Bug 68932

Summary:

DFG JIT should speculate more aggressively on reads of array.length

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+
the patch	oliver: review-

Description Filip Pizlo 2011-09-27 14:11:26 PDT

DFG JIT currently optimizes accesses to array.length the same way as the old JIT: it generates a stub on the fly when an array length access is detected after the code is already compiled.  But the DFG has all the information it needs to inline a fast speculative array length access.

Comment 1 Filip Pizlo 2011-09-27 14:14:22 PDT

Created attachment 108895 [details]
the patch

Comment 2 Oliver Hunt 2011-09-27 14:17:35 PDT

Comment on attachment 108895 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=108895&action=review

> Source/JavaScriptCore/dfg/DFGPropagator.cpp:695
> +#if ENABLE(DFG_DEBUG_PROPAGATION_VERBOSE)
> +            printf("  @%u -> GetArrayLength", nodeIndex);
> +#endif

please add debug message macros

Comment 3 Filip Pizlo 2011-09-27 14:48:37 PDT

Created attachment 108903 [details]
the patch

Added debug message macro.

Comment 4 Oliver Hunt 2011-09-27 15:03:03 PDT

Comment on attachment 108903 [details]
the patch

I'd rather #define DFG_DEBUG_PROPAGATION(msg...) printf(msg);

But my suggestion was meant for a following patch

Comment 5 Filip Pizlo 2011-09-27 15:04:28 PDT

(In reply to comment #4)
> (From update of attachment 108903 [details])
> I'd rather #define DFG_DEBUG_PROPAGATION(msg...) printf(msg);
> 
> But my suggestion was meant for a following patch

So you want me to commit the previous patch, and then do the refactoring separately?

Comment 6 Filip Pizlo 2011-09-27 20:39:26 PDT

Landed in r96184.