Bug 143727 - DFG register fillSpeculate*() functions should validate incoming spill format is compatible with requested fill format
Summary: DFG register fillSpeculate*() functions should validate incoming spill format...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Michael Saboff
URL:
Keywords: InRadar
: 145023 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-04-14 14:19 PDT by Michael Saboff
Modified: 2015-05-14 15:54 PDT (History)
2 users (show)

See Also:


Attachments
Patch (8.76 KB, patch)
2015-04-14 16:06 PDT, Michael Saboff
no flags Details | Formatted Diff | Diff
Updated Patch (13.61 KB, patch)
2015-04-14 17:37 PDT, Michael Saboff
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2015-04-14 14:19:31 PDT
The fillSpeculate*() functions like fillSpeculateCell() should check that current spill format for the virtual register is compatible.  If it isn't, then we should force and OSR exit.  There are some spot checks in these functions, but we can use the return result from the call to AbstractInterpreter<>::filter() at the top of each function to perform the checks.
Comment 1 Radar WebKit Bug Importer 2015-04-14 14:20:23 PDT
<rdar://problem/20541588>
Comment 2 Michael Saboff 2015-04-14 16:06:03 PDT
Created attachment 250751 [details]
Patch

Appears neutral overall on performance with a few variations.  Notable is that sunspider:string-base64 is reported to be 5% faster, but that could be noise.

VMs tested:
"Baseline" at /Volumes/Data/src/webkit.baseline/WebKitBuild/Release/jsc (r182806)
"143727" at /Volumes/Data/src/webkit/WebKitBuild/Release/jsc (r182806)

Collected 4 samples per benchmark/VM, with 4 VM invocations per benchmark. Emitted a call to gc() between sample measurements.
Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level
timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds.

                                                         Baseline                   143727                                      
SunSpider:
   3d-cube                                            6.6951+-0.2440     ?      6.7707+-0.3619        ? might be 1.0113x slower
   3d-morph                                           7.8648+-0.1546     ?      7.8941+-0.1884        ?
   3d-raytrace                                        8.5908+-0.2727     ?      8.7690+-0.1159        ? might be 1.0208x slower
   access-binary-trees                                2.9194+-0.1589     ?      3.0078+-0.0492        ? might be 1.0303x slower
   access-fannkuch                                    7.9238+-0.2817     ?      8.0009+-0.2831        ?
   access-nbody                                       4.2805+-0.1937     ?      4.3350+-0.1628        ? might be 1.0127x slower
   access-nsieve                                      4.9242+-0.1054            4.7366+-0.3863          might be 1.0396x faster
   bitops-3bit-bits-in-byte                           1.8680+-0.1505            1.7475+-0.1081          might be 1.0690x faster
   bitops-bits-in-byte                                5.5717+-0.0880     ?      5.5908+-0.1382        ?
   bitops-bitwise-and                                 2.7184+-0.1716     ?      2.7535+-0.2034        ? might be 1.0129x slower
   bitops-nsieve-bits                                 5.0280+-0.2265            5.0228+-0.1496        
   controlflow-recursive                              2.7967+-0.1881     ?      2.8382+-0.1525        ? might be 1.0148x slower
   crypto-aes                                         5.7721+-0.1032            5.6432+-0.3392          might be 1.0228x faster
   crypto-md5                                         3.3722+-0.1628     ?      3.3975+-0.0320        ?
   crypto-sha1                                        3.2269+-0.1154            3.2017+-0.2253        
   date-format-tofte                                 12.3098+-0.4333           12.0205+-1.0824          might be 1.0241x faster
   date-format-xparb                                  7.6066+-0.4051            7.4769+-0.2108          might be 1.0173x faster
   math-cordic                                        4.1104+-0.1710     ?      4.1535+-0.0542        ? might be 1.0105x slower
   math-partial-sums                                  9.0890+-0.0958     ?      9.1769+-0.2290        ?
   math-spectral-norm                                 2.9006+-0.0721            2.8894+-0.0845        
   regexp-dna                                         9.5349+-0.4512     ?      9.7933+-0.3790        ? might be 1.0271x slower
   string-base64                                      6.0475+-0.1177     ^      5.7366+-0.1585        ^ definitely 1.0542x faster
   string-fasta                                       9.2220+-0.2754     ?      9.2825+-0.2248        ?
   string-tagcloud                                   13.5172+-0.4320           13.4819+-0.3588        
   string-unpack-code                                26.7908+-1.3774     ?     26.8724+-0.5808        ?
   string-validate-input                              6.6559+-0.1416     ?      6.9228+-0.7314        ? might be 1.0401x slower

   <arithmetic>                                       6.9745+-0.0493     ?      6.9814+-0.0841        ? might be 1.0010x slower

                                                         Baseline                   143727                                      
Octane:
   encrypt                                           0.31574+-0.00897    ?     0.32287+-0.00940       ? might be 1.0226x slower
   decrypt                                           5.65659+-0.02111          5.65017+-0.02365       
   deltablue                                x2       0.26609+-0.00050    ?     0.26661+-0.00269       ?
   earley                                            0.81587+-0.00663          0.81095+-0.00692       
   boyer                                            10.33068+-0.09405         10.31035+-0.04910       
   navier-stokes                            x2       6.41370+-0.06852          6.39819+-0.01887       
   raytrace                                 x2       1.71317+-0.06833    ?     1.76390+-0.09317       ? might be 1.0296x slower
   richards                                 x2       0.16647+-0.00480    ?     0.16811+-0.00521       ?
   splay                                    x2       0.52492+-0.01753          0.52429+-0.00490       
   regexp                                   x2      44.81353+-0.17889         44.45178+-0.34867       
   pdfjs                                    x2      62.55568+-0.39999    ?    62.61614+-0.58267       ?
   mandreel                                 x2      71.69652+-0.21810         71.60592+-1.53774       
   gbemu                                    x2      56.09795+-0.49104    ?    56.10090+-0.39067       ?
   closure                                           0.76699+-0.00535    ?     0.77035+-0.00192       ?
   jquery                                            9.61660+-0.04316          9.61625+-0.05188       
   box2d                                    x2      16.85752+-0.13343    ?    17.01420+-0.28640       ?
   zlib                                     x2     526.71844+-42.07698       525.24186+-38.40360      
   typescript                               x2    1104.50177+-13.87379      1091.16248+-17.64856        might be 1.0122x faster

