Patch forthcoming.
Oh man, this is super hard to test. We end up not hoisting MultiGetByOffset in LICM in any of the situations where safeToExecute() would have been wrong - if the loop is responsible for adding or removing the property that is being loaded, then it will appear to clobber JSCell_structure or the property. This means that of MultiGetByOffset relies on some CheckStructure to prove the presence of a property in a prototype, then that CheckStructure will be hoisted anytime that MultiGetByOffset is hoisted.
It just occurred to me that there's a tremendously simple solution: don't use MultiGetByOffset for prototype loads if the field in the prototype isn't constant-inferred. That means we don't have to do any kind of checks on the prototype to guarantee the safety of MultiGetByOffset's execution. Another solution is to prevent hoisting of MutliGetByOffset's whose prototype properties are not constant-inferred.
Created attachment 257425 [details] the patch
As expected, there is no effect on performance: Benchmark report for SunSpider, LongSpider, V8Spider, Octane, Kraken, JSRegress, AsmBench, and CompressionBench on dethklok (MacBookPro9,1). VMs tested: "TipOfTree" at /Volumes/Data/pizlo/secondary/OpenSource/WebKitBuild/Release/jsc (r187282) "FixSTE" at /Volumes/Data/pizlo/tertiary/OpenSource/WebKitBuild/Release/jsc (r187282) Collected 6 samples per benchmark/VM, with 6 VM invocations per benchmark. Emitted a call to gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds. TipOfTree FixSTE SunSpider: 3d-cube 5.3942+-0.2171 5.2932+-0.0824 might be 1.0191x faster 3d-morph 5.7981+-0.0895 ? 5.8463+-0.1318 ? 3d-raytrace 6.6349+-0.4400 6.5021+-0.0932 might be 1.0204x faster access-binary-trees 2.3634+-0.0989 ? 2.4486+-0.2319 ? might be 1.0361x slower access-fannkuch 7.3573+-0.2042 6.5433+-0.6331 might be 1.1244x faster access-nbody 2.9073+-0.1249 2.8647+-0.0770 might be 1.0148x faster access-nsieve 3.1949+-0.1067 ? 3.1990+-0.1015 ? bitops-3bit-bits-in-byte 1.7177+-0.0688 1.6563+-0.0673 might be 1.0370x faster bitops-bits-in-byte 3.6613+-0.1550 3.6080+-0.1117 might be 1.0148x faster bitops-bitwise-and 2.2122+-0.0479 ? 2.2459+-0.0713 ? might be 1.0153x slower bitops-nsieve-bits 3.1946+-0.0793 3.1815+-0.0574 controlflow-recursive 2.3007+-0.0678 ? 2.3331+-0.0385 ? might be 1.0141x slower crypto-aes 4.6464+-0.1368 ? 4.6963+-0.1525 ? might be 1.0108x slower crypto-md5 2.8195+-0.2624 2.7766+-0.1186 might be 1.0155x faster crypto-sha1 2.6965+-0.1812 ? 2.8359+-0.3018 ? might be 1.0517x slower date-format-tofte 9.3464+-0.3072 9.1623+-0.0993 might be 1.0201x faster date-format-xparb 5.3880+-0.1257 ? 5.5550+-0.2300 ? might be 1.0310x slower math-cordic 3.0848+-0.0530 ? 3.0857+-0.0541 ? math-partial-sums 5.4990+-0.3757 ? 5.9557+-0.9060 ? might be 1.0831x slower math-spectral-norm 2.1145+-0.2771 2.0754+-0.0565 might be 1.0188x faster regexp-dna 7.7231+-1.2226 ? 8.1423+-1.6785 ? might be 1.0543x slower string-base64 4.8289+-0.0727 ? 5.8427+-1.7397 ? might be 1.2100x slower string-fasta 7.3020+-0.8343 ? 7.3181+-0.9742 ? string-tagcloud 10.6605+-1.5104 9.8118+-0.6454 might be 1.0865x faster string-unpack-code 20.2755+-0.3183 ? 