Bug 120796 - REGRESSION(r155149): Fixing ToThis so that it is correct causes a 30% regression on LongSpider/3d-cube
Summary: REGRESSION(r155149): Fixing ToThis so that it is correct causes a 30% regress...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Geoffrey Garen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-05 14:19 PDT by Filip Pizlo
Modified: 2013-09-05 16:39 PDT (History)
7 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-09-05 14:19:37 PDT
We should fix it, and I'm not sure how - Geoff, do you have ideas since you introduced the new ToThis logic?
Comment 1 Geoffrey Garen 2013-09-05 16:39:32 PDT
Here’s a complete proposal:

(*) If a simple structure check will do, use it. It’s good to check structures because our check will likely CSE with a property access.

(*) If a simple array type check will do, use it. It’s good to check array types because our check will likely CSE with an indexed access.

(*) Otherwise, check a bit in Structure that says “I don’t need ToThis conversion”.

(*) For the global object:

	(*) The only example we have where this matters is a five-year-old typo, so we should probably just fix the typo.

	(*) But if we really care, we can add a specific check for global object => global this, and constant-fold it.