| Summary: | REGRESSION (r182899): icloud.com crashes | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Basile Clement <basile_clement> | ||||||||
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> | ||||||||
| Status: | RESOLVED FIXED | ||||||||||
| Severity: | Normal | CC: | commit-queue, fpizlo, ggaren, msaboff | ||||||||
| Priority: | P2 | ||||||||||
| Version: | 528+ (Nightly build) | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Basile Clement
2015-04-20 13:06:17 PDT
Created attachment 251185 [details]
Possible patch, regression test forthcoming
Comment on attachment 251185 [details] Possible patch, regression test forthcoming View in context: https://bugs.webkit.org/attachment.cgi?id=251185&action=review > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:113 > + case AllocationProfileWatchpoint: { > + InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet(); > + if (watchpointSet) > + addLazily(*watchpointSet); > break; > + } If watchpointSet is null, the compiler will fail to add a necessary watchpoint, which means that we'll end up with incorrect code if the watchpoint fires. Can we ASSERT that watchpointSet is not null instead of checking? What guarantees that it will not be null? (In reply to comment #2) > Comment on attachment 251185 [details] > Possible patch, regression test forthcoming > > View in context: > https://bugs.webkit.org/attachment.cgi?id=251185&action=review > > > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:113 > > + case AllocationProfileWatchpoint: { > > + InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet(); > > + if (watchpointSet) > > + addLazily(*watchpointSet); > > break; > > + } > > If watchpointSet is null, the compiler will fail to add a necessary > watchpoint, which means that we'll end up with incorrect code if the > watchpoint fires. > > Can we ASSERT that watchpointSet is not null instead of checking? > > What guarantees that it will not be null? If the watchpointSet is null, it means there is no rare data and thus there shouldn't be an AllocationProfileWatchpoint for this node. A least that was the case before I made the allocation profile clearing too aggressive when the .prototype is overwritten. This can only appear in the case of a singleton constructor whose prototype is overwritten after having been already constructed in the DFG, then constructed again, so no wonder the test cases did not catch this. I am writing a proper fix now. > If the watchpointSet is null, it means there is no rare data and thus there > shouldn't be an AllocationProfileWatchpoint for this node. OK. Sounds like an ASSERT is appropriate, then. > A least that was the case before I made the allocation profile clearing too > aggressive when the .prototype is overwritten. > > This can only appear in the case of a singleton constructor whose prototype > is overwritten after having been already constructed in the DFG, then > constructed again, so no wonder the test cases did not catch this. > > I am writing a proper fix now. Nice! Created attachment 251211 [details]
Slow (but clean) patch
So in spite of the outrageous slowdown on Kraken/ai-astar I experienced yesterday, things seems to be now OK with the same code... Patch w/ ChangeLog and additional style details used for this benchmark forthcoming. Benchmark report for SunSpider, LongSpider, V8Spider, Octane, Kraken, JSRegress, AsmBench, and CompressionBench on Basiles-MacBook-Pro (MacBookPro11,3). VMs tested: "Conf#1" at /Volumes/Data/Baseline/OpenSource/WebKitBuild/Release/jsc (r183038) "Conf#2" at /Volumes/Data/Temp/OpenSource/WebKitBuild/Release/jsc (r183038) Collected 6 samples per benchmark/VM, with 6 VM invocations per benchmark. Emitted a call to gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds. Conf#1 Conf#2 SunSpider: 3d-cube 4.4111+-0.2044 4.3238+-0.1437 might be 1.0202x faster 3d-morph 5.3675+-0.2143 ? 5.5118+-0.3181 ? might be 1.0269x slower 3d-raytrace 5.1515+-0.1547 ? 5.2351+-0.3690 ? might be 1.0162x slower access-binary-trees 2.1466+-0.2869 ? 2.1582+-0.1988 ? access-fannkuch 5.1811+-0.1676 ? 5.6444+-0.6224 ? might be 1.0894x slower access-nbody 2.8918+-0.6780 2.6600+-0.3254 might be 1.0871x faster access-nsieve 3.1853+-0.3112 3.1574+-0.3144 bitops-3bit-bits-in-byte 1.4046+-0.0306 ? 1.4376+-0.0628 ? might be 1.0235x slower bitops-bits-in-byte 3.2297+-0.4151 ? 3.5550+-0.3327 ? might be 1.1007x slower bitops-bitwise-and 2.0845+-0.0474 2.0393+-0.0925 might be 1.0222x faster bitops-nsieve-bits 3.4909+-0.2473 ? 3.4997+-0.3675 ? controlflow-recursive 1.8942+-0.0722 ? 1.9248+-0.1217 ? might be 1.0162x slower crypto-aes 3.8242+-0.3814 3.7720+-0.2282 might be 1.0138x faster crypto-md5 2.1725+-0.0943 2.1700+-0.1034 crypto-sha1 2.3858+-0.2348 ? 2.5206+-0.5790 ? might be 1.0565x slower date-format-tofte 7.1268+-0.9663 6.9247+-0.2957 might be 1.0292x faster date-format-xparb 4.9818+-0.5199 ? 5.0142+-0.1648 ? math-cordic 2.8288+-0.1861 ? 2.8327+-0.1511 ? math-partial-sums 4.5638+-0.1321 ? 5.0288+-0.8141 ? might be 1.1019x slower math-spectral-norm 1.7558+-0.0402 ? 1.8155+-0.0769 ? might be 1.0340x slower regexp-dna 6.6329+-0.1391 ? 6.8435+-0.5221 ? might be 1.0317x slower string-base64 4.3359+-0.2851 4.3359+-0.2919 string-fasta 6.0370+-0.3537 5.8378+-0.1334 might be 1.0341x faster string-tagcloud 8.9259+-0.3721 ? 9.3738+-1.4458 ? might be 1.0502x slower string-unpack-code 18.9049+-0.7931 ? 