Bug 143960 – REGRESSION (r182899): icloud.com crashes

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Basile Clement]

icloud.com crashes following the changes in https://bugs.webkit.org/show_bug.cgi?id=143807, patch forthcoming.

[Basile Clement]

Created attachment 251185 [details]
Possible patch, regression test forthcoming

[Geoffrey Garen]

Comment on attachment 251185 [details]
Possible patch, regression test forthcoming

View in context: https://bugs.webkit.org/attachment.cgi?id=251185&action=review

> Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:113
> +        case AllocationProfileWatchpoint: {
> +            InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet();
> +            if (watchpointSet)
> +                addLazily(*watchpointSet);
>              break;
> +        }

If watchpointSet is null, the compiler will fail to add a necessary watchpoint, which means that we'll end up with incorrect code if the watchpoint fires.

Can we ASSERT that watchpointSet is not null instead of checking?

What guarantees that it will not be null?

[Basile Clement]

(In reply to comment #2)
> Comment on attachment 251185 [details]
> Possible patch, regression test forthcoming
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=251185&action=review
> 
> > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:113
> > +        case AllocationProfileWatchpoint: {
> > +            InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet();
> > +            if (watchpointSet)
> > +                addLazily(*watchpointSet);
> >              break;
> > +        }
> 
> If watchpointSet is null, the compiler will fail to add a necessary
> watchpoint, which means that we'll end up with incorrect code if the
> watchpoint fires.
> 
> Can we ASSERT that watchpointSet is not null instead of checking?
> 
> What guarantees that it will not be null?

If the watchpointSet is null, it means there is no rare data and thus there shouldn't be an AllocationProfileWatchpoint for this node.
A least that was the case before I made the allocation profile clearing too aggressive when the .prototype is overwritten.

This can only appear in the case of a singleton constructor whose prototype is overwritten after having been already constructed in the DFG, then constructed again, so no wonder the test cases did not catch this.

I am writing a proper fix now.

[Geoffrey Garen]

> If the watchpointSet is null, it means there is no rare data and thus there
> shouldn't be an AllocationProfileWatchpoint for this node.

OK. Sounds like an ASSERT is appropriate, then.

> A least that was the case before I made the allocation profile clearing too
> aggressive when the .prototype is overwritten.
> 
> This can only appear in the case of a singleton constructor whose prototype
> is overwritten after having been already constructed in the DFG, then
> constructed again, so no wonder the test cases did not catch this.
> 
> I am writing a proper fix now.

Nice!

[Basile Clement]

Created attachment 251211 [details]
Slow (but clean) patch

[Basile Clement]

So in spite of the outrageous slowdown on Kraken/ai-astar I experienced yesterday, things seems to be now OK with the same code...
Patch w/ ChangeLog and additional style details used for this benchmark forthcoming.

Benchmark report for SunSpider, LongSpider, V8Spider, Octane, Kraken, JSRegress, AsmBench, and CompressionBench on Basiles-MacBook-Pro (MacBookPro11,3).

VMs tested:
"Conf#1" at /Volumes/Data/Baseline/OpenSource/WebKitBuild/Release/jsc (r183038)
"Conf#2" at /Volumes/Data/Temp/OpenSource/WebKitBuild/Release/jsc (r183038)

Collected 6 samples per benchmark/VM, with 6 VM invocations per benchmark. Emitted a call to gc() between sample measurements.
Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level
timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds.

                                                          Conf#1                    Conf#2                                      
SunSpider:
   3d-cube                                            4.4111+-0.2044            4.3238+-0.1437          might be 1.0202x faster
   3d-morph                                           5.3675+-0.2143     ?      5.5118+-0.3181        ? might be 1.0269x slower
   3d-raytrace                                        5.1515+-0.1547     ?      5.2351+-0.3690        ? might be 1.0162x slower
   access-binary-trees                                2.1466+-0.2869     ?      2.1582+-0.1988        ?
   access-fannkuch                                    5.1811+-0.1676     ?      5.6444+-0.6224        ? might be 1.0894x slower
   access-nbody                                       2.8918+-0.6780            2.6600+-0.3254          might be 1.0871x faster
   access-nsieve                                      3.1853+-0.3112            3.1574+-0.3144        
   bitops-3bit-bits-in-byte                           1.4046+-0.0306     ?      1.4376+-0.0628        ? might be 1.0235x slower
   bitops-bits-in-byte                                3.2297+-0.4151     ?      3.5550+-0.3327        ? might be 1.1007x slower
   bitops-bitwise-and                                 2.0845+-0.0474            2.0393+-0.0925          might be 1.0222x faster
   bitops-nsieve-bits                                 3.4909+-0.2473     ?      3.4997+-0.3675        ?
   controlflow-recursive                              1.8942+-0.0722     ?      1.9248+-0.1217        ? might be 1.0162x slower
   crypto-aes                                         3.8242+-0.3814            3.7720+-0.2282          might be 1.0138x faster
   crypto-md5                                         2.1725+-0.0943            2.1700+-0.1034        
   crypto-sha1                                        2.3858+-0.2348     ?      2.5206+-0.5790        ? might be 1.0565x slower
   date-format-tofte                                  7.1268+-0.9663            6.9247+-0.2957          might be 1.0292x faster
   date-format-xparb                                  4.9818+-0.5199     ?      5.0142+-0.1648        ?
   math-cordic                                        2.8288+-0.1861     ?      2.8327+-0.1511        ?
   math-partial-sums                                  4.5638+-0.1321     ?      5.0288+-0.8141        ? might be 1.1019x slower
   math-spectral-norm                                 1.7558+-0.0402     ?      1.8155+-0.0769        ? might be 1.0340x slower
   regexp-dna                                         6.6329+-0.1391     ?      6.8435+-0.5221        ? might be 1.0317x slower
   string-base64                                      4.3359+-0.2851            4.3359+-0.2919        
   string-fasta                                       6.0370+-0.3537            5.8378+-0.1334          might be 1.0341x faster
   string-tagcloud                                    8.9259+-0.3721     ?      9.3738+-1.4458        ? might be 1.0502x slower
   string-unpack-code                                18.9049+-0.7931     ?     19.1390+-0.6200        ? might be 1.0124x slower
   string-validate-input                              4.4896+-0.1714     ?      4.5817+-0.3382        ? might be 1.0205x slower

   <arithmetic>                                       4.5925+-0.0960     ?      4.6668+-0.0724        ? might be 1.0162x slower

                                                          Conf#1                    Conf#2                                      
LongSpider:
   3d-cube                                          817.6180+-19.7165    ?    822.9426+-12.3744       ?
   3d-morph                                        1573.7068+-14.2216    ?   1588.3167+-40.2457       ?
   3d-raytrace                                      688.1183+-12.9003    ?    691.6603+-16.6387       ?
   access-binary-trees                              870.7376+-11.3850    ?    887.5717+-42.1808       ? might be 1.0193x slower
   access-fannkuch                                  280.5467+-15.9701         279.4959+-17.8178       
   access-nbody                                     580.6865+-13.6523    ?    584.6453+-26.0042       ?
   access-nsieve                                    680.6292+-24.1388         661.7668+-9.8425          might be 1.0285x faster
   bitops-3bit-bits-in-byte                          44.4220+-0.9161           43.4525+-1.4874          might be 1.0223x faster
   bitops-bits-in-byte                               88.4662+-9.0516     ?     92.8015+-6.3850        ? might be 1.0490x slower
   bitops-nsieve-bits                               709.9130+-31.4591         697.8083+-17.1376         might be 1.0173x faster
   controlflow-recursive                            474.7817+-8.5041          474.7696+-12.7393       
   crypto-aes                                       583.7215+-13.5868    ?    588.3995+-18.9155       ?
   crypto-md5                                       553.5954+-11.9800         553.0100+-14.4423       
   crypto-sha1                                      606.8895+-17.2668         600.1799+-10.2761         might be 1.0112x faster
   date-format-tofte                                539.9448+-15.2411    ?    540.1794+-11.5012       ?
   date-format-xparb                                656.9644+-19.0389    ?    663.0825+-14.8690       ?
   math-cordic                                      531.5884+-20.5807         527.6919+-15.8413       
   math-partial-sums                                448.3560+-6.5085     ?    450.0747+-13.1886       ?
   math-spectral-norm                               578.6361+-14.8553    ?    594.4453+-28.2468       ? might be 1.0273x slower
   string-base64                                    343.0765+-8.1814     ?    345.7093+-11.5500       ?
   string-fasta                                     392.9964+-5.9136     ?    394.9641+-13.0204       ?
   string-tagcloud                                  205.1713+-3.3125     ?    205.8254+-2.9971        ?