20.8014+-1.2156 ? might be 1.0259x slower string-validate-input 5.2791+-0.5351 5.1257+-0.1226 might be 1.0299x faster <arithmetic> 5.3231+-0.0743 ? 5.3426+-0.1563 ? might be 1.0037x slower TipOfTree FixSTE LongSpider: 3d-cube 1113.9581+-15.9047 ? 1122.6446+-14.2030 ? 3d-morph 1550.0653+-23.7832 1548.7938+-22.5314 3d-raytrace 700.5168+-3.2786 697.9635+-4.4509 access-binary-trees 1011.5247+-9.3131 ? 1026.6173+-39.8346 ? might be 1.0149x slower access-fannkuch 340.4065+-15.5176 333.3040+-1.3611 might be 1.0213x faster access-nbody 594.0071+-9.6001 ? 598.9314+-8.0393 ? access-nsieve 477.2102+-5.2419 ? 479.0203+-9.7719 ? bitops-3bit-bits-in-byte 45.1807+-1.2414 44.7111+-0.7806 might be 1.0105x faster bitops-bits-in-byte 103.1696+-1.6273 ? 104.4125+-2.9245 ? might be 1.0120x slower bitops-nsieve-bits 421.7130+-4.7491 ? 427.0826+-12.2488 ? might be 1.0127x slower controlflow-recursive 493.8736+-6.1179 ? 496.1055+-10.0189 ? crypto-aes 697.2868+-8.5208 ? 702.6652+-22.5853 ? crypto-md5 543.1454+-3.5397 537.7665+-15.3720 might be 1.0100x faster crypto-sha1 712.6993+-13.5456 698.7428+-15.3981 might be 1.0200x faster date-format-tofte 723.8298+-10.9820 721.3319+-4.8518 date-format-xparb 777.2660+-20.6460 ? 807.7032+-24.1727 ? might be 1.0392x slower hash-map 176.1766+-4.0239 175.7396+-5.4489 math-cordic 582.2731+-7.2319 581.9697+-9.5447 math-partial-sums 515.9413+-2.8245 510.7365+-3.4967 might be 1.0102x faster math-spectral-norm 573.0699+-2.4170 ? 574.0151+-11.7185 ? string-base64 418.3698+-7.9984 414.4432+-6.3318 string-fasta 423.7142+-3.5634 ? 431.6918+-25.0562 ? might be 1.0188x slower string-tagcloud 198.2391+-8.0541 194.9641+-2.8238 might be 1.0168x faster <geometric> 461.0907+-2.0648 ? 461.4885+-1.7456 ? might be 1.0009x slower TipOfTree FixSTE V8Spider: crypto 57.3664+-2.5998 ? 65.5976+-19.4829 ? might be 1.1435x slower deltablue 98.6021+-8.8660 ? 102.4016+-14.4358 ? might be 1.0385x slower earley-boyer 48.3950+-1.8376 47.7350+-2.4051 might be 1.0138x faster raytrace 39.3809+-2.5219 ? 39.5667+-3.1778 ? regexp 76.2546+-2.3023 74.5444+-1.6498 might be 1.0229x faster richards 78.9153+-2.7159 ? 79.4523+-0.5808 ? splay 40.9786+-2.2021 39.8220+-2.7102 might be 1.0290x faster <geometric> 59.5085+-1.5972 ? 60.2446+-2.0035 ? might be 1.0124x slower TipOfTree FixSTE Octane: encrypt 0.19470+-0.00554 ? 0.19500+-0.00157 ? decrypt 3.29597+-0.05074 ? 3.29733+-0.02554 ? deltablue x2 0.19257+-0.00745 0.18918+-0.00176 might be 1.0179x faster earley 0.38732+-0.00352 ? 0.38883+-0.00422 ? boyer 5.11013+-0.02951 5.09835+-0.02978 navier-stokes x2 5.20096+-0.07741 5.15698+-0.02487 raytrace x2 1.29696+-0.03808 ? 1.31062+-0.04177 ? might be 1.0105x slower richards x2 0.12884+-0.00323 ? 0.13081+-0.00729 ? might be 1.0153x slower splay x2 0.40259+-0.02456 0.38821+-0.00482 might be 1.0370x faster regexp x2 29.14315+-0.31428 ? 30.63084+-4.21463 ? might be 1.0510x slower pdfjs x2 43.07589+-0.25917 ? 43.37032+-0.56780 ? mandreel x2 50.74457+-0.42856 ? 50.75525+-0.33062 ? gbemu x2 44.53727+-1.87002 44.49853+-2.38834 closure 0.65929+-0.00385 ? 