Bug 133356 – Assertion failure at JSC::Structure::checkOffsetConsistency() const + 234 (StructureInlines.h:242)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

This causes js/primitive-property-access-edge-cases.html to be flaky and crash sometimes.

See:
http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK1%20(Tests)/r169424%20(14130)/results.html
http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK1%20(Tests)/r169424%20(14130)/js/primitive-property-access-edge-cases-crash-log.txt.

The crash backtrace:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000108dc623a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.JavaScriptCore      	0x0000000108604eca JSC::Structure::checkOffsetConsistency() const + 234 (StructureInlines.h:242)
2   com.apple.JavaScriptCore      	0x0000000108d46853 JSC::Structure::materializePropertyMap(JSC::VM&) + 867 (Structure.cpp:317)
3   com.apple.JavaScriptCore      	0x00000001086c60c4 JSC::Structure::materializePropertyMapIfNecessary(JSC::VM&, JSC::DeferGC&) + 292 (Structure.h:432)
4   com.apple.JavaScriptCore      	0x0000000108d49649 JSC::Structure::get(JSC::VM&, JSC::PropertyName, unsigned int&, JSC::JSCell*&) + 217 (Structure.cpp:908)
5   com.apple.JavaScriptCore      	0x0000000108606dfd JSC::JSObject::inlineGetOwnPropertySlot(JSC::ExecState*, JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) + 93 (JSObject.h:1211)
6   com.apple.JavaScriptCore      	0x000000010860051e JSC::JSObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 94 (JSObject.h:1231)
7   com.apple.JavaScriptCore      	0x0000000108d383b0 JSC::StringObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 128 (StringObject.cpp:52)
8   com.apple.JavaScriptCore      	0x0000000108607c04 JSC::JSObject::fastGetOwnPropertySlot(JSC::ExecState*, JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) + 164 (JSObject.h:1238)
9   com.apple.JavaScriptCore      	0x00000001086079ae JSC::JSObject::getPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 110 (JSObject.h:1249)
10  com.apple.JavaScriptCore      	0x000000010862c9ed JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const + 253 (JSCJSValueInlines.h:681)
11  com.apple.JavaScriptCore      	0x0000000108a7411d operationGetByIdOptimize + 269 (JITOperations.cpp:157)
12  ???                           	0x00005d090b02f085 0 + 102293420830853
13  ???                           	0x00005d090b02e7f7 0 + 102293420828663
14  ???                           	0x00005d090b00fc4d 0 + 102293420702797
15  ???                           	0x00005d090b001fda 0 + 102293420646362
16  com.apple.JavaScriptCore      	0x0000000108bd1ba7 llint_entry + 26033
17  com.apple.JavaScriptCore      	0x0000000108bd1ba7 llint_entry + 26033
18  com.apple.JavaScriptCore      	0x0000000108bd1ba7 llint_entry + 26033
19  com.apple.JavaScriptCore      	0x0000000108bcb384 callToJavaScript + 356
20  com.apple.JavaScriptCore      	0x0000000108a6721d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47)
21  com.apple.JavaScriptCore      	0x0000000108a4b4bd JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 4733 (Interpreter.cpp:935)
22  com.apple.JavaScriptCore      	0x00000001086f01b0 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 480 (Completion.cpp:82)
23  com.apple.WebCore             	0x000000010d6d4975 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 69 (JSMainThreadExecState.h:62)
24  com.apple.WebCore             	0x000000010e041e4d WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 317 (ScriptController.cpp:149)
...

[Radar WebKit Bug Importer]

<rdar://problem/17055934>

[Alexey Proskuryakov]

ASSERTION FAILED: numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize()

[Mark Lam]

Declared js/primitive-property-access-edge-cases.html as flaky in <http://trac.webkit.org/r169454>.  Please undo once this bug is fixed.

[Mark Lam]

(In reply to comment #3)
> Declared js/primitive-property-access-edge-cases.html as flaky in <http://trac.webkit.org/r169454>.  Please undo once this bug is fixed.

Corrected the expectation to be [Pass Crash] in r169459: <http://trac.webkit.org/r169459>.

[Mark Lam]

Created attachment 232763 [details]
the patch.

This patch has passed the JSC tests and the layout tests.

[Mark Lam]

Here are the perf results:
                                                          Conf#1                    Conf#2                                      
SunSpider:
   3d-cube                                            7.6758+-0.2829     ?      7.8093+-0.8332        ? might be 1.0174x slower
   3d-morph                                           9.5602+-0.5558            9.2842+-0.3009          might be 1.0297x faster
   3d-raytrace                                       10.0385+-0.3633     ?     10.4318+-0.8708        ? might be 1.0392x slower
   access-binary-trees                                2.8033+-0.3624     ?      3.2511+-0.4080        ? might be 1.1597x slower
   access-fannkuch                                    9.3883+-0.3730     ?      9.4203+-0.3884        ?
   access-nbody                                       4.8205+-0.1591            4.7460+-0.2593          might be 1.0157x faster
   access-nsieve                                      5.8022+-0.5123            5.7777+-0.2190        
   bitops-3bit-bits-in-byte                           1.9525+-0.0912     ?      2.0358+-0.1799        ? might be 1.0427x slower
   bitops-bits-in-byte                                6.4258+-0.2564            6.2815+-0.1502          might be 1.0230x faster
   bitops-bitwise-and                                 3.1458+-0.4272     ?      3.2328+-0.0950        ? might be 1.0276x slower
   bitops-nsieve-bits                                 5.9169+-0.2048            5.8787+-0.2595        
   controlflow-recursive                              2.9981+-0.2744            2.9231+-0.3192          might be 1.0257x faster
   crypto-aes                                         6.4255+-0.1905            6.3701+-0.3408        
   crypto-md5                                         3.7275+-0.2409     ?      4.1144+-1.2146        ? might be 1.1038x slower
   crypto-sha1                                        3.6681+-0.0753     ?      3.6707+-0.3888        ?
   date-format-tofte                                 13.6455+-1.1166     ?     14.9688+-2.7256        ? might be 1.0970x slower
   date-format-xparb                                  9.3328+-0.7127     ?      9.4130+-0.4763        ?
   math-cordic                                        4.8698+-0.2273            4.8495+-0.3027        
   math-partial-sums                                 10.5707+-0.3699           10.5035+-0.6192        
   math-spectral-norm                                 3.3500+-0.1678            3.1427+-0.0744          might be 1.0660x faster
   regexp-dna                                        11.8608+-0.4181           11.5405+-0.1964          might be 1.0278x faster
   string-base64                                      6.7769+-0.9842     ?      7.2872+-0.3437        ? might be 1.0753x slower
   string-fasta                                      11.7344+-0.6594           11.2834+-0.3543          might be 1.0400x faster
   string-tagcloud                                   17.6355+-0.8040           15.8913+-1.6039          might be 1.1098x faster
   string-unpack-code                                33.7907+-1.5421     ?     34.9437+-2.4211        ? might be 1.0341x slower
   string-validate-input                              7.9498+-0.7827            7.8064+-0.8433          might be 1.0184x faster