   <geometric>                                      454.8897+-4.7613     ?    456.3003+-4.2183        ? might be 1.0031x slower

                                                          Conf#1                    Conf#2                                      
V8Spider:
   crypto                                            54.5824+-2.7855           54.1031+-3.3591        
   deltablue                                         85.6617+-2.8945           82.2306+-7.5361          might be 1.0417x faster
   earley-boyer                                      42.2645+-2.0524           41.5098+-3.0421          might be 1.0182x faster
   raytrace                                          32.2721+-2.1072     ?     32.7733+-2.7647        ? might be 1.0155x slower
   regexp                                            60.5894+-2.2568     ?     62.2518+-2.2598        ? might be 1.0274x slower
   richards                                          79.4209+-3.5216           76.1930+-4.9852          might be 1.0424x faster
   splay                                             36.9962+-4.2056     ?     39.1694+-2.4252        ? might be 1.0587x slower

   <geometric>                                       52.6704+-0.5327           52.5930+-1.6708          might be 1.0015x faster

                                                          Conf#1                    Conf#2                                      
Octane:
   encrypt                                           0.21007+-0.00446    ?     0.21144+-0.00308       ?
   decrypt                                           3.71290+-0.14272    ?     3.75313+-0.21931       ? might be 1.0108x slower
   deltablue                                x2       0.16996+-0.00489    ?     0.17085+-0.00273       ?
   earley                                            0.45581+-0.00553    ?     0.45863+-0.01049       ?
   boyer                                             5.91343+-0.10822    ?     6.14323+-0.24823       ? might be 1.0389x slower
   navier-stokes                            x2       5.37667+-0.13896    ?     5.38362+-0.13202       ?
   raytrace                                 x2       1.10628+-0.06968          1.04890+-0.03014         might be 1.0547x faster
   richards                                 x2       0.10011+-0.00399          0.09725+-0.00413         might be 1.0294x faster
   splay                                    x2       0.37522+-0.01394          0.37513+-0.01274       
   regexp                                   x2      30.36643+-0.71624         29.97653+-0.48692         might be 1.0130x faster
   pdfjs                                    x2      40.33048+-0.99985         40.21220+-0.47707       
   mandreel                                 x2      49.51375+-2.06638         47.59378+-0.59116         might be 1.0403x faster
   gbemu                                    x2      32.76628+-1.98360    ?    33.43657+-2.29444       ? might be 1.0205x slower
   closure                                           0.52168+-0.01117    ?     0.52477+-0.01508       ?
   jquery                                            6.72555+-0.17672          6.44958+-0.21828         might be 1.0428x faster
   box2d                                    x2      10.59619+-0.15298    ?    10.79456+-0.38331       ? might be 1.0187x slower
   zlib                                     x2     369.35583+-16.86866   ?   370.48058+-20.24982      ?
   typescript                               x2     679.37744+-22.76805   ?   685.72013+-28.59215      ?

   <geometric>                                       6.05632+-0.04854          6.02923+-0.05310         might be 1.0045x faster

                                                          Conf#1                    Conf#2                                      
Kraken:
   ai-astar                                          287.336+-15.250           284.738+-8.406         
   audio-beat-detection                              100.672+-1.883      ?     103.208+-6.142         ? might be 1.0252x slower
   audio-dft                                         172.977+-4.890      ?     176.204+-5.033         ? might be 1.0187x slower
   audio-fft                                          81.997+-3.216             79.780+-4.816           might be 1.0278x faster
   audio-oscillator                                  185.525+-2.845      ?     185.645+-3.430         ?
   imaging-darkroom                                   98.589+-2.853      ?      98.676+-3.153         ?
   imaging-desaturate                                 62.835+-2.297             58.786+-3.219           might be 1.0689x faster
   imaging-gaussian-blur                              90.820+-2.361      ?      93.428+-3.716         ? might be 1.0287x slower
   json-parse-financial                               40.398+-3.083             38.619+-2.061           might be 1.0461x faster
   json-stringify-tinderbox                           53.089+-2.624             52.673+-1.704         
   stanford-crypto-aes                                61.027+-2.323             59.853+-2.455           might be 1.0196x faster
   stanford-crypto-ccm                                55.202+-8.040             50.737+-3.651           might be 1.0880x faster
   stanford-crypto-pbkdf2                            162.948+-5.371            157.755+-4.224           might be 1.0329x faster
   stanford-crypto-sha256-iterative                   54.075+-4.366             53.503+-2.294           might be 1.0107x faster

   <arithmetic>                                      107.678+-1.610            106.686+-1.659           might be 1.0093x faster

