Bug 131356 – REGRESSION(r166678): Dromaeo/cssquery-dojo.html crashes regularly

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Csaba Osztrogonác]

It crashes regularly on the Apple Mountain Lion and the EFL performance bots.

Here is a backtrace from the EFL bot:
Running Dromaeo/cssquery-dojo.html (46 of 128)
error: Dromaeo/cssquery-dojo.html
1   0x7f775df41ae0
2   0x7f775e2cbff0
3   0x7f775dac18a7 JSC::speculationFromCell(JSC::JSCell*)
4   0x7f775dbc76c3 JSC::DFG::PredictionPropagationPhase::propagate(JSC::DFG::Node*)
5   0x7f775dbc9456 bool JSC::DFG::runAndLog<JSC::DFG::PredictionPropagationPhase>(JSC::DFG::PredictionPropagationPhase&)
6   0x7f775dbc9f1e JSC::DFG::performPredictionPropagation(JSC::DFG::Graph&)
7   0x7f775dbc6376 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
8   0x7f775dbc6837 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
9   0x7f775db58674 JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::DFG::CompilationMode, unsigned int, JSC::Operands<JSC::JSValue, JSC::OperandValueTraits<JSC::JSValue> > const&, WTF::PassRefPtr<JSC::DeferredCompilationCallback>)
10  0x7f775dce8c29
11  0x7f770402f5d7

FAILED
Finished: 600.570791 s

---

After checking the bot history the first failure was on r166690 :
http://build.webkit.org/builders/Apple%20MountainLion%20Release%20%28Perf%29/builds/8494
But this build doesn't contain any JSC related change, maybe the following
patch is the culprit - http://trac.webkit.org/changeset/166678 (CodeBlockSet should be generational)

Could you possibly check it?

[Filip Pizlo]

Yup I'll take a look.

[Filip Pizlo]

Errr, I'll pass it along to MarkH.

[Mark Hahnenberg]

I can't repro this on ToT (r166932) in debug on release on Mavericks.

[Csaba Osztrogonác]

(In reply to comment #3)
> I can't repro this on ToT (r166932) in debug on release on Mavericks.

As I said it is a flakey crash on the Mountain Lion and EFL performance bots.
I haven't seen this crash on Mavericks before. And it is flakey, so it doesn't
crash always, see http://build.webkit.org/builders/Apple%20MountainLion%20Release%20%28Perf%29?numbuilds=200 for details.

[Csaba Osztrogonác]

Here is a crash on Mavericks too - http://build.webkit.org/builders/Apple%20Mavericks%20Release%20%28Perf%29/builds/1101

[Csaba Osztrogonác]

Is there any plan to fix this serious DFG JIT bug? 
Or is this crash a feature not a bug? :)

Apple Mountain Lion bot: (53 crashes / 200 builds)
http://build.webkit.org/builders/Apple%20MountainLion%20Release%20%28Perf%29?numbuilds=200

Apple Mavericks bot: (6 crashes / 200 builds)
http://build.webkit.org/builders/Apple%20Mavericks%20Release%20%28Perf%29?numbuilds=200

EFL bot: (12 crashes / 200 builds)
http://build.webkit.org/builders/EFL%20Linux%2064-bit%20Release%20WK2%20%28Perf%29?numbuilds=200

[Alexey Proskuryakov]

<rdar://problem/16712772>

[Mark Lam]

I was able to reproduce this with a release build of r167815 by running the Dromaeo/cssquery-dojo.html benchmark only via run-perf-tests in a loop on the command line.  Out of 100 runs, it only reproduced once.  It's not very easily reproducible.

Here are some data that I've collected from that one crash:

Crashed Thread:  10  JSC Compilation Thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000001a1693c80

Thread 0:: Dispatch queue: com.apple.main-thread
0   ???                           	0x000041d7c0634885 0 + 72394901506181
1   ???                           	0x000041d7c06976b0 0 + 72394901911216
2   ???                           	0x000041d800600dba 0 + 72395975036346
3   ???                           	0x000041d7c0698705 0 + 72394901915397
4   ???                           	0x000041d800600dba 0 + 72395975036346
5   ???                           	0x000041d7c0693dd8 0 + 72394901896664
6   com.apple.JavaScriptCore      	0x0000000109d0663d callToJavaScript + 321
7   com.apple.JavaScriptCore      	0x0000000109c25773 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:376)
8   com.apple.JavaScriptCore      	0x0000000109c0b9a8 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 440 (Interpreter.cpp:994)
9   com.apple.JavaScriptCore      	0x0000000109a9cfaf JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 63 (Register.h:118)
10  com.apple.WebCore             	0x000000010afd6489 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 537 (JSMainThreadExecState.h:89)
11  com.apple.WebCore             	0x000000010afd60f0 WebCore::ScheduledAction::execute(WebCore::Document*) + 144 (ScheduledAction.cpp:125)
12  com.apple.WebCore             	0x000000010a6c7d80 WebCore::DOMTimer::fired() + 304 (InspectorInstrumentation.h:290)
13  com.apple.WebCore             	0x000000010b18050f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175 (ThreadTimers.cpp:135)
14  com.apple.WebCore             	0x000000010b03582a WebCore::timerFired(__CFRunLoopTimer*, void*) + 58 (SharedTimerMac.mm:134)
...

Thread 10 Crashed:: JSC Compilation Thread
0   com.apple.JavaScriptCore      	0x0000000109dd2d6e JSC::speculationFromCell(JSC::JSCell*) + 46 (StructureIDTable.h:86)
1   com.apple.JavaScriptCore      	0x0000000109b5ede3 JSC::DFG::PredictionPropagationPhase::propagate(JSC::DFG::Node*) + 1795 (DFGPredictionPropagationPhase.cpp:140)
2   com.apple.JavaScriptCore      	0x0000000109b5d5ca JSC::DFG::PredictionPropagationPhase::run() + 106 (DFGPredictionPropagationPhase.cpp:623)
3   com.apple.JavaScriptCore      	0x0000000109b5d4fc JSC::DFG::performPredictionPropagation(JSC::DFG::Graph&) + 44 (DFGCommon.h:68)
4   com.apple.JavaScriptCore      	0x0000000109b5c57b JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 427 (DFGPlan.cpp:228)
5   com.apple.JavaScriptCore      	0x0000000109b5c1eb JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) + 299 (DFGPlan.cpp:155)
6   com.apple.JavaScriptCore      	0x0000000109bc98b6 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 566 (Locker.h:43)
7   com.apple.JavaScriptCore      	0x0000000109e648cf WTF::wtfThreadEntryPoint(void*) + 15 (ThreadingPthreads.cpp:168)
8   libsystem_pthread.dylib       	0x00007fff863fe899 _pthread_body + 138
9   libsystem_pthread.dylib       	0x00007fff863fe72a _pthread_start + 137
10  libsystem_pthread.dylib       	0x00007fff86402fc9 thread_start + 13