19.1390+-0.6200 ? might be 1.0124x slower string-validate-input 4.4896+-0.1714 ? 4.5817+-0.3382 ? might be 1.0205x slower <arithmetic> 4.5925+-0.0960 ? 4.6668+-0.0724 ? might be 1.0162x slower Conf#1 Conf#2 LongSpider: 3d-cube 817.6180+-19.7165 ? 822.9426+-12.3744 ? 3d-morph 1573.7068+-14.2216 ? 1588.3167+-40.2457 ? 3d-raytrace 688.1183+-12.9003 ? 691.6603+-16.6387 ? access-binary-trees 870.7376+-11.3850 ? 887.5717+-42.1808 ? might be 1.0193x slower access-fannkuch 280.5467+-15.9701 279.4959+-17.8178 access-nbody 580.6865+-13.6523 ? 584.6453+-26.0042 ? access-nsieve 680.6292+-24.1388 661.7668+-9.8425 might be 1.0285x faster bitops-3bit-bits-in-byte 44.4220+-0.9161 43.4525+-1.4874 might be 1.0223x faster bitops-bits-in-byte 88.4662+-9.0516 ? 92.8015+-6.3850 ? might be 1.0490x slower bitops-nsieve-bits 709.9130+-31.4591 697.8083+-17.1376 might be 1.0173x faster controlflow-recursive 474.7817+-8.5041 474.7696+-12.7393 crypto-aes 583.7215+-13.5868 ? 588.3995+-18.9155 ? crypto-md5 553.5954+-11.9800 553.0100+-14.4423 crypto-sha1 606.8895+-17.2668 600.1799+-10.2761 might be 1.0112x faster date-format-tofte 539.9448+-15.2411 ? 540.1794+-11.5012 ? date-format-xparb 656.9644+-19.0389 ? 663.0825+-14.8690 ? math-cordic 531.5884+-20.5807 527.6919+-15.8413 math-partial-sums 448.3560+-6.5085 ? 450.0747+-13.1886 ? math-spectral-norm 578.6361+-14.8553 ? 594.4453+-28.2468 ? might be 1.0273x slower string-base64 343.0765+-8.1814 ? 345.7093+-11.5500 ? string-fasta 392.9964+-5.9136 ? 394.9641+-13.0204 ? string-tagcloud 205.1713+-3.3125 ? 205.8254+-2.9971 ? <geometric> 454.8897+-4.7613 ? 456.3003+-4.2183 ? might be 1.0031x slower Conf#1 Conf#2 V8Spider: crypto 54.5824+-2.7855 54.1031+-3.3591 deltablue 85.6617+-2.8945 82.2306+-7.5361 might be 1.0417x faster earley-boyer 42.2645+-2.0524 41.5098+-3.0421 might be 1.0182x faster raytrace 32.2721+-2.1072 ? 32.7733+-2.7647 ? might be 1.0155x slower regexp 60.5894+-2.2568 ? 62.2518+-2.2598 ? might be 1.0274x slower richards 79.4209+-3.5216 76.1930+-4.9852 might be 1.0424x faster splay 36.9962+-4.2056 ? 39.1694+-2.4252 ? might be 1.0587x slower <geometric> 52.6704+-0.5327 52.5930+-1.6708 might be 1.0015x faster Conf#1 Conf#2 Octane: encrypt 0.21007+-0.00446 ? 0.21144+-0.00308 ? decrypt 3.71290+-0.14272 ? 3.75313+-0.21931 ? might be 1.0108x slower deltablue x2 0.16996+-0.00489 ? 0.17085+-0.00273 ? earley 0.45581+-0.00553 ? 0.45863+-0.01049 ? boyer 5.91343+-0.10822 ? 6.14323+-0.24823 ? might be 1.0389x slower navier-stokes x2 5.37667+-0.13896 ? 5.38362+-0.13202 ? raytrace x2 1.10628+-0.06968 1.04890+-0.03014 might be 1.0547x faster richards x2 0.10011+-0.00399 0.09725+-0.00413 might be 1.0294x faster splay x2 0.37522+-0.01394 0.37513+-0.01274 regexp x2 30.36643+-0.71624 29.97653+-0.48692 might be 1.0130x faster pdfjs x2 40.33048+-0.99985 40.21220+-0.47707 mandreel x2 49.51375+-2.06638 47.59378+-0.59116 might be 1.0403x faster gbemu x2 32.76628+-1.98360 ? 33.43657+-2.29444 ? might be 1.0205x slower closure 0.52168+-0.01117 ? 0.52477+-0.01508 ? jquery 6.72555+-0.17672 6.44958+-0.21828 might be 1.0428x faster box2d x2 10.59619+-0.15298 ? 10.79456+-0.38331 ? might be 1.0187x slower zlib x2 369.35583+-16.86866 ? 370.48058+-20.24982 ? typescript x2 679.37744+-22.76805 ? 685.72013+-28.59215 ? <geometric> 6.05632+-0.04854 6.02923+-0.05310 might be 1.0045x faster Conf#1 Conf#2 Kraken: ai-astar 287.336+-15.250 284.738+-8.406 audio-beat-detection 100.672+-1.883 ? 103.208+-6.142 ? might be 1.0252x slower audio-dft 172.977+-4.890 ? 176.204+-5.033 ? might be 1.0187x slower audio-fft 81.997+-3.216 79.780+-4.816 might be 1.0278x faster audio-oscillator 185.525+-2.845 ? 185.645+-3.430 ? imaging-darkroom 98.589+-2.853 ? 98.676+-3.153 ? imaging-desaturate 62.835+-2.297 58.786+-3.219 might be 1.0689x faster imaging-gaussian-blur 90.820+-2.361 ? 93.428+-3.716 ? might be 1.0287x slower json-parse-financial 40.398+-3.083 38.619+-2.061 might be 1.0461x faster json-stringify-tinderbox 53.089+-2.624 52.673+-1.704 stanford-crypto-aes 61.027+-2.323 59.853+-2.455 might be 1.0196x faster stanford-crypto-ccm 55.202+-8.040 50.737+-3.651 might be 1.0880x faster stanford-crypto-pbkdf2 162.948+-5.371 157.755+-4.224 might be 1.0329x faster stanford-crypto-sha256-iterative 54.075+-4.366 53.503+-2.294 might be 1.0107x faster <arithmetic> 107.678+-1.610 106.686+-1.659 might be 1.0093x faster Conf#1 Conf#2 JSRegress: abs-boolean 2.6124+-0.4033 2.4428+-0.1249 might be 1.0694x faster adapt-to-double-divide 17.0688+-0.5593 ? 17.1006+-0.3706 ? aliased-arguments-getbyval 1.1637+-0.2058 1.1230+-0.0949 might be 1.0362x faster allocate-big-object 2.8472+-0.4356 ? 2.9385+-0.8776 ? might be 1.0320x slower arguments-named-and-reflective 11.2933+-0.9596 11.1178+-0.4019 might be 1.0158x faster arguments-out-of-bounds 10.9053+-0.4980 10.6532+-0.3087 might be 1.0237x faster arguments-strict-mode 10.6584+-0.7108 ? 10.9958+-0.7231 ? might be 1.0317x slower arguments 9.5830+-0.5207 9.2352+-0.6302 might be 1.0377x faster arity-mismatch-inlining 0.8003+-0.0312 0.7971+-0.0338 array-access-polymorphic-structure 6.3953+-0.5653 6.3636+-0.3803 array-nonarray-polymorhpic-access 29.6038+-1.2433 29.4707+-1.7052 array-prototype-every 84.1193+-4.0456 ? 86.0033+-2.0384 ? might be 1.0224x slower array-prototype-forEach 84.4655+-2.6500 83.4175+-3.5744 might be 1.0126x faster array-prototype-map 91.3452+-3.1869 ? 92.9378+-4.6529 ? might be 1.0174x slower array-prototype-some 84.7174+-2.7073 ? 