                                                          Conf#1                    Conf#2                                      
JSRegress:
   abs-boolean                                        2.6124+-0.4033            2.4428+-0.1249          might be 1.0694x faster
   adapt-to-double-divide                            17.0688+-0.5593     ?     17.1006+-0.3706        ?
   aliased-arguments-getbyval                         1.1637+-0.2058            1.1230+-0.0949          might be 1.0362x faster
   allocate-big-object                                2.8472+-0.4356     ?      2.9385+-0.8776        ? might be 1.0320x slower
   arguments-named-and-reflective                    11.2933+-0.9596           11.1178+-0.4019          might be 1.0158x faster
   arguments-out-of-bounds                           10.9053+-0.4980           10.6532+-0.3087          might be 1.0237x faster
   arguments-strict-mode                             10.6584+-0.7108     ?     10.9958+-0.7231        ? might be 1.0317x slower
   arguments                                          9.5830+-0.5207            9.2352+-0.6302          might be 1.0377x faster
   arity-mismatch-inlining                            0.8003+-0.0312            0.7971+-0.0338        
   array-access-polymorphic-structure                 6.3953+-0.5653            6.3636+-0.3803        
   array-nonarray-polymorhpic-access                 29.6038+-1.2433           29.4707+-1.7052        
   array-prototype-every                             84.1193+-4.0456     ?     86.0033+-2.0384        ? might be 1.0224x slower
   array-prototype-forEach                           84.4655+-2.6500           83.4175+-3.5744          might be 1.0126x faster
   array-prototype-map                               91.3452+-3.1869     ?     92.9378+-4.6529        ? might be 1.0174x slower
   array-prototype-some                              84.7174+-2.7073     ?     85.0240+-5.3037        ?
   array-splice-contiguous                           43.6191+-1.6529     ^     38.8805+-0.8602        ^ definitely 1.1219x faster
   array-with-double-add                              3.5232+-0.4815     ?      3.5730+-0.2506        ? might be 1.0141x slower
   array-with-double-increment                        3.1361+-0.2830     ?      3.2225+-0.2474        ? might be 1.0275x slower
   array-with-double-mul-add                          4.3812+-0.5406            4.2806+-0.3037          might be 1.0235x faster
   array-with-double-sum                              3.3892+-0.1037            3.3739+-0.3085        
   array-with-int32-add-sub                           5.8597+-0.1233     ?      6.1549+-0.6268        ? might be 1.0504x slower
   array-with-int32-or-double-sum                     3.4059+-0.3212            3.3490+-0.2758          might be 1.0170x faster
   ArrayBuffer-DataView-alloc-large-long-lived   
                                                     30.9327+-4.1872           27.4834+-0.5178          might be 1.1255x faster
   ArrayBuffer-DataView-alloc-long-lived             12.8712+-0.9715     ?     13.7437+-1.6279        ? might be 1.0678x slower
   ArrayBuffer-Int32Array-byteOffset                  3.7529+-0.1095            3.7030+-0.2212          might be 1.0135x faster
   ArrayBuffer-Int8Array-alloc-large-long-lived   
                                                     29.4908+-2.1964     ?     30.2222+-4.2261        ? might be 1.0248x slower
   ArrayBuffer-Int8Array-alloc-long-lived-buffer   
                                                     21.8310+-1.2266     ?     22.1141+-1.6000        ? might be 1.0130x slower
   ArrayBuffer-Int8Array-alloc-long-lived            12.3098+-0.6281           12.2984+-0.5201        
   ArrayBuffer-Int8Array-alloc                       10.8290+-1.3924           10.2240+-0.2865          might be 1.0592x faster
   asmjs_bool_bug                                     7.1077+-0.5078            6.8527+-0.4310          might be 1.0372x faster
   assign-custom-setter-polymorphic                   2.6458+-0.1286     ?      2.6799+-0.2595        ? might be 1.0129x slower
   assign-custom-setter                               3.6307+-0.2180            3.5252+-0.1748          might be 1.0299x faster
   basic-set                                          7.9879+-0.7943     ?      8.3805+-0.7784        ? might be 1.0492x slower
   big-int-mul                                        3.4585+-0.1257     ?      3.4856+-0.1692        ?
   boolean-test                                       3.0920+-0.3657            2.7690+-0.0611          might be 1.1166x faster
   branch-fold                                        3.5407+-0.0889     ?      3.6171+-0.1821        ? might be 1.0216x slower
   by-val-generic                                     8.0601+-0.3659            7.4375+-0.2719          might be 1.0837x faster
   call-spread-apply                                 27.6390+-1.5798           27.2447+-0.5247          might be 1.0145x faster
   call-spread-call                                  22.4515+-1.0915     ?     22.5743+-0.4371        ?
   captured-assignments                               0.3919+-0.0371            0.3857+-0.0517          might be 1.0160x faster
   cast-int-to-double                                 5.0644+-0.4675            5.0507+-0.2256        
   cell-argument                                      7.0046+-0.8499            6.6217+-0.9109          might be 1.0578x faster
   cfg-simplify                                       2.8696+-0.1196     ?      3.0249+-0.2185        ? might be 1.0541x slower
   chain-getter-access                                9.3335+-0.3058            9.1649+-0.1615          might be 1.0184x faster
   cmpeq-obj-to-obj-other                            11.1920+-1.0460           10.0025+-0.7598          might be 1.1189x faster
   constant-test                                      4.6949+-0.1809     ?      4.7850+-0.2780        ? might be 1.0192x slower
   create-lots-of-functions                          11.6183+-1.6850           10.7512+-1.1989          might be 1.0807x faster
   DataView-custom-properties                        37.7437+-2.6097           35.7613+-2.7194          might be 1.0554x faster
   deconstructing-parameters-overridden-by-function   
                                                      0.5586+-0.2080            0.4260+-0.0377          might be 1.3113x faster
   delay-tear-off-arguments-strictmode               12.5851+-0.6293     ?     13.5450+-1.1332        ? might be 1.0763x slower
   deltablue-varargs                                150.9985+-4.3408          149.9580+-4.0979        
   destructuring-arguments                           14.5688+-1.2935     ?     15.5117+-0.9651        ? might be 1.0647x slower
   destructuring-swap                                 4.8762+-0.3395            4.7178+-0.1383          might be 1.0336x faster
   direct-arguments-getbyval                          1.0990+-0.0450     ?      1.3486+-0.4359        ? might be 1.2271x slower
   div-boolean-double                                 5.4707+-0.1005            5.4607+-0.1971        
   div-boolean                                        8.6695+-0.2311            8.4148+-0.4300          might be 1.0303x faster
   double-get-by-val-out-of-bounds                    4.2937+-0.1702            4.0596+-0.1076          might be 1.0577x faster
   double-pollution-getbyval                          9.1175+-0.3625            8.9581+-0.2146          might be 1.0178x faster
   double-pollution-putbyoffset                       4.0350+-0.1464     ?      4.6441+-1.1842        ? might be 1.1509x slower
   double-to-int32-typed-array-no-inline              2.2477+-0.2448     ?      2.2925+-0.6242        ? might be 1.0199x slower
   double-to-int32-typed-array                        1.9484+-0.3038     ?      1.9720+-0.5252        ? might be 1.0121x slower
   double-to-uint32-typed-array-no-inline             2.2250+-0.1157            2.1003+-0.0203          might be 1.0594x faster
   double-to-uint32-typed-array                       1.8212+-0.1917            1.7602+-0.1020          might be 1.0347x faster
   elidable-new-object-dag                           37.2981+-3.1315     ?     38.7206+-2.9826        ? might be 1.0381x slower
   elidable-new-object-roflcopter                    39.6376+-3.2297           39.5931+-3.8236        
   elidable-new-object-then-call                     34.0243+-3.1473     ?     34.7145+-4.2870        ? might be 1.0203x slower
   elidable-new-object-tree                          39.7441+-2.5039           39.3264+-2.1488          might be 1.0106x faster
   empty-string-plus-int                              4.8006+-0.1188     ?      4.8724+-0.2138        ? might be 1.0150x slower
   emscripten-cube2hash                              27.5030+-1.1814     ?     30.8230+-3.5570        ? might be 1.1207x slower
   exit-length-on-plain-object                       12.8774+-0.2845           12.7901+-0.7225        
   external-arguments-getbyval                        1.3349+-0.1772            1.2212+-0.1398          might be 1.0931x faster
   external-arguments-putbyval                        2.1980+-0.1282     ?      2.2215+-0.1669        ? might be 1.0107x slower
   fixed-typed-array-storage-var-index                1.2353+-0.2150            1.1725+-0.0669          might be 1.0535x faster
   fixed-typed-array-storage                          0.8152+-0.0426            0.8137+-0.0436        
   Float32Array-matrix-mult                           4.1239+-0.3860            3.8107+-0.0821          might be 1.0822x faster
   Float32Array-to-Float64Array-set                  51.0987+-1.0249           50.8393+-2.5773        
   Float64Array-alloc-long-lived                     66.3454+-4.6387     ?     66.9267+-3.3990        ?
   Float64Array-to-Int16Array-set                    62.0043+-1.3961     ?     64.2865+-3.4803        ? might be 1.0368x slower
   fold-double-to-int                                13.0621+-0.5187           12.9029+-0.4743          might be 1.0123x faster
   fold-get-by-id-to-multi-get-by-offset-rare-int   
                                                     10.2085+-0.4990            9.6475+-0.3437          might be 1.0582x faster
   fold-get-by-id-to-multi-get-by-offset              8.4259+-0.7676            7.8657+-1.7257          might be 1.0712x faster
   fold-multi-get-by-offset-to-get-by-offset   
                                                      7.4025+-1.1130     ?      8.2970+-0.6792        ? might be 1.1208x slower
   fold-multi-get-by-offset-to-poly-get-by-offset   
                                                      7.3861+-0.8781            7.1215+-0.9959          might be 1.0372x faster
   fold-multi-put-by-offset-to-poly-put-by-offset   
                                                      7.8603+-0.9585            7.2335+-0.6107          might be 1.0867x faster
   fold-multi-put-by-offset-to-put-by-offset   
                                                      4.2035+-0.9675     ?      5.1413+-0.9192        ? might be 1.2231x slower
   fold-multi-put-by-offset-to-replace-or-transition-put-by-offset   
                                                      8.9422+-0.7122            8.6329+-0.6409          might be 1.0358x faster
   fold-put-by-id-to-multi-put-by-offset              8.3568+-0.4795     ?      8.5654+-1.2329        ? might be 1.0250x slower
   fold-put-structure                                 4.3931+-0.9913     ?      4.4553+-0.7154        ? might be 1.0142x slower
   for-of-iterate-array-entries                       4.3953+-0.5308            4.1294+-0.0866          might be 1.0644x faster
   for-of-iterate-array-keys                          3.2304+-0.0878     ?      3.3182+-0.2229        ? might be 1.0272x slower
   for-of-iterate-array-values                        3.6969+-1.3025            3.3634+-0.3986          might be 1.0991x faster
   fround                                            18.4783+-1.1521     ?     18.6940+-0.7156        ? might be 1.0117x slower
   ftl-library-inlining-dataview                     61.3789+-1.4651           60.9891+-1.7918        
   ftl-library-inlining                             118.6348+-5.0307          114.4706+-5.2385          might be 1.0364x faster
   function-dot-apply                                 2.0585+-0.0683     ?      2.2522+-0.1995        ? might be 1.0941x slower
   function-test                                      2.9905+-0.0819            2.9102+-0.0363          might be 1.0276x faster
