Bug 164356

Summary:

[DOMJIT] Add DOMJIT::Signature annotation to Document::getElementById

Product:

WebKit

Reporter:

Yusuke Suzuki <ysuzuki>

Component:

JavaScriptCore

Assignee:

Yusuke Suzuki <ysuzuki>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

cdumez, commit-queue, darin, dbates, esprehn+autocc, fpizlo, ggaren, kangil.han, kondapallykalyan, saam, sam

Priority:

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

162980

Bug Blocks:

162544

Attachments:

Description	Flags
Patch	none
Patch	fpizlo: review+, ysuzuki: commit-queue-
Patch for landing	none

Yusuke Suzuki

Reported 2016-11-02 20:12:15 PDT

...

Attachments
Patch (11.89 KB, patch) 2016-11-03 01:04 PDT, Yusuke Suzuki	no flags	Details Formatted Diff Diff
Patch (12.11 KB, patch) 2016-11-03 11:39 PDT, Yusuke Suzuki	fpizlo: review+ ysuzuki: commit-queue-	Details Formatted Diff Diff
Patch for landing (12.08 KB, patch) 2016-11-04 10:56 PDT, Yusuke Suzuki	no flags	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Yusuke Suzuki

Comment 1 2016-11-02 23:43:32 PDT

Haha, it figures out that the result of getElementById will be hoisted since it does not write anything.