85.0240+-5.3037 ? array-splice-contiguous 43.6191+-1.6529 ^ 38.8805+-0.8602 ^ definitely 1.1219x faster array-with-double-add 3.5232+-0.4815 ? 3.5730+-0.2506 ? might be 1.0141x slower array-with-double-increment 3.1361+-0.2830 ? 3.2225+-0.2474 ? might be 1.0275x slower array-with-double-mul-add 4.3812+-0.5406 4.2806+-0.3037 might be 1.0235x faster array-with-double-sum 3.3892+-0.1037 3.3739+-0.3085 array-with-int32-add-sub 5.8597+-0.1233 ? 6.1549+-0.6268 ? might be 1.0504x slower array-with-int32-or-double-sum 3.4059+-0.3212 3.3490+-0.2758 might be 1.0170x faster ArrayBuffer-DataView-alloc-large-long-lived 30.9327+-4.1872 27.4834+-0.5178 might be 1.1255x faster ArrayBuffer-DataView-alloc-long-lived 12.8712+-0.9715 ? 13.7437+-1.6279 ? might be 1.0678x slower ArrayBuffer-Int32Array-byteOffset 3.7529+-0.1095 3.7030+-0.2212 might be 1.0135x faster ArrayBuffer-Int8Array-alloc-large-long-lived 29.4908+-2.1964 ? 30.2222+-4.2261 ? might be 1.0248x slower ArrayBuffer-Int8Array-alloc-long-lived-buffer 21.8310+-1.2266 ? 22.1141+-1.6000 ? might be 1.0130x slower ArrayBuffer-Int8Array-alloc-long-lived 12.3098+-0.6281 12.2984+-0.5201 ArrayBuffer-Int8Array-alloc 10.8290+-1.3924 10.2240+-0.2865 might be 1.0592x faster asmjs_bool_bug 7.1077+-0.5078 6.8527+-0.4310 might be 1.0372x faster assign-custom-setter-polymorphic 2.6458+-0.1286 ? 2.6799+-0.2595 ? might be 1.0129x slower assign-custom-setter 3.6307+-0.2180 3.5252+-0.1748 might be 1.0299x faster basic-set 7.9879+-0.7943 ? 8.3805+-0.7784 ? might be 1.0492x slower big-int-mul 3.4585+-0.1257 ? 3.4856+-0.1692 ? boolean-test 3.0920+-0.3657 2.7690+-0.0611 might be 1.1166x faster branch-fold 3.5407+-0.0889 ? 3.6171+-0.1821 ? might be 1.0216x slower by-val-generic 8.0601+-0.3659 7.4375+-0.2719 might be 1.0837x faster call-spread-apply 27.6390+-1.5798 27.2447+-0.5247 might be 1.0145x faster call-spread-call 22.4515+-1.0915 ? 22.5743+-0.4371 ? captured-assignments 0.3919+-0.0371 0.3857+-0.0517 might be 1.0160x faster cast-int-to-double 5.0644+-0.4675 5.0507+-0.2256 cell-argument 7.0046+-0.8499 6.6217+-0.9109 might be 1.0578x faster cfg-simplify 2.8696+-0.1196 ? 3.0249+-0.2185 ? might be 1.0541x slower chain-getter-access 9.3335+-0.3058 9.1649+-0.1615 might be 1.0184x faster cmpeq-obj-to-obj-other 11.1920+-1.0460 10.0025+-0.7598 might be 1.1189x faster constant-test 4.6949+-0.1809 ? 4.7850+-0.2780 ? might be 1.0192x slower create-lots-of-functions 11.6183+-1.6850 10.7512+-1.1989 might be 1.0807x faster DataView-custom-properties 37.7437+-2.6097 35.7613+-2.7194 might be 1.0554x faster deconstructing-parameters-overridden-by-function 0.5586+-0.2080 0.4260+-0.0377 might be 1.3113x faster delay-tear-off-arguments-strictmode 12.5851+-0.6293 ? 13.5450+-1.1332 ? might be 1.0763x slower deltablue-varargs 150.9985+-4.3408 149.9580+-4.0979 destructuring-arguments 14.5688+-1.2935 ? 15.5117+-0.9651 ? might be 1.0647x slower destructuring-swap 4.8762+-0.3395 4.7178+-0.1383 might be 1.0336x faster direct-arguments-getbyval 1.0990+-0.0450 ? 1.3486+-0.4359 ? might be 1.2271x slower div-boolean-double 5.4707+-0.1005 5.4607+-0.1971 div-boolean 8.6695+-0.2311 8.4148+-0.4300 might be 1.0303x faster double-get-by-val-out-of-bounds 4.2937+-0.1702 4.0596+-0.1076 might be 1.0577x faster double-pollution-getbyval 9.1175+-0.3625 8.9581+-0.2146 might be 1.0178x faster double-pollution-putbyoffset 4.0350+-0.1464 ? 4.6441+-1.1842 ? might be 1.1509x slower double-to-int32-typed-array-no-inline 2.2477+-0.2448 ? 2.2925+-0.6242 ? might be 1.0199x slower double-to-int32-typed-array 1.9484+-0.3038 ? 1.9720+-0.5252 ? might be 1.0121x slower double-to-uint32-typed-array-no-inline 2.2250+-0.1157 2.1003+-0.0203 might be 1.0594x faster double-to-uint32-typed-array 1.8212+-0.1917 1.7602+-0.1020 might be 1.0347x faster elidable-new-object-dag 37.2981+-3.1315 ? 38.7206+-2.9826 ? might be 1.0381x slower elidable-new-object-roflcopter 39.6376+-3.2297 39.5931+-3.8236 elidable-new-object-then-call 34.0243+-3.1473 ? 34.7145+-4.2870 ? might be 1.0203x slower elidable-new-object-tree 39.7441+-2.5039 39.3264+-2.1488 might be 1.0106x faster empty-string-plus-int 4.8006+-0.1188 ? 4.8724+-0.2138 ? might be 1.0150x slower emscripten-cube2hash 27.5030+-1.1814 ? 30.8230+-3.5570 ? might be 1.1207x slower exit-length-on-plain-object 12.8774+-0.2845 12.7901+-0.7225 external-arguments-getbyval 1.3349+-0.1772 1.2212+-0.1398 might be 1.0931x faster external-arguments-putbyval 2.1980+-0.1282 ? 2.2215+-0.1669 ? might be 1.0107x slower fixed-typed-array-storage-var-index 1.2353+-0.2150 1.1725+-0.0669 might be 1.0535x faster fixed-typed-array-storage 0.8152+-0.0426 0.8137+-0.0436 Float32Array-matrix-mult 4.1239+-0.3860 3.8107+-0.0821 might be 1.0822x faster Float32Array-to-Float64Array-set 51.0987+-1.0249 50.8393+-2.5773 Float64Array-alloc-long-lived 66.3454+-4.6387 ? 66.9267+-3.3990 ? Float64Array-to-Int16Array-set 62.0043+-1.3961 ? 64.2865+-3.4803 ? might be 1.0368x slower fold-double-to-int 13.0621+-0.5187 12.9029+-0.4743 might be 1.0123x faster fold-get-by-id-to-multi-get-by-offset-rare-int 10.2085+-0.4990 9.6475+-0.3437 might be 1.0582x faster fold-get-by-id-to-multi-get-by-offset 8.4259+-0.7676 7.8657+-1.7257 might be 1.0712x faster fold-multi-get-by-offset-to-get-by-offset 7.4025+-1.1130 ? 8.2970+-0.6792 ? might be 1.1208x slower fold-multi-get-by-offset-to-poly-get-by-offset 7.3861+-0.8781 7.1215+-0.9959 might be 1.0372x faster fold-multi-put-by-offset-to-poly-put-by-offset 7.8603+-0.9585 7.2335+-0.6107 might be 1.0867x faster fold-multi-put-by-offset-to-put-by-offset 4.2035+-0.9675 ? 