   function-with-eval                                95.9841+-4.0819     ?    110.1152+-24.8950       ? might be 1.1472x slower
   gcse-poly-get-less-obvious                        14.8907+-0.2268           14.8212+-0.4925        
   gcse-poly-get                                     16.4358+-0.2338     ?     16.9280+-0.5059        ? might be 1.0299x slower
   gcse                                               4.1624+-0.4775            4.0576+-0.4708          might be 1.0258x faster
   get-by-id-bimorphic-check-structure-elimination-simple   
                                                      2.8382+-0.4728            2.5909+-0.0508          might be 1.0955x faster
   get-by-id-bimorphic-check-structure-elimination   
                                                      5.9729+-0.1525            5.8138+-0.1369          might be 1.0274x faster
   get-by-id-chain-from-try-block                     6.7079+-0.3848            6.6500+-0.2590        
   get-by-id-check-structure-elimination              4.5428+-0.2881     ?      4.9865+-1.2217        ? might be 1.0977x slower
   get-by-id-proto-or-self                           14.9050+-0.2173     ?     14.9645+-0.6398        ?
   get-by-id-quadmorphic-check-structure-elimination-simple   
                                                      3.3185+-0.8081            3.2056+-0.3717          might be 1.0352x faster
   get-by-id-self-or-proto                           14.8591+-0.7872     ?     15.0859+-0.6957        ? might be 1.0153x slower
   get-by-val-out-of-bounds                           4.0846+-0.1382     ?      4.1166+-0.5714        ?
   get_callee_monomorphic                             2.3303+-0.1135     ?      2.4639+-0.2337        ? might be 1.0573x slower
   get_callee_polymorphic                             3.6390+-0.6101            3.4173+-0.2397          might be 1.0649x faster
   getter-no-activation                               4.8637+-0.1939     ?      4.9764+-0.3604        ? might be 1.0232x slower
   getter-richards                                  120.9899+-15.6810         114.1755+-8.8575          might be 1.0597x faster
   getter                                             5.4965+-0.3118     ?      5.5071+-0.2932        ?
   global-var-const-infer-fire-from-opt               0.8497+-0.0889            0.8380+-0.0945          might be 1.0140x faster
   global-var-const-infer                             0.8065+-0.1089     ?      0.8110+-0.1850        ?
   HashMap-put-get-iterate-keys                      24.0239+-0.3676     ?     24.7915+-0.8495        ? might be 1.0320x slower
   HashMap-put-get-iterate                           24.8761+-0.8427           24.4520+-1.1561          might be 1.0173x faster
   HashMap-string-put-get-iterate                    24.8168+-1.7032           23.8726+-1.6081          might be 1.0396x faster
   hoist-make-rope                                    8.3755+-0.7564            8.2123+-0.4897          might be 1.0199x faster
   hoist-poly-check-structure-effectful-loop   
                                                      4.3172+-0.3195     ?      4.3516+-0.2903        ?
   hoist-poly-check-structure                         3.2174+-0.0681     ?      3.2314+-0.1458        ?
   imul-double-only                                   6.6746+-0.2625     ?      6.8629+-0.4471        ? might be 1.0282x slower
   imul-int-only                                      8.4836+-0.3282     ?      8.6803+-0.6001        ? might be 1.0232x slower
   imul-mixed                                         6.7882+-0.3174            6.6359+-0.4031          might be 1.0230x faster
   in-four-cases                                     15.8355+-0.7204     ?     16.8802+-2.1376        ? might be 1.0660x slower
   in-one-case-false                                  8.5850+-0.4471     ?      9.8381+-2.0429        ? might be 1.1460x slower
   in-one-case-true                                   9.8300+-1.9223            8.6866+-0.5848          might be 1.1316x faster
   in-two-cases                                       8.8835+-0.7052     ?      9.1420+-0.6992        ? might be 1.0291x slower
   indexed-properties-in-objects                      2.8223+-0.1008     ?      2.8234+-0.0950        ?
   infer-closure-const-then-mov-no-inline             3.4264+-0.8576            3.0686+-0.0462          might be 1.1166x faster
   infer-closure-const-then-mov                      18.2389+-0.3675           18.1495+-0.7134        
   infer-closure-const-then-put-to-scope-no-inline   
                                                     13.8455+-0.7286           13.2236+-0.2516          might be 1.0470x faster
   infer-closure-const-then-put-to-scope             24.2026+-0.6288     ?     24.6665+-1.0772        ? might be 1.0192x slower
   infer-closure-const-then-reenter-no-inline   
                                                     53.7620+-1.7351     ?     55.7958+-2.6804        ? might be 1.0378x slower
   infer-closure-const-then-reenter                  25.3317+-1.3177           25.1524+-1.5309        
   infer-constant-global-property                    31.3579+-1.8043           31.0830+-0.8867        
   infer-constant-property                            2.6389+-0.0945     ?      2.7349+-0.2005        ? might be 1.0364x slower
   infer-one-time-closure-ten-vars                    9.0155+-0.7036     ?      9.0997+-0.5744        ?
   infer-one-time-closure-two-vars                    8.2882+-0.3000     ?      8.9283+-1.5039        ? might be 1.0772x slower
   infer-one-time-closure                             8.0345+-0.1446     ?      8.2469+-0.4173        ? might be 1.0264x slower
   infer-one-time-deep-closure                       13.7146+-1.0183           13.3157+-0.9131          might be 1.0300x faster
   inline-arguments-access                            4.0356+-0.3460     ?      4.1931+-0.5745        ? might be 1.0390x slower
   inline-arguments-aliased-access                    4.1823+-0.2530            3.9044+-0.0809          might be 1.0712x faster
   inline-arguments-local-escape                      4.3812+-0.2852     ?      4.4043+-0.3647        ?
   inline-get-scoped-var                              4.7461+-0.2033     ?      4.9052+-0.3011        ? might be 1.0335x slower
   inlined-put-by-id-transition                      10.3148+-0.7765            9.9667+-0.8308          might be 1.0349x faster
   int-or-other-abs-then-get-by-val                   5.1212+-0.4289            5.0435+-0.4794          might be 1.0154x faster
   int-or-other-abs-zero-then-get-by-val             16.7528+-0.2182     ?     17.4038+-0.6839        ? might be 1.0389x slower
   int-or-other-add-then-get-by-val                   4.0844+-0.1849     ?      4.1119+-0.2725        ?
   int-or-other-add                                   5.2224+-0.2567            4.9546+-0.2567          might be 1.0541x faster
   int-or-other-div-then-get-by-val                   3.8312+-0.1098            3.8222+-0.1107        
   int-or-other-max-then-get-by-val                   4.4756+-0.9596            4.3152+-0.5135          might be 1.0372x faster
   int-or-other-min-then-get-by-val                   4.3708+-0.2186            4.1888+-0.1418          might be 1.0434x faster
   int-or-other-mod-then-get-by-val                   3.7262+-0.3753            3.6206+-0.2314          might be 1.0292x faster
   int-or-other-mul-then-get-by-val                   3.9207+-0.2014     ?      4.1636+-0.4268        ? might be 1.0619x slower
   int-or-other-neg-then-get-by-val                   4.4564+-0.1105            4.4125+-0.1963        
   int-or-other-neg-zero-then-get-by-val             17.8671+-1.3597           16.9993+-0.5341          might be 1.0510x faster
   int-or-other-sub-then-get-by-val                   4.0664+-0.1521     ?      4.2163+-0.3643        ? might be 1.0369x slower
   int-or-other-sub                                   3.6337+-0.4867            3.4364+-0.1194          might be 1.0574x faster
   int-overflow-local                                 4.1526+-0.0403            4.1104+-0.0776          might be 1.0103x faster
   Int16Array-alloc-long-lived                       48.7369+-4.0494           47.8248+-5.0278          might be 1.0191x faster
   Int16Array-bubble-sort-with-byteLength            17.6099+-0.4861           17.4806+-0.3733        
   Int16Array-bubble-sort                            17.6533+-0.7791     ?     17.6838+-0.7807        ?
   Int16Array-load-int-mul                            1.3483+-0.0232     ?      1.4420+-0.1950        ? might be 1.0695x slower
   Int16Array-to-Int32Array-set                      46.2507+-0.8523     ?     46.4640+-1.0458        ?
   Int32Array-alloc-large                            13.6655+-2.0230           13.3265+-1.8258          might be 1.0254x faster
   Int32Array-alloc-long-lived                       55.9387+-3.9141           53.5671+-5.2731          might be 1.0443x faster
   Int32Array-alloc                                   2.8921+-0.3054     ?      3.0367+-0.2173        ? might be 1.0500x slower
   Int32Array-Int8Array-view-alloc                    6.7293+-0.5029            6.5955+-0.5190          might be 1.0203x faster
   int52-spill                                        6.2748+-0.9450            6.0066+-0.3288          might be 1.0446x faster
   Int8Array-alloc-long-lived                        43.8311+-4.5533           43.6835+-2.8911        
   Int8Array-load-with-byteLength                     3.4565+-0.2464            3.4504+-0.0970        
   Int8Array-load                                     3.4598+-0.1892     ?      3.5139+-0.2510        ? might be 1.0156x slower
   integer-divide                                    11.2052+-0.5573           10.9589+-0.4075          might be 1.0225x faster
   integer-modulo                                     1.6611+-0.0679     ?      1.7275+-0.2495        ? might be 1.0400x slower
   large-int-captured                                 3.9163+-0.0747     ?      4.0233+-0.1640        ? might be 1.0273x slower
   large-int-neg                                     15.0482+-0.4990           15.0210+-0.2414        
   large-int                                         14.3858+-0.5765     ?     15.4661+-1.5988        ? might be 1.0751x slower
   logical-not                                        4.3418+-0.2568     ?      4.3884+-0.2367        ? might be 1.0107x slower
   lots-of-fields                                    10.4569+-0.4284           10.2705+-0.5437          might be 1.0181x faster
   make-indexed-storage                               2.7777+-0.0751     ?      2.9109+-0.1726        ? might be 1.0480x slower
   make-rope-cse                                      3.9885+-0.2592     ?      4.1922+-0.6506        ? might be 1.0511x slower
   marsaglia-larger-ints                             35.6355+-1.6379           35.2685+-1.0325          might be 1.0104x faster
   marsaglia-osr-entry                               22.1777+-0.5668           22.0870+-0.9666        
   max-boolean                                        2.7627+-0.1074            2.7440+-0.1887        
   method-on-number                                  18.1119+-0.7544           16.8166+-1.0631          might be 1.0770x faster
   min-boolean                                        2.8259+-0.2639            2.7153+-0.1995          might be 1.0407x faster
   minus-boolean-double                               3.0961+-0.0982     ?      3.1600+-0.1237        ? might be 1.0206x slower
   minus-boolean                                      2.4540+-0.3917     ?      2.4784+-0.3236        ?
   misc-strict-eq                                    31.6663+-2.1068     ?     32.6092+-1.9717        ? might be 1.0298x slower
   mod-boolean-double                                11.5306+-0.2425     ?     11.5972+-0.5547        ?
   mod-boolean                                        8.5161+-0.1225     ?      8.5398+-0.1789        ?
   mul-boolean-double                                 3.7844+-0.1778     ?      3.8935+-0.4416        ? might be 1.0288x slower
   mul-boolean                                        2.7473+-0.0381     ?      2.8382+-0.0946        ? might be 1.0331x slower
   neg-boolean                                        3.2996+-0.3726     ?      3.3427+-0.4394        ? might be 1.0130x slower
   negative-zero-divide                               0.3033+-0.0246     ?      0.3065+-0.0180        ? might be 1.0107x slower
   negative-zero-modulo                               0.3037+-0.0243     ?      0.3303+-0.0393        ? might be 1.0876x slower