   <geometric>                                       9.22295+-0.04102    ?     9.24270+-0.07206       ? might be 1.0021x slower

                                                         Baseline                   143727                                      
Kraken:
   ai-astar                                          469.689+-1.068            466.823+-12.643        
   audio-beat-detection                              153.569+-4.686            152.523+-4.125         
   audio-dft                                         206.638+-8.557            203.708+-3.627           might be 1.0144x faster
   audio-fft                                         113.852+-8.211            112.517+-7.424           might be 1.0119x faster
   audio-oscillator                                  265.707+-4.698            263.981+-1.014         
   imaging-darkroom                                  139.822+-0.684      ?     140.755+-3.112         ?
   imaging-desaturate                                 95.119+-0.455             94.625+-0.463         
   imaging-gaussian-blur                             156.583+-2.880      ?     156.854+-0.417         ?
   json-parse-financial                               66.596+-1.528             65.127+-0.816           might be 1.0225x faster
   json-stringify-tinderbox                           77.678+-1.587             76.882+-1.150           might be 1.0104x faster
   stanford-crypto-aes                                88.093+-2.553             86.838+-5.296           might be 1.0144x faster
   stanford-crypto-ccm                                66.703+-1.397      ?      72.410+-15.095        ? might be 1.0856x slower
   stanford-crypto-pbkdf2                            225.513+-1.096      ?     226.186+-1.652         ?
   stanford-crypto-sha256-iterative                   73.553+-1.066             73.502+-1.084         

   <arithmetic>                                      157.080+-1.402            156.624+-1.256           might be 1.0029x faster

