Bug 65883 – DFG JIT has no way of propagating predictions to loads and calls

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

The DFG JIT sometimes wants to predict the type of a variable based on how it gets used.  But it can only do this if the variable was assigned to by loading from the register file or from global variables.  It should be able to also do this if the variable is the result of a heap load (GetById, GetByVal) or a call.

[Filip Pizlo]

Created attachment 103306 [details]
the patch

[Filip Pizlo]

Comment on attachment 103306 [details]
the patch

All tests pass.

[Gavin Barraclough]

Comment on attachment 103306 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=103306&action=review

Sorry to cq- for a typo, but I think there is a grammar error in the change log. :-)
Otherwise all looks good.  I think we might want a prediction for more (all) node types in the future, so may want to break this out as a separate field, but reuse of opInfo2 seems like a good call, at least for now.

> Source/JavaScriptCore/ChangeLog:8
> +        This introduces the capability to stored predictions on graph

stored -> store ?

[Filip Pizlo]

Created attachment 103423 [details]
the patch (fix for review)

[WebKit Review Bot]

Comment on attachment 103423 [details]
the patch (fix for review)

Clearing flags on attachment: 103423

Committed r92734: <http://trac.webkit.org/changeset/92734>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Filip Pizlo]

When combined with https://bugs.webkit.org/show_bug.cgi?id=65949, this produces a 20% slow-down in v8-crypto without any significant speed-ups anywhere.  It should probably be disabled.