The crashing site:

inline Structure* StructureIDTable::get(StructureID structureID)
{
#if USE(JSVALUE64)
    return table()[structureID].structure;    // <======= CRASHED here.
#else
    return structureID;
#endif
}

Probably called from:

SpeculatedType speculationFromCell(JSCell* cell)
{
    if (JSString* string = jsDynamicCast<JSString*>(cell)) {
        if (const StringImpl* impl = string->tryGetValueImpl()) {
            if (impl->isAtomic())
                return SpecStringIdent;
        }
        return SpecStringVar;
    }
    return speculationFromStructure(cell->structure());   // <========== here
}

Probably called from:

SpeculatedType speculationFromValue(JSValue value)
{
   ...
    if (value.isCell())
        return speculationFromCell(value.asCell());      // <============= here
   ...
}

Called from:

    void propagate(Node* node)          // in DFGPredictionPropagationPhase.cpp
    {
        NodeType op = node->op();

        bool changed = false;
        
        switch (op) {
        case JSConstant:
        case WeakJSConstant: {
            SpeculatedType type = speculationFromValue(m_graph.valueOfJSConstant(node));      // <============ here
            ...
    }

[Mark Lam]

Created attachment 230950 [details]
the patch.

Still running perf numbers and regression tests.

[Geoffrey Garen]

Comment on attachment 230950 [details]
the patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=230950&action=review

r=me

> Source/JavaScriptCore/bytecode/VariableWatchpointSet.h:82
> +    SymbolTable* m_symbolTable;

Since this pointer is never null, and available at initialization time, it should be a reference.

[Mark Lam]

Perf numbers for patch 1:

Benchmark report for SunSpider, LongSpider, V8Spider, Octane, Kraken, JSRegress, and AsmBench on albion (MacPro5,1).

VMs tested:
"Conf#1" at /Volumes/Data-HD/ws6/OpenSource/WebKitBuild/Release/jsc (r168386)
"Conf#2" at /Volumes/Data-HD/ws4/OpenSource/WebKitBuild/Release/jsc (r168386)

Collected 4 samples per benchmark/VM, with 4 VM invocations per benchmark. Emitted a call to gc() between sample measurements.
Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level
timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds.

                                                          Conf#1                    Conf#2                                      
SunSpider:
   3d-cube                                            7.5020+-0.3457     ?      7.6741+-0.1966        ? might be 1.0230x slower
   3d-morph                                           8.9777+-0.2195     ?      9.1365+-0.1589        ? might be 1.0177x slower
   3d-raytrace                                        9.9604+-1.2744            9.8354+-0.3609          might be 1.0127x faster
   access-binary-trees                                2.6372+-0.1254     ?      2.6925+-0.1240        ? might be 1.0210x slower
   access-fannkuch                                    8.8266+-0.1354     ?      8.8583+-0.1746        ?
   access-nbody                                       4.6670+-0.3378            4.6115+-0.2552          might be 1.0120x faster
   access-nsieve                                      5.5468+-0.2812     ?      5.5538+-0.5039        ?
   bitops-3bit-bits-in-byte                           1.9026+-0.1427            1.8727+-0.1043          might be 1.0160x faster
   bitops-bits-in-byte                                6.2463+-0.1104     ?      6.2834+-0.1303        ?
   bitops-bitwise-and                                 3.1055+-0.0812            3.0975+-0.1251        
   bitops-nsieve-bits                                 5.7509+-0.1477            5.5876+-0.0329          might be 1.0292x faster
   controlflow-recursive                              2.7903+-0.1143            2.7787+-0.0587        
   crypto-aes                                         6.2498+-0.1735            6.1704+-0.2012          might be 1.0129x faster
   crypto-md5                                         3.7258+-0.0680            3.5211+-0.2136          might be 1.0582x faster
   crypto-sha1                                        3.4042+-0.1573            3.3726+-0.1576        
   date-format-tofte                                 12.7582+-0.3804     ?     13.0303+-0.3998        ? might be 1.0213x slower
   date-format-xparb                                  9.5333+-0.7105     ?      9.5780+-0.2291        ?
   math-cordic                                        4.6667+-0.0856     ^      4.5335+-0.0272        ^ definitely 1.0294x faster
   math-partial-sums                                 10.1859+-0.1437           10.1238+-0.1186        
   math-spectral-norm                                 3.0679+-0.1119            3.0208+-0.1398          might be 1.0156x faster
   regexp-dna                                        11.3718+-0.6948     ?     11.5696+-0.2171        ? might be 1.0174x slower
   string-base64                                      6.0460+-0.1047     ?      6.1927+-0.2134        ? might be 1.0243x slower
   string-fasta                                      10.9633+-0.6559     ?     11.1175+-0.2064        ? might be 1.0141x slower
   string-tagcloud                                   15.3752+-0.4550     ?     15.4942+-0.5573        ?
   string-unpack-code                                32.1638+-0.4690           31.4360+-0.8297          might be 1.0231x faster
   string-validate-input                              7.7933+-0.2166            7.4625+-0.1963          might be 1.0443x faster

   <arithmetic> *                                     7.8930+-0.0717            7.8694+-0.0887          might be 1.0030x faster
   <geometric>                                        6.4147+-0.0583            6.3882+-0.0726          might be 1.0041x faster
   <harmonic>                                         5.3190+-0.0463            5.2823+-0.0695          might be 1.0070x faster