                                                         Baseline                   143727                                      
JSRegress:
   abs-boolean                                        3.6832+-0.0995            3.6381+-0.1115          might be 1.0124x faster
   adapt-to-double-divide                            18.0697+-0.5780           17.6843+-0.1364          might be 1.0218x faster
   aliased-arguments-getbyval                         1.6911+-0.0398     ?      1.7546+-0.1153        ? might be 1.0375x slower
   allocate-big-object                                3.6746+-0.4463     ?      3.7822+-0.3241        ? might be 1.0293x slower
   arguments-named-and-reflective                    14.6545+-0.4213     ?     14.7844+-0.2388        ?
   arguments-out-of-bounds                           18.1047+-1.3071           17.7922+-0.4487          might be 1.0176x faster
   arguments-strict-mode                             13.8130+-0.4097           13.3796+-0.4407          might be 1.0324x faster
   arguments                                         12.0327+-0.6359           11.8663+-0.2127          might be 1.0140x faster
   arity-mismatch-inlining                            1.1000+-0.1074     ?      1.1740+-0.1148        ? might be 1.0673x slower
   array-access-polymorphic-structure                 9.2925+-0.1003            9.1429+-0.4231          might be 1.0164x faster
   array-nonarray-polymorhpic-access                 47.1545+-2.7377           47.1072+-4.0002        
   array-prototype-every                            118.9837+-2.4395     ?    119.5703+-4.1424        ?
   array-prototype-forEach                          117.3148+-2.9472     ?    117.8513+-1.2471        ?
   array-prototype-map                              129.7469+-3.1162     ?    132.8765+-3.3928        ? might be 1.0241x slower
   array-prototype-some                             119.7091+-3.7419          118.3590+-2.1894          might be 1.0114x faster
   array-splice-contiguous                           57.3076+-1.6176     ?     58.9095+-3.2983        ? might be 1.0280x slower
   array-with-double-add                              5.6701+-0.5087            5.6560+-0.1762        
   array-with-double-increment                        4.0297+-0.1468     ?      4.0671+-0.1101        ?
   array-with-double-mul-add                          7.0412+-0.0785     ?      7.2471+-0.2108        ? might be 1.0292x slower
   array-with-double-sum                              4.4521+-0.1456            4.4016+-0.1464          might be 1.0115x faster
   array-with-int32-add-sub                           9.5637+-0.3037            9.5309+-0.1467        
   array-with-int32-or-double-sum                     4.4882+-0.1748     ?      4.5848+-0.6026        ? might be 1.0215x slower
   ArrayBuffer-DataView-alloc-large-long-lived   
                                                     45.1507+-1.1367     ?     46.2133+-1.8932        ? might be 1.0235x slower
   ArrayBuffer-DataView-alloc-long-lived             18.5651+-0.1542           18.3342+-0.3606          might be 1.0126x faster
   ArrayBuffer-Int32Array-byteOffset                  5.0153+-0.2657            4.9817+-0.3182        
   ArrayBuffer-Int8Array-alloc-large-long-lived   
                                                     48.3492+-2.9078           47.4785+-1.3865          might be 1.0183x faster
   ArrayBuffer-Int8Array-alloc-long-lived-buffer   
                                                     31.5641+-0.4340           31.3622+-0.7006        
   ArrayBuffer-Int8Array-alloc-long-lived            18.0937+-0.6177           17.8484+-0.3441          might be 1.0137x faster
   ArrayBuffer-Int8Array-alloc                       15.3066+-0.1885           14.8665+-0.4276          might be 1.0296x faster
   asmjs_bool_bug                                     8.8420+-0.1137            8.7374+-0.2682          might be 1.0120x faster
   assign-custom-setter-polymorphic                   4.4225+-0.1138            4.4219+-0.2467        
   assign-custom-setter                               5.6971+-0.2169     ?      5.8922+-0.2404        ? might be 1.0342x slower
   basic-set                                         12.6847+-0.5399           12.1803+-0.9787          might be 1.0414x faster
   big-int-mul                                        5.8146+-0.1920     ?      5.9888+-0.4068        ? might be 1.0299x slower
   boolean-test                                       4.2387+-0.0762     ?      4.2722+-0.1509        ?
   branch-fold                                        4.5798+-0.0810     ?      4.6478+-0.1579        ? might be 1.0148x slower
   by-val-generic                                    10.8729+-0.4481           10.8701+-0.2971        
   call-spread-apply                                 40.1239+-0.4979     ?     40.8217+-1.2363        ? might be 1.0174x slower
   call-spread-call                                  33.3540+-0.9923     !     35.4169+-0.9084        ! definitely 1.0618x slower
   captured-assignments                               0.5679+-0.0167     ?      0.6376+-0.1101        ? might be 1.1227x slower
   cast-int-to-double                                 8.0920+-0.2307            8.0008+-0.2433          might be 1.0114x faster
   cell-argument                                      9.9703+-0.4215            9.9406+-0.2009        
   cfg-simplify                                       3.6942+-0.1573     ?      3.7335+-0.0345        ? might be 1.0106x slower
   chain-getter-access                               12.8613+-0.4463     ?     12.8750+-0.1904        ?
   cmpeq-obj-to-obj-other                            13.0319+-0.5420           12.7548+-0.4316          might be 1.0217x faster
   constant-test                                      7.6102+-0.2010     ?      7.8897+-0.5390        ? might be 1.0367x slower
   create-lots-of-functions                          32.1183+-1.1508           31.6409+-0.3933          might be 1.0151x faster
   DataView-custom-properties                        53.5148+-2.3179           53.0017+-2.7890        
   deconstructing-parameters-overridden-by-function   
                                                      0.6980+-0.1974     ?      0.6983+-0.1646        ?
   delay-tear-off-arguments-strictmode               18.7353+-0.1462     ?     18.8301+-0.0972        ?
   deltablue-varargs                                256.8453+-2.0385          256.1028+-6.0280        
   destructuring-arguments                           21.9749+-0.2221     ?     22.3100+-1.0657        ? might be 1.0152x slower
   destructuring-swap                                 7.6900+-0.1418            7.6169+-0.1377        
   direct-arguments-getbyval                          1.4437+-0.0987     ?      1.6404+-0.1972        ? might be 1.1363x slower
   div-boolean-double                                 5.4897+-0.1071            5.4175+-0.1312          might be 1.0133x faster
   div-boolean                                        9.7052+-0.1638     ?      9.8074+-0.0878        ? might be 1.0105x slower
   double-get-by-val-out-of-bounds                    5.7213+-0.2227     !      6.1357+-0.0678        ! definitely 1.0724x slower
   double-pollution-getbyval                          9.6314+-0.2787     ?      9.7254+-0.1475        ?
   double-pollution-putbyoffset                       5.4895+-0.2774     ?      5.6146+-0.2425        ? might be 1.0228x slower
   double-to-int32-typed-array-no-inline              2.9285+-0.1471     ?      2.9311+-0.1301        ?
   double-to-int32-typed-array                        2.5053+-0.1455            2.4415+-0.2163          might be 1.0261x faster
   double-to-uint32-typed-array-no-inline             2.9061+-0.1481     ?      2.9935+-0.2730        ? might be 1.0301x slower
   double-to-uint32-typed-array                       2.5685+-0.2304     ?      2.5690+-0.2103        ?
   elidable-new-object-dag                           54.9875+-1.2415     ?     55.0366+-1.4285        ?
   elidable-new-object-roflcopter                    60.2272+-0.7276     ?     61.3841+-3.0177        ? might be 1.0192x slower
   elidable-new-object-then-call                     52.9955+-3.8982           50.5580+-1.3398          might be 1.0482x faster
   elidable-new-object-tree                          64.0610+-1.0193           63.2074+-2.0112          might be 1.0135x faster
   empty-string-plus-int                              7.5704+-0.2562            7.4539+-0.1685          might be 1.0156x faster
   emscripten-cube2hash                              45.3801+-0.4851           44.7535+-0.8213          might be 1.0140x faster
   exit-length-on-plain-object                       18.7822+-0.2135           18.4063+-0.5068          might be 1.0204x faster
   external-arguments-getbyval                        1.6140+-0.1814            1.5614+-0.2621          might be 1.0337x faster
   external-arguments-putbyval                        3.1501+-0.0992     ?      3.2399+-0.2782        ? might be 1.0285x slower