   <arithmetic> *                                     8.3025+-0.1488     ?      8.3407+-0.1880        ? might be 1.0046x slower
   <geometric>                                        6.7172+-0.0922     ?      6.7674+-0.1476        ? might be 1.0075x slower
   <harmonic>                                         5.5576+-0.0894     ?      5.6394+-0.1751        ? might be 1.0147x slower

                                                          Conf#1                    Conf#2                                      
LongSpider:
   3d-cube                                         1363.4692+-29.5649        1360.0992+-35.3449       
   3d-morph                                        2200.8102+-59.1919        2177.9119+-61.0743         might be 1.0105x faster
   3d-raytrace                                     1452.7106+-53.2629    ?   1458.9010+-84.1236       ?
   access-binary-trees                             1902.3200+-180.4096       1845.9135+-175.7995        might be 1.0306x faster
   access-fannkuch                                  538.9900+-24.9310         519.9278+-45.7008         might be 1.0367x faster
   access-nbody                                    1227.9713+-37.8461        1221.4742+-37.4700       
   access-nsieve                                   1928.5615+-331.3353       1911.2037+-132.5335      
   bitops-3bit-bits-in-byte                          59.4903+-1.2167           58.7163+-2.1304          might be 1.0132x faster
   bitops-bits-in-byte                              377.9657+-4.2543     ?    384.3466+-16.7827       ? might be 1.0169x slower
   bitops-nsieve-bits                              1234.7872+-131.5290       1178.7343+-72.9358         might be 1.0476x faster
   controlflow-recursive                            834.5144+-20.8909    ?    851.3480+-24.8212       ? might be 1.0202x slower
   crypto-aes                                      1201.1626+-14.2309        1181.5767+-24.5228         might be 1.0166x faster
   crypto-md5                                      1072.6472+-55.7412    ?   1073.1192+-68.8354       ?
   crypto-sha1                                     1148.7267+-53.5988    ?   1151.8065+-43.6541       ?
   date-format-tofte                               1249.5334+-45.6547        1191.8867+-74.9449         might be 1.0484x faster
   date-format-xparb                               1609.3623+-108.8585       1598.8677+-55.1423       
   math-cordic                                      827.3528+-23.1785         823.9123+-24.6454       
   math-partial-sums                               1236.5170+-31.7352    ?   1239.0373+-40.7250       ?
   math-spectral-norm                              1277.0692+-44.9306        1252.7448+-27.0247         might be 1.0194x faster
   string-base64                                    626.9760+-36.7954         618.0417+-57.1514         might be 1.0145x faster
   string-fasta                                    1096.3477+-16.5854        1087.1813+-29.1451       
   string-tagcloud                                  396.9557+-18.7330         390.4305+-19.5780         might be 1.0167x faster

   <arithmetic>                                    1130.1928+-24.4544        1117.1446+-8.8758          might be 1.0117x faster
   <geometric> *                                    940.1942+-15.5984         930.0697+-5.5126          might be 1.0109x faster
   <harmonic>                                       564.7473+-6.0798          558.4238+-7.2547          might be 1.0113x faster

                                                          Conf#1                    Conf#2                                      
V8Spider:
   crypto                                            85.2290+-2.3279     ?     85.4970+-4.3695        ?
   deltablue                                        104.3741+-10.8935         101.5805+-1.6064          might be 1.0275x faster
   earley-boyer                                      72.4753+-2.6129     ?     73.1296+-5.2393        ?
   raytrace                                          46.7830+-2.5874           46.3032+-3.7839          might be 1.0104x faster
   regexp                                           103.4971+-6.5607     ?    105.1146+-8.0362        ? might be 1.0156x slower
   richards                                         105.4800+-4.7508          103.6182+-5.1368          might be 1.0180x faster
   splay                                             58.9835+-6.6264           58.2898+-8.2738          might be 1.0119x faster

   <arithmetic>                                      82.4031+-1.7170           81.9333+-2.6006          might be 1.0057x faster
   <geometric> *                                     79.0748+-1.7649           78.6217+-2.6408          might be 1.0058x faster
   <harmonic>                                        75.5071+-1.9842           75.0228+-2.7742          might be 1.0065x faster