                                                          Conf#1                    Conf#2                                      
LongSpider:
   3d-cube                                         1306.7593+-30.8449        1301.7043+-7.7947        
   3d-morph                                        2131.5762+-4.3162     ?   2133.9419+-4.1465        ?
   3d-raytrace                                     1400.3865+-10.0884    ?   1419.3524+-21.1943       ? might be 1.0135x slower
   access-binary-trees                             1583.6116+-11.4021    ?   1595.5197+-18.9801       ?
   access-fannkuch                                  509.2729+-36.8005    ?    517.9512+-53.0950       ? might be 1.0170x slower
   access-nbody                                    1196.0980+-2.1604         1195.0439+-3.4533        
   access-nsieve                                   1558.3048+-17.3619    ?   1559.8978+-12.0591       ?
   bitops-3bit-bits-in-byte                          57.0106+-1.0040           56.9750+-0.2721        
   bitops-bits-in-byte                              372.7449+-8.3813     ?    376.0921+-9.1419        ?
   bitops-nsieve-bits                              1130.4653+-4.6447     ?   1134.6368+-4.2862        ?
   controlflow-recursive                            820.6756+-3.6188          819.9839+-2.9866        
   crypto-aes                                      1072.2081+-4.8776     ?   1075.9193+-7.8548        ?
   crypto-md5                                      1004.2381+-5.0437     ?   1005.9482+-8.6468        ?
   crypto-sha1                                     1103.2324+-7.2710         1099.3356+-3.6492        
   date-format-tofte                               1118.8730+-5.9827         1118.3395+-20.3861       
   date-format-xparb                               1554.7705+-80.6755        1535.5633+-19.8170         might be 1.0125x faster
   math-cordic                                      796.9058+-4.1443          795.8225+-1.0869        
   math-partial-sums                               1202.4246+-8.1326     ?   1203.5470+-5.7826        ?
   math-spectral-norm                              1232.6562+-6.2700         1232.4922+-3.3570        
   string-base64                                    562.1345+-3.5402     ?    562.1895+-5.6353        ?
   string-fasta                                    1054.0327+-22.7715    ?   1061.7597+-44.8150       ?
   string-tagcloud                                  381.4352+-5.5794          377.6240+-1.3713          might be 1.0101x faster

   <arithmetic>                                    1052.2644+-3.9071     ?   1053.6200+-3.4267        ? might be 1.0013x slower
   <geometric> *                                    882.3355+-1.9511     ?    883.5952+-5.4870        ? might be 1.0014x slower
   <harmonic>                                       536.9439+-2.2391     ?    537.3549+-3.8173        ? might be 1.0008x slower

                                                          Conf#1                    Conf#2                                      
V8Spider:
   crypto                                            81.4258+-0.5603     ?     82.2731+-1.6852        ? might be 1.0104x slower
   deltablue                                         96.7683+-0.6843     ?     96.9927+-1.4237        ?
   earley-boyer                                      70.6422+-4.5454           68.6530+-0.6976          might be 1.0290x faster
   raytrace                                          43.5614+-2.7385     ?     43.6927+-1.9978        ?
   regexp                                            98.3039+-1.1022           98.2133+-1.2584        
   richards                                         100.3709+-1.7948           99.7380+-1.5467        
   splay                                             48.5545+-1.8844     ?     48.9492+-0.5514        ?

   <arithmetic>                                      77.0896+-1.0485           76.9303+-0.1635          might be 1.0021x faster
   <geometric> *                                     73.5127+-1.1436           73.3941+-0.1314          might be 1.0016x faster
   <harmonic>                                        69.6499+-1.2213           69.6013+-0.4017          might be 1.0007x faster

                                                          Conf#1                    Conf#2                                      
Octane:
   encrypt                                           0.42437+-0.00096    ?     0.42522+-0.00368       ?
   decrypt                                           7.62092+-0.09164          7.60890+-0.02973       
   deltablue                                x2       0.41989+-0.00764          0.41638+-0.00490       
   earley                                            0.86726+-0.00893          0.86707+-0.01210       
   boyer                                            10.01611+-0.15971          9.96110+-0.10657       
   navier-stokes                            x2       7.37602+-0.00657    ?     7.38887+-0.05396       ?
   raytrace                                 x2       2.65929+-0.03940    ?     2.67111+-0.07180       ?
   richards                                 x2       0.21856+-0.01310          0.21790+-0.00899       
   splay                                    x2       0.62119+-0.00973    ?     0.62205+-0.00364       ?
   regexp                                   x2      69.05898+-0.81065    ?    69.55539+-0.93254       ?
   pdfjs                                    x2      89.00096+-0.83621         88.68435+-0.18454       
   mandreel                                 x2      95.14173+-0.93153    ?    95.74943+-0.85892       ?
   gbemu                                    x2      81.61711+-2.28011         81.61419+-2.13115       
   closure                                           0.85617+-0.00257    ?     0.86326+-0.00551       ?
   jquery                                           10.67687+-0.03728    ?    10.68303+-0.03524       ?
   box2d                                    x2      26.77140+-0.57604    ?    27.39102+-0.30221       ? might be 1.0231x slower
   zlib                                     x2     708.64376+-1.13046    ?   708.65562+-4.65431       ?
   typescript                               x2    1213.06030+-7.00925       1206.13574+-19.91231      

   <arithmetic>                                    153.98800+-0.27380        153.62042+-0.81797         might be 1.0024x faster
   <geometric> *                                    12.19685+-0.08789    ?    12.21739+-0.05858       ? might be 1.0017x slower
   <harmonic>                                        1.28522+-0.02761          1.28302+-0.02412         might be 1.0017x faster

                                                          Conf#1                    Conf#2                                      
Kraken:
   ai-astar                                          539.379+-3.134            538.202+-2.085         
   audio-beat-detection                              201.835+-2.726      ?     201.948+-2.245         ?
   audio-dft                                         243.632+-2.064            242.710+-1.045         
   audio-fft                                         119.940+-1.410      ?     119.995+-1.552         ?
   audio-oscillator                                  370.830+-12.870           366.160+-1.065           might be 1.0128x faster
   imaging-darkroom                                  278.854+-2.486      ?     279.016+-3.180         ?
   imaging-desaturate                                121.060+-0.754      ?     121.103+-0.350         ?
   imaging-gaussian-blur                             196.742+-16.141           186.156+-5.808           might be 1.0569x faster
   json-parse-financial                               78.521+-1.465             78.117+-1.172         
   json-stringify-tinderbox                           96.878+-1.198      ?      98.124+-2.207         ? might be 1.0129x slower
   stanford-crypto-aes                                88.125+-2.671      ?      88.692+-0.933         ?
   stanford-crypto-ccm                                82.606+-17.958     ?      84.737+-18.074        ? might be 1.0258x slower
   stanford-crypto-pbkdf2                            230.726+-1.730      ?     231.858+-2.054         ?
   stanford-crypto-sha256-iterative                   82.694+-1.192             82.323+-0.754         