Yusuke Suzuki

Comment 2 2016-11-03 00:08:36 PDT

We have dromaeo test like this. test( "getElementById", function(){ for ( var i = 0; i < num * 30; i++ ) { ret = document.getElementById("testA" + num).nodeType; ret = document.getElementById("testB" + num).nodeType; ret = document.getElementById("testC" + num).nodeType; ret = document.getElementById("testD" + num).nodeType; ret = document.getElementById("testE" + num).nodeType; ret = document.getElementById("testF" + num).nodeType; } }); After fix up phase in DFG FTL is finished the graph becomes like this. https://gist.github.com/Constellation/21a8d938fa73ced9ca7e1b20d98bae41 Especially, per `ret = document.getElementById("testA" + num).nodeType;` line, 42:< 1:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261, bc#34) 43:<!0:-> MovHint(Check:Untyped:@42, MustGen, loc7, W:SideState, ClobbersExit, bc#34) 44:< 1:-> SetLocal(Check:Untyped:@42, loc7(P~<Object>/FlushedJSValue), W:Stack(-8), bc#34, exit: bc#41) predicting Otherobj 45:< 1:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391, bc#41) 46:<!0:-> MovHint(Check:Untyped:@45, MustGen, loc12, W:SideState, ClobbersExit, bc#41) 47:<!0:-> Check(MustGen, bc#41, ExitInvalid) 48:< 1:-> SetLocal(Check:Untyped:@45, loc12(Q~<Object>/FlushedJSValue), W:Stack(-13), bc#41, exit: bc#48) predicting Otherobj 49:<!0:-> Check(MustGen, bc#48) 50:< 1:-> GetGlobalVar(JS|UseAsOther, Otherobj, global(0x1166dc900), R:Absolute(4671260928), Exits, bc#48) predicting Otherobj 51:<!0:-> MovHint(Check:Untyped:@50, MustGen, loc12, W:SideState, ClobbersExit, bc#48) 52:< 1:-> SetLocal(Check:Untyped:@50, loc12(R~<Object>/FlushedJSValue), W:Stack(-13), bc#48, exit: bc#56) predicting Otherobj 53:<!0:-> PureGetById(Check:Cell:@50, JS|MustGen|UseAsOther, Function, id3{getElementById}, R:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags,JSCell_typeInfoType,JSObject_butterfly,NamedProperties(3),MiscFields, W:JSCell_structureID,JSCell_typeInfoFlags,JSObject_butterfly,Watchpoint_fire,MiscFields, Exits, ClobbersExit, bc#56) predicting Function 54:<!0:-> MovHint(Check:Untyped:@53, MustGen, loc8, W:SideState, ClobbersExit, bc#56, ExitInvalid) 316:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#56, exit: bc#65) 55:< 1:-> SetLocal(Check:Untyped:@53, loc8(S~<Function>/FlushedJSValue), W:Stack(-9), bc#56, exit: bc#65) predicting Function 56:<!0:-> Check(MustGen, bc#65) 57:< 1:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261, bc#65) 58:<!0:-> MovHint(Check:Untyped:@57, MustGen, loc13, W:SideState, ClobbersExit, bc#65) 59:< 1:-> SetLocal(Check:Untyped:@57, loc13(T~<Object>/FlushedJSValue), W:Stack(-14), bc#65, exit: bc#72) predicting Otherobj 60:<!0:-> Check(MustGen, bc#72) 61:< 1:-> JSConstant(JS|PureNum|UseAsOther, Nonboolint32, Int32: 40, bc#72) 62:<!0:-> MovHint(Check:Untyped:@61, MustGen, loc14, W:SideState, ClobbersExit, bc#72) 63:< 1:-> SetLocal(Check:Untyped:@61, loc14(U~<Int32>/FlushedJSValue), W:Stack(-15), bc#72, exit: bc#80) predicting Nonboolint32 64:< 1:-> JSConstant(JS|PureNum|UseAsOther, Stringident, Strong:String (atomic) (identifier): testA, ID: 4, bc#80) 65:<!0:-> ValueAdd(Check:Untyped:@64, Check:Untyped:@61, JS|MustGen|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, R:World, W:Heap, Exits, ClobbersExit, bc#80) 66:<!0:-> MovHint(Check:Untyped:@65, MustGen, loc11, W:SideState, ClobbersExit, bc#80, ExitInvalid) 317:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#80, exit: bc#85) 67:< 1:-> SetLocal(Check:Untyped:@65, loc11(V~/FlushedJSValue), W:Stack(-12), bc#80, exit: bc#85) predicting StringBoolint32Nonboolint32 68:<!0:-> CheckCell(Check:Cell:@53, Check:Untyped:@50, MustGen, <0x11c9e2da0, Function>, <host function>, Exits, bc#85) 304:<!0:-> CheckDOM(Check:Cell:@50, MustGen, Exits, bc#85) 69:< 1:-> CallDOM(Check:Cell:@50, Check:String:@65, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#85) predicting Otherobj 70:<!0:-> MovHint(Check:Untyped:@69, MustGen, loc8, W:SideState, ClobbersExit, bc#85, ExitInvalid) 71:<!0:-> Check(MustGen, bc#85, ExitInvalid) 72:<!0:-> Check(MustGen, bc#85, ExitInvalid) 73:<!0:-> Check(MustGen, bc#85, ExitInvalid) 74:< 1:-> SetLocal(Check:Untyped:@69, loc8(W~<Object>/FlushedJSValue), W:Stack(-9), bc#85, exit: bc#94) predicting Otherobj 75:<!0:-> CheckStructure(Check:Cell:@69, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#94) 76:<!0:-> CheckDOM(Check:Cell:@69, MustGen, Exits, bc#94) 77:< 1:-> CallDOMGetter(Check:Cell:@69, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#94) predicting Boolint32 78:<!0:-> MovHint(Check:Untyped:@77, MustGen, loc9, W:SideState, ClobbersExit, bc#94) 79:< 1:-> SetLocal(Check:Untyped:@77, loc9(X~<BoolInt32>/FlushedJSValue), W:Stack(-10), bc#94, exit: bc#103) predicting Boolint32 305:<!0:-> Check(Check:Int32:@77, MustGen, Exits, bc#103) 80:<!0:-> PutClosureVar(Check:KnownCell:@42, Check:Untyped:@77, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#103) The crazy thing is, 1. Since nodeType is now handled as CallDOMGetter, we know that it is pure 2. PureGetById does not write Heap/DOMState 3. `"testA" + num` will be converted to constant thing 4. CallDOM for getElementById said it just reads(DOM). 