                                                          Conf#1                    Conf#2                                      
Octane:
   encrypt                                           0.43744+-0.01330          0.43545+-0.01702       
   decrypt                                           7.90888+-0.29070          7.88005+-0.39884       
   deltablue                                x2       0.43633+-0.01642    ?     0.44235+-0.00521       ? might be 1.0138x slower
   earley                                            0.95340+-0.05864    ?     0.96068+-0.04748       ?
   boyer                                            11.11037+-0.29158    ?    11.25531+-0.47150       ? might be 1.0130x slower
   navier-stokes                            x2       7.59547+-0.27920    ?     7.60737+-0.26970       ?
   raytrace                                 x2       3.10482+-0.07834          3.05742+-0.18369         might be 1.0155x faster
   richards                                 x2       0.22440+-0.01368          0.22228+-0.00988       
   splay                                    x2       0.74399+-0.11409          0.74023+-0.04457       
   regexp                                   x2      67.69771+-2.28641    ?    68.04937+-2.49421       ?
   pdfjs                                    x2      96.65246+-8.29490    ?    99.66998+-6.06001       ? might be 1.0312x slower
   mandreel                                 x2     102.73525+-1.72686    ?   103.55393+-4.15534       ?
   gbemu                                    x2      70.14644+-3.72049    ?    73.18794+-4.23470       ? might be 1.0434x slower
   closure                                           0.88428+-0.03763    ?     0.89790+-0.03119       ? might be 1.0154x slower
   jquery                                           11.13645+-0.93463    ?    11.50981+-0.64001       ? might be 1.0335x slower
   box2d                                    x2      28.64422+-1.68790         28.60846+-1.68475       
   zlib                                     x2     782.63141+-27.91947       772.45514+-60.87699        might be 1.0132x faster
   typescript                               x2    1286.20795+-89.34885   ?  1315.08777+-90.34050      ? might be 1.0225x slower

   <arithmetic>                                    164.20239+-5.39989    ?   165.94346+-5.87918       ? might be 1.0106x slower
   <geometric> *                                    12.86980+-0.23011    ?    12.96610+-0.08330       ? might be 1.0075x slower
   <harmonic>                                        1.35988+-0.05058          1.35919+-0.02081         might be 1.0005x faster

                                                          Conf#1                    Conf#2                                      
Kraken:
   ai-astar                                          560.363+-17.988           550.224+-14.522          might be 1.0184x faster
   audio-beat-detection                              214.628+-13.087     ?     215.629+-12.857        ?
   audio-dft                                         372.061+-25.473     ^     266.659+-36.269        ^ definitely 1.3953x faster
   audio-fft                                         135.017+-3.089            134.980+-3.993         
   audio-oscillator                                  379.454+-12.844           377.508+-9.727         
   imaging-darkroom                                  288.306+-10.526     ?     295.947+-17.872        ? might be 1.0265x slower
   imaging-desaturate                                125.442+-2.958            123.336+-2.106           might be 1.0171x faster
   imaging-gaussian-blur                             199.489+-1.313            195.868+-5.771           might be 1.0185x faster
   json-parse-financial                               80.859+-3.209      ?      82.490+-1.978         ? might be 1.0202x slower
   json-stringify-tinderbox                          107.398+-5.055            106.917+-6.579         
   stanford-crypto-aes                                95.524+-4.772             93.709+-6.681           might be 1.0194x faster
   stanford-crypto-ccm                                93.895+-19.796            87.521+-21.178          might be 1.0728x faster
   stanford-crypto-pbkdf2                            245.184+-5.538      ?     246.729+-6.542         ?
   stanford-crypto-sha256-iterative                   88.785+-4.197             85.214+-2.783           might be 1.0419x faster

   <arithmetic> *                                    213.315+-3.696      ^     204.481+-2.670         ^ definitely 1.0432x faster
   <geometric>                                       176.194+-3.360            170.331+-3.495           might be 1.0344x faster
   <harmonic>                                        149.047+-3.842            145.182+-4.487           might be 1.0266x faster

