-osr 21.4666+-0.1750 ? 21.6069+-0.6271 ? setter 5.4515+-0.0261 ^ 5.2524+-0.1291 ^ definitely 1.0379x faster simple-activation-demo 31.9390+-1.1355 ^ 26.2942+-1.8028 ^ definitely 1.2147x faster simple-getter-access 12.6310+-0.2266 ? 12.6915+-0.2109 ? simple-poly-call-nested 8.3163+-0.1396 8.2673+-0.3140 simple-poly-call 1.3190+-0.1185 1.3042+-0.1413 might be 1.0113x faster sin-boolean 23.9337+-1.8666 23.6639+-1.5978 might be 1.0114x faster sinkable-new-object-dag 69.5548+-1.5453 ? 69.9312+-2.0722 ? sinkable-new-object-taken 52.4511+-2.7461 52.3018+-3.5433 sinkable-new-object 38.9757+-1.1063 ? 39.3671+-1.5142 ? might be 1.0100x slower slow-array-profile-convergence 2.6693+-0.2096 ? 2.6825+-0.0583 ? slow-convergence 3.1857+-0.0504 ? 3.2217+-0.0333 ? might be 1.0113x slower sparse-conditional 1.1097+-0.0238 1.0762+-0.0306 might be 1.0311x faster splice-to-remove 17.9878+-1.7903 17.2052+-1.4703 might be 1.0455x faster string-char-code-at 16.1121+-0.7657 ? 16.1286+-0.6505 ? string-concat-object 2.4749+-0.1735 ? 2.4762+-0.2839 ? string-concat-pair-object 2.3785+-0.0508 2.3304+-0.0961 might be 1.0207x faster string-concat-pair-simple 11.4618+-0.5132 ? 12.0457+-0.9620 ? might be 1.0509x slower string-concat-simple 11.7712+-0.4925 ? 12.6808+-1.1079 ? might be 1.0773x slower string-cons-repeat 8.0387+-0.8459 7.8221+-0.4473 might be 1.0277x faster string-cons-tower 8.3190+-0.5611 7.8791+-0.6728 might be 1.0558x faster string-equality 17.5171+-0.3956 ? 18.1165+-1.0030 ? might be 1.0342x slower string-get-by-val-big-char 7.4461+-0.0615 7.2585+-0.4677 might be 1.0258x faster string-get-by-val-out-of-bounds-insane 3.8245+-0.1071 ? 3.9633+-0.3969 ? might be 1.0363x slower string-get-by-val-out-of-bounds 5.2240+-0.0727 5.1852+-0.0573 string-get-by-val 3.2917+-0.0599 ? 3.2954+-0.0399 ? string-hash 1.9999+-0.0146 ? 2.0071+-0.0169 ? string-long-ident-equality 14.3724+-0.2709 ? 14.5167+-0.2435 ? might be 1.0100x slower string-out-of-bounds 14.9482+-0.2539 ? 15.4169+-1.2734 ? might be 1.0314x slower string-repeat-arith 32.2099+-3.1970 ? 36.2543+-2.5830 ? might be 1.1256x slower string-sub 67.1983+-3.9848 66.6566+-2.7299 string-test 2.9294+-0.0247 2.9025+-0.0373 string-var-equality 30.1188+-0.3935 ? 31.2776+-2.1455 ? might be 1.0385x slower structure-hoist-over-transitions 2.5920+-0.1816 2.4882+-0.0407 might be 1.0417x faster substring-concat-weird 38.8348+-1.0127 ? 39.4757+-1.8279 ? might be 1.0165x slower substring-concat 41.1488+-2.1344 41.0628+-0.7561 substring 45.7676+-1.9039 44.9646+-0.6260 might be 1.0179x faster switch-char-constant 2.7369+-0.1143 2.7191+-0.0726 switch-char 6.7739+-0.7838 ? 7.3924+-1.0846 ? might be 1.0913x slower switch-constant 8.0296+-0.2236 ? 8.0930+-0.4248 ? switch-string-basic-big-var 14.9238+-0.0918 ? 16.0129+-1.7182 ? might be 1.0730x slower switch-string-basic-big 14.5870+-1.5317 14.2672+-0.3031 might be 1.0224x faster switch-string-basic-var 14.8967+-1.2656 ? 16.2094+-2.0745 ? might be 1.0881x slower switch-string-basic 14.5520+-1.7587 13.8256+-1.4738 might be 1.0525x faster switch-string-big-length-tower-var 21.0621+-1.7390 20.2810+-1.5739 might be 1.0385x faster switch-string-length-tower-var 17.0393+-1.8582 16.3207+-1.8961 might be 1.0440x faster switch-string-length-tower 14.0979+-1.6992 13.6581+-1.7448 might be 1.0322x faster switch-string-short 14.0776+-1.7766 13.2806+-1.4159 might be 1.0600x faster switch 12.0075+-0.3335 ? 