0.68134+-0.04154 ? might be 1.0334x slower jquery 8.61741+-0.12809 ? 9.00999+-0.75168 ? might be 1.0456x slower box2d x2 12.28737+-0.80271 ? 12.30726+-0.73797 ? zlib x2 409.16100+-13.80942 ? 416.95498+-1.85162 ? might be 1.0190x slower typescript x2 843.63871+-33.75756 838.27352+-12.86461 <geometric> 6.64308+-0.04825 ? 6.67289+-0.04324 ? might be 1.0045x slower TipOfTree FixSTE Kraken: ai-astar 232.623+-13.076 224.867+-5.047 might be 1.0345x faster audio-beat-detection 97.137+-5.554 94.054+-1.560 might be 1.0328x faster audio-dft 109.174+-2.366 ? 109.202+-2.203 ? audio-fft 60.972+-0.453 ? 61.686+-0.790 ? might be 1.0117x slower audio-oscillator 76.742+-1.986 ? 77.220+-2.203 ? imaging-darkroom 108.155+-1.736 ? 109.629+-6.656 ? might be 1.0136x slower imaging-desaturate 64.348+-5.071 63.629+-5.041 might be 1.0113x faster imaging-gaussian-blur 113.492+-5.907 111.204+-1.959 might be 1.0206x faster json-parse-financial 49.617+-2.159 49.429+-5.709 json-stringify-tinderbox 28.721+-0.938 ? 30.212+-2.221 ? might be 1.0519x slower stanford-crypto-aes 46.538+-0.117 46.516+-0.440 stanford-crypto-ccm 48.986+-1.659 48.415+-1.890 might be 1.0118x faster stanford-crypto-pbkdf2 108.803+-1.559 ^ 102.799+-1.468 ^ definitely 1.0584x faster stanford-crypto-sha256-iterative 43.866+-2.864 41.045+-0.755 might be 1.0687x faster <arithmetic> 84.941+-0.957 83.565+-1.087 might be 1.0165x faster TipOfTree FixSTE JSRegress: abc-forward-loop-equal 49.1909+-2.1341 47.5768+-1.2780 might be 1.0339x faster abc-postfix-backward-loop 47.5818+-1.5716 ? 47.6836+-1.8892 ? abc-simple-backward-loop 48.2264+-1.6033 47.1350+-1.6587 might be 1.0232x faster abc-simple-forward-loop 47.5694+-1.7235 ? 47.5911+-1.7692 ? abc-skippy-loop 32.2809+-0.4943 31.9365+-0.3483 might be 1.0108x faster abs-boolean 2.9457+-0.3486 2.7575+-0.0437 might be 1.0682x faster adapt-to-double-divide 16.6534+-0.1427 ? 16.9419+-0.7938 ? might be 1.0173x slower aliased-arguments-getbyval 1.3224+-0.0370 ? 1.3534+-0.0608 ? might be 1.0235x slower allocate-big-object 2.7873+-0.1354 ? 2.8757+-0.3936 ? might be 1.0317x slower arguments-named-and-reflective 12.5630+-0.8464 ? 13.1570+-1.1915 ? might be 1.0473x slower arguments-out-of-bounds 14.9372+-0.8787 14.7114+-0.5311 might be 1.0153x faster arguments-strict-mode 11.7524+-1.0879 11.0042+-0.3990 might be 1.0680x faster arguments 9.6530+-0.2282 ? 10.0413+-0.8535 ? might be 1.0402x slower arity-mismatch-inlining 0.8948+-0.0277 0.8705+-0.0240 might be 1.0279x faster array-access-polymorphic-structure 6.7381+-0.2737 ? 7.4423+-1.1779 ? might be 1.1045x slower array-nonarray-polymorhpic-access 31.7732+-0.8469 ? 32.5481+-1.5567 ? might be 1.0244x slower array-prototype-every 86.0412+-2.9648 ? 89.7076+-7.7587 ? might be 1.0426x slower array-prototype-forEach 83.6662+-2.3123 ? 84.3614+-0.8779 ? array-prototype-map 92.1899+-3.8084 ? 97.5947+-15.1127 ? might be 1.0586x slower array-prototype-reduce 81.5271+-2.5709 ? 82.1276+-2.6015 ? array-prototype-reduceRight 81.5508+-2.1303 ? 85.3123+-11.9698 ? might be 1.0461x slower array-prototype-some 83.0337+-1.9327 ? 88.8455+-4.5127 ? might be 1.0700x slower array-splice-contiguous 25.2864+-0.2314 ? 