   fixed-typed-array-storage-var-index                1.5746+-0.1810            1.4970+-0.1606          might be 1.0518x faster
   fixed-typed-array-storage                          1.2123+-0.1407     ?      1.2866+-0.1893        ? might be 1.0613x slower
   Float32Array-matrix-mult                           5.8850+-0.3038     ?      5.9540+-0.2647        ? might be 1.0117x slower
   Float32Array-to-Float64Array-set                  75.3255+-3.7368     ?     76.0145+-5.5955        ?
   Float64Array-alloc-long-lived                     93.7083+-0.5569     ?     94.2015+-0.3238        ?
   Float64Array-to-Int16Array-set                   101.1656+-0.3744     ?    105.6171+-4.6733        ? might be 1.0440x slower
   fold-double-to-int                                20.5146+-0.4067     !     21.6608+-0.6138        ! definitely 1.0559x slower
   fold-get-by-id-to-multi-get-by-offset-rare-int   
                                                     10.3411+-0.5078     ?     10.4304+-0.4086        ?
   fold-get-by-id-to-multi-get-by-offset              9.0780+-0.4407     ?      9.1000+-0.2010        ?
   fold-multi-get-by-offset-to-get-by-offset   
                                                      8.6281+-1.2641            7.8265+-1.1989          might be 1.1024x faster
   fold-multi-get-by-offset-to-poly-get-by-offset   
                                                      8.1868+-0.8343     ?      8.4438+-0.8462        ? might be 1.0314x slower
   fold-multi-put-by-offset-to-poly-put-by-offset   
                                                      7.3401+-0.7200     ?      7.4749+-0.7009        ? might be 1.0184x slower
   fold-multi-put-by-offset-to-put-by-offset   
                                                      6.5112+-0.7173            6.2652+-0.7588          might be 1.0393x faster
   fold-multi-put-by-offset-to-replace-or-transition-put-by-offset   
                                                     12.8248+-1.0691           12.3017+-1.2229          might be 1.0425x faster
   fold-put-by-id-to-multi-put-by-offset              8.6852+-1.0315            8.6730+-1.0906        
   fold-put-structure                                 6.2204+-0.7618            6.1633+-0.1120        
   for-of-iterate-array-entries                       6.3524+-0.1138            6.2445+-0.0580          might be 1.0173x faster
   for-of-iterate-array-keys                          5.1888+-0.1351            5.1508+-0.2326        
   for-of-iterate-array-values                        5.0550+-0.1976     ?      5.0583+-0.5086        ?
   fround                                            21.7065+-0.5407     ?     22.2723+-1.2071        ? might be 1.0261x slower
   ftl-library-inlining-dataview                     90.9430+-1.9200           90.2015+-3.0495        
   ftl-library-inlining                             112.4117+-15.6981    ?    114.6644+-4.8106        ? might be 1.0200x slower
   function-dot-apply                                 2.8652+-0.1710     ?      2.8729+-0.2057        ?
   function-test                                      4.8790+-0.0822     ?      4.9973+-0.4062        ? might be 1.0242x slower
   function-with-eval                               133.1198+-1.1478     ?    134.3550+-3.0813        ?
   gcse-poly-get-less-obvious                        25.0759+-0.9704           25.0520+-0.8056        
   gcse-poly-get                                     24.6019+-0.0802     ?     24.7795+-0.4499        ?
   gcse                                               6.4210+-0.2558     ?      6.5438+-0.1969        ? might be 1.0191x slower
   get-by-id-bimorphic-check-structure-elimination-simple   
                                                      3.2976+-0.1312     ?      3.3403+-0.1473        ? might be 1.0129x slower
   get-by-id-bimorphic-check-structure-elimination   
                                                      8.3458+-0.1079            8.3195+-0.2952        
   get-by-id-chain-from-try-block                    11.3985+-0.0976           11.3826+-0.1749        
   get-by-id-check-structure-elimination              7.3347+-0.2285     ?      7.6223+-0.1275        ? might be 1.0392x slower
   get-by-id-proto-or-self                           22.5237+-1.3097           22.1998+-0.9897          might be 1.0146x faster
   get-by-id-quadmorphic-check-structure-elimination-simple   
                                                      3.9831+-0.0616     ?      4.0162+-0.1143        ?
   get-by-id-self-or-proto                           22.6560+-1.5152           22.4652+-1.4889        
   get-by-val-out-of-bounds                           5.7322+-0.3710     ?      5.9993+-0.4309        ? might be 1.0466x slower
   get_callee_monomorphic                             5.1404+-0.4548     ?      5.1851+-0.2689        ?
   get_callee_polymorphic                             4.3513+-0.3403            4.2195+-0.1752          might be 1.0312x faster
   getter-no-activation                               5.7789+-0.1406            5.7550+-0.0979        
   getter-richards                                  128.2052+-2.5427     ?    128.2664+-5.1315        ?
   getter                                             7.1855+-0.0562     ?      7.2230+-0.1067        ?
   global-var-const-infer-fire-from-opt               1.2318+-0.1453     ?      1.3099+-0.0891        ? might be 1.0635x slower
   global-var-const-infer                             1.2999+-0.1511            1.1618+-0.2845          might be 1.1188x faster
   HashMap-put-get-iterate-keys                      34.7606+-0.5577           34.3834+-0.6389          might be 1.0110x faster
   HashMap-put-get-iterate                           34.8658+-1.4332     ?     35.1343+-0.7995        ?
   HashMap-string-put-get-iterate                    35.4775+-2.0143     ?     35.6600+-1.1483        ?
   hoist-make-rope                                   15.2250+-1.7818           13.4758+-0.7035          might be 1.1298x faster
   hoist-poly-check-structure-effectful-loop   
                                                      6.7720+-0.2944     ?      7.0695+-0.5495        ? might be 1.0439x slower
   hoist-poly-check-structure                         4.8701+-0.0936     ?      4.9697+-0.0656        ? might be 1.0204x slower
   imul-double-only                                  10.0265+-0.4813     ?     10.1379+-0.8136        ? might be 1.0111x slower
   imul-int-only                                     11.7772+-1.0445     ?     12.4283+-0.7395        ? might be 1.0553x slower
   imul-mixed                                         9.7637+-0.7230     ?      9.9225+-0.9500        ? might be 1.0163x slower
   in-four-cases                                     23.7491+-0.3667     ?     23.8334+-0.4580        ?
   in-one-case-false                                 12.5684+-0.2618           12.5215+-0.1952        
   in-one-case-true                                  12.4813+-0.2361     ?     12.4912+-0.1845        ?
   in-two-cases                                      12.9849+-0.1977           12.9382+-0.1264        
   indexed-properties-in-objects                      3.7418+-0.0593            3.6436+-0.1166          might be 1.0269x faster
   infer-closure-const-then-mov-no-inline             4.3319+-0.1404     ?      4.3530+-0.0263        ?
   infer-closure-const-then-mov                      24.9031+-1.0847     ?     24.9205+-1.1894        ?
   infer-closure-const-then-put-to-scope-no-inline   
                                                     17.1152+-0.1801           16.9490+-0.1379        
   infer-closure-const-then-put-to-scope             30.0213+-1.0400     ?     30.0497+-0.2930        ?
   infer-closure-const-then-reenter-no-inline   
                                                     80.7958+-0.2172     ?     81.3198+-2.1794        ?
   infer-closure-const-then-reenter                  30.1017+-0.6374     ?     30.3847+-0.6250        ?
   infer-constant-global-property                    37.3363+-0.7653     ?     37.4379+-1.0401        ?
   infer-constant-property                            3.3432+-0.1572            3.3255+-0.1098        
   infer-one-time-closure-ten-vars                   15.0338+-0.4418           14.7272+-0.3288          might be 1.0208x faster
   infer-one-time-closure-two-vars                   14.3091+-0.4445           14.1312+-0.4135          might be 1.0126x faster
   infer-one-time-closure                            14.2449+-0.4014           13.9420+-0.4348          might be 1.0217x faster
   infer-one-time-deep-closure                       24.8617+-0.4569           24.5095+-0.3968          might be 1.0144x faster
   inline-arguments-access                            5.6998+-0.2500     ?      5.8360+-0.2594        ? might be 1.0239x slower
   inline-arguments-aliased-access                    5.7664+-0.1101     ?      5.8210+-0.2753        ?
   inline-arguments-local-escape                      5.9590+-0.5793            5.9349+-0.2441        
   inline-get-scoped-var                              5.7143+-0.1840            5.7037+-0.1525        