                                                          Conf#1                    Conf#2                                      
JSRegress:
   abs-boolean                                        5.3029+-0.1841     ?      5.3724+-0.1693        ? might be 1.0131x slower
   adapt-to-double-divide                            20.2910+-0.8655           20.1403+-0.9032        
   aliased-arguments-getbyval                         1.3195+-0.2377            1.2048+-0.0865          might be 1.0952x faster
   allocate-big-object                                4.1301+-1.2169            3.9880+-1.2788          might be 1.0356x faster
   arity-mismatch-inlining                            1.1738+-0.0835     ?      1.2963+-0.3589        ? might be 1.1044x slower
   array-access-polymorphic-structure                11.0485+-0.5341     ?     11.1607+-1.0572        ? might be 1.0102x slower
   array-nonarray-polymorhpic-access                 62.2576+-1.7899     ?     62.9814+-1.8185        ? might be 1.0116x slower
   array-prototype-every                            131.2160+-2.5915          128.2362+-4.5137          might be 1.0232x faster
   array-prototype-forEach                          126.0688+-2.4921          125.6247+-4.4335        
   array-prototype-map                              154.1981+-8.9514     ?    158.0093+-2.7974        ? might be 1.0247x slower
   array-prototype-some                             124.9353+-1.4089          124.8405+-3.7430        
   array-splice-contiguous                           68.1807+-1.9426     ?     69.4335+-5.2685        ? might be 1.0184x slower
   array-with-double-add                              6.7755+-0.3425     ?      6.7966+-0.3080        ?
   array-with-double-increment                        4.6190+-0.1808     ?      4.7286+-0.3591        ? might be 1.0237x slower
   array-with-double-mul-add                          7.6332+-0.3199     ?      7.7524+-0.0791        ? might be 1.0156x slower
   array-with-double-sum                              5.1136+-0.3047            4.9720+-0.2612          might be 1.0285x faster
   array-with-int32-add-sub                          11.8229+-0.3401     ?     11.8261+-0.1602        ?
   array-with-int32-or-double-sum                     5.1572+-0.1449            5.0190+-0.1809          might be 1.0275x faster
   ArrayBuffer-DataView-alloc-large-long-lived   
                                                    125.9213+-12.3356    ?    127.5858+-5.9731        ? might be 1.0132x slower
   ArrayBuffer-DataView-alloc-long-lived             34.3591+-1.6401     ?     36.0496+-1.9970        ? might be 1.0492x slower
   ArrayBuffer-Int32Array-byteOffset                  5.3415+-0.4346            5.3403+-0.1617        
   ArrayBuffer-Int8Array-alloc-large-long-lived   
                                                    128.4739+-15.4031         127.3635+-6.0669        
   ArrayBuffer-Int8Array-alloc-long-lived-buffer   
                                                     57.9390+-3.5195           56.8052+-1.5243          might be 1.0200x faster
   ArrayBuffer-Int8Array-alloc-long-lived            30.7320+-1.9773     ?     31.2244+-2.9608        ? might be 1.0160x slower
   ArrayBuffer-Int8Array-alloc                       27.7119+-1.2832     ?     28.9647+-3.5069        ? might be 1.0452x slower
   asmjs_bool_bug                                    10.2417+-0.5025     ?     10.3556+-0.3194        ? might be 1.0111x slower
   assign-custom-setter-polymorphic                   4.9314+-0.2038            4.8875+-0.2318        
   assign-custom-setter                               6.7968+-0.5674            6.6953+-0.1608          might be 1.0152x faster
   basic-set                                         15.6735+-0.6328     !     17.4927+-0.6392        ! definitely 1.1161x slower
   big-int-mul                                        6.3817+-0.5604            6.3467+-0.3498        
   boolean-test                                       4.7720+-0.2004            4.7195+-0.1989          might be 1.0111x faster
   branch-fold                                        5.2257+-0.2059            5.1121+-0.1718          might be 1.0222x faster
   by-val-generic                                    14.5858+-0.6364     ?     14.7253+-1.6211        ?
   call-spread-apply                                 20.6047+-1.2532     ?     21.3599+-1.6191        ? might be 1.0367x slower
   call-spread-call                                   8.7717+-0.3141     ?      8.9935+-0.4091        ? might be 1.0253x slower
   captured-assignments                               0.6090+-0.1543     ?      0.6744+-0.2164        ? might be 1.1073x slower
   cast-int-to-double                                12.6562+-0.2247     ?     12.8856+-0.2913        ? might be 1.0181x slower
   cell-argument                                     10.9622+-0.6075     ?     11.2543+-0.2302        ? might be 1.0266x slower
   cfg-simplify                                       4.2393+-0.0941     ?      4.2740+-0.1675        ?
   chain-getter-access                               32.0747+-0.9211     ?     32.1693+-0.6612        ?
   cmpeq-obj-to-obj-other                            13.1130+-1.0986           13.0383+-0.2236        
   constant-test                                      8.5865+-0.2316     ?      8.8285+-0.2035        ? might be 1.0282x slower
   DataView-custom-properties                       131.1437+-9.7624          128.6348+-12.5230         might be 1.0195x faster
   delay-tear-off-arguments-strictmode                3.9030+-0.1315            3.7648+-0.1285          might be 1.0367x faster
   destructuring-arguments                            8.9213+-0.2965     ?      9.0786+-0.2909        ? might be 1.0176x slower
   destructuring-swap                                 9.0170+-0.4459            8.8306+-0.2061          might be 1.0211x faster
   direct-arguments-getbyval                          1.3516+-0.0688            1.2532+-0.2945          might be 1.0785x faster
   div-boolean-double                                 6.3477+-0.2572     ?      6.3702+-0.1539        ?
   div-boolean                                       11.5569+-0.4645           11.4571+-0.2575        
   double-get-by-val-out-of-bounds                    6.6640+-0.3410     ?      7.0280+-0.8331        ? might be 1.0546x slower
   double-pollution-getbyval                         11.3032+-0.4037           11.1334+-0.1007          might be 1.0153x faster
   double-pollution-putbyoffset                       6.7478+-1.3323            6.4629+-0.8782          might be 1.0441x faster
   double-to-int32-typed-array-no-inline              3.1142+-0.2706            3.0736+-0.1785          might be 1.0132x faster
   double-to-int32-typed-array                        2.6921+-0.3144            2.5944+-0.2893          might be 1.0376x faster
   double-to-uint32-typed-array-no-inline             3.3549+-0.2735            3.1297+-0.1050          might be 1.0720x faster
   double-to-uint32-typed-array                       2.8552+-0.1271            2.8467+-0.2468        
   empty-string-plus-int                             10.4762+-0.9147     ?     11.2012+-0.9858        ? might be 1.0692x slower
   emscripten-cube2hash                              57.0391+-4.7314           55.7321+-2.7186          might be 1.0235x faster
   external-arguments-getbyval                        2.2790+-0.1644     ?      2.4577+-0.1667        ? might be 1.0784x slower
   external-arguments-putbyval                        3.1782+-0.7235     ?      3.4443+-0.5739        ? might be 1.0837x slower
   fixed-typed-array-storage-var-index                1.6781+-0.1446     ?      1.7352+-0.2950        ? might be 1.0340x slower
   fixed-typed-array-storage                          1.1757+-0.1455     ?      1.2761+-0.2042        ? might be 1.0854x slower
   Float32Array-matrix-mult                           7.7477+-0.2880     ?      7.9578+-0.2301        ? might be 1.0271x slower
   Float32Array-to-Float64Array-set                  88.7687+-3.6097           87.3907+-2.2501          might be 1.0158x faster
   Float64Array-alloc-long-lived                    123.9927+-7.0652          113.0915+-17.2853         might be 1.0964x faster
   Float64Array-to-Int16Array-set                   113.2252+-4.6138     ?    114.2654+-4.5831        ?
   fold-double-to-int                                19.5590+-0.4316     !     26.5398+-0.8806        ! definitely 1.3569x slower
   for-of-iterate-array-entries                      10.1607+-1.1984     ?     10.2630+-0.7442        ? might be 1.0101x slower
   for-of-iterate-array-keys                          4.3875+-0.4750            3.9055+-0.3443          might be 1.1234x faster
   for-of-iterate-array-values                        3.9447+-0.2455            3.5635+-0.3041          might be 1.1070x faster
   fround                                            25.0003+-1.3386           24.2112+-2.0207          might be 1.0326x faster
   function-dot-apply                                 2.1831+-0.1068     ^      1.8540+-0.0995        ^ definitely 1.1775x faster
   function-test                                      5.0759+-0.1895            5.0132+-0.2752          might be 1.0125x faster
   function-with-eval                                44.9664+-2.4278           42.9635+-1.2390          might be 1.0466x faster