   negative-zero-negate                               0.3098+-0.0706     ?      0.3193+-0.0728        ? might be 1.0309x slower
   nested-function-parsing                           34.5573+-2.6194           33.6400+-0.7249          might be 1.0273x faster
   new-array-buffer-dead                              2.7913+-0.1426            2.7263+-0.0645          might be 1.0239x faster
   new-array-buffer-push                              6.0462+-0.3556            6.0190+-0.4608        
   new-array-dead                                     9.6864+-0.5997     ?      9.9414+-0.8334        ? might be 1.0263x slower
   new-array-push                                     3.7024+-0.5537            3.5044+-0.2072          might be 1.0565x faster
   no-inline-constructor                            108.9671+-2.2867          104.5506+-4.7201          might be 1.0422x faster
   number-test                                        2.9881+-0.3125            2.9140+-0.2580          might be 1.0254x faster
   object-closure-call                                4.8981+-0.1294            4.8772+-0.0618        
   object-test                                        2.9364+-0.1908     ?      2.9474+-0.1983        ?
   obvious-sink-pathology-taken                     107.0574+-3.9488     ?    111.6744+-6.7696        ? might be 1.0431x slower
   obvious-sink-pathology                           104.7736+-4.2252     ?    108.2299+-4.2431        ? might be 1.0330x slower
   obviously-elidable-new-object                     31.3320+-2.5127           30.7920+-3.1901          might be 1.0175x faster
   plus-boolean-arith                                 2.5021+-0.2101            2.4873+-0.2770        
   plus-boolean-double                                3.3088+-0.6157            3.0722+-0.0601          might be 1.0770x faster
   plus-boolean                                       2.5480+-0.0853            2.5155+-0.0646          might be 1.0129x faster
   poly-chain-access-different-prototypes-simple   
                                                      2.6983+-0.0776     ?      2.8265+-0.2295        ? might be 1.0475x slower
   poly-chain-access-different-prototypes             2.5655+-0.1119     ?      2.6258+-0.3196        ? might be 1.0235x slower
   poly-chain-access-simpler                          2.8056+-0.2506     ?      2.8295+-0.4094        ?
   poly-chain-access                                  2.5168+-0.1450     ?      2.5530+-0.1645        ? might be 1.0144x slower
   poly-stricteq                                     49.1741+-1.6906     ?     50.1401+-2.8268        ? might be 1.0196x slower
   polymorphic-array-call                             1.0881+-0.1012     ?      1.1031+-0.1228        ? might be 1.0137x slower
   polymorphic-get-by-id                              2.8107+-0.0662     ?      2.8518+-0.0942        ? might be 1.0146x slower
   polymorphic-put-by-id                             26.2426+-1.0928           25.5664+-0.1925          might be 1.0264x faster
   polymorphic-structure                             13.9203+-0.5674           13.8964+-1.0804        
   polyvariant-monomorphic-get-by-id                  6.4553+-0.2236     !      7.5822+-0.7260        ! definitely 1.1746x slower
   proto-getter-access                                9.0942+-0.0968     ?      9.3986+-0.3046        ? might be 1.0335x slower
   put-by-id-replace-and-transition                   8.4405+-0.6790     ?      8.7300+-1.1852        ? might be 1.0343x slower
   put-by-id-slightly-polymorphic                     2.6528+-0.1409     ?      2.6679+-0.1786        ?
   put-by-id                                         10.7583+-1.4083     ?     10.9115+-1.1898        ? might be 1.0142x slower
   put-by-val-direct                                  0.3788+-0.0268     ?      0.4498+-0.1291        ? might be 1.1873x slower
   put-by-val-large-index-blank-indexing-type   
                                                      5.6993+-0.7683     ?      5.9220+-1.3019        ? might be 1.0391x slower
   put-by-val-machine-int                             2.4703+-0.1134     ?      2.5688+-0.2164        ? might be 1.0399x slower
   rare-osr-exit-on-local                            15.7332+-0.9632           15.2385+-0.5151          might be 1.0325x faster
   register-pressure-from-osr                        17.7685+-0.4828           17.3510+-0.4243          might be 1.0241x faster
   setter                                             5.7622+-0.4019            5.5868+-0.1466          might be 1.0314x faster
   simple-activation-demo                            25.4145+-1.0757     ?     26.0834+-1.6628        ? might be 1.0263x slower
   simple-getter-access                              12.3498+-0.4463           12.2237+-0.2240          might be 1.0103x faster
   simple-poly-call-nested                            9.2196+-0.8026            9.2072+-0.4101        
   simple-poly-call                                   1.2638+-0.1809            1.1849+-0.0164          might be 1.0666x faster
   sin-boolean                                       18.8774+-1.3058           18.2290+-0.4796          might be 1.0356x faster
   singleton-scope                                   66.5435+-2.1890           65.5371+-3.0307          might be 1.0154x faster
   sinkable-new-object-dag                           62.5098+-2.9018     ?     63.9054+-5.0768        ? might be 1.0223x slower
   sinkable-new-object-taken                         50.3336+-4.5854           48.2935+-2.3465          might be 1.0422x faster
   sinkable-new-object                               32.9258+-1.3582     ?     32.9503+-2.7257        ?
   slow-array-profile-convergence                     2.5645+-0.1417            2.4883+-0.0961          might be 1.0306x faster
   slow-convergence                                   2.4004+-0.1481     ?      2.4690+-0.2960        ? might be 1.0285x slower
   sorting-benchmark                                 19.9376+-0.5832     ?     20.3229+-0.9949        ? might be 1.0193x slower
   sparse-conditional                                 1.2254+-0.3264     ?      1.2809+-0.4717        ? might be 1.0453x slower
   splice-to-remove                                  15.2596+-2.8761           14.4368+-0.4090          might be 1.0570x faster
   string-char-code-at                               15.4146+-0.6647     ?     15.4984+-0.4344        ?
   string-concat-object                               2.1832+-0.1572     ?      2.4016+-0.2744        ? might be 1.1000x slower
   string-concat-pair-object                          2.2862+-0.3378            2.2569+-0.1136          might be 1.0130x faster
   string-concat-pair-simple                         10.4030+-1.3108           10.2056+-1.1025          might be 1.0193x faster
   string-concat-simple                              11.5682+-3.7015           10.1462+-1.2285          might be 1.1401x faster
   string-cons-repeat                                 6.7654+-0.3419     ?      8.0803+-1.4258        ? might be 1.1944x slower
   string-cons-tower                                  7.1641+-0.4320     ?      7.1866+-0.7949        ?
   string-equality                                   16.4210+-0.4724     ?     16.4843+-1.2007        ?
   string-get-by-val-big-char                         6.9902+-0.2899            6.8252+-0.3940          might be 1.0242x faster
   string-get-by-val-out-of-bounds-insane             3.1980+-0.2120     ?      3.2200+-0.0968        ?
   string-get-by-val-out-of-bounds                    3.9671+-0.0994     ?      4.1689+-0.1258        ? might be 1.0509x slower
   string-get-by-val                                  3.0064+-0.3366            2.9761+-0.1745          might be 1.0102x faster
   string-hash                                        2.0874+-0.4243            1.8457+-0.0976          might be 1.1310x faster
   string-long-ident-equality                        13.5976+-0.3661     ?     14.4719+-1.5542        ? might be 1.0643x slower
   string-out-of-bounds                              10.5994+-0.2091     ?     10.9404+-0.7613        ? might be 1.0322x slower
   string-repeat-arith                               28.0467+-1.0644           27.4799+-0.7036          might be 1.0206x faster
   string-sub                                        58.4035+-2.0790           55.2434+-3.2920          might be 1.0572x faster
   string-test                                        2.9138+-0.4746            2.7748+-0.0839          might be 1.0501x faster
   string-var-equality                               28.5701+-0.5370     ?     29.8542+-2.1021        ? might be 1.0449x slower
   structure-hoist-over-transitions                   2.5118+-0.2271     ?      2.5342+-0.1670        ?
   substring-concat-weird                            36.6634+-1.8219     ?     38.2138+-2.6922        ? might be 1.0423x slower
   substring-concat                                  39.1127+-1.0932     ?     39.3696+-1.2294        ?
   substring                                         46.6574+-2.5097           46.5481+-3.7045        
   switch-char-constant                               2.8241+-0.2673            2.6672+-0.0314          might be 1.0588x faster
   switch-char                                        6.1698+-0.6116     ?      6.2150+-0.9096        ?
   switch-constant                                    9.8255+-3.1176            8.6575+-1.0438          might be 1.1349x faster
   switch-string-basic-big-var                       13.6732+-0.7577           13.5375+-0.7866          might be 1.0100x faster
   switch-string-basic-big                           12.7436+-0.4469     ?     12.7967+-0.5288        ?
   switch-string-basic-var                           13.0576+-0.2949           12.7418+-0.4423          might be 1.0248x faster
   switch-string-basic                               12.9240+-1.0038           11.9897+-0.3513          might be 1.0779x faster
   switch-string-big-length-tower-var                19.2532+-0.5932     ?     19.9592+-2.9737        ? might be 1.0367x slower
   switch-string-length-tower-var                    13.3217+-0.5538     ?     13.5393+-0.7084        ? might be 1.0163x slower
   switch-string-length-tower                        11.9067+-0.5744           11.6297+-0.1933          might be 1.0238x faster
   switch-string-short                               11.7114+-0.5644     ?     11.8004+-0.4911        ?
   switch                                            12.7096+-1.0044           11.7810+-0.6533          might be 1.0788x faster
   tear-off-arguments-simple                          3.2962+-0.1680            3.2032+-0.4366          might be 1.0290x faster
   tear-off-arguments                                 4.6378+-0.7649            4.1485+-0.1433          might be 1.1179x faster
   temporal-structure                                12.4672+-0.3427     ?     13.1151+-1.4988        ? might be 1.0520x slower
   to-int32-boolean                                  13.3999+-0.3373     ?     13.4344+-0.3336        ?
   try-catch-get-by-val-cloned-arguments             13.4958+-0.6048     ?     14.2495+-1.2112        ? might be 1.0558x slower
   try-catch-get-by-val-direct-arguments              6.2397+-0.6576            5.9273+-0.2225          might be 1.0527x faster
   try-catch-get-by-val-scoped-arguments              7.7965+-0.8139     ?     10.7249+-2.9016        ? might be 1.3756x slower
   undefined-property-access                        223.6949+-4.0243     ?    224.4459+-6.7891        ?
   undefined-test                                     2.9040+-0.2012     ?      2.9294+-0.2558        ?
   unprofiled-licm                                   15.9854+-2.9598           15.1021+-1.2818          might be 1.0585x faster
   varargs-call                                      14.1574+-0.3450     ?     15.4649+-0.9988        ? might be 1.0924x slower
   varargs-construct-inline                          18.9257+-0.7375     ?     19.4996+-2.0310        ? might be 1.0303x slower
   varargs-construct                                 32.1125+-1.8864     ?     34.0411+-3.5164        ? might be 1.0601x slower
   varargs-inline                                     8.3596+-0.2664     ?      8.9384+-0.5767        ? might be 1.0692x slower
   varargs-strict-mode                                9.9932+-1.2811            9.4230+-0.1707          might be 1.0605x faster
   varargs                                            9.8012+-0.7140     ?     10.0531+-2.0576        ? might be 1.0257x slower
   weird-inlining-const-prop                          2.0902+-0.1633     ?      2.1792+-0.3850        ? might be 1.0426x slower