   inlined-put-by-id-transition                      14.8660+-0.4295           14.5943+-0.4865          might be 1.0186x faster
   int-or-other-abs-then-get-by-val                   6.8052+-0.3257     ?      6.8676+-0.3811        ?
   int-or-other-abs-zero-then-get-by-val             27.2778+-0.9229     ?     27.6646+-0.6937        ? might be 1.0142x slower
   int-or-other-add-then-get-by-val                   6.0018+-0.2821            5.8478+-0.1617          might be 1.0263x faster
   int-or-other-add                                   7.8127+-0.2230     ?      7.9340+-0.1393        ? might be 1.0155x slower
   int-or-other-div-then-get-by-val                   5.1697+-0.1813     ?      5.2258+-0.0554        ? might be 1.0108x slower
   int-or-other-max-then-get-by-val                   6.5150+-0.2566            6.4810+-0.7896        
   int-or-other-min-then-get-by-val                   5.2440+-0.2388     ?      5.4130+-0.2045        ? might be 1.0322x slower
   int-or-other-mod-then-get-by-val                   5.0398+-0.2261     ?      5.1074+-0.1664        ? might be 1.0134x slower
   int-or-other-mul-then-get-by-val                   4.9562+-0.2354     ?      5.0333+-0.1646        ? might be 1.0156x slower
   int-or-other-neg-then-get-by-val                   6.2012+-0.1558            6.1985+-0.1578        
   int-or-other-neg-zero-then-get-by-val             26.9248+-0.3669     ?     27.2697+-0.4654        ? might be 1.0128x slower
   int-or-other-sub-then-get-by-val                   5.9010+-0.1804            5.8435+-0.2201        
   int-or-other-sub                                   4.7698+-0.1447     ?      4.8132+-0.1799        ?
   int-overflow-local                                 5.8281+-0.1794            5.7505+-0.1700          might be 1.0135x faster
   Int16Array-alloc-long-lived                       63.4922+-0.8037           63.3909+-0.9284        
   Int16Array-bubble-sort-with-byteLength            37.9282+-0.8458           37.2159+-0.2734          might be 1.0191x faster
   Int16Array-bubble-sort                            37.3541+-0.2119     ?     37.7584+-0.8336        ? might be 1.0108x slower
   Int16Array-load-int-mul                            2.0120+-0.1855            1.9370+-0.0846          might be 1.0387x faster
   Int16Array-to-Int32Array-set                      73.5837+-2.1801     ?     73.6262+-0.4041        ?
   Int32Array-alloc-large                            35.0888+-1.4214           33.9891+-1.8661          might be 1.0324x faster
   Int32Array-alloc-long-lived                       72.5142+-0.5010     ?     72.7043+-1.0689        ?
   Int32Array-alloc                                   4.5682+-0.5480            4.4721+-0.0405          might be 1.0215x faster
   Int32Array-Int8Array-view-alloc                    9.8177+-0.2786     ?     10.0126+-0.4405        ? might be 1.0199x slower
   int52-spill                                        8.9645+-0.2154     ?      9.2405+-0.4667        ? might be 1.0308x slower
   Int8Array-alloc-long-lived                        57.9207+-1.6310     ?     58.1138+-1.3799        ?
   Int8Array-load-with-byteLength                     4.7917+-0.1533            4.7891+-0.1664        
   Int8Array-load                                     4.7863+-0.0970            4.7473+-0.1287        
   integer-divide                                    14.0909+-0.1472           14.0120+-0.3021        
   integer-modulo                                     2.7492+-0.2130     ?      2.7623+-0.1777        ?
   large-int-captured                                 8.0454+-0.2286     ?      8.0660+-0.1610        ?
   large-int-neg                                     20.7856+-1.0879           20.4080+-0.1134          might be 1.0185x faster
   large-int                                         18.2613+-0.5043           18.2182+-0.4205        
   logical-not                                        6.0845+-0.3834     ?      6.3435+-0.8566        ? might be 1.0426x slower
   lots-of-fields                                    18.7712+-0.1689           18.6628+-0.3172        
   make-indexed-storage                               4.2336+-0.4875     ?      4.3915+-0.1334        ? might be 1.0373x slower
   make-rope-cse                                      6.1550+-0.0378            6.1533+-0.0855        
   marsaglia-larger-ints                             55.5128+-0.7541     ?     55.5353+-0.5884        ?
   marsaglia-osr-entry                               28.1095+-0.6591           28.0898+-0.2063        
   max-boolean                                        3.3043+-0.0857            3.2988+-0.1554        
   method-on-number                                  24.7257+-0.5517     ?     25.6224+-0.9194        ? might be 1.0363x slower
   min-boolean                                        3.2396+-0.1621            3.2073+-0.0767          might be 1.0101x faster
   minus-boolean-double                               4.1873+-0.0839     ?      4.2345+-0.1323        ? might be 1.0113x slower
   minus-boolean                                      3.2734+-0.0397            3.2038+-0.0992          might be 1.0217x faster
   misc-strict-eq                                    52.3315+-1.3247           51.2353+-1.1387          might be 1.0214x faster
   mod-boolean-double                                11.7344+-0.0596     ?     11.9423+-0.7332        ? might be 1.0177x slower
   mod-boolean                                        8.7850+-0.2016     ?      8.8699+-0.1313        ?
   mul-boolean-double                                 4.8585+-0.0999            4.8234+-0.0935        
   mul-boolean                                        3.4742+-0.1541            3.4465+-0.1707        
   neg-boolean                                        4.3657+-0.0917            4.2991+-0.1350          might be 1.0155x faster
   negative-zero-divide                               0.5114+-0.0992     ?      0.5437+-0.1115        ? might be 1.0631x slower
   negative-zero-modulo                               0.5188+-0.1145     ?      0.5245+-0.0997        ? might be 1.0109x slower
   negative-zero-negate                               0.4936+-0.0975            0.4484+-0.0883          might be 1.1007x faster
   nested-function-parsing                           58.8552+-0.6856     ?     59.1370+-0.8599        ?
   new-array-buffer-dead                              3.8118+-0.1075     ?      3.8547+-0.2265        ? might be 1.0113x slower
   new-array-buffer-push                              8.9529+-0.3644     ?      9.2654+-0.2111        ? might be 1.0349x slower
   new-array-dead                                    14.9910+-1.0760     ?     15.2504+-1.8320        ? might be 1.0173x slower
   new-array-push                                     5.2435+-0.3325     ?      5.5261+-0.3861        ? might be 1.0539x slower
   no-inline-constructor                            152.0026+-1.5529          151.6688+-0.9927        
   number-test                                        4.2701+-0.1210            4.2093+-0.1652          might be 1.0145x faster
   object-closure-call                                7.5890+-0.1450            7.5555+-0.3864        
   object-test                                        4.4857+-0.1182     ?      4.4963+-0.0366        ?
   obvious-sink-pathology-taken                     170.1875+-2.1206     ?    171.3854+-5.1715        ?
   obvious-sink-pathology                           162.5636+-1.2617     ?    162.7296+-4.1510        ?
   obviously-elidable-new-object                     45.8965+-5.0232     ?     46.9008+-4.8869        ? might be 1.0219x slower
   plus-boolean-arith                                 3.2112+-0.0738     ?      3.2177+-0.1405        ?
   plus-boolean-double                                4.2200+-0.1809            4.2009+-0.1241        
   plus-boolean                                       3.1868+-0.1490            3.1653+-0.1357        
   poly-chain-access-different-prototypes-simple   
                                                      3.8439+-0.1499     ?      3.8771+-0.0375        ?
   poly-chain-access-different-prototypes             3.2590+-0.1088     ?      3.3239+-0.0981        ? might be 1.0199x slower
   poly-chain-access-simpler                          3.8117+-0.2083     ?      3.8688+-0.0811        ? might be 1.0150x slower
   poly-chain-access                                  3.0971+-0.1617            3.0480+-0.1245          might be 1.0161x faster
   poly-stricteq                                     68.2525+-1.2170     ?     69.3685+-1.6732        ? might be 1.0164x slower
   polymorphic-array-call                             1.9932+-0.4922     ?      2.0095+-0.3491        ?
   polymorphic-get-by-id                              4.0605+-0.1390     ?      4.3147+-0.7370        ? might be 1.0626x slower
   polymorphic-put-by-id                             38.1545+-6.1494     ?     40.0676+-5.4364        ? might be 1.0501x slower