5. CheckCell leading CallDOM ensures the inlined getElementById node. (CallDOM node) The important thing is, anyone does not write DOMState -> Heap! CallDOM will be hoisted. The final code becomes like this. DFG for #B0dEnY:[0x11c9adae0->0x11c9ad680->0x11c9d21a0, DFGFunctionCall, 518 (DidTryToEnterInLoop)]: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount Argument formats: FlushedJSValue Block #0 (bc#0): (OSR target) Execution count: 1.000000 Predecessors: Successors: #2 Dominated by: #0 Dominates: #0 #1 #2 #3 #4 Dominance Frontier: Iterated Dominance Frontier: Backwards dominates by: #end #0 #2 #3 #4 Backwards dominates: #0 Control equivalent to: #0 #2 #3 #4 States: StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable; heap = } Live: Values: 17:< 13:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261, bc#0) 22:< 2:-> JSConstant(JS|UseAsOther, Boolint32, Int32: 0, bc#0) 11:< 1:-> JSConstant(JS|PureNum, Boolint32, Int32: 1, bc#0) 34:< 3:-> JSConstant(Number|UseAsOther, Int32, Int32: 1200, bc#0) 1:< 1:-> JSConstant(JS|PureInt, Other, Undefined, bc#0) 32:<!0:-> ExitOK(MustGen, W:SideState, bc#0) 61:<!0:-> KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0) 2:<!0:-> ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid) 41:<!0:-> KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 4:<!0:-> ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 29:<!0:-> KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 6:<!0:-> ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 55:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 8:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 56:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 10:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 59:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 12:<!0:-> ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 63:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 14:<!0:-> ZombieHint(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 74:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1) 18:<!0:-> MovHint(Untyped:@17, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid) 84:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3) 20:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid) 88:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#6) 23:<!0:-> MovHint(Untyped:@22, MustGen, loc5, W:SideState, ClobbersExit, bc#6, ExitInvalid) 92:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#9) 27:<!0:-> ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#9, ExitInvalid) 97:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#16) 31:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#16, ExitInvalid) 101:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#24, ExitInvalid) 35:<!0:-> MovHint(Untyped:@34, MustGen, loc8, W:SideState, ClobbersExit, bc#24, ExitInvalid) 25:<!0:-> Jump(MustGen, T:#2, W:SideState, bc#29, ExitInvalid) States: InvalidBranchDirection, StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc3:ConflictingFlush/@17 loc5:ConflictingFlush/@22 loc8:ConflictingFlush/@34; heap = } Live: @1, @11, @17, @22, @34 Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, NonArray, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @22=>(Boolint32, Int32: 0), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391) Block #1 (bc#33): Execution count: 10.000000 Predecessors: #3 Successors: #3 Dominated by: #0 #1 #2 #3 Dominates: #1 Dominance Frontier: #3 Iterated Dominance Frontier: #3 Backwards dominates by: #end #1 #3 #4 Backwards dominates: #1 Control equivalent to: #1 Containing loop headers: #3 States: StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@9 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1, @9, @11, @17, @19, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197 Values: @1=>(Other, Undefined), @9=>(Int32), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @149=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @197=>(Int32) 111:<!0:-> ExitOK(MustGen, W:SideState, bc#33) 87:< 1:-> Upsilon(KnownInt32:@9, ^28, W:SideState, bc#33) 5:<!0:-> Jump(MustGen, T:#3, W:SideState, bc#33) States: InvalidBranchDirection, StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@9 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1, @11, @17, @19, @28, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197 Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @28=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @149=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @197=>(Int32) Block #2 (bc#33): Execution count: 1.000000 Predecessors: #0 Successors: #3 Dominated by: #0 #2 Dominates: #1 #2 #3 #4 Dominance Frontier: Iterated Dominance Frontier: Backwards dominates by: #end #2 #3 #4 Backwards dominates: #0 #2 Control equivalent to: #0 #2 #3 #4 States: StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@22 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1, @11, @17, @22, @34 Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, NonArray, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @22=>(Boolint32, Int32: 0), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391) 103:<!0:-> ExitOK(MustGen, W:SideState, bc#33) 71:< 1:-> Upsilon(KnownInt32:@22, ^28, W:SideState, bc#33) 50:< 10:-> GetGlobalVar(JS|UseAsOther, Otherobj, global(0x1166dc900), R:Absolute(4671260928), Exits, bc#48, exit: bc#33) predicting Otherobj 65:< 2:-> LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testA40), bc#80, exit: bc#33) 89:<!0:-> CheckDOM(Check:Cell:@50, MustGen, Exits, bc#85, exit: bc#33) 69:< 3:-> CallDOM(Cell:@50, String:@65, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#85, exit: bc#33) predicting Otherobj 77:< 1:-> CallDOMGetter(Check:Cell:@69, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#94, exit: bc#33) predicting Boolint32 105:< 1:-> LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testB40), bc#156, exit: bc#33) 109:< 3:-> CallDOM(Cell:@50, String:Kill:@105, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#161, exit: bc#33) predicting Otherobj 117:< 1:-> CallDOMGetter(Check:Cell:@109, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#170, exit: bc#33) predicting Boolint32 145:< 1:-> LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testC40), bc#232, exit: bc#33) 149:< 3:-> CallDOM(Cell:@50, String:Kill:@145, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#237, exit: bc#33) predicting Otherobj 157:< 1:-> CallDOMGetter(Check:Cell:@149, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#246, exit: bc#33) predicting Boolint32 185:< 1:-> LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testD40), bc#308, exit: bc#33) 189:< 3:-> CallDOM(Cell:@50, String:Kill:@185, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#313, exit: bc#33) predicting Otherobj 197:< 1:-> CallDOMGetter(Check:Cell:@189, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#322, exit: bc#33) predicting Boolint32 164:< 1:-> LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testE40), bc#384, exit: bc#33) 147:< 3:-> CallDOM(Cell:@50, String:Kill:@164, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#389, exit: bc#33) predicting Otherobj 119:< 1:-> CallDOMGetter(Check:Cell:@147, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#398, exit: bc#33) predicting Boolint32 47:< 1:-> LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testF40), bc#460, exit: bc#33) 38:< 3:-> CallDOM(Cell:@50, String:Kill:@47, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#465, exit: bc#33) predicting Otherobj 19:< 1:-> CallDOMGetter(Check:Cell:@38, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#474, exit: bc#33) predicting Boolint32 3:<!0:-> Jump(MustGen, T:#3, W:SideState, bc#33) States: InvalidBranchDirection, StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@22 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1, @11, @17, @19, @28, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197 Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, NonArray, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @28=>(Boolint32, Int32: 0), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Cell, TOP, TOP), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Cell, TOP, TOP), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Cell, TOP, TOP), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Cell, TOP, TOP), @149=>(Cell, TOP, TOP), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Cell, TOP, TOP), @197=>(Int32) Block #3 (bc#33): (OSR target) Execution count: 10.000000 Predecessors: #1 #2 Successors: #1 #4 Dominated by: #0 #2 #3 Dominates: #1 #3 #4 Dominance Frontier: #3 Iterated Dominance Frontier: #3 Backwards dominates by: #end #3 #4 Backwards dominates: #0 #1 #2 #3 Control equivalent to: #0 #2 #3 #4 Loop header, contains: #1 #3 Containing loop headers: #3 States: StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1, @11, @17, @19, @28, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197 Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @28=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Cell, TOP, TOP), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Cell, TOP, TOP), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Cell, TOP, TOP), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Cell, TOP, TOP), @149=>(Cell, TOP, TOP), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Cell, TOP, TOP), @197=>(Int32) 28:< 2:-> Phi(Int32|PureInt, Int32, W:SideState, bc#33, ExitInvalid) 124:<!0:-> MovHint(Untyped:@28, MustGen, loc5, W:SideState, ClobbersExit, bc#33, ExitInvalid) 132:<!0:-> ExitOK(MustGen, W:SideState, bc#33) 39:<!0:-> LoopHint(MustGen, W:SideState, bc#33) 135:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#34) 43:<!0:-> MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#34, ExitInvalid) 139:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#41) 46:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#41, ExitInvalid) 72:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#48) 51:<!0:-> MovHint(Untyped:@50, MustGen, loc12, W:SideState, ClobbersExit, bc#48, ExitInvalid) 53:<!2:-> PureGetById(Cell:@50, JS|MustGen|UseAsOther, Function, id3{getElementById}, R:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags,JSCell_typeInfoType,JSObject_butterfly,NamedProperties(3),MiscFields, W:JSCell_structureID,JSCell_typeInfoFlags,JSObject_butterfly,Watchpoint_fire,MiscFields, Exits, ClobbersExit, bc#56) predicting Function 154:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#56, ExitInvalid) 54:<!0:-> MovHint(Untyped:@53, MustGen, loc8, W:SideState, ClobbersExit, bc#56, ExitInvalid) 60:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#56, exit: bc#65) 40:<!0:-> KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#65) 58:<!0:-> ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#65, ExitInvalid) 175:<!0:-> KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#72) 