   <arithmetic> *                                    195.130+-1.460            194.224+-1.077           might be 1.0047x faster
   <geometric>                                       161.505+-1.887            161.151+-2.464           might be 1.0022x faster
   <harmonic>                                        137.291+-2.520      ?     137.429+-3.492         ? might be 1.0010x slower

                                                          Conf#1                    Conf#2                                      
JSRegress:
   adapt-to-double-divide                            19.3823+-0.3939           19.2555+-0.8093        
   aliased-arguments-getbyval                         1.2377+-0.0878            1.1640+-0.1028          might be 1.0633x faster
   allocate-big-object                                3.1382+-0.2345            3.0658+-0.1090          might be 1.0236x faster
   arity-mismatch-inlining                            1.1234+-0.1589     !      1.7153+-0.1010        ! definitely 1.5268x slower
   array-access-polymorphic-structure                10.1132+-0.3152     ?     10.2735+-0.3003        ? might be 1.0158x slower
   array-nonarray-polymorhpic-access                 60.2507+-0.5758     ?     60.3549+-0.7711        ?
   array-prototype-every                            120.0062+-2.0865          116.9751+-1.2256          might be 1.0259x faster
   array-prototype-forEach                          120.0565+-6.1395          116.6153+-2.1500          might be 1.0295x faster
   array-prototype-map                              141.9522+-2.7209          140.7390+-3.3697        
   array-prototype-some                             117.5760+-2.8921          115.9459+-1.3198          might be 1.0141x faster
   array-with-double-add                              6.5134+-0.0329            6.5027+-0.1355        
   array-with-double-increment                        4.6032+-0.1133     ?      4.6806+-0.3251        ? might be 1.0168x slower
   array-with-double-mul-add                          7.4723+-0.1126     ?      7.4760+-0.1574        ?
   array-with-double-sum                              4.8367+-0.0530            4.8276+-0.1263        
   array-with-int32-add-sub                          11.4795+-0.1953           11.4257+-0.2075        
   array-with-int32-or-double-sum                     4.9638+-0.0705            4.9572+-0.1424        
   ArrayBuffer-DataView-alloc-large-long-lived   
                                                    108.9470+-0.8627     ?    109.0035+-0.5219        ?
   ArrayBuffer-DataView-alloc-long-lived             30.1442+-1.2520           29.9838+-1.0545        
   ArrayBuffer-Int32Array-byteOffset                  5.3387+-0.2559            5.2867+-0.3213        
   ArrayBuffer-Int8Array-alloc-large-long-lived   
                                                    112.6555+-0.7892     ?    112.9815+-1.4206        ?
   ArrayBuffer-Int8Array-alloc-long-lived-buffer   
                                                     48.6693+-1.8182           47.4923+-0.0536          might be 1.0248x faster
   ArrayBuffer-Int8Array-alloc-long-lived            28.9188+-0.3647     ?     29.0355+-0.7111        ?
   ArrayBuffer-Int8Array-alloc                       25.8433+-0.2106           25.4814+-0.4668          might be 1.0142x faster
   asmjs_bool_bug                                    10.4194+-0.0922     ^      9.9984+-0.1024        ^ definitely 1.0421x faster
   assign-custom-setter-polymorphic                   4.6334+-0.1595     ?      4.7307+-0.1954        ? might be 1.0210x slower
   assign-custom-setter                               6.3411+-0.3211     ?      6.6371+-0.5912        ? might be 1.0467x slower
   basic-set                                         15.2784+-0.3250           14.8600+-0.4539          might be 1.0282x faster
   big-int-mul                                        6.0945+-0.1050     !      6.5878+-0.1656        ! definitely 1.0809x slower
   boolean-test                                       4.6658+-0.1611            4.5993+-0.0821          might be 1.0145x faster
   branch-fold                                        5.0358+-0.0318     ?      5.1298+-0.1303        ? might be 1.0187x slower
   by-val-generic                                    13.9811+-0.2287     ?     14.4480+-0.6815        ? might be 1.0334x slower
   call-spread-apply                                 20.7062+-1.1787     !     23.0069+-0.7499        ! definitely 1.1111x slower
   call-spread-call                                   8.8101+-0.2262     !     10.3087+-0.2654        ! definitely 1.1701x slower
   captured-assignments                               0.6540+-0.1084            0.6019+-0.1159          might be 1.0866x faster
   cast-int-to-double                                12.3420+-0.2716     ?     12.3703+-0.3096        ?
   cell-argument                                     10.2212+-0.2965     ?     10.6597+-0.3101        ? might be 1.0429x slower
   cfg-simplify                                       4.0591+-0.1470     ?      4.0654+-0.0620        ?
   chain-getter-access                               31.6298+-0.4345           31.4977+-0.0531        
   cmpeq-obj-to-obj-other                            12.9720+-0.8726           12.8372+-0.2440          might be 1.0105x faster
   constant-test                                      8.5061+-0.1255     ?      8.5336+-0.1530        ?
   DataView-custom-properties                       115.7548+-0.9234     ?    116.0894+-0.7314        ?
   delay-tear-off-arguments-strictmode                3.6532+-0.2058     ?      3.6577+-0.1987        ?
   destructuring-arguments                            8.7505+-0.1566     ?      8.7685+-0.1106        ?
   destructuring-swap                                 8.6813+-0.1708            8.6613+-0.1179        
   direct-arguments-getbyval                          1.1725+-0.1974     ?      1.2007+-0.0928        ? might be 1.0240x slower
   double-get-by-val-out-of-bounds                    6.2817+-0.2793     ?      7.0935+-0.5770        ? might be 1.1292x slower
   double-pollution-getbyval                         10.9280+-0.3017     ?     10.9594+-0.5057        ?
   double-pollution-putbyoffset                       6.0344+-0.0436     ?      6.0815+-0.1072        ?
   double-to-int32-typed-array-no-inline              2.9221+-0.0444     !      2.9996+-0.0137        ! definitely 1.0265x slower
   double-to-int32-typed-array                        2.5560+-0.1584            2.5122+-0.1667          might be 1.0174x faster