   polymorphic-structure                             21.7722+-0.2217           21.6404+-0.3947        
   polyvariant-monomorphic-get-by-id                 12.2614+-0.2128     ?     12.2868+-0.0974        ?
   proto-getter-access                               13.1175+-0.4099           12.9016+-0.3751          might be 1.0167x faster
   put-by-id-replace-and-transition                  11.8304+-0.9738           11.5258+-0.5703          might be 1.0264x faster
   put-by-id-slightly-polymorphic                     3.5153+-0.0592     ?      3.5557+-0.1171        ? might be 1.0115x slower
   put-by-id                                         17.8141+-0.5456     ?     18.0328+-0.2828        ? might be 1.0123x slower
   put-by-val-direct                                  0.8193+-0.1323     ?      0.9025+-0.1340        ? might be 1.1015x slower
   put-by-val-large-index-blank-indexing-type   
                                                      8.1998+-0.5175     ?      8.5166+-0.6385        ? might be 1.0386x slower
   put-by-val-machine-int                             3.3901+-0.1955            3.3740+-0.1456        
   rare-osr-exit-on-local                            18.4877+-0.3705           18.2715+-0.3339          might be 1.0118x faster
   register-pressure-from-osr                        26.4394+-0.7365     ?     26.7149+-0.7900        ? might be 1.0104x slower
   setter                                             6.4805+-0.1774     ?      6.5632+-0.1305        ? might be 1.0128x slower
   simple-activation-demo                            30.9162+-0.4224     ?     31.1877+-0.9158        ?
   simple-getter-access                              18.0295+-0.5032     ?     18.0688+-0.3607        ?
   simple-poly-call-nested                           10.0445+-0.1911           10.0123+-0.1814        
   simple-poly-call                                   1.6366+-0.0741     ?      1.6670+-0.0938        ? might be 1.0186x slower
   sin-boolean                                       24.2407+-4.3232     ?     25.8521+-4.1658        ? might be 1.0665x slower
   singleton-scope                                   86.7270+-0.1130           86.7228+-0.2818        
   sinkable-new-object-dag                           93.1264+-1.3167     ?     93.3135+-1.0346        ?
   sinkable-new-object-taken                         69.6967+-0.6111     ?     69.9041+-4.3163        ?
   sinkable-new-object                               52.4207+-0.8008     ?     52.7608+-1.2507        ?
   slow-array-profile-convergence                     3.8120+-0.2532     ?      3.9662+-0.2637        ? might be 1.0405x slower
   slow-convergence                                   3.7896+-0.4217            3.7825+-0.3316        
   sorting-benchmark                                 28.4336+-1.2762     ?     28.5738+-1.2388        ?
   sparse-conditional                                 1.6603+-0.0725            1.6085+-0.0565          might be 1.0322x faster
   splice-to-remove                                  21.7463+-0.4711           21.4300+-0.3675          might be 1.0148x faster
   string-char-code-at                               20.0610+-0.3219     ?     20.1116+-0.4718        ?
   string-concat-object                               3.1594+-0.4018     ?      3.1693+-0.2902        ?
   string-concat-pair-object                          3.0463+-0.2800            2.9934+-0.2059          might be 1.0177x faster
   string-concat-pair-simple                         16.0303+-0.3035           16.0302+-0.5618        
   string-concat-simple                              16.6632+-0.1979     ^     16.1061+-0.2265        ^ definitely 1.0346x faster
   string-cons-repeat                                10.6597+-0.5696           10.4426+-0.1695          might be 1.0208x faster
   string-cons-tower                                 10.4323+-0.1898     ?     10.4560+-0.1287        ?
   string-equality                                   21.8538+-0.3482     ?     21.8724+-0.6109        ?
   string-get-by-val-big-char                         9.8223+-0.2602     ?      9.9375+-0.6576        ? might be 1.0117x slower
   string-get-by-val-out-of-bounds-insane             6.2908+-1.8982            5.4880+-0.1652          might be 1.1463x faster
   string-get-by-val-out-of-bounds                    6.8745+-0.0801            6.7972+-0.1949          might be 1.0114x faster
   string-get-by-val                                  4.7074+-0.0716            4.6479+-0.0384          might be 1.0128x faster
   string-hash                                        2.7343+-0.1375     ?      2.8042+-0.0717        ? might be 1.0256x slower
   string-long-ident-equality                        17.8735+-0.2064     ?     18.2411+-1.2365        ? might be 1.0206x slower
   string-out-of-bounds                              17.3430+-0.5082     ?     17.4003+-0.5622        ?
   string-repeat-arith                               42.3940+-0.6312     ^     41.5699+-0.0850        ^ definitely 1.0198x faster
   string-sub                                        81.5804+-2.5071     ?     81.7614+-0.9854        ?
   string-test                                        4.2355+-0.1774     ?      4.2424+-0.1083        ?
   string-var-equality                               43.4485+-0.2077           43.3173+-0.2606        
   structure-hoist-over-transitions                   3.3890+-0.0881            3.3539+-0.0909          might be 1.0104x faster
   substring-concat-weird                            53.7742+-0.5426           53.5283+-0.4597        
   substring-concat                                  56.4106+-1.0145           56.1638+-1.5924        
   substring                                         61.8919+-0.5330     ?     62.4438+-0.7624        ?
   switch-char-constant                               3.3887+-0.0741            3.3887+-0.1296        
   switch-char                                        7.8750+-0.1923     ?      7.9001+-0.0579        ?
   switch-constant                                   10.8351+-0.2999     ?     10.9232+-0.4263        ?
   switch-string-basic-big-var                       25.1897+-4.4325     ?     25.9348+-1.4076        ? might be 1.0296x slower
   switch-string-basic-big                           18.7584+-1.4635           18.6484+-1.7771        
   switch-string-basic-var                           28.6392+-3.2773           28.3292+-3.5770          might be 1.0109x faster
   switch-string-basic                               21.1318+-2.5262           20.3491+-2.4462          might be 1.0385x faster
   switch-string-big-length-tower-var                24.9944+-0.1527           24.9183+-0.1721        
   switch-string-length-tower-var                    19.6554+-0.2339     ?     19.8168+-0.3263        ?
   switch-string-length-tower                        14.0645+-0.3312           13.8892+-0.2916          might be 1.0126x faster
   switch-string-short                               13.9894+-0.3528     ?     14.0222+-0.2074        ?
   switch                                            14.5886+-0.6231     ?     14.6350+-0.5577        ?
   tear-off-arguments-simple                          4.4011+-0.1511            4.2543+-0.4407          might be 1.0345x faster
   tear-off-arguments                                 6.1454+-0.3866            5.9039+-0.4522          might be 1.0409x faster
   temporal-structure                                16.9724+-0.1662     ?     17.0052+-0.3276        ?
   to-int32-boolean                                  21.2393+-0.3647           21.1669+-0.4563        
   try-catch-get-by-val-cloned-arguments             18.9767+-0.2715           18.8947+-0.1481        
   try-catch-get-by-val-direct-arguments              8.2734+-0.5865     ?      8.5180+-0.3788        ? might be 1.0296x slower
   try-catch-get-by-val-scoped-arguments             10.1182+-0.1332     ?     10.2683+-0.1584        ? might be 1.0148x slower
   undefined-property-access                        432.1925+-10.4127         425.7377+-3.3271          might be 1.0152x faster
   undefined-test                                     4.3992+-0.0908     ?      4.5065+-0.1703        ? might be 1.0244x slower
   unprofiled-licm                                   27.0419+-0.5430     ?     27.1466+-0.8547        ?
   varargs-call                                      18.9021+-0.2435     ?     19.0057+-0.3980        ?
   varargs-construct-inline                          29.5133+-0.4769     ?     30.1278+-0.2342        ? might be 1.0208x slower
   varargs-construct                                 42.3535+-1.6087     ?     42.4584+-1.8058        ?
   varargs-inline                                    11.9781+-0.3236     ?     12.0016+-0.3649        ?
   varargs-strict-mode                               14.0560+-0.1409           13.8088+-0.3871          might be 1.0179x faster
   varargs                                           13.9841+-0.2656     ?     14.0099+-0.3455        ?
   weird-inlining-const-prop                          2.8838+-0.1848            2.8153+-0.2822          might be 1.0243x faster