   <geometric>                                        7.8998+-0.0467            7.8978+-0.0334          might be 1.0003x faster

                                                          Conf#1                    Conf#2                                      
AsmBench:
   bigfib.cpp                                       466.4996+-6.8999     ?    468.8544+-9.9788        ?
   cray.c                                           411.6480+-9.4796     ?    424.9932+-17.2724       ? might be 1.0324x slower
   dry.c                                            460.8665+-56.1903         440.3503+-11.8731         might be 1.0466x faster
   FloatMM.c                                        712.5105+-5.4940     !    739.2544+-16.0969       ! definitely 1.0375x slower
   gcc-loops.cpp                                   3732.0947+-127.2753   ?   3737.2475+-96.7664       ?
   n-body.c                                         896.1395+-24.6118         871.9576+-28.1694         might be 1.0277x faster
   Quicksort.c                                      412.6768+-3.4782     ?    419.7579+-14.5950       ? might be 1.0172x slower
   stepanov_container.cpp                          3836.8887+-124.5477   ?   3847.3214+-139.0657      ?
   Towers.c                                         246.8086+-3.6901     ?    252.5093+-9.1557        ? might be 1.0231x slower

   <geometric>                                      757.2919+-10.7685    ?    761.3380+-7.5114        ? might be 1.0053x slower