   double-to-uint32-typed-array-no-inline             3.1728+-0.4634            3.0807+-0.0865          might be 1.0299x faster
   double-to-uint32-typed-array                       2.6215+-0.0639     ?      2.6749+-0.1762        ? might be 1.0203x slower
   empty-string-plus-int                             10.1248+-0.3834           10.1120+-0.5861        
   emscripten-cube2hash                              54.2736+-2.0553           54.0609+-1.8173        
   external-arguments-getbyval                        2.1030+-0.1480            2.0673+-0.1490          might be 1.0173x faster
   external-arguments-putbyval                        2.9559+-0.1257            2.9467+-0.1664        
   fixed-typed-array-storage-var-index                1.5853+-0.0614            1.5678+-0.1016          might be 1.0111x faster
   fixed-typed-array-storage                          1.2318+-0.1155     ?      1.2537+-0.1154        ? might be 1.0178x slower
   Float32Array-matrix-mult                           7.7467+-0.8357            7.6463+-0.6649          might be 1.0131x faster
   Float32Array-to-Float64Array-set                  84.9412+-1.7735           84.4825+-5.3767        
   Float64Array-alloc-long-lived                     96.1516+-1.6012     ?     97.9599+-0.2985        ? might be 1.0188x slower
   Float64Array-to-Int16Array-set                   111.0578+-1.3882     ^    107.4605+-0.8315        ^ definitely 1.0335x faster
   fold-double-to-int                                19.5593+-0.5384           19.5067+-0.4763        
   for-of-iterate-array-entries                       9.3673+-0.2768            9.1719+-0.2327          might be 1.0213x faster
   for-of-iterate-array-keys                          3.7280+-0.3013            3.6992+-0.2171        
   for-of-iterate-array-values                        3.3132+-0.1696            3.3084+-0.0421        
   fround                                            23.6090+-1.1921     ?     23.9722+-1.0781        ? might be 1.0154x slower
   function-dot-apply                                 2.2555+-0.1627     !      3.1720+-0.1455        ! definitely 1.4063x slower
   function-test                                      4.8428+-0.1145     ?      4.8855+-0.1230        ?
   function-with-eval                                40.6710+-1.3718     ?     40.8978+-3.1424        ?
   get-by-id-chain-from-try-block                     8.1341+-0.2648            8.0179+-0.2204          might be 1.0145x faster
   get-by-id-proto-or-self                           24.9310+-3.7626           23.5518+-1.1237          might be 1.0586x faster
   get-by-id-self-or-proto                           23.7039+-0.6931     ?     24.4880+-1.1776        ? might be 1.0331x slower
   get-by-val-out-of-bounds                           6.2044+-0.0915     !      6.7446+-0.1829        ! definitely 1.0871x slower
   get_callee_monomorphic                             4.8813+-0.2770     ?      4.9739+-0.3232        ? might be 1.0190x slower
   get_callee_polymorphic                             4.5435+-0.1689     ?      4.6422+-0.0845        ? might be 1.0217x slower
   getter                                            17.5087+-0.2166           17.4517+-0.3705        
   global-var-const-infer-fire-from-opt               1.3479+-0.1977            1.3403+-0.1451        
   global-var-const-infer                             1.2115+-0.0864            1.1614+-0.0854          might be 1.0431x faster
   HashMap-put-get-iterate-keys                      37.9347+-0.6169     ?     38.4453+-0.8741        ? might be 1.0135x slower
   HashMap-put-get-iterate                           37.3751+-0.2714     ?     37.4517+-0.5478        ?
   HashMap-string-put-get-iterate                    43.5165+-0.5064     ?     44.0725+-2.5793        ? might be 1.0128x slower
   imul-double-only                                  10.5715+-0.3007           10.0162+-0.5781          might be 1.0554x faster
   imul-int-only                                     13.6553+-0.6768           13.0123+-0.5731          might be 1.0494x faster
   imul-mixed                                         9.7104+-0.7421     ?      9.7382+-1.0968        ?
   in-four-cases                                     21.7359+-0.3586     ?     22.0422+-0.6527        ? might be 1.0141x slower
   in-one-case-false                                 12.3218+-0.1957     ?     12.3860+-0.3081        ?
   in-one-case-true                                  12.2938+-0.3299     ?     12.3043+-0.1348        ?
   in-two-cases                                      12.5948+-0.1735     ?     12.7687+-0.3027        ? might be 1.0138x slower
   indexed-properties-in-objects                      4.3516+-0.1297            4.2625+-0.0941          might be 1.0209x faster
   infer-closure-const-then-mov-no-inline             4.8930+-0.1366     ?      4.9390+-0.1165        ?
   infer-closure-const-then-mov                      28.1350+-0.8154           28.0074+-0.4876        
   infer-closure-const-then-put-to-scope-no-inline   
                                                     18.4719+-0.3630     !     26.4289+-0.3116        ! definitely 1.4308x slower
   infer-closure-const-then-put-to-scope             29.4982+-1.0813     !     89.3005+-1.5944        ! definitely 3.0273x slower
   infer-closure-const-then-reenter-no-inline   
                                                     85.5662+-1.0545     !    127.3098+-0.4809        ! definitely 1.4879x slower
   infer-closure-const-then-reenter                  31.0850+-1.8716     !     98.4985+-24.6073       ! definitely 3.1687x slower
   infer-one-time-closure-ten-vars                   15.7407+-0.2197     ?     16.1625+-0.5016        ? might be 1.0268x slower
   infer-one-time-closure-two-vars                   14.8059+-0.5081     ?     15.3876+-0.5063        ? might be 1.0393x slower
   infer-one-time-closure                            14.8836+-0.5601     ?     15.4051+-0.4167        ? might be 1.0350x slower
   infer-one-time-deep-closure                       27.4865+-0.7895           27.4781+-0.6207        
   inline-arguments-access                            1.6883+-0.0781     !      2.9946+-0.0814        ! definitely 1.7738x slower
   inline-arguments-aliased-access                    1.8993+-0.1518     !      3.0562+-0.0818        ! definitely 1.6091x slower
   inline-arguments-local-escape                     19.3694+-0.3772     !     20.3154+-0.3566        ! definitely 1.0488x slower