5.1413+-0.9192 ? might be 1.2231x slower fold-multi-put-by-offset-to-replace-or-transition-put-by-offset 8.9422+-0.7122 8.6329+-0.6409 might be 1.0358x faster fold-put-by-id-to-multi-put-by-offset 8.3568+-0.4795 ? 8.5654+-1.2329 ? might be 1.0250x slower fold-put-structure 4.3931+-0.9913 ? 4.4553+-0.7154 ? might be 1.0142x slower for-of-iterate-array-entries 4.3953+-0.5308 4.1294+-0.0866 might be 1.0644x faster for-of-iterate-array-keys 3.2304+-0.0878 ? 3.3182+-0.2229 ? might be 1.0272x slower for-of-iterate-array-values 3.6969+-1.3025 3.3634+-0.3986 might be 1.0991x faster fround 18.4783+-1.1521 ? 18.6940+-0.7156 ? might be 1.0117x slower ftl-library-inlining-dataview 61.3789+-1.4651 60.9891+-1.7918 ftl-library-inlining 118.6348+-5.0307 114.4706+-5.2385 might be 1.0364x faster function-dot-apply 2.0585+-0.0683 ? 2.2522+-0.1995 ? might be 1.0941x slower function-test 2.9905+-0.0819 2.9102+-0.0363 might be 1.0276x faster function-with-eval 95.9841+-4.0819 ? 110.1152+-24.8950 ? might be 1.1472x slower gcse-poly-get-less-obvious 14.8907+-0.2268 14.8212+-0.4925 gcse-poly-get 16.4358+-0.2338 ? 16.9280+-0.5059 ? might be 1.0299x slower gcse 4.1624+-0.4775 4.0576+-0.4708 might be 1.0258x faster get-by-id-bimorphic-check-structure-elimination-simple 2.8382+-0.4728 2.5909+-0.0508 might be 1.0955x faster get-by-id-bimorphic-check-structure-elimination 5.9729+-0.1525 5.8138+-0.1369 might be 1.0274x faster get-by-id-chain-from-try-block 6.7079+-0.3848 6.6500+-0.2590 get-by-id-check-structure-elimination 4.5428+-0.2881 ? 4.9865+-1.2217 ? might be 1.0977x slower get-by-id-proto-or-self 14.9050+-0.2173 ? 14.9645+-0.6398 ? get-by-id-quadmorphic-check-structure-elimination-simple 3.3185+-0.8081 3.2056+-0.3717 might be 1.0352x faster get-by-id-self-or-proto 14.8591+-0.7872 ? 15.0859+-0.6957 ? might be 1.0153x slower get-by-val-out-of-bounds 4.0846+-0.1382 ? 4.1166+-0.5714 ? get_callee_monomorphic 2.3303+-0.1135 ? 2.4639+-0.2337 ? might be 1.0573x slower get_callee_polymorphic 3.6390+-0.6101 3.4173+-0.2397 might be 1.0649x faster getter-no-activation 4.8637+-0.1939 ? 4.9764+-0.3604 ? might be 1.0232x slower getter-richards 120.9899+-15.6810 114.1755+-8.8575 might be 1.0597x faster getter 5.4965+-0.3118 ? 5.5071+-0.2932 ? global-var-const-infer-fire-from-opt 0.8497+-0.0889 0.8380+-0.0945 might be 1.0140x faster global-var-const-infer 0.8065+-0.1089 ? 0.8110+-0.1850 ? HashMap-put-get-iterate-keys 24.0239+-0.3676 ? 24.7915+-0.8495 ? might be 1.0320x slower HashMap-put-get-iterate 24.8761+-0.8427 24.4520+-1.1561 might be 1.0173x faster HashMap-string-put-get-iterate 24.8168+-1.7032 23.8726+-1.6081 might be 1.0396x faster hoist-make-rope 8.3755+-0.7564 8.2123+-0.4897 might be 1.0199x faster hoist-poly-check-structure-effectful-loop 4.3172+-0.3195 ? 4.3516+-0.2903 ? hoist-poly-check-structure 3.2174+-0.0681 ? 3.2314+-0.1458 ? imul-double-only 6.6746+-0.2625 ? 6.8629+-0.4471 ? might be 1.0282x slower imul-int-only 8.4836+-0.3282 ? 8.6803+-0.6001 ? might be 1.0232x slower imul-mixed 6.7882+-0.3174 6.6359+-0.4031 might be 1.0230x faster in-four-cases 15.8355+-0.7204 ? 16.8802+-2.1376 ? might be 1.0660x slower in-one-case-false 8.5850+-0.4471 ? 9.8381+-2.0429 ? might be 1.1460x slower in-one-case-true 9.8300+-1.9223 8.6866+-0.5848 might be 1.1316x faster in-two-cases 8.8835+-0.7052 ? 9.1420+-0.6992 ? might be 1.0291x slower indexed-properties-in-objects 2.8223+-0.1008 ? 2.8234+-0.0950 ? infer-closure-const-then-mov-no-inline 3.4264+-0.8576 3.0686+-0.0462 might be 1.1166x faster infer-closure-const-then-mov 18.2389+-0.3675 18.1495+-0.7134 infer-closure-const-then-put-to-scope-no-inline 13.8455+-0.7286 13.2236+-0.2516 might be 1.0470x faster infer-closure-const-then-put-to-scope 24.2026+-0.6288 ? 24.6665+-1.0772 ? might be 1.0192x slower infer-closure-const-then-reenter-no-inline 53.7620+-1.7351 ? 55.7958+-2.6804 ? might be 1.0378x slower infer-closure-const-then-reenter 25.3317+-1.3177 25.1524+-1.5309 infer-constant-global-property 31.3579+-1.8043 31.0830+-0.8867 infer-constant-property 2.6389+-0.0945 ? 2.7349+-0.2005 ? might be 1.0364x slower infer-one-time-closure-ten-vars 9.0155+-0.7036 ? 9.0997+-0.5744 ? infer-one-time-closure-two-vars 8.2882+-0.3000 ? 8.9283+-1.5039 ? might be 1.0772x slower infer-one-time-closure 8.0345+-0.1446 ? 8.2469+-0.4173 ? might be 1.0264x slower infer-one-time-deep-closure 13.7146+-1.0183 13.3157+-0.9131 might be 1.0300x faster inline-arguments-access 4.0356+-0.3460 ? 4.1931+-0.5745 ? might be 1.0390x slower inline-arguments-aliased-access 4.1823+-0.2530 3.9044+-0.0809 might be 1.0712x faster inline-arguments-local-escape 4.3812+-0.2852 ? 4.4043+-0.3647 ? inline-get-scoped-var 4.7461+-0.2033 ? 4.9052+-0.3011 ? might be 1.0335x slower inlined-put-by-id-transition 10.3148+-0.7765 9.9667+-0.8308 might be 1.0349x faster int-or-other-abs-then-get-by-val 5.1212+-0.4289 5.0435+-0.4794 might be 1.0154x faster int-or-other-abs-zero-then-get-by-val 16.7528+-0.2182 ? 17.4038+-0.6839 ? might be 1.0389x slower int-or-other-add-then-get-by-val 4.0844+-0.1849 ? 4.1119+-0.2725 ? int-or-other-add 5.2224+-0.2567 4.9546+-0.2567 might be 1.0541x faster int-or-other-div-then-get-by-val 3.8312+-0.1098 3.8222+-0.1107 int-or-other-max-then-get-by-val 4.4756+-0.9596 4.3152+-0.5135 might be 1.0372x faster int-or-other-min-then-get-by-val 4.3708+-0.2186 4.1888+-0.1418 might be 1.0434x faster int-or-other-mod-then-get-by-val 3.7262+-0.3753 3.6206+-0.2314 might be 1.0292x faster int-or-other-mul-then-get-by-val 3.9207+-0.2014 ? 