   get-by-id-chain-from-try-block                     8.3142+-0.2266            8.1642+-0.3356          might be 1.0184x faster
   get-by-id-proto-or-self                           23.9388+-1.5530     ?     24.8692+-0.8164        ? might be 1.0389x slower
   get-by-id-self-or-proto                           24.4667+-1.2449     ?     26.5050+-4.0040        ? might be 1.0833x slower
   get-by-val-out-of-bounds                           6.8075+-0.6037     ?      6.8595+-0.1713        ?
   get_callee_monomorphic                             6.0641+-1.4194            6.0040+-1.3638          might be 1.0100x faster
   get_callee_polymorphic                             5.2872+-0.7486     ?      5.6008+-0.6431        ? might be 1.0593x slower
   getter                                            18.2237+-0.6499           17.7967+-0.6650          might be 1.0240x faster
   global-var-const-infer-fire-from-opt               1.3915+-0.3197     ?      1.4939+-0.2908        ? might be 1.0736x slower
   global-var-const-infer                             1.1424+-0.1996     ?      1.1805+-0.1045        ? might be 1.0334x slower
   HashMap-put-get-iterate-keys                      39.5582+-1.7469     ?     40.0130+-1.5241        ? might be 1.0115x slower
   HashMap-put-get-iterate                           40.5280+-2.3448           39.7251+-1.2539          might be 1.0202x faster
   HashMap-string-put-get-iterate                    47.2607+-4.2066           46.0959+-4.3478          might be 1.0253x faster
   imul-double-only                                  11.4341+-1.5658           10.9482+-1.0111          might be 1.0444x faster
   imul-int-only                                     13.5126+-1.1189     ?     13.7590+-0.8199        ? might be 1.0182x slower
   imul-mixed                                        10.2897+-1.4164     ?     10.8368+-0.3566        ? might be 1.0532x slower
   in-four-cases                                     22.4727+-0.7416     ?     22.9611+-0.7274        ? might be 1.0217x slower
   in-one-case-false                                 12.6928+-0.5456     ?     12.6953+-0.3465        ?
   in-one-case-true                                  12.5855+-0.5419     ?     12.6163+-0.3325        ?
   in-two-cases                                      12.8969+-0.3818     ?     13.0817+-0.2134        ? might be 1.0143x slower
   indexed-properties-in-objects                      4.6190+-0.1420            4.4064+-0.0863          might be 1.0482x faster
   infer-closure-const-then-mov-no-inline             5.2912+-0.2200     ?      5.3667+-0.4815        ? might be 1.0143x slower
   infer-closure-const-then-mov                      29.4344+-0.7921           29.2222+-0.0798        
   infer-closure-const-then-put-to-scope-no-inline   
                                                     17.7901+-0.1717           17.5663+-0.3919          might be 1.0127x faster
   infer-closure-const-then-put-to-scope             32.8831+-1.0319     ?     33.2209+-0.9231        ? might be 1.0103x slower
   infer-closure-const-then-reenter-no-inline   
                                                     75.4556+-2.3415     ?     75.5199+-1.2116        ?
   infer-closure-const-then-reenter                  32.8000+-0.9397           32.5042+-0.5799        
   infer-one-time-closure-ten-vars                   16.4172+-0.6588     ?     16.6565+-0.5263        ? might be 1.0146x slower
   infer-one-time-closure-two-vars                   15.7888+-1.0722           15.7470+-1.2549        
   infer-one-time-closure                            15.4858+-0.4944     ?     15.6072+-1.3990        ?
   infer-one-time-deep-closure                       28.0881+-0.7353     ?     28.4828+-0.8687        ? might be 1.0141x slower
   inline-arguments-access                            1.7838+-0.1676     ?      1.8015+-0.3394        ?
   inline-arguments-aliased-access                    2.1113+-0.3341            2.0153+-0.2858          might be 1.0476x faster
   inline-arguments-local-escape                     20.6606+-1.7516           20.3068+-1.2343          might be 1.0174x faster
   inline-get-scoped-var                              6.5948+-0.1474     ?      6.6330+-0.1415        ?
   inlined-put-by-id-transition                      17.6805+-3.3922     ?     18.9510+-1.9752        ? might be 1.0719x slower
   int-or-other-abs-then-get-by-val                   9.6387+-0.3774     ?      9.6569+-0.1113        ?
   int-or-other-abs-zero-then-get-by-val             33.1549+-1.4367           32.8996+-0.3943        
   int-or-other-add-then-get-by-val                  10.8974+-0.2788     ?     11.0462+-0.2692        ? might be 1.0137x slower
   int-or-other-add                                  11.1516+-0.1896           11.0477+-0.4761        
   int-or-other-div-then-get-by-val                   6.8044+-0.3617     ?      6.8268+-0.1321        ?
   int-or-other-max-then-get-by-val                   7.8262+-0.5478     ?      7.8475+-0.3255        ?
   int-or-other-min-then-get-by-val                   7.6660+-0.1285     ^      7.5002+-0.0248        ^ definitely 1.0221x faster
   int-or-other-mod-then-get-by-val                   7.2241+-2.0801            7.1630+-1.5930        
   int-or-other-mul-then-get-by-val                   6.8137+-0.2023     ?      6.9348+-0.0817        ? might be 1.0178x slower
   int-or-other-neg-then-get-by-val                   8.5050+-0.2346            8.4460+-0.1508        
   int-or-other-neg-zero-then-get-by-val             33.5958+-1.8910           31.9020+-0.5480          might be 1.0531x faster
   int-or-other-sub-then-get-by-val                  11.3694+-0.2425     ?     11.4838+-0.2375        ? might be 1.0101x slower
   int-or-other-sub                                   9.8135+-0.2547            9.7766+-0.4709        
   int-overflow-local                                 6.8035+-0.2366            6.5674+-0.1600          might be 1.0359x faster
   Int16Array-alloc-long-lived                       84.7465+-4.8537           79.8777+-8.2757          might be 1.0610x faster
   Int16Array-bubble-sort-with-byteLength            47.6054+-0.9034           47.0591+-3.4243          might be 1.0116x faster
   Int16Array-bubble-sort                            47.0056+-2.8387     ?     47.0141+-0.8042        ?
   Int16Array-load-int-mul                            2.1720+-0.1695     ?      2.3075+-0.2963        ? might be 1.0624x slower
   Int16Array-to-Int32Array-set                      82.3089+-3.4334     ?     83.4912+-3.1336        ? might be 1.0144x slower
   Int32Array-alloc-large                            57.7275+-9.8134     ?     64.5662+-1.6429        ? might be 1.1185x slower
   Int32Array-alloc-long-lived                       95.3062+-12.7665          93.1479+-12.8945         might be 1.0232x faster
   Int32Array-alloc                                   5.1612+-0.9962     ?      5.6460+-0.8742        ? might be 1.0939x slower
   Int32Array-Int8Array-view-alloc                   16.9727+-1.4727     ?     17.9792+-0.7123        ? might be 1.0593x slower
   int52-spill                                       11.2777+-0.6203     ?     11.2842+-0.6646        ?
   Int8Array-alloc-long-lived                        75.3700+-5.3400           72.8400+-5.0274          might be 1.0347x faster
   Int8Array-load-with-byteLength                     5.4902+-0.1036     ?      5.5422+-0.1453        ?
   Int8Array-load                                     5.4784+-0.2550     ?      5.4863+-0.1957        ?
   integer-divide                                    16.9575+-0.0854           16.7045+-0.4798          might be 1.0151x faster
   integer-modulo                                     3.1978+-0.0668            3.0948+-0.2612          might be 1.0333x faster
   large-int-captured                                11.6662+-1.1132           10.7358+-1.7085          might be 1.0867x faster
   large-int-neg                                     23.8705+-0.5352     ?     24.8070+-2.2478        ? might be 1.0392x slower
   large-int                                         21.3873+-0.8562           21.0898+-0.3169          might be 1.0141x faster
   logical-not                                        6.8604+-0.2619            6.8417+-0.2198        
   lots-of-fields                                    16.5435+-0.9786           15.4993+-1.4554          might be 1.0674x faster
   make-indexed-storage                               4.5422+-0.7789     ?      5.0680+-0.5331        ? might be 1.1157x slower
   make-rope-cse                                      7.7687+-1.5504            6.9913+-0.5677          might be 1.1112x faster
   marsaglia-larger-ints                             59.5383+-2.9270     ?     60.0661+-3.1081        ?
   marsaglia-osr-entry                               31.8362+-0.7412           31.1928+-1.3721          might be 1.0206x faster
   max-boolean                                        5.0364+-0.3502            4.9822+-0.3475          might be 1.0109x faster
   method-on-number                                  31.7434+-0.8686           30.6497+-1.9537          might be 1.0357x faster
   min-boolean                                        4.5656+-0.2243     ?      4.7244+-0.2993        ? might be 1.0348x slower
   minus-boolean-double                               4.7694+-0.2106            4.7320+-0.2491        