                                                          Conf#1                    Conf#2                                      
CompressionBench:
   huffman                                          326.3646+-13.0703         318.5332+-8.9526          might be 1.0246x faster
   arithmetic-simple                                357.8881+-3.6055     ?    372.2515+-33.4373       ? might be 1.0401x slower
   arithmetic-precise                               276.5046+-3.2232          275.1275+-9.0497        
   arithmetic-complex-precise                       277.9065+-10.6697         277.4886+-4.0506        
   arithmetic-precise-order-0                       378.1003+-9.4672     ?    387.9857+-12.3537       ? might be 1.0261x slower
   arithmetic-precise-order-1                       313.9424+-8.4653          313.6561+-4.4173        
   arithmetic-precise-order-2                       381.2032+-43.7698         353.2679+-7.1584          might be 1.0791x faster
   arithmetic-simple-order-1                        353.0623+-8.1321          351.3759+-9.6957        
   arithmetic-simple-order-2                        402.5803+-11.3447         395.0693+-4.9827          might be 1.0190x faster
   lz-string                                        352.1007+-10.6296    ?    371.1422+-29.5769       ? might be 1.0541x slower

   <geometric>                                      339.2868+-7.6625          338.8005+-4.3919          might be 1.0014x faster

                                                          Conf#1                    Conf#2                                      
Geomean of preferred means:
   <scaled-result>                                   58.9361+-0.2459     ?     58.9913+-0.2349        ? might be 1.0009x slower


Rerunning AsmBench gives:

Benchmark report for AsmBench on Basiles-MacBook-Pro (MacBookPro11,3).

VMs tested:
"Conf#1" at /Volumes/Data/Baseline/OpenSource/WebKitBuild/Release/jsc (r183038)
"Conf#2" at /Volumes/Data/Temp/OpenSource/WebKitBuild/Release/jsc (r183038)

Collected 6 samples per benchmark/VM, with 6 VM invocations per benchmark. Emitted a call to gc()
between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used the
jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times
with 95% confidence intervals in milliseconds.

                                  Conf#1                    Conf#2                                      

bigfib.cpp                  459.5575+-1.9665     ?    460.1482+-2.6871        ?
cray.c                      407.4002+-4.6968     ?    411.0604+-5.2820        ?
dry.c                       457.5689+-11.3058         446.9803+-17.9435         might be 1.0237x faster
FloatMM.c                   717.0470+-5.0931          715.4148+-6.2474        
gcc-loops.cpp              3666.1530+-49.8003        3649.7342+-25.0163       
n-body.c                    861.4548+-10.7466         855.5641+-8.6685        
Quicksort.c                 416.2374+-8.0882          413.8203+-6.3448        
stepanov_container.cpp     3801.0749+-51.4163    ?   3807.4605+-52.6609       ?
Towers.c                    247.6909+-5.0338     ?    249.9651+-7.5637        ?

<geometric>                 750.9835+-4.5607          749.1282+-5.4124          might be 1.0025x faster

[Filip Pizlo]

Comment on attachment 251211 [details]
Slow (but clean) patch

View in context: https://bugs.webkit.org/attachment.cgi?id=251211&action=review

It's surprising that this patch is a slow-down. :-/

> Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116
> -        case AllocationProfileWatchpoint:
> -            addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet());
> +        case AllocationProfileWatchpoint: {
> +            InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet();
> +            // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint
> +            // was added to the graph. We never de-allocate the rare data, so it must still be present, and the
> +            // allocationProfileWatchpointSet with it.
> +            ASSERT (watchpointSet);
> +            addLazily(*watchpointSet);
>              break;
> +        }

It would be better to remove the AllocationProfileWatchpoint node in this patch, and do the watchpoint set registration in ByteCodeParser.