4.1636+-0.4268 ? might be 1.0619x slower int-or-other-neg-then-get-by-val 4.4564+-0.1105 4.4125+-0.1963 int-or-other-neg-zero-then-get-by-val 17.8671+-1.3597 16.9993+-0.5341 might be 1.0510x faster int-or-other-sub-then-get-by-val 4.0664+-0.1521 ? 4.2163+-0.3643 ? might be 1.0369x slower int-or-other-sub 3.6337+-0.4867 3.4364+-0.1194 might be 1.0574x faster int-overflow-local 4.1526+-0.0403 4.1104+-0.0776 might be 1.0103x faster Int16Array-alloc-long-lived 48.7369+-4.0494 47.8248+-5.0278 might be 1.0191x faster Int16Array-bubble-sort-with-byteLength 17.6099+-0.4861 17.4806+-0.3733 Int16Array-bubble-sort 17.6533+-0.7791 ? 17.6838+-0.7807 ? Int16Array-load-int-mul 1.3483+-0.0232 ? 1.4420+-0.1950 ? might be 1.0695x slower Int16Array-to-Int32Array-set 46.2507+-0.8523 ? 46.4640+-1.0458 ? Int32Array-alloc-large 13.6655+-2.0230 13.3265+-1.8258 might be 1.0254x faster Int32Array-alloc-long-lived 55.9387+-3.9141 53.5671+-5.2731 might be 1.0443x faster Int32Array-alloc 2.8921+-0.3054 ? 3.0367+-0.2173 ? might be 1.0500x slower Int32Array-Int8Array-view-alloc 6.7293+-0.5029 6.5955+-0.5190 might be 1.0203x faster int52-spill 6.2748+-0.9450 6.0066+-0.3288 might be 1.0446x faster Int8Array-alloc-long-lived 43.8311+-4.5533 43.6835+-2.8911 Int8Array-load-with-byteLength 3.4565+-0.2464 3.4504+-0.0970 Int8Array-load 3.4598+-0.1892 ? 3.5139+-0.2510 ? might be 1.0156x slower integer-divide 11.2052+-0.5573 10.9589+-0.4075 might be 1.0225x faster integer-modulo 1.6611+-0.0679 ? 1.7275+-0.2495 ? might be 1.0400x slower large-int-captured 3.9163+-0.0747 ? 4.0233+-0.1640 ? might be 1.0273x slower large-int-neg 15.0482+-0.4990 15.0210+-0.2414 large-int 14.3858+-0.5765 ? 15.4661+-1.5988 ? might be 1.0751x slower logical-not 4.3418+-0.2568 ? 4.3884+-0.2367 ? might be 1.0107x slower lots-of-fields 10.4569+-0.4284 10.2705+-0.5437 might be 1.0181x faster make-indexed-storage 2.7777+-0.0751 ? 2.9109+-0.1726 ? might be 1.0480x slower make-rope-cse 3.9885+-0.2592 ? 4.1922+-0.6506 ? might be 1.0511x slower marsaglia-larger-ints 35.6355+-1.6379 35.2685+-1.0325 might be 1.0104x faster marsaglia-osr-entry 22.1777+-0.5668 22.0870+-0.9666 max-boolean 2.7627+-0.1074 2.7440+-0.1887 method-on-number 18.1119+-0.7544 16.8166+-1.0631 might be 1.0770x faster min-boolean 2.8259+-0.2639 2.7153+-0.1995 might be 1.0407x faster minus-boolean-double 3.0961+-0.0982 ? 3.1600+-0.1237 ? might be 1.0206x slower minus-boolean 2.4540+-0.3917 ? 2.4784+-0.3236 ? misc-strict-eq 31.6663+-2.1068 ? 32.6092+-1.9717 ? might be 1.0298x slower mod-boolean-double 11.5306+-0.2425 ? 11.5972+-0.5547 ? mod-boolean 8.5161+-0.1225 ? 8.5398+-0.1789 ? mul-boolean-double 3.7844+-0.1778 ? 3.8935+-0.4416 ? might be 1.0288x slower mul-boolean 2.7473+-0.0381 ? 2.8382+-0.0946 ? might be 1.0331x slower neg-boolean 3.2996+-0.3726 ? 3.3427+-0.4394 ? might be 1.0130x slower negative-zero-divide 0.3033+-0.0246 ? 0.3065+-0.0180 ? might be 1.0107x slower negative-zero-modulo 0.3037+-0.0243 ? 0.3303+-0.0393 ? might be 1.0876x slower negative-zero-negate 0.3098+-0.0706 ? 0.3193+-0.0728 ? might be 1.0309x slower nested-function-parsing 34.5573+-2.6194 33.6400+-0.7249 might be 1.0273x faster new-array-buffer-dead 2.7913+-0.1426 2.7263+-0.0645 might be 1.0239x faster new-array-buffer-push 6.0462+-0.3556 6.0190+-0.4608 new-array-dead 9.6864+-0.5997 ? 9.9414+-0.8334 ? might be 1.0263x slower new-array-push 3.7024+-0.5537 3.5044+-0.2072 might be 1.0565x faster no-inline-constructor 108.9671+-2.2867 104.5506+-4.7201 might be 1.0422x faster number-test 2.9881+-0.3125 2.9140+-0.2580 might be 1.0254x faster object-closure-call 4.8981+-0.1294 4.8772+-0.0618 object-test 2.9364+-0.1908 ? 2.9474+-0.1983 ? obvious-sink-pathology-taken 107.0574+-3.9488 ? 111.6744+-6.7696 ? might be 1.0431x slower obvious-sink-pathology 104.7736+-4.2252 ? 108.2299+-4.2431 ? might be 1.0330x slower obviously-elidable-new-object 31.3320+-2.5127 30.7920+-3.1901 might be 1.0175x faster plus-boolean-arith 2.5021+-0.2101 2.4873+-0.2770 plus-boolean-double 3.3088+-0.6157 3.0722+-0.0601 might be 1.0770x faster plus-boolean 2.5480+-0.0853 2.5155+-0.0646 might be 1.0129x faster poly-chain-access-different-prototypes-simple 2.6983+-0.0776 ? 2.8265+-0.2295 ? might be 1.0475x slower poly-chain-access-different-prototypes 2.5655+-0.1119 ? 2.6258+-0.3196 ? might be 1.0235x slower poly-chain-access-simpler 2.8056+-0.2506 ? 2.8295+-0.4094 ? poly-chain-access 2.5168+-0.1450 ? 2.5530+-0.1645 ? might be 1.0144x slower poly-stricteq 49.1741+-1.6906 ? 50.1401+-2.8268 ? might be 1.0196x slower polymorphic-array-call 1.0881+-0.1012 ? 1.1031+-0.1228 ? might be 1.0137x slower polymorphic-get-by-id 2.8107+-0.0662 ? 2.8518+-0.0942 ? might be 1.0146x slower polymorphic-put-by-id 26.2426+-1.0928 25.5664+-0.1925 might be 1.0264x faster polymorphic-structure 13.9203+-0.5674 13.8964+-1.0804 polyvariant-monomorphic-get-by-id 6.4553+-0.2236 ! 7.5822+-0.7260 ! definitely 1.1746x slower proto-getter-access 9.0942+-0.0968 ? 9.3986+-0.3046 ? might be 1.0335x slower put-by-id-replace-and-transition 8.4405+-0.6790 ? 8.7300+-1.1852 ? might be 1.0343x slower put-by-id-slightly-polymorphic 2.6528+-0.1409 ? 2.6679+-0.1786 ? put-by-id 10.7583+-1.4083 ? 10.9115+-1.1898 ? might be 1.0142x slower put-by-val-direct 0.3788+-0.0268 ? 0.4498+-0.1291 ? might be 1.1873x slower put-by-val-large-index-blank-indexing-type 5.6993+-0.7683 ? 