   inline-get-scoped-var                              7.3472+-0.2319            7.1227+-0.4824          might be 1.0315x faster
   inlined-put-by-id-transition                      14.6092+-0.7833           14.1965+-0.1479          might be 1.0291x faster
   int-or-other-abs-then-get-by-val                   9.7665+-1.0413            9.4841+-0.3206          might be 1.0298x faster
   int-or-other-abs-zero-then-get-by-val             34.7211+-1.2687           33.7867+-0.2441          might be 1.0277x faster
   int-or-other-add-then-get-by-val                  10.9286+-0.5552           10.7180+-0.1996          might be 1.0196x faster
   int-or-other-add                                  10.7108+-0.2702     ?     10.7727+-0.1778        ?
   int-or-other-div-then-get-by-val                   6.5704+-0.2491     ?      6.5750+-0.0827        ?
   int-or-other-max-then-get-by-val                   8.7711+-0.1016     ^      7.4525+-0.1130        ^ definitely 1.1769x faster
   int-or-other-min-then-get-by-val                   7.5591+-0.1270     ?      7.5663+-0.0983        ?
   int-or-other-mod-then-get-by-val                   6.3017+-0.1431            6.2855+-0.1877        
   int-or-other-mul-then-get-by-val                   6.7657+-0.2217     ?      6.8494+-0.1130        ? might be 1.0124x slower
   int-or-other-neg-then-get-by-val                   8.3448+-0.1337            8.2550+-0.1230          might be 1.0109x faster
   int-or-other-neg-zero-then-get-by-val             33.7281+-0.2009     ?     33.7520+-0.6384        ?
   int-or-other-sub-then-get-by-val                  10.4709+-0.2668     ?     10.7724+-0.2315        ? might be 1.0288x slower
   int-or-other-sub                                   8.7563+-0.2447     !      9.5318+-0.2344        ! definitely 1.0886x slower
   int-overflow-local                                 6.5071+-0.1196     ?      6.5228+-0.2053        ?
   Int16Array-alloc-long-lived                       71.0291+-0.3624     ^     69.9531+-0.3434        ^ definitely 1.0154x faster
   Int16Array-bubble-sort-with-byteLength            46.3291+-0.3777           46.0616+-0.9958        
   Int16Array-bubble-sort                            45.8340+-1.7248           45.2162+-0.2817          might be 1.0137x faster
   Int16Array-load-int-mul                            2.0620+-0.0766     ?      2.0980+-0.0935        ? might be 1.0175x slower
   Int16Array-to-Int32Array-set                      83.9869+-1.5614     ?     84.9869+-1.1963        ? might be 1.0119x slower
   Int32Array-alloc-large                            39.4028+-1.3381           38.5523+-2.0809          might be 1.0221x faster
   Int32Array-alloc-long-lived                       78.8344+-0.5081           78.2657+-1.0937        
   Int32Array-alloc                                   4.3915+-0.0894            4.2836+-0.1381          might be 1.0252x faster
   Int32Array-Int8Array-view-alloc                   14.0590+-0.7414           14.0288+-0.7440        
   int52-spill                                       11.3666+-0.7363     !     12.5745+-0.2370        ! definitely 1.1063x slower
   Int8Array-alloc-long-lived                        65.2097+-1.6101           64.6270+-0.9344        
   Int8Array-load-with-byteLength                     5.3398+-0.1131     ?      5.3465+-0.1375        ?
   Int8Array-load                                     5.2583+-0.1037     ?      5.3652+-0.1025        ? might be 1.0203x slower
   integer-divide                                    16.2384+-0.2150     ?     16.4371+-0.4478        ? might be 1.0122x slower
   integer-modulo                                     2.8860+-0.1730     ?      2.9111+-0.0535        ?
   large-int-captured                                10.3930+-1.1162            9.6619+-0.4606          might be 1.0757x faster
   large-int-neg                                     23.4220+-0.4590     ?     23.4911+-0.3417        ?
   large-int                                         21.4116+-0.9013           20.6468+-0.6232          might be 1.0370x faster
   logical-not                                        6.6633+-0.1766     ?      6.7620+-0.1777        ? might be 1.0148x slower
   lots-of-fields                                    13.6047+-0.1900           13.6019+-0.3541        
   make-indexed-storage                               4.3539+-0.2230            4.2212+-0.4442          might be 1.0314x faster
   make-rope-cse                                      6.1815+-0.4589            6.1226+-0.2378        
   marsaglia-larger-ints                             56.3451+-0.1905     ?     56.3763+-0.2843        ?
   marsaglia-osr-entry                               30.4260+-0.9625           29.9277+-0.5548          might be 1.0167x faster
   method-on-number                                  30.0623+-1.2206     ?     30.2355+-0.8895        ?
   misc-strict-eq                                    55.8140+-0.7836     ?     56.1756+-1.1390        ?
   negative-zero-divide                               0.4725+-0.0636            0.4645+-0.0601          might be 1.0173x faster
   negative-zero-modulo                               0.4910+-0.1098     ?      0.5593+-0.0418        ? might be 1.1391x slower
   negative-zero-negate                               0.5325+-0.1382            0.5151+-0.0857          might be 1.0338x faster
   nested-function-parsing                           47.0928+-0.5043           47.0864+-0.2452        
   new-array-buffer-dead                              4.0881+-0.1327            4.0793+-0.1021        
   new-array-buffer-push                             10.4794+-0.1332           10.2825+-0.1708          might be 1.0192x faster
   new-array-dead                                    14.2155+-1.0692           13.5248+-0.3305          might be 1.0511x faster
   new-array-push                                     7.1294+-0.5348            6.9947+-0.3798          might be 1.0193x faster
   number-test                                        4.5419+-0.1416            4.5120+-0.0660        
   object-closure-call                                8.4897+-0.1777            8.4897+-0.1441        
   object-test                                        4.7555+-0.1333     ?      4.8018+-0.1179        ?
   poly-stricteq                                     79.7697+-1.8223     ?     81.5659+-3.2448        ? might be 1.0225x slower
   polymorphic-array-call                             2.3983+-0.1807            2.3513+-0.1907          might be 1.0200x faster