   <geometric>                                       11.2668+-0.0296     ?     11.2949+-0.0279        ? might be 1.0025x slower

                                                         Baseline                   143727                                      
AsmBench:
   bigfib.cpp                                       656.0960+-2.4786     ?    660.0327+-4.2235        ?
   cray.c                                           622.4896+-2.7524     ?    624.2029+-5.1927        ?
   dry.c                                            640.9047+-15.1779    ?    649.0897+-12.7497       ? might be 1.0128x slower
   FloatMM.c                                        957.8546+-1.9209          956.5390+-1.3765        
   gcc-loops.cpp                                   5874.8479+-9.8641     ?   5877.9625+-20.9874       ?
   n-body.c                                        1672.8197+-4.6147         1669.5305+-1.6165        
   Quicksort.c                                      577.2261+-14.3923    ?    587.1200+-4.7258        ? might be 1.0171x slower
   stepanov_container.cpp                          4839.1768+-19.6526    ?   4856.3395+-19.8868       ?
   Towers.c                                         376.1375+-2.3617     ?    377.3905+-1.6067        ?

   <geometric>                                     1111.4566+-5.2123     ?   1116.7242+-3.6366        ? might be 1.0047x slower

                                                         Baseline                   143727                                      
CompressionBench:
   huffman                                          503.9668+-3.8761          502.3233+-5.0106        
   arithmetic-simple                                527.0562+-2.6899          525.1830+-0.6031        
   arithmetic-precise                               400.9268+-6.8895          400.5740+-4.6006        
   arithmetic-complex-precise                       399.0178+-0.4564          397.0725+-3.6927        
   arithmetic-precise-order-0                       580.8662+-9.1488          576.5144+-10.1525       
   arithmetic-precise-order-1                       429.0465+-21.3222         419.7703+-2.6844          might be 1.0221x faster
   arithmetic-precise-order-2                       472.9880+-4.1944     ?    473.1099+-1.3579        ?
   arithmetic-simple-order-1                        528.6113+-3.9115          527.4030+-2.6000        
   arithmetic-simple-order-2                        591.4443+-3.4363          590.6199+-5.4291        
   lz-string                                        418.2889+-3.5944     ?    419.0020+-8.3839        ?