5.9220+-1.3019 ? might be 1.0391x slower put-by-val-machine-int 2.4703+-0.1134 ? 2.5688+-0.2164 ? might be 1.0399x slower rare-osr-exit-on-local 15.7332+-0.9632 15.2385+-0.5151 might be 1.0325x faster register-pressure-from-osr 17.7685+-0.4828 17.3510+-0.4243 might be 1.0241x faster setter 5.7622+-0.4019 5.5868+-0.1466 might be 1.0314x faster simple-activation-demo 25.4145+-1.0757 ? 26.0834+-1.6628 ? might be 1.0263x slower simple-getter-access 12.3498+-0.4463 12.2237+-0.2240 might be 1.0103x faster simple-poly-call-nested 9.2196+-0.8026 9.2072+-0.4101 simple-poly-call 1.2638+-0.1809 1.1849+-0.0164 might be 1.0666x faster sin-boolean 18.8774+-1.3058 18.2290+-0.4796 might be 1.0356x faster singleton-scope 66.5435+-2.1890 65.5371+-3.0307 might be 1.0154x faster sinkable-new-object-dag 62.5098+-2.9018 ? 63.9054+-5.0768 ? might be 1.0223x slower sinkable-new-object-taken 50.3336+-4.5854 48.2935+-2.3465 might be 1.0422x faster sinkable-new-object 32.9258+-1.3582 ? 32.9503+-2.7257 ? slow-array-profile-convergence 2.5645+-0.1417 2.4883+-0.0961 might be 1.0306x faster slow-convergence 2.4004+-0.1481 ? 2.4690+-0.2960 ? might be 1.0285x slower sorting-benchmark 19.9376+-0.5832 ? 20.3229+-0.9949 ? might be 1.0193x slower sparse-conditional 1.2254+-0.3264 ? 1.2809+-0.4717 ? might be 1.0453x slower splice-to-remove 15.2596+-2.8761 14.4368+-0.4090 might be 1.0570x faster string-char-code-at 15.4146+-0.6647 ? 15.4984+-0.4344 ? string-concat-object 2.1832+-0.1572 ? 2.4016+-0.2744 ? might be 1.1000x slower string-concat-pair-object 2.2862+-0.3378 2.2569+-0.1136 might be 1.0130x faster string-concat-pair-simple 10.4030+-1.3108 10.2056+-1.1025 might be 1.0193x faster string-concat-simple 11.5682+-3.7015 10.1462+-1.2285 might be 1.1401x faster string-cons-repeat 6.7654+-0.3419 ? 8.0803+-1.4258 ? might be 1.1944x slower string-cons-tower 7.1641+-0.4320 ? 7.1866+-0.7949 ? string-equality 16.4210+-0.4724 ? 16.4843+-1.2007 ? string-get-by-val-big-char 6.9902+-0.2899 6.8252+-0.3940 might be 1.0242x faster string-get-by-val-out-of-bounds-insane 3.1980+-0.2120 ? 3.2200+-0.0968 ? string-get-by-val-out-of-bounds 3.9671+-0.0994 ? 4.1689+-0.1258 ? might be 1.0509x slower string-get-by-val 3.0064+-0.3366 2.9761+-0.1745 might be 1.0102x faster string-hash 2.0874+-0.4243 1.8457+-0.0976 might be 1.1310x faster string-long-ident-equality 13.5976+-0.3661 ? 14.4719+-1.5542 ? might be 1.0643x slower string-out-of-bounds 10.5994+-0.2091 ? 10.9404+-0.7613 ? might be 1.0322x slower string-repeat-arith 28.0467+-1.0644 27.4799+-0.7036 might be 1.0206x faster string-sub 58.4035+-2.0790 55.2434+-3.2920 might be 1.0572x faster string-test 2.9138+-0.4746 2.7748+-0.0839 might be 1.0501x faster string-var-equality 28.5701+-0.5370 ? 29.8542+-2.1021 ? might be 1.0449x slower structure-hoist-over-transitions 2.5118+-0.2271 ? 2.5342+-0.1670 ? substring-concat-weird 36.6634+-1.8219 ? 38.2138+-2.6922 ? might be 1.0423x slower substring-concat 39.1127+-1.0932 ? 39.3696+-1.2294 ? substring 46.6574+-2.5097 46.5481+-3.7045 switch-char-constant 2.8241+-0.2673 2.6672+-0.0314 might be 1.0588x faster switch-char 6.1698+-0.6116 ? 6.2150+-0.9096 ? switch-constant 9.8255+-3.1176 8.6575+-1.0438 might be 1.1349x faster switch-string-basic-big-var 13.6732+-0.7577 13.5375+-0.7866 might be 1.0100x faster switch-string-basic-big 12.7436+-0.4469 ? 12.7967+-0.5288 ? switch-string-basic-var 13.0576+-0.2949 12.7418+-0.4423 might be 1.0248x faster switch-string-basic 12.9240+-1.0038 11.9897+-0.3513 might be 1.0779x faster switch-string-big-length-tower-var 19.2532+-0.5932 ? 19.9592+-2.9737 ? might be 1.0367x slower switch-string-length-tower-var 13.3217+-0.5538 ? 13.5393+-0.7084 ? might be 1.0163x slower switch-string-length-tower 11.9067+-0.5744 11.6297+-0.1933 might be 1.0238x faster switch-string-short 11.7114+-0.5644 ? 11.8004+-0.4911 ? switch 12.7096+-1.0044 11.7810+-0.6533 might be 1.0788x faster tear-off-arguments-simple 3.2962+-0.1680 3.2032+-0.4366 might be 1.0290x faster tear-off-arguments 4.6378+-0.7649 4.1485+-0.1433 might be 1.1179x faster temporal-structure 12.4672+-0.3427 ? 13.1151+-1.4988 ? might be 1.0520x slower to-int32-boolean 13.3999+-0.3373 ? 13.4344+-0.3336 ? try-catch-get-by-val-cloned-arguments 13.4958+-0.6048 ? 14.2495+-1.2112 ? might be 1.0558x slower try-catch-get-by-val-direct-arguments 6.2397+-0.6576 5.9273+-0.2225 might be 1.0527x faster try-catch-get-by-val-scoped-arguments 7.7965+-0.8139 ? 10.7249+-2.9016 ? might be 1.3756x slower undefined-property-access 223.6949+-4.0243 ? 224.4459+-6.7891 ? undefined-test 2.9040+-0.2012 ? 2.9294+-0.2558 ? unprofiled-licm 15.9854+-2.9598 15.1021+-1.2818 might be 1.0585x faster varargs-call 14.1574+-0.3450 ? 15.4649+-0.9988 ? might be 1.0924x slower varargs-construct-inline 18.9257+-0.7375 ? 19.4996+-2.0310 ? might be 1.0303x slower varargs-construct 32.1125+-1.8864 ? 34.0411+-3.5164 ? might be 1.0601x slower varargs-inline 8.3596+-0.2664 ? 8.9384+-0.5767 ? might be 1.0692x slower varargs-strict-mode 9.9932+-1.2811 9.4230+-0.1707 might be 1.0605x faster varargs 9.8012+-0.7140 ? 10.0531+-2.0576 ? might be 1.0257x slower weird-inlining-const-prop 2.0902+-0.1633 ? 2.1792+-0.3850 ? might be 1.0426x slower <geometric> 7.8998+-0.0467 7.8978+-0.0334 might be 1.0003x faster Conf#1 Conf#2 AsmBench: bigfib.cpp 466.4996+-6.8999 ? 468.8544+-9.9788 ? cray.c 411.6480+-9.4796 ? 