Bug 68932 – DFG JIT should speculate more aggressively on reads of array.length

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

DFG JIT currently optimizes accesses to array.length the same way as the old JIT: it generates a stub on the fly when an array length access is detected after the code is already compiled.  But the DFG has all the information it needs to inline a fast speculative array length access.

[Filip Pizlo]

Created attachment 108895 [details]
the patch

[Oliver Hunt]

Comment on attachment 108895 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=108895&action=review

> Source/JavaScriptCore/dfg/DFGPropagator.cpp:695
> +#if ENABLE(DFG_DEBUG_PROPAGATION_VERBOSE)
> +            printf("  @%u -> GetArrayLength", nodeIndex);
> +#endif

please add debug message macros

[Filip Pizlo]

Created attachment 108903 [details]
the patch

Added debug message macro.

[Oliver Hunt]

Comment on attachment 108903 [details]
the patch

I'd rather #define DFG_DEBUG_PROPAGATION(msg...) printf(msg);

But my suggestion was meant for a following patch

[Filip Pizlo]

(In reply to comment #4)
> (From update of attachment 108903 [details])
> I'd rather #define DFG_DEBUG_PROPAGATION(msg...) printf(msg);
> 
> But my suggestion was meant for a following patch

So you want me to commit the previous patch, and then do the refactoring separately?

[Filip Pizlo]

Landed in r96184.