Bug 136118 – Stop implicitly skipping a function's own activation when walking the scope chain

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Oliver Hunt]

Stop implicitly skipping a function's own activation when walking the scope chain

[Oliver Hunt]

Created attachment 236894 [details]
Patch

[Geoffrey Garen]

Comment on attachment 236894 [details]
Patch

r=me

If the extra pointer dereference is a performance hit, perhaps we need a DFG/FTL optimization to infer that your parent scopes are constants. It seems like, at each level up the scope chain, the odds of a constant scope must increase exponentially.

[Oliver Hunt]

Committed r172808: <http://trac.webkit.org/changeset/172808>

[Csaba Osztrogonác]

(In reply to comment #3)
> Committed r172808: <http://trac.webkit.org/changeset/172808>

It broke 6 different tests on Apple Mac 32 bit:

http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/3692/steps/webkit-32bit-jsc-test/logs/stdio

jsc-layout-tests.yaml/js/script-tests/array-filter.js (7 failures)
jsc-layout-tests.yaml/js/script-tests/dfg-cse-cfa-discrepancy.js (7 failures)
jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js (7 failures)
mozilla-tests.yaml/js1_5/Scope/regress-208496-001.js (1 failure)
regress/script-tests/Float32Array-matrix-mult.js (8 failures)
v8-v6/v8-earley-boyer.js (11 failures)

[Csaba Osztrogonác]

(In reply to comment #4)
> (In reply to comment #3)
> > Committed r172808: <http://trac.webkit.org/changeset/172808>
> 
> It broke 6 different tests on Apple Mac 32 bit:
> 
> http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/3692/steps/webkit-32bit-jsc-test/logs/stdio
> 
> jsc-layout-tests.yaml/js/script-tests/array-filter.js (7 failures)
> jsc-layout-tests.yaml/js/script-tests/dfg-cse-cfa-discrepancy.js (7 failures)
> jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js (7 failures)
> mozilla-tests.yaml/js1_5/Scope/regress-208496-001.js (1 failure)
> regress/script-tests/Float32Array-matrix-mult.js (8 failures)
> v8-v6/v8-earley-boyer.js (11 failures)

It isn't related to x86, the same regression occurs on other 
32 bit platforms, ARM Traditional and ARM Thumb2.

[Csaba Osztrogonác]

new bug report to track this regression: https://bugs.webkit.org/show_bug.cgi?id=136123

[Mark Lam]

(In reply to comment #6)
> new bug report to track this regression: https://bugs.webkit.org/show_bug.cgi?id=136123

FYI, this has been fixed in r172838: <http://trac.webkit.org/r172838>.