   polymorphic-get-by-id                              4.6652+-0.2317            4.6365+-0.0828        
   polymorphic-put-by-id                             85.4098+-50.4230    ?     93.7911+-59.1560       ? might be 1.0981x slower
   polymorphic-structure                             29.4047+-0.8182     ?     29.4144+-0.6672        ?
   polyvariant-monomorphic-get-by-id                 12.8087+-0.1850     ?     12.8325+-0.2743        ?
   proto-getter-access                               31.5098+-0.2835     ?     31.7770+-0.4131        ?
   put-by-id                                         19.4623+-0.5660           19.4533+-0.4429        
   put-by-val-large-index-blank-indexing-type   
                                                     10.2538+-0.3554     ?     10.4426+-0.2774        ? might be 1.0184x slower
   put-by-val-machine-int                             3.5144+-0.0547            3.4102+-0.3020          might be 1.0306x faster
   rare-osr-exit-on-local                            21.1505+-1.0930           20.8011+-0.1631          might be 1.0168x faster
   register-pressure-from-osr                        30.1984+-0.7296           30.0203+-0.4136        
   setter                                            19.8678+-0.8121           19.6318+-0.1786          might be 1.0120x faster
   simple-activation-demo                            33.8174+-0.4198           33.6327+-0.6298        
   simple-getter-access                              49.1508+-0.2161     !     51.5257+-1.0152        ! definitely 1.0483x slower
   slow-array-profile-convergence                     4.4039+-0.3819     ?      4.4262+-0.1934        ?
   slow-convergence                                   4.7617+-0.1606     ?      4.9006+-0.1496        ? might be 1.0292x slower
   sparse-conditional                                 1.5641+-0.1049     ?      1.5737+-0.0673        ?
   splice-to-remove                                  74.6746+-0.6093     ?     75.2182+-1.5301        ?
   string-char-code-at                               24.9584+-0.4459     !     30.3880+-1.1227        ! definitely 1.2175x slower
   string-concat-object                               2.9935+-0.4033            2.7235+-0.0316          might be 1.0991x faster
   string-concat-pair-object                          2.6059+-0.0499     ?      2.7677+-0.1952        ? might be 1.0621x slower
   string-concat-pair-simple                         17.4865+-0.3764           17.4315+-0.3144        
   string-concat-simple                              17.7873+-0.4523           17.6387+-0.2793        
   string-cons-repeat                                11.6436+-0.3814     ?     11.6874+-0.5462        ?
   string-cons-tower                                 10.6057+-0.4757     ?     10.9050+-0.5503        ? might be 1.0282x slower
   string-equality                                   42.2438+-0.5343     ?     43.5516+-0.9038        ? might be 1.0310x slower
   string-get-by-val-big-char                        13.4163+-1.2326           13.3007+-0.6375        
   string-get-by-val-out-of-bounds-insane             6.4545+-0.7393            6.0129+-0.0955          might be 1.0734x faster
   string-get-by-val-out-of-bounds                    6.9185+-0.0931            6.8848+-0.1355        
   string-get-by-val                                  5.3950+-0.0481            5.3910+-0.0920        
   string-hash                                        3.0168+-0.0589     !      3.1777+-0.0996        ! definitely 1.0533x slower
   string-long-ident-equality                        37.7850+-1.2317     ?     38.5128+-0.5557        ? might be 1.0193x slower
   string-repeat-arith                               45.1643+-0.8823     ?     45.2589+-0.5554        ?
   string-sub                                        90.6378+-1.3037           89.8120+-0.5183        
   string-test                                        4.4271+-0.0965     ?      4.5472+-0.0834        ? might be 1.0271x slower
   string-var-equality                               69.2932+-0.7696           69.2572+-1.5123        
   structure-hoist-over-transitions                   3.7723+-0.2092            3.7150+-0.2729          might be 1.0154x faster
   switch-char-constant                               3.5953+-0.0594            3.5768+-0.1251        
   switch-char                                        8.9301+-0.0849     ?      8.9450+-0.1050        ?
   switch-constant                                   11.2811+-0.1307           11.2540+-0.0809        
   switch-string-basic-big-var                       25.4135+-1.5465           24.3307+-3.8757          might be 1.0445x faster
   switch-string-basic-big                           25.1330+-6.1588     ?     28.5273+-8.7980        ? might be 1.1351x slower
   switch-string-basic-var                           31.1096+-0.6092           30.4557+-1.6280          might be 1.0215x faster
   switch-string-basic                               24.4887+-5.4891     ?     26.2252+-1.9563        ? might be 1.0709x slower
   switch-string-big-length-tower-var                28.6133+-0.5711     ?     29.0167+-0.5769        ? might be 1.0141x slower
   switch-string-length-tower-var                    23.0243+-0.4811           22.8272+-0.8279        
   switch-string-length-tower                        17.6232+-1.1742           17.4654+-0.4167        
   switch-string-short                               17.2228+-0.4194     ?     17.6193+-0.3109        ? might be 1.0230x slower
   switch                                            15.4624+-0.3256     ?     15.5522+-0.2288        ?
   tear-off-arguments-simple                          2.6891+-0.0871            2.6056+-0.1840          might be 1.0320x faster
   tear-off-arguments                                 3.8938+-0.0190     ?      3.9322+-0.0477        ?
   temporal-structure                                14.9877+-0.4561     !     16.8427+-0.5870        ! definitely 1.1238x slower
   to-int32-boolean                                  23.2543+-0.5554     ?     23.3248+-0.2048        ?
   undefined-test                                     4.9802+-0.7755            4.6913+-0.1375          might be 1.0616x faster
   unprofiled-licm                                   30.1825+-1.5997           30.0535+-1.1346        
   weird-inlining-const-prop                          2.5686+-0.1604     ?      2.5983+-0.1234        ? might be 1.0115x slower