12.0476+-0.4075 ? tear-off-arguments-simple 1.9328+-0.0545 1.9028+-0.0904 might be 1.0158x faster tear-off-arguments 2.7583+-0.0307 ? 2.7723+-0.0429 ? temporal-structure 13.3942+-1.4017 13.2743+-0.4805 to-int32-boolean 13.8383+-0.2412 13.6946+-0.3953 might be 1.0105x faster undefined-property-access 383.5835+-3.4652 ? 384.1574+-2.9239 ? undefined-test 3.0465+-0.0457 3.0152+-0.0432 might be 1.0104x faster unprofiled-licm 22.9290+-0.6555 ? 23.4746+-1.0830 ? might be 1.0238x slower weird-inlining-const-prop 2.3440+-0.0812 2.3279+-0.0741 <geometric> 8.2763+-0.0095 8.2544+-0.0182 might be 1.0027x faster TipOfTree FixExecAlloc AsmBench: bigfib.cpp 496.5868+-6.3711 495.1169+-3.2285 cray.c 430.0208+-1.3642 ? 439.9113+-15.1149 ? might be 1.0230x slower dry.c 490.2217+-2.6931 487.6617+-5.7372 FloatMM.c 736.3917+-10.1804 730.6357+-5.7510 gcc-loops.cpp 4267.0334+-30.5568 4249.6080+-7.6123 n-body.c 985.9462+-3.1145 ? 987.1685+-1.8554 ? Quicksort.c 443.9646+-3.9226 ? 446.5733+-5.3090 ? stepanov_container.cpp 3840.5032+-688.4201 3604.3124+-58.7508 might be 1.0655x faster Towers.c 266.2259+-2.3260 ? 269.2322+-4.1724 ? might be 1.0113x slower <geometric> 807.3714+-11.9610 804.3825+-3.3102 might be 1.0037x faster TipOfTree FixExecAlloc CompressionBench: huffman 355.7395+-2.6811 ! 387.8106+-2.1727 ! definitely 1.0902x slower arithmetic-simple 406.8492+-3.8275 405.7917+-4.2524 arithmetic-precise 307.7015+-4.9003 303.7481+-3.6778 might be 1.0130x faster arithmetic-complex-precise 304.0359+-5.5902 303.3922+-2.9695 arithmetic-precise-order-0 434.3406+-6.6574 432.9622+-7.6714 arithmetic-precise-order-1 343.8501+-4.2109 ? 344.6013+-7.3633 ? arithmetic-precise-order-2 386.8418+-6.7782 ? 387.4291+-8.2662 ? arithmetic-simple-order-1 437.0731+-8.3196 430.8148+-4.9948 might be 1.0145x faster arithmetic-simple-order-2 481.9714+-3.9808 ? 483.0452+-6.3517 ? lz-string 334.5050+-21.6366 326.0211+-13.7832 might be 1.0260x faster <geometric> 375.0244+-4.3204 ? 376.2154+-1.8245 ? might be 1.0032x slower TipOfTree FixExecAlloc TipOfTree FixExecAlloc Geomean of preferred means: <scaled-result> 63.8343+-0.2158 63.7480+-0.1075 might be 1.0014x faster
Filip Pizlo
Comment 12 2015-03-25 13:02:40 PDT
I'm going to try to add some test cases for the failing case.
Filip Pizlo
Comment 13 2015-03-25 15:59:32 PDT
Created attachment 249435 [details] the patch And now, with tests!
WebKit Commit Bot
Comment 14 2015-03-25 16:02:14 PDT
Attachment 249435 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/tests/executableAllocationFuzz/v8-raytrace.js:652: Line contains tab character. [whitespace/tab] [5] ERROR: Source/JavaScriptCore/tests/executableAllocationFuzz/v8-raytrace.js:654: Line contains tab character. [whitespace/tab] [5] ERROR: Source/JavaScriptCore/tests/executableAllocationFuzz/v8-raytrace.js:656: Line contains tab character. [whitespace/tab] [5] ERROR: Source/JavaScriptCore/tests/executableAllocationFuzz/v8-raytrace.js:658: Line contains tab character. [whitespace/tab] [5] Total errors found: 4 in 26 files If any of these errors are false positives, please file a bug against check-webkit-style.
Mark Lam
Comment 15 2015-03-25 16:40:18 PDT
Comment on attachment 249435 [details] the patch r=me on tests and supporting code.
Filip Pizlo
Comment 16 2015-03-25 18:27:56 PDT
Landed in http://trac.webkit.org/changeset/181990
Filip Pizlo
Comment 17 2015-03-25 18:29:10 PDT
Landed in http://trac.webkit.org/changeset/181990
Note You need to log in before you can comment on or make changes to this bug.