25.3512+-0.4523 ? array-with-double-add 4.2203+-0.1752 4.1504+-0.0962 might be 1.0168x faster array-with-double-increment 3.3513+-0.1392 3.2325+-0.0289 might be 1.0367x faster array-with-double-mul-add 5.1173+-0.1241 ? 5.2091+-0.3715 ? might be 1.0179x slower array-with-double-sum 3.4972+-0.2699 3.3394+-0.0525 might be 1.0473x faster array-with-int32-add-sub 6.8170+-0.0524 ? 6.8830+-0.0748 ? array-with-int32-or-double-sum 3.4641+-0.1102 3.3548+-0.0155 might be 1.0326x faster ArrayBuffer-DataView-alloc-large-long-lived 38.9885+-2.6579 37.2008+-1.6814 might be 1.0481x faster ArrayBuffer-DataView-alloc-long-lived 15.1242+-1.0167 14.2812+-0.2134 might be 1.0590x faster ArrayBuffer-Int32Array-byteOffset 3.8807+-0.0770 ? 3.9896+-0.3726 ? might be 1.0281x slower ArrayBuffer-Int8Array-alloc-large-long-lived 38.2821+-1.6692 37.1934+-0.5598 might be 1.0293x faster ArrayBuffer-Int8Array-alloc-long-lived-buffer 22.0061+-0.7376 ! 24.8669+-1.0747 ! definitely 1.1300x slower ArrayBuffer-Int8Array-alloc-long-lived 14.0660+-1.3942 ? 14.7852+-1.9043 ? might be 1.0511x slower ArrayBuffer-Int8Array-alloc 11.2478+-1.3504 10.6762+-0.7508 might be 1.0535x faster asmjs_bool_bug 8.3143+-0.7529 8.0327+-0.1103 might be 1.0351x faster assign-custom-setter-polymorphic 3.0737+-0.0632 3.0710+-0.0616 assign-custom-setter 4.1909+-0.0977 4.1880+-0.0586 basic-set 8.6260+-0.1368 ? 8.9596+-0.6024 ? might be 1.0387x slower big-int-mul 4.1665+-0.1516 4.0070+-0.0438 might be 1.0398x faster boolean-test 3.1082+-0.0381 3.1024+-0.0496 branch-fold 3.8864+-0.1410 ? 3.8889+-0.2879 ? branch-on-string-as-boolean 20.8957+-1.2355 19.9648+-0.5736 might be 1.0466x faster by-val-generic 8.2857+-0.2103 ? 8.2885+-0.3868 ? call-spread-apply 30.1623+-0.6728 29.6469+-0.6101 might be 1.0174x faster call-spread-call 24.7203+-0.9377 24.4686+-0.3431 might be 1.0103x faster captured-assignments 0.5288+-0.0738 0.4885+-0.0098 might be 1.0826x faster cast-int-to-double 5.3146+-0.0202 ? 5.3602+-0.1176 ? cell-argument 8.5445+-0.2305 ? 8.6558+-0.2292 ? might be 1.0130x slower cfg-simplify 3.1894+-0.8359 2.8498+-0.0219 might be 1.1192x faster chain-getter-access 9.1638+-0.1554 9.1611+-0.1443 cmpeq-obj-to-obj-other 12.0038+-0.9257 ? 12.2597+-1.7879 ? might be 1.0213x slower constant-test 5.0182+-0.0357 ? 5.0354+-0.0440 ? create-lots-of-functions 11.3013+-0.1159 ? 11.7486+-1.3105 ? might be 1.0396x slower cse-new-array-buffer 2.5121+-0.0363 ? 2.5493+-0.0678 ? might be 1.0148x slower cse-new-array 2.6302+-0.0500 ? 2.6702+-0.0847 ? might be 1.0152x slower DataView-custom-properties 44.0143+-4.1470 41.8956+-0.4631 might be 1.0506x faster delay-tear-off-arguments-strictmode 14.7181+-1.2060 14.1253+-0.5450 might be 1.0420x faster deltablue-varargs 218.7625+-33.6891 208.7928+-1.3955 might be 1.0477x faster destructuring-arguments 183.7234+-4.2812 ? 187.1041+-5.6745 ? might be 1.0184x slower destructuring-parameters-overridden-by-function 0.5897+-0.0166 ? 0.6128+-0.0290 ? might be 1.0393x slower destructuring-swap 5.1031+-0.0326 ? 5.1341+-0.0570 ? direct-arguments-getbyval 1.3245+-0.0665 1.2749+-0.0309 might be 1.0389x faster div-boolean-double 5.2563+-0.0241 ? 