424.9932+-17.2724 ? might be 1.0324x slower dry.c 460.8665+-56.1903 440.3503+-11.8731 might be 1.0466x faster FloatMM.c 712.5105+-5.4940 ! 739.2544+-16.0969 ! definitely 1.0375x slower gcc-loops.cpp 3732.0947+-127.2753 ? 3737.2475+-96.7664 ? n-body.c 896.1395+-24.6118 871.9576+-28.1694 might be 1.0277x faster Quicksort.c 412.6768+-3.4782 ? 419.7579+-14.5950 ? might be 1.0172x slower stepanov_container.cpp 3836.8887+-124.5477 ? 3847.3214+-139.0657 ? Towers.c 246.8086+-3.6901 ? 252.5093+-9.1557 ? might be 1.0231x slower <geometric> 757.2919+-10.7685 ? 761.3380+-7.5114 ? might be 1.0053x slower Conf#1 Conf#2 CompressionBench: huffman 326.3646+-13.0703 318.5332+-8.9526 might be 1.0246x faster arithmetic-simple 357.8881+-3.6055 ? 372.2515+-33.4373 ? might be 1.0401x slower arithmetic-precise 276.5046+-3.2232 275.1275+-9.0497 arithmetic-complex-precise 277.9065+-10.6697 277.4886+-4.0506 arithmetic-precise-order-0 378.1003+-9.4672 ? 387.9857+-12.3537 ? might be 1.0261x slower arithmetic-precise-order-1 313.9424+-8.4653 313.6561+-4.4173 arithmetic-precise-order-2 381.2032+-43.7698 353.2679+-7.1584 might be 1.0791x faster arithmetic-simple-order-1 353.0623+-8.1321 351.3759+-9.6957 arithmetic-simple-order-2 402.5803+-11.3447 395.0693+-4.9827 might be 1.0190x faster lz-string 352.1007+-10.6296 ? 371.1422+-29.5769 ? might be 1.0541x slower <geometric> 339.2868+-7.6625 338.8005+-4.3919 might be 1.0014x faster Conf#1 Conf#2 Geomean of preferred means: <scaled-result> 58.9361+-0.2459 ? 58.9913+-0.2349 ? might be 1.0009x slower Rerunning AsmBench gives: Benchmark report for AsmBench on Basiles-MacBook-Pro (MacBookPro11,3). VMs tested: "Conf#1" at /Volumes/Data/Baseline/OpenSource/WebKitBuild/Release/jsc (r183038) "Conf#2" at /Volumes/Data/Temp/OpenSource/WebKitBuild/Release/jsc (r183038) Collected 6 samples per benchmark/VM, with 6 VM invocations per benchmark. Emitted a call to gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds. Conf#1 Conf#2 bigfib.cpp 459.5575+-1.9665 ? 460.1482+-2.6871 ? cray.c 407.4002+-4.6968 ? 411.0604+-5.2820 ? dry.c 457.5689+-11.3058 446.9803+-17.9435 might be 1.0237x faster FloatMM.c 717.0470+-5.0931 715.4148+-6.2474 gcc-loops.cpp 3666.1530+-49.8003 3649.7342+-25.0163 n-body.c 861.4548+-10.7466 855.5641+-8.6685 Quicksort.c 416.2374+-8.0882 413.8203+-6.3448 stepanov_container.cpp 3801.0749+-51.4163 ? 3807.4605+-52.6609 ? Towers.c 247.6909+-5.0338 ? 249.9651+-7.5637 ? <geometric> 750.9835+-4.5607 749.1282+-5.4124 might be 1.0025x faster Comment on attachment 251211 [details] Slow (but clean) patch View in context: https://bugs.webkit.org/attachment.cgi?id=251211&action=review It's surprising that this patch is a slow-down. :-/ > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116 > - case AllocationProfileWatchpoint: > - addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet()); > + case AllocationProfileWatchpoint: { > + InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet(); > + // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint > + // was added to the graph. We never de-allocate the rare data, so it must still be present, and the > + // allocationProfileWatchpointSet with it. > + ASSERT (watchpointSet); > + addLazily(*watchpointSet); > break; > + } It would be better to remove the AllocationProfileWatchpoint node in this patch, and do the watchpoint set registration in ByteCodeParser. (In reply to comment #7) > Comment on attachment 251211 [details] > Slow (but clean) patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=251211&action=review > > It's surprising that this patch is a slow-down. :-/ Oh - I guess the slow-down went away? Lol. > > > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116 > > - case AllocationProfileWatchpoint: > > - addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet()); > > + case AllocationProfileWatchpoint: { > > + InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet(); > > + // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint > > + // was added to the graph. We never de-allocate the rare data, so it must still be present, and the > > + // allocationProfileWatchpointSet with it. > > + ASSERT (watchpointSet); > > + addLazily(*watchpointSet); > > break; > > + } > > It would be better to remove the AllocationProfileWatchpoint node in this > patch, and do the watchpoint set registration in ByteCodeParser. (In reply to comment #7) > Comment on attachment 251211 [details] > Slow (but clean) patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=251211&action=review > > It's surprising that this patch is a slow-down. :-/ > > > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116 > > - case AllocationProfileWatchpoint: > > - addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet()); > > + case AllocationProfileWatchpoint: { > > + InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet(); > > + // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint > > + // was added to the graph. We never de-allocate the rare data, so it must still be present, and the > > + // allocationProfileWatchpointSet with it. > > + ASSERT (watchpointSet); > > + addLazily(*watchpointSet); > > break; > > + } > > It would be better to remove the AllocationProfileWatchpoint node in this > patch, and do the watchpoint set registration in ByteCodeParser. I thought we said we shouldn't do this? (Splitting this into smaller more atomic patches) (In reply to comment #9) > (In reply to comment #7) > > Comment on attachment 