Bug 110539 - 25-30% regression in V8 RayTrace test in 32 bit builds with JIT disabled
Summary: 25-30% regression in V8 RayTrace test in 32 bit builds with JIT disabled
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Michael Saboff
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2013-02-21 18:03 PST by Michael Saboff
Modified: 2013-02-21 18:11 PST (History)
0 users

See Also:

Attachments
Patch (1.43 KB, patch)
2013-02-21 18:07 PST, Michael Saboff 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2013-02-21 18:03:39 PST 
A regression of 25-30% was found in iOS builds when running JavaScript with just the interpreter running V8 RayTrace.

The problem has been tracked to a change made in r129713 <http://trac.webkit.org/changeset/129713> in llint/LowLevelInterpreter32_64.asm.  When looking up a pointer in the JSGlobalObject::m_specialPointers array on 32 bit builds, we should use a scale of 4 instead of the 8 introduced in that patch.

This is being tracked in <rdar://problem/13102630>.
Comment 1 Michael Saboff 2013-02-21 18:07:14 PST 
Created attachment 189655 [details]
Patch

This patch has already been reviewed in person.
Comment 2 Michael Saboff 2013-02-21 18:11:47 PST 
Committed r143677: <http://trac.webkit.org/changeset/143677>