   minus-boolean                                      3.6983+-0.2555     ?      3.7114+-0.1626        ?
   misc-strict-eq                                    59.7135+-1.2886           59.0293+-2.0532          might be 1.0116x faster
   mod-boolean-double                                13.7410+-0.2790           13.7341+-0.3776        
   mod-boolean                                       10.3488+-0.2063     ?     10.6147+-0.1212        ? might be 1.0257x slower
   mul-boolean-double                                 5.4969+-0.1915     ?      5.6078+-0.2631        ? might be 1.0202x slower
   mul-boolean                                        4.0150+-0.1569            4.0079+-0.1669        
   neg-boolean                                        4.8952+-0.1228            4.8597+-0.2180        
   negative-zero-divide                               0.5633+-0.1895     ?      0.6121+-0.1621        ? might be 1.0866x slower
   negative-zero-modulo                               0.6472+-0.1164            0.5875+-0.1563          might be 1.1016x faster
   negative-zero-negate                               0.5542+-0.1291            0.5309+-0.1594          might be 1.0438x faster
   nested-function-parsing                           51.1905+-2.5119     ?     51.6163+-3.4386        ?
   new-array-buffer-dead                              4.3148+-0.5251            4.1309+-0.3424          might be 1.0445x faster
   new-array-buffer-push                             13.4410+-1.6674     ?     13.4442+-1.3523        ?
   new-array-dead                                    15.1098+-0.8445           15.0862+-0.5490        
   new-array-push                                     8.1160+-1.2027            7.2767+-0.6177          might be 1.1153x faster
   number-test                                        4.6978+-0.1168            4.6570+-0.2713        
   object-closure-call                                8.7441+-0.4907            8.6766+-0.5160        
   object-test                                        4.8605+-0.2371     ?      4.9904+-0.2794        ? might be 1.0267x slower
   plus-boolean-arith                                 3.6704+-0.1795     ?      3.8461+-0.3100        ? might be 1.0479x slower
   plus-boolean-double                                4.7266+-0.1537     ?      4.7530+-0.2990        ?
   plus-boolean                                       3.7678+-0.1093            3.6223+-0.2614          might be 1.0402x faster
   poly-stricteq                                     81.0771+-2.7834     ?     82.7434+-5.4841        ? might be 1.0206x slower
   polymorphic-array-call                             2.5634+-0.5702     ?      3.0041+-0.2841        ? might be 1.1719x slower
   polymorphic-get-by-id                              4.6797+-0.2052     ?      4.8693+-0.1696        ? might be 1.0405x slower
   polymorphic-put-by-id                             97.1175+-66.2383          64.1154+-12.6442         might be 1.5147x faster
   polymorphic-structure                             30.4745+-0.2326           30.3312+-0.7774        
   polyvariant-monomorphic-get-by-id                 13.1732+-0.2741     ?     13.2130+-0.5277        ?
   proto-getter-access                               33.1493+-0.1556           32.9982+-0.2014        
   put-by-id                                         25.4875+-5.6633           23.9792+-3.3976          might be 1.0629x faster
   put-by-val-large-index-blank-indexing-type   
                                                     12.3038+-1.8987           12.1073+-0.9926          might be 1.0162x faster
   put-by-val-machine-int                             3.7102+-0.7314     ?      3.9397+-0.7833        ? might be 1.0619x slower
   rare-osr-exit-on-local                            21.6300+-0.6974     ?     21.6371+-0.0725        ?
   register-pressure-from-osr                        30.9243+-0.6205     ?     31.1858+-0.1265        ?
   setter                                            20.5754+-0.2067           20.2284+-0.7172          might be 1.0172x faster
   simple-activation-demo                            34.9927+-1.7124     ?     35.1621+-0.8903        ?
   simple-getter-access                              50.4938+-2.2456     ?     52.1249+-4.3584        ? might be 1.0323x slower
   sin-boolean                                       24.4758+-2.8429     ?     24.9770+-1.6644        ? might be 1.0205x slower
   slow-array-profile-convergence                     4.3984+-0.5262            4.2360+-0.4923          might be 1.0383x faster
   slow-convergence                                   4.9499+-0.4180     ?      5.0544+-0.2205        ? might be 1.0211x slower
   sparse-conditional                                 1.6038+-0.1220     ?      1.6548+-0.2165        ? might be 1.0318x slower
   splice-to-remove                                  26.3163+-1.0174     ?     26.4495+-1.3811        ?
   string-char-code-at                               25.0896+-0.4284     ?     25.2404+-0.6596        ?
   string-concat-object                               3.5767+-1.1964            2.7910+-0.1196          might be 1.2815x faster
   string-concat-pair-object                          3.8218+-1.0358            3.5770+-1.5052          might be 1.0684x faster
   string-concat-pair-simple                         21.8845+-2.7769     ?     22.5010+-2.4573        ? might be 1.0282x slower
   string-concat-simple                              21.8534+-4.7476     ?     23.5771+-0.5487        ? might be 1.0789x slower
   string-cons-repeat                                14.9104+-1.9744           14.8358+-3.7772        
   string-cons-tower                                 13.5253+-1.3465     ?     15.1953+-1.9809        ? might be 1.1235x slower
   string-equality                                   26.4771+-0.8358           25.9532+-1.0259          might be 1.0202x faster
   string-get-by-val-big-char                        14.1156+-1.0151     ?     14.2172+-0.7937        ?
   string-get-by-val-out-of-bounds-insane             6.3358+-0.2855     ?      6.3707+-0.1577        ?
   string-get-by-val-out-of-bounds                    7.1590+-0.0622            7.1039+-0.0954        
   string-get-by-val                                  5.5657+-0.1857            5.4973+-0.2575          might be 1.0124x faster
   string-hash                                        3.2185+-0.1480     ?      3.2300+-0.1492        ?
   string-long-ident-equality                        21.2392+-0.7846     ?     21.3912+-0.8045        ?
   string-repeat-arith                               46.7794+-1.5032     ?     47.2325+-0.9186        ?
   string-sub                                        95.6171+-1.6782           94.5656+-2.7975          might be 1.0111x faster
   string-test                                        4.5732+-0.2912     ?      4.5981+-0.2548        ?
   string-var-equality                               52.3887+-0.9135           52.0975+-0.3856        
   structure-hoist-over-transitions                   3.9457+-0.6121     ?      4.2894+-0.7061        ? might be 1.0871x slower
   switch-char-constant                               3.6726+-0.2489            3.5723+-0.0969          might be 1.0281x faster
   switch-char                                        9.0833+-0.1797     ?      9.1760+-0.2168        ? might be 1.0102x slower
   switch-constant                                   14.8043+-2.3979     ?     15.6763+-0.8345        ? might be 1.0589x slower
   switch-string-basic-big-var                       24.2195+-1.7330           23.1232+-3.0632          might be 1.0474x faster
   switch-string-basic-big                           29.9672+-0.7236           27.7518+-5.5180          might be 1.0798x faster
   switch-string-basic-var                           30.3746+-1.0077     ?     30.7035+-1.2390        ? might be 1.0108x slower
   switch-string-basic                               34.1287+-1.7974           32.4469+-5.5069          might be 1.0518x faster
   switch-string-big-length-tower-var                29.6438+-0.5127     ?     30.0594+-0.2044        ? might be 1.0140x slower
   switch-string-length-tower-var                    23.3942+-0.7694           23.3727+-0.6723        
   switch-string-length-tower                        18.7759+-4.8251     ?     19.4161+-4.9764        ? might be 1.0341x slower
   switch-string-short                               18.9370+-5.5197           17.3602+-0.4110          might be 1.0908x faster
   switch                                            18.3485+-2.7915     ?     18.7390+-2.7508        ? might be 1.0213x slower
   tear-off-arguments-simple                          2.8025+-0.2648     ?      2.8445+-0.6148        ? might be 1.0150x slower
   tear-off-arguments                                 4.0220+-0.2240     ?      4.1565+-0.1354        ? might be 1.0334x slower
   temporal-structure                                19.8626+-1.7890           19.4424+-0.6420          might be 1.0216x faster
   to-int32-boolean                                  23.8640+-0.5261           23.7631+-0.7864        
   undefined-test                                     5.0320+-0.3513            4.8742+-0.2473          might be 1.0324x faster
   unprofiled-licm                                   30.9462+-1.6895           30.7285+-0.5830        
   weird-inlining-const-prop                          3.0869+-0.2187            2.7861+-0.2269          might be 1.1080x faster