[Filip Pizlo]

(In reply to comment #7)
> Comment on attachment 251211 [details]
> Slow (but clean) patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=251211&action=review
> 
> It's surprising that this patch is a slow-down. :-/

Oh - I guess the slow-down went away?  Lol.

> 
> > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116
> > -        case AllocationProfileWatchpoint:
> > -            addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet());
> > +        case AllocationProfileWatchpoint: {
> > +            InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet();
> > +            // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint
> > +            // was added to the graph. We never de-allocate the rare data, so it must still be present, and the
> > +            // allocationProfileWatchpointSet with it.
> > +            ASSERT (watchpointSet);
> > +            addLazily(*watchpointSet);
> >              break;
> > +        }
> 
> It would be better to remove the AllocationProfileWatchpoint node in this
> patch, and do the watchpoint set registration in ByteCodeParser.

[Basile Clement]

(In reply to comment #7)
> Comment on attachment 251211 [details]
> Slow (but clean) patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=251211&action=review
> 
> It's surprising that this patch is a slow-down. :-/
> 
> > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116
> > -        case AllocationProfileWatchpoint:
> > -            addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet());
> > +        case AllocationProfileWatchpoint: {
> > +            InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet();
> > +            // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint
> > +            // was added to the graph. We never de-allocate the rare data, so it must still be present, and the
> > +            // allocationProfileWatchpointSet with it.
> > +            ASSERT (watchpointSet);
> > +            addLazily(*watchpointSet);
> >              break;
> > +        }
> 
> It would be better to remove the AllocationProfileWatchpoint node in this
> patch, and do the watchpoint set registration in ByteCodeParser.

I thought we said we shouldn't do this?

(Splitting this into smaller more atomic patches)

[Filip Pizlo]

(In reply to comment #9)
> (In reply to comment #7)
> > Comment on attachment 251211 [details]
> > Slow (but clean) patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=251211&action=review
> > 
> > It's surprising that this patch is a slow-down. :-/
> > 
> > > Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp:116
> > > -        case AllocationProfileWatchpoint:
> > > -            addLazily(m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet());
> > > +        case AllocationProfileWatchpoint: {
> > > +            InlineWatchpointSet* watchpointSet = m_node->castOperand<JSFunction*>()->allocationProfileWatchpointSet();
> > > +            // If we reach this point, the function's rare data was allocated when the AllocationProfileWatchpoint
> > > +            // was added to the graph. We never de-allocate the rare data, so it must still be present, and the
> > > +            // allocationProfileWatchpointSet with it.
> > > +            ASSERT (watchpointSet);
> > > +            addLazily(*watchpointSet);
> > >              break;
> > > +        }
> > 
> > It would be better to remove the AllocationProfileWatchpoint node in this
> > patch, and do the watchpoint set registration in ByteCodeParser.
> 
> I thought we said we shouldn't do this?
> 
> (Splitting this into smaller more atomic patches)

Ah - it makes sense to do that as a different patch, if you like.

[Basile Clement]

Created attachment 251241 [details]
Atomic patch w/ test

This only fixes this bug (+ adds a regression test) and nothing more.

Related improvements/fixes coming in other patches.

[WebKit Commit Bot]

Comment on attachment 251241 [details]
Atomic patch w/ test

Clearing flags on attachment: 251241

Committed r183069: <http://trac.webkit.org/changeset/183069>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Filip Pizlo]

I'm seeing this crash in r183071:

stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2: 47158 Segmentation fault: 11  "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --enableFunctionDotArguments\=true --minHeapUtilization\=2.0 --minCopiedBlockUtilization\=2.0 dfg-rare-data.js
stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit code: 139

[Basile Clement]

(In reply to comment #14)
> I'm seeing this crash in r183071:
> 
> stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2:
> 47158 Segmentation fault: 11  "$@"
> ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false
> --enableFunctionDotArguments\=true --minHeapUtilization\=2.0
> --minCopiedBlockUtilization\=2.0 dfg-rare-data.js
> stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit
> code: 139

I don't see it in r183076 ; checking out r183071 to test.

[Filip Pizlo]

(In reply to comment #15)
> (In reply to comment #14)
> > I'm seeing this crash in r183071:
> > 
> > stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2:
> > 47158 Segmentation fault: 11  "$@"
> > ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false
> > --enableFunctionDotArguments\=true --minHeapUtilization\=2.0
> > --minCopiedBlockUtilization\=2.0 dfg-rare-data.js
> > stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit
> > code: 139
> 
> I don't see it in r183076 ; checking out r183071 to test.

It appears flaky.  I got it on one run and haven't seen it since.  Maybe your "don't reallocate" work will fix it.

[Basile Clement]

(In reply to comment #16)
> (In reply to comment #15)
> > (In reply to comment #14)
> > > I'm seeing this crash in r183071:
> > > 
> > > stress/dfg-rare-data.js.always-trigger-copy-phase: test_script_8421: line 2:
> > > 47158 Segmentation fault: 11  "$@"
> > > ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false
> > > --enableFunctionDotArguments\=true --minHeapUtilization\=2.0
> > > --minCopiedBlockUtilization\=2.0 dfg-rare-data.js
> > > stress/dfg-rare-data.js.always-trigger-copy-phase: ERROR: Unexpected exit
> > > code: 139
> > 
> > I don't see it in r183076 ; checking out r183071 to test.
> 
> It appears flaky.  I got it on one run and haven't seen it since.  Maybe
> your "don't reallocate" work will fix it.

Running

while true; do
  DYLD_FRAMEWORK_PATH=WebKitBuild/Debug/ WebKitBuild/Debug/jsc Source/JavaScriptCore/tests/stress/dfg-rare-data.js --useFTLJIT=false --enableFunctionDotArguments=true --minHeapUtilization=2.0 --minCopiedBlockUtilization=2.0;
done

on r183071 dies frequently, while it doesn't happen in r183076, so I think this is the race condition incidently fixed in https://bugs.webkit.org/show_bug.cgi?id=143999.

The backtrace seems to support this:

ASSERTION FAILED: m_rareData
/Volumes/Data/SVN/WIP/OpenSource/Source/JavaScriptCore/runtime/JSFunction.h(129) : JSC::InlineWatchpointSet &JSC::JSFunction::allocationProfileWatchpointSet()
1   0x109e1fce0 WTFCrash
2   0x10982ce86 JSC::JSFunction::allocationProfileWatchpointSet()
3   0x10982cb9a JSC::DFG::WatchpointCollectionPhase::handle()
4   0x10982c7c9 JSC::DFG::WatchpointCollectionPhase::run()
5   0x10982c675 bool JSC::DFG::runAndLog<JSC::DFG::WatchpointCollectionPhase>(JSC::DFG::WatchpointCollectionPhase&)
6   0x10982c605 bool JSC::DFG::runPhase<JSC::DFG::WatchpointCollectionPhase>(JSC::DFG::Graph&)
7   0x10982c598 JSC::DFG::performWatchpointCollection(JSC::DFG::Graph&)
8   0x109764bfb JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
9   0x109763bf1 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
10  0x10982efc0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
11  0x10982d5a4 JSC::DFG::Worklist::threadFunction(void*)
12  0x109e76f99 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const
13  0x109e76f6c std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()()
14  0x1099437aa std::__1::function<void ()>::operator()() const
15  0x109e75eee WTF::threadEntryPoint(void*)
16  0x109e778c8 WTF::wtfThreadEntryPoint(void*)
17  0x7fff8d91b268 _pthread_body
18  0x7fff8d91b1e5 _pthread_body
19  0x7fff8d91941d thread_start
Segmentation fault: 11