62:<!0:-> ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#72, ExitInvalid) 179:<!0:-> KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#80, ExitInvalid) 66:<!0:-> MovHint(Untyped:@65, MustGen, loc11, W:SideState, ClobbersExit, bc#80, ExitInvalid) 68:<!0:-> CheckCell(Check:Cell:Kill:@53, Untyped:@50, MustGen, <0x11c9e2da0, Function>, <host function>, Exits, bc#85) 187:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#85, ExitInvalid) 70:<!0:-> MovHint(Untyped:@69, MustGen, loc8, W:SideState, ClobbersExit, bc#85, ExitInvalid) 75:<!0:-> CheckStructure(Cell:@69, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#94) 194:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#94) 78:<!0:-> ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#94, ExitInvalid) 80:<!0:-> PutClosureVar(KnownCell:@17, Untyped:@77, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#103) 204:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#110) 83:<!0:-> MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#110, ExitInvalid) 210:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#117) 86:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#117, ExitInvalid) 209:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#124) 91:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#124, ExitInvalid) 207:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#132, ExitInvalid) 94:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#132, ExitInvalid) 205:<!0:-> KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#141) 98:<!0:-> ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#141, ExitInvalid) 202:<!0:-> KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#148) 102:<!0:-> ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#148, ExitInvalid) 201:<!0:-> KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#156, ExitInvalid) 106:<!0:-> ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#156, ExitInvalid) 73:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#161, ExitInvalid) 110:<!0:-> MovHint(Untyped:@109, MustGen, loc8, W:SideState, ClobbersExit, bc#161, ExitInvalid) 115:<!0:-> CheckStructure(Cell:@109, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#170) 196:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#170) 118:<!0:-> ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#170, ExitInvalid) 120:<!0:-> PutClosureVar(KnownCell:@17, Untyped:@117, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#179) 193:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#186) 123:<!0:-> MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#186, ExitInvalid) 192:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#193) 126:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#193, ExitInvalid) 191:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#200) 131:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#200, ExitInvalid) 76:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#208, ExitInvalid) 134:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#208, ExitInvalid) 188:<!0:-> KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#217) 138:<!0:-> ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#217, ExitInvalid) 42:<!0:-> KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#224) 142:<!0:-> ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#224, ExitInvalid) 181:<!0:-> KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#232, ExitInvalid) 146:<!0:-> ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#232, ExitInvalid) 180:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#237, ExitInvalid) 150:<!0:-> MovHint(Untyped:@149, MustGen, loc8, W:SideState, ClobbersExit, bc#237, ExitInvalid) 155:<!0:-> CheckStructure(Cell:@149, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#246) 177:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#246) 158:<!0:-> ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#246, ExitInvalid) 160:<!0:-> PutClosureVar(KnownCell:@17, Untyped:@157, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#255) 176:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#262) 163:<!0:-> MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#262, ExitInvalid) 173:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#269) 166:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#269, ExitInvalid) 170:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#276) 171:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#276, ExitInvalid) 169:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#284, ExitInvalid) 174:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#284, ExitInvalid) 167:<!0:-> KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#293) 178:<!0:-> ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#293, ExitInvalid) 165:<!0:-> KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#300) 182:<!0:-> ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#300, ExitInvalid) 162:<!0:-> KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#308, ExitInvalid) 186:<!0:-> ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#308, ExitInvalid) 161:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#313, ExitInvalid) 190:<!0:-> MovHint(Untyped:@189, MustGen, loc8, W:SideState, ClobbersExit, bc#313, ExitInvalid) 195:<!0:-> CheckStructure(Cell:@189, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#322) 81:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#322) 198:<!0:-> ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#322, ExitInvalid) 200:<!0:-> PutClosureVar(KnownCell:@17, Untyped:@197, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#331) 156:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#338) 203:<!0:-> MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#338, ExitInvalid) 153:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#345) 206:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#345, ExitInvalid) 152:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#352) 208:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#352, ExitInvalid) 151:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#360, ExitInvalid) 199:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#360, ExitInvalid) 82:<!0:-> KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#369) 183:<!0:-> ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#369, ExitInvalid) 148:<!0:-> KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#376) 172:<!0:-> ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#376, ExitInvalid) 49:<!0:-> KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#384, ExitInvalid) 159:<!0:-> ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#384, ExitInvalid) 141:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#389, ExitInvalid) 143:<!0:-> MovHint(Untyped:@147, MustGen, loc8, W:SideState, ClobbersExit, bc#389, ExitInvalid) 128:<!0:-> CheckStructure(Cell:@147, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#398) 140:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#398) 114:<!0:-> ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#398, ExitInvalid) 107:<!0:-> PutClosureVar(KnownCell:@17, Untyped:@119, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#407) 137:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#414) 99:<!0:-> MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#414, ExitInvalid) 136:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#421) 95:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#421, ExitInvalid) 133:<!0:-> KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#428) 79:<!0:-> ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#428, ExitInvalid) 130:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#436, ExitInvalid) 67:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#436, ExitInvalid) 129:<!0:-> KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#445) 57:<!0:-> ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#445, ExitInvalid) 127:<!0:-> KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#452) 52:<!0:-> ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#452, ExitInvalid) 125:<!0:-> KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#460, ExitInvalid) 44:<!0:-> ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#460, ExitInvalid) 122:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#465, ExitInvalid) 36:<!0:-> MovHint(Untyped:@38, MustGen, loc8, W:SideState, ClobbersExit, bc#465, ExitInvalid) 24:<!0:-> CheckStructure(Cell:@38, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#474) 121:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#474) 15:<!0:-> ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#474, ExitInvalid) 13:<!0:-> PutClosureVar(KnownCell:@17, Untyped:@19, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#483) 9:<!3:-> ArithAdd(Int32:Kill:@28, Int32:@11, Number|MustGen|UseAsOther, Int32, Unchecked, Exits, bc#490) 85:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#490) 7:<!0:-> MovHint(Untyped:@9, MustGen, loc5, W:SideState, ClobbersExit, bc#490, ExitInvalid) 116:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#492) 0:<!0:-> ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#492, ExitInvalid) 113:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#499) 21:<!0:-> ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#499, ExitInvalid) 112:<!0:-> KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#507, ExitInvalid) 100:<!0:-> MovHint(Untyped:@34, MustGen, loc8, W:SideState, ClobbersExit, bc#507, ExitInvalid) 96:< 1:-> CompareLess(Int32:@9, Int32:@34, Boolean|UseAsOther, Bool, Exits, bc#512) 93:<!0:-> Branch(KnownBoolean:Kill:@96, MustGen, T:#1/w:10.000000, F:#4/w:1.000000, W:SideState, bc#512, ExitInvalid) States: TakeBoth, StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@9 loc6:DeadFlush/Undecided loc8:ConflictingFlush/@34 loc10:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1, @9, @11, @17, @19, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197 Values: @1=>(Other, Undefined), @9=>(Int32), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @149=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @197=>(Int32) Block #4 (bc#516): Execution count: 1.000000 Predecessors: #3 Successors: Dominated by: #0 #2 #3 #4 Dominates: #4 Dominance Frontier: Iterated Dominance Frontier: Backwards dominates by: #end #4 Backwards dominates: #0 #1 #2 #3 #4 Control equivalent to: #0 #2 #3 #4 States: StructuresAreWatched Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: @1 Values: @1=>(Other, Undefined) 108:<!0:-> ExitOK(MustGen, W:SideState, bc#516) 90:<!0:-> Return(Untyped:Kill:@1, MustGen, W:SideState, Exits, bc#516) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = } Live: Values:

Yusuke Suzuki

Comment 3 2016-11-03 00:15:05 PDT

Saam and Filip, is that sound? I'm still carefully considering about it. But I think it is sound. getByIdElement cannot be changed. And it is figured out by DFG. Only way to change it is doing something PureGetById and in that case the watchpoint is fired. And even if the getElementById is changed, CheckCell will cause OSR and it ensures the result of inlining is correct. And CallDOM said that getElementById is not observable and it returns the same value if DOMState(DOM) is not changed. That is correct. If you change the tree, your node should say that DOMState(DOM) / DOMState(Tree) is changed.

Yusuke Suzuki

Comment 4 2016-11-03 01:04:22 PDT

Created attachment 293754 [details] Patch Performance numbers will be added tomorrow. But quick comparison between STP shows that getElementById test becomes 43x faster (250638 v.s. 5791.2)

Yusuke Suzuki

Comment 5 2016-11-03 02:54:13 PDT

Comment on attachment 293754 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=293754&action=review > Source/WebCore/dom/NonElementParentNode.idl:31 > + [DOMJIT=ReadDOM] Element? getElementById([RequiresExistingAtomicString] DOMString elementId); I found this IDL was wrong. It may return null.

Yusuke Suzuki

Comment 6 2016-11-03 11:39:27 PDT

Created attachment 293782 [details] Patch

Filip Pizlo

Comment 7 2016-11-03 11:48:06 PDT

Comment on attachment 293782 [details] Patch Wow, this is cool!

Yusuke Suzuki

Comment 8 2016-11-03 12:19:40 PDT

Comment on attachment 293782 [details] Patch Thanks!

Yusuke Suzuki

Comment 9 2016-11-03 13:26:40 PDT

Comment on attachment 293782 [details] Patch Before landing I'll check the crashing things. It may be unrelated, since the current ToT seems crashing with Speedometer and DOMJIT::Signature patch was not related to that (I checked it))

Yusuke Suzuki

Comment 10 2016-11-04 10:56:00 PDT

Created attachment 293901 [details] Patch for landing

Yusuke Suzuki

Comment 11 2016-11-04 18:18:21 PDT

Committed r208412: <http://trac.webkit.org/changeset/208412>

Note You need to log in before you can comment on or make changes to this bug.