251211 [details] > > Slow (but clean) patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=251211&action=review > > > > It's surprising that this patch is a slow-down. :-/ > > > > > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116 > > > - case AllocationProfileWatchpoint: > > > - addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet()); > > > + case AllocationProfileWatchpoint: { > > > + InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet(); > > > + // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint > > > + // was added to the graph. We never de-allocate the rare data, so it must still be present, and the > > > + // allocationProfileWatchpointSet with it. > > > + ASSERT (watchpointSet); > > > + addLazily(*watchpointSet); > > > break; > > > + } > > > > It would be better to remove the AllocationProfileWatchpoint node in this > > patch, and do the watchpoint set registration in ByteCodeParser. > > I thought we said we shouldn't do this? > > (Splitting this into smaller more atomic patches) Ah - it makes sense to do that as a different patch, if you like. Created attachment 251241 [details]
Atomic patch w/ test
This only fixes this bug (+ adds a regression test) and nothing more.
Related improvements/fixes coming in other patches.
Comment on attachment 251241 [details] Atomic patch w/ test Clearing flags on attachment: 251241 Committed r183069: <http://trac.webkit.org/changeset/183069> All reviewed patches have been landed. Closing bug. I'm seeing this crash in r183071: stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2: 47158 Segmentation fault: 11 "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --enableFunctionDotArguments\=true --minHeapUtilization\=2.0 --minCopiedBlockUtilization\=2.0 dfg-rare-data.js stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit code: 139 (In reply to comment #14) > I'm seeing this crash in r183071: > > stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2: > 47158 Segmentation fault: 11 "$@" > ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false > --enableFunctionDotArguments\=true --minHeapUtilization\=2.0 > --minCopiedBlockUtilization\=2.0 dfg-rare-data.js > stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit > code: 139 I don't see it in r183076 ; checking out r183071 to test. (In reply to comment #15) > (In reply to comment #14) > > I'm seeing this crash in r183071: > > > > stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2: > > 47158 Segmentation fault: 11 "$@" > > ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false > > --enableFunctionDotArguments\=true --minHeapUtilization\=2.0 > > --minCopiedBlockUtilization\=2.0 dfg-rare-data.js > > stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit > > code: 139 > > I don't see it in r183076 ; checking out r183071 to test. It appears flaky. I got it on one run and haven't seen it since. Maybe your "don't reallocate" work will fix it. (In reply to comment #16) > (In reply to comment #15) > > (In reply to comment #14) > > > I'm seeing this crash in r183071: > > > > > > stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2: > > > 47158 Segmentation fault: 11 "$@" > > > ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false > > > --enableFunctionDotArguments\=true --minHeapUtilization\=2.0 > > > --minCopiedBlockUtilization\=2.0 dfg-rare-data.js > > > stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit > > > code: 139 > > > > I don't see it in r183076 ; checking out r183071 to test. > > It appears flaky. I got it on one run and haven't seen it since. Maybe > your "don't reallocate" work will fix it. Running while true; do DYLD_FRAMEWORK_PATH=WebKitBuild/Debug/ WebKitBuild/Debug/jsc Source/JavaScriptCore/tests/stress/dfg-rare-data.js --useFTLJIT=false --enableFunctionDotArguments=true --minHeapUtilization=2.0 --minCopiedBlockUtilization=2.0; done on r183071 dies frequently, while it doesn't happen in r183076, so I think this is the race condition incidently fixed in https://bugs.webkit.org/show_bug.cgi?id=143999. The backtrace seems to support this: ASSERTION FAILED: m_rareData /Volumes/Data/SVN/WIP/OpenSource/Source/JavaScriptCore/runtime/JSFunction.h(129) : JSC::InlineWatchpointSet &JSC::JSFunction::allocationProfileWatchpointSet() 1 0x109e1fce0 WTFCrash 2 0x10982ce86 JSC::JSFunction::allocationProfileWatchpointSet() 3 0x10982cb9a JSC::DFG::WatchpointCollectionPhase::handle() 4 0x10982c7c9 JSC::DFG::WatchpointCollectionPhase::run() 5 0x10982c675 bool JSC::DFG::runAndLog<JSC::DFG::WatchpointCollectionPhase>(JSC::DFG::WatchpointCollectionPhase&) 6 0x10982c605 bool JSC::DFG::runPhase<JSC::DFG::WatchpointCollectionPhase>(JSC::DFG::Graph&) 7 0x10982c598 JSC::DFG::performWatchpointCollection(JSC::DFG::Graph&) 8 0x109764bfb JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) 9 0x109763bf1 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) 10 0x10982efc0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) 11 0x10982d5a4 JSC::DFG::Worklist::threadFunction(void*) 12 0x109e76f99 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const 13 0x109e76f6c std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() 14 0x1099437aa std::__1::function<void ()>::operator()() const 15 0x109e75eee WTF::threadEntryPoint(void*) 16 0x109e778c8 WTF::wtfThreadEntryPoint(void*) 17 0x7fff8d91b268 _pthread_body 18 0x7fff8d91b1e5 _pthread_body 19 0x7fff8d91941d thread_start Segmentation fault: 11 |