   <geometric>                                      480.4041+-1.6238          478.3243+-1.1365          might be 1.0043x faster

                                                         Baseline                   143727                                      
Geomean of preferred means:
   <scaled-result>                                   62.7044+-0.0601     ?     62.7367+-0.0550        ? might be 1.0005x slower
Comment 3 Geoffrey Garen 2015-04-14 16:52:32 PDT
Comment on attachment 250751 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=250751&action=review

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:849
> +    if (m_interpreter.filter(value, SpecInt32) == Contradiction) {

Can you merge this block with the constant check below?

If the edge is constant, and not int32, the abstract interpreter should know it, and so we shouldn't need a separate constant check.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:821
> +    if (m_interpreter.filter(value, SpecInt32) == Contradiction) {

Same question about constants.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:972
> +    if (m_interpreter.filter(value, SpecMachineInt) == Contradiction) {

Same question about constants.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:1106
> +    if (m_interpreter.filter(value, SpecCell) == Contradiction) {

Same question about constants.
Comment 4 Michael Saboff 2015-04-14 17:37:52 PDT
Created attachment 250766 [details]
Updated Patch

As suggested, I eliminated all other spill/fill consistency checks as the AbstractInterpreter<>::filter() covers them.
Comment 5 Geoffrey Garen 2015-04-14 17:44:08 PDT
Comment on attachment 250766 [details]
Updated Patch

r=me
Comment 6 Michael Saboff 2015-04-14 17:50:02 PDT
Committed r182827: <http://trac.webkit.org/changeset/182827>
Comment 7 Mark Lam 2015-05-14 15:54:46 PDT
*** Bug 145023 has been marked as a duplicate of this bug. ***