   <arithmetic>                                      22.4484+-0.1858           22.2802+-0.1374          might be 1.0075x faster
   <geometric> *                                     11.6390+-0.0811           11.6338+-0.0209          might be 1.0005x faster
   <harmonic>                                         5.9242+-0.0590     ?      5.9262+-0.1008        ? might be 1.0003x slower

                                                          Conf#1                    Conf#2                                      
AsmBench:
   bigfib.cpp                                       829.8212+-45.3042         806.1873+-34.2029         might be 1.0293x faster
   cray.c                                           856.0281+-16.2969         842.4886+-15.5674         might be 1.0161x faster
   dry.c                                            800.0474+-66.6007         767.2623+-85.6775         might be 1.0427x faster
   FloatMM.c                                       1078.1230+-21.3068    ?   1079.5433+-25.5499       ?
   gcc-loops.cpp                                   7419.3102+-127.0723       7411.9954+-112.1792      
   n-body.c                                        1990.3752+-57.1305        1979.9704+-53.2465       
   Quicksort.c                                      661.7217+-5.7647          661.2761+-24.1724       
   stepanov_container.cpp                          6334.2307+-689.0652   ?   6430.7390+-669.3982      ? might be 1.0152x slower
   Towers.c                                         479.6274+-14.0508    ?    480.0175+-17.6876       ?