   <arithmetic>                                      22.1623+-0.1351     !     23.0766+-0.4006        ! definitely 1.0413x slower
   <geometric> *                                     11.4755+-0.0256     !     11.7756+-0.0769        ! definitely 1.0261x slower
   <harmonic>                                         5.5595+-0.0437     !      5.7096+-0.0911        ! definitely 1.0270x slower

                                                          Conf#1                    Conf#2                                      
AsmBench:
   bigfib.cpp                                       799.3931+-7.6966     ?    804.1427+-10.7156       ?
   cray.c                                           818.7056+-4.7348          816.1562+-5.9460        
   dry.c                                            752.0370+-72.1259    ?    769.0327+-59.8027       ? might be 1.0226x slower
   FloatMM.c                                       1057.0609+-6.6257         1054.4727+-0.6323        
   gcc-loops.cpp                                   7167.2107+-161.9924       7123.6832+-37.3784       
   n-body.c                                        1924.8619+-5.4875     ?   1925.8546+-2.6077        ?
   Quicksort.c                                      646.6255+-1.1430          642.5638+-12.0471       
   stepanov_container.cpp                          5680.4355+-138.4362       5657.7018+-22.0248       
   Towers.c                                         472.5874+-2.3284          471.6799+-1.5571        

   <arithmetic>                                    2146.5464+-21.7027        2140.5875+-4.7127          might be 1.0028x faster
   <geometric> *                                   1323.2878+-14.6436    ?   1324.0766+-11.4450       ? might be 1.0006x slower
   <harmonic>                                       973.0885+-14.0741    ?    974.8129+-11.5385       ? might be 1.0018x slower

                                                          Conf#1                    Conf#2                                      
All benchmarks:
   <arithmetic>                                     172.2293+-0.4821     ?    172.6826+-0.4129        ? might be 1.0026x slower
   <geometric>                                       19.7934+-0.0156     !     20.1314+-0.0800        ! definitely 1.0171x slower
   <harmonic>                                         4.8054+-0.0271     ?      4.8736+-0.0576        ? might be 1.0142x slower

                                                          Conf#1                    Conf#2                                      
Geomean of preferred means:
   <scaled-result>                                   78.5806+-0.2743     ?     78.8087+-0.2640        ? might be 1.0029x slower

[Mark Hahnenberg]

Comment on attachment 230950 [details]
the patch.

r=me to fwiw

[Mark Hahnenberg]

too* :-/

[Geoffrey Garen]

These look like a real regression -- as if the VariableWatchpointSet is failing to infer a constant where it used to succeed:

   infer-closure-const-then-put-to-scope-no-inline   18.4719+-0.3630     !     26.4289+-0.3116        ! definitely 1.4308x slower
   infer-closure-const-then-put-to-scope                   29.4982+-1.0813     !     89.3005+-1.5944        ! definitely 3.0273x slower
   infer-closure-const-then-reenter-no-inline             85.5662+-1.0545     !    127.3098+-0.4809        ! definitely 1.4879x slower
   infer-closure-const-then-reenter                             31.0850+-1.8716     !     98.4985+-24.6073       ! definitely 3.1687x slower

[Mark Lam]

(In reply to comment #14)
> These look like a real regression -- as if the VariableWatchpointSet is failing to infer a constant where it used to succeed:
> 
>    infer-closure-const-then-put-to-scope-no-inline   18.4719+-0.3630     !     26.4289+-0.3116        ! definitely 1.4308x slower
>    infer-closure-const-then-put-to-scope                   29.4982+-1.0813     !     89.3005+-1.5944        ! definitely 3.0273x slower
>    infer-closure-const-then-reenter-no-inline             85.5662+-1.0545     !    127.3098+-0.4809        ! definitely 1.4879x slower
>    infer-closure-const-then-reenter                             31.0850+-1.8716     !     98.4985+-24.6073       ! definitely 3.1687x slower

It’s not failing to infer constants.  The regression is because we took out the optimization that checks for writing the same value.  Adding a counter to track how many times the DFG slow path is called, shows that infer-closure-const-then-put-to-scope was calling the slow path like 3 million times per run of the benchmark.  Presumably, the other benchmarks behaved similarly.  I did a quick test change to add back that value equivalence check optimization in the DFG generated code, and with that, the regression went away.  I’ll implement a more rigorous fix tomorrow and redo the tests.

[Mark Lam]

Created attachment 231012 [details]
patch 2: don't call the 

This patch has passed the jsc tests and layout tests on x86_64.  It has also passed the jsc tests on 32-bit x86.  Performance results are a wash in aggregate though some individual test components did seem to show some consistent differences across 3 runs of the perf test.  I will upload perf results shortly after this.

Note: I need to rerun this updated test against the original dromaeo crash issue in this bug to ensure that the fix is still effective.

[Mark Lam]

Created attachment 231013 [details]
perf-run 1

[Mark Lam]

Created attachment 231014 [details]
perf-run 2

[Mark Lam]

Created attachment 231015 [details]
perf-run 3

[Mark Lam]

In the 3 set of perf results that I've just uploaded, the results show no significant perf difference in aggregate.

However, all 3 set of results consistently show the following differences (in approximately the same amount of difference in perf results): 
 
   asmjs_bool_bug                                    10.4389+-0.3607     ^      9.5516+-0.2003        ^ definitely 1.0929x faster
   Float32Array-to-Float64Array-set                  83.1491+-1.1323     !     88.9993+-2.8888        ! definitely 1.0704x slower
   function-dot-apply                                 2.1975+-0.0733     ^      1.8278+-0.0814        ^ definitely 1.2023x faster
   infer-closure-const-then-put-to-scope-no-inline   
                                                     18.5222+-0.7751     ^     16.8975+-0.3315        ^ definitely 1.0961x faster
   infer-closure-const-then-reenter-no-inline   
                                                     85.2867+-1.0562     ^     73.9457+-0.5822        ^ definitely 1.1534x faster
   int-or-other-max-then-get-by-val                   8.8130+-0.0650     ^      7.5538+-0.1662        ^ definitely 1.1667x faster
   int-or-other-sub-then-get-by-val                  10.5041+-0.1474     !     11.0717+-0.1680        ! definitely 1.0540x slower
   int-or-other-sub                                   8.8774+-0.1046     !      9.4892+-0.1166        ! definitely 1.0689x slower
   Int16Array-alloc-long-lived                       71.8928+-1.5212     ^     69.3307+-0.3483        ^ definitely 1.0370x faster
   temporal-structure                                15.2799+-0.5182     !     18.5397+-0.3622        ! definitely 1.2133x slower

[Geoffrey Garen]

Comment on attachment 231012 [details]
patch 2: don't call the 

r=me

[Mark Lam]

Thanks.  I've run 10 iterations of the Dromaeo/cssquery-dojo.html test so far and have not seen a crash.  Without the fix, I would normally have seen crash by now.

The patch is landed in r168443: <http://trac.webkit.org/r168443>

[Mark Lam]

FYI, I've completed 100 runs of Dromaeo/cssquery-dojo.html with no crashes.