   <arithmetic>                                    2272.1428+-71.2831    ?   2273.2755+-72.5992       ? might be 1.0005x slower
   <geometric> *                                   1379.7624+-7.5225         1368.0262+-16.1855         might be 1.0086x faster
   <harmonic>                                      1005.9465+-12.9371         993.8437+-3.4567          might be 1.0122x faster

                                                          Conf#1                    Conf#2                                      
All benchmarks:
   <arithmetic>                                     175.0942+-2.8274          173.9424+-2.1089          might be 1.0066x faster
   <geometric>                                       19.8107+-0.1054           19.7805+-0.0775          might be 1.0015x faster
   <harmonic>                                         5.1365+-0.0825     ?      5.1420+-0.0796        ? might be 1.0011x slower

                                                          Conf#1                    Conf#2                                      
Geomean of preferred means:
   <scaled-result>                                   83.0307+-0.3330           82.3720+-0.8857          might be 1.0080x faster

[Mark Lam]

Created attachment 232773 [details]
2nd perf run

[Mark Lam]

Created attachment 232774 [details]
3rd perf run

[Mark Lam]

In all the perf runs, we see that there's a consistent significant degradation in JSRegress' fold-double-to-int benchmark.  I'll take a look tomorrow to see if there's a way to resolve that.

[Mark Lam]

(In reply to comment #9)
> In all the perf runs, we see that there's a consistent significant degradation in JSRegress' fold-double-to-int benchmark.  I'll take a look tomorrow to see if there's a way to resolve that.

Strange.  fold-double-to-int doesn't even trigger a nonPropertyTransition.  There should be no effect.  Will check a few more things.

[Mark Lam]

Created attachment 232790 [details]
inverse perf test - runs new code first, followed by baseline

All I did in the inverse perf test is that I specified the new code as conf 1 and the baseline as conf 2 (swapped from how I specified them for the other perf runs).  With this configuration, the results confirm that there is no significant perf different in the fold-double-to-int benchmark component.  The perf difference in the previous runs must be due to noise.

[Geoffrey Garen]

Comment on attachment 232763 [details]
the patch.

Usually, it is the caller's responsibility not to try to transition from a dictionary structure. Notice that other Structure transition functions ASSERT that the Structure is not a dictionary, to enforce this invariant. Why did you make non-property transitions different? What would it take to follow the idiom and make this the caller's responsibility?

[Mark Hahnenberg]

Comment on attachment 232763 [details]
the patch.

r=me

[Mark Hahnenberg]

(In reply to comment #13)
> (From update of attachment 232763 [details])
> r=me

After addressing Geoff's questions :-)

[Geoffrey Garen]

Comment on attachment 232763 [details]
the patch.

If we do want to build in automatic support for dictionaries in Structure::nonPropertyTransition, then I think the right solution is to modify the existing structure and return early, rather than allocate a new structure. It doesn't really make sense to record a transition away from a dictionary. The whole point of dictionary status is that it means "I do not transition -- I just update myself".

[Mark Lam]

As discussed offline, it is proper for nonPropertyTransition to transition dictionary structures to other structure because JIT structure checks need to be able to tell is the indexed type has changed.  Will proceed with landing this patch.

[Mark Lam]

Landed in r169758: <http://trac.webkit.org/r169758>.