5.2644+-0.0239 ? div-boolean 7.8086+-0.0201 ? 7.8231+-0.0382 ? double-get-by-val-out-of-bounds 4.7594+-0.1462 4.7008+-0.0309 might be 1.0125x faster double-pollution-getbyval 8.8988+-0.0781 8.8909+-0.0395 double-pollution-putbyoffset 4.9632+-1.7375 4.3039+-0.0797 might be 1.1532x faster double-real-use 30.1287+-1.3722 29.9961+-0.8962 double-to-int32-typed-array-no-inline 2.3420+-0.0898 ? 2.3913+-0.2015 ? might be 1.0210x slower double-to-int32-typed-array 2.0004+-0.0612 ? 2.1338+-0.2501 ? might be 1.0667x slower double-to-uint32-typed-array-no-inline 2.3850+-0.0324 ? 2.4280+-0.1056 ? might be 1.0180x slower double-to-uint32-typed-array 2.0900+-0.0459 2.0825+-0.0617 elidable-new-object-dag 43.9916+-1.8175 42.8857+-1.4953 might be 1.0258x faster elidable-new-object-roflcopter 40.9328+-1.1856 ? 41.2094+-1.9513 ? elidable-new-object-then-call 39.5514+-1.5827 38.5594+-0.9633 might be 1.0257x faster elidable-new-object-tree 46.7832+-2.2496 45.8525+-1.4358 might be 1.0203x faster empty-string-plus-int 5.2943+-0.0775 ? 5.3000+-0.0835 ? emscripten-cube2hash 40.1535+-2.1423 38.9712+-1.9306 might be 1.0303x faster exit-length-on-plain-object 15.0809+-1.1766 14.3964+-1.1325 might be 1.0475x faster external-arguments-getbyval 1.3603+-0.1981 ? 1.3639+-0.0608 ? external-arguments-putbyval 2.4624+-0.0738 ? 2.4649+-0.0489 ? fixed-typed-array-storage-var-index 1.8224+-1.3160 1.3270+-0.1477 might be 1.3733x faster fixed-typed-array-storage 0.9613+-0.0563 0.9502+-0.0639 might be 1.0117x faster Float32Array-matrix-mult 4.6595+-0.1214 ? 4.7762+-0.2827 ? might be 1.0251x slower Float32Array-to-Float64Array-set 55.7070+-0.7630 ! 57.3212+-0.3474 ! definitely 1.0290x slower Float64Array-alloc-long-lived 90.7164+-2.0180 ? 92.0000+-1.4179 ? might be 1.0141x slower Float64Array-to-Int16Array-set 71.6648+-1.8695 70.7601+-3.0791 might be 1.0128x faster fold-double-to-int 14.0702+-0.1140 ? 14.4607+-0.5918 ? might be 1.0278x slower fold-get-by-id-to-multi-get-by-offset-rare-int 10.5685+-1.2664 10.4272+-0.9918 might be 1.0136x faster fold-get-by-id-to-multi-get-by-offset 10.3959+-1.3215 ? 10.4731+-1.6726 ? fold-multi-get-by-offset-to-get-by-offset 8.8291+-0.6347 ? 9.2003+-0.8716 ? might be 1.0420x slower fold-multi-get-by-offset-to-poly-get-by-offset 9.7229+-1.7296 8.8240+-1.1337 might be 1.1019x faster fold-multi-put-by-offset-to-poly-put-by-offset 10.3809+-1.9562 9.9882+-1.4589 might be 1.0393x faster fold-multi-put-by-offset-to-put-by-offset 8.2402+-0.5412 8.1815+-0.3354 fold-multi-put-by-offset-to-replace-or-transition-put-by-offset 10.1741+-0.6344 9.8442+-0.4684 might be 1.0335x faster fold-put-by-id-to-multi-put-by-offset 10.4608+-0.5653 ? 11.2751+-0.6263 ? might be 1.0779x slower fold-put-structure 7.8026+-0.2851 7.5094+-0.7761 might be 1.0391x faster for-of-iterate-array-entries 12.4062+-0.1222 12.3581+-0.1324 for-of-iterate-array-keys 3.7091+-0.1222 ? 3.7343+-0.1362 ? for-of-iterate-array-values 4.1755+-0.4672 3.9761+-0.2673 might be 1.0502x faster fround 22.0680+-1.3373 21.6063+-0.4859 might be 1.0214x faster ftl-library-inlining-dataview 66.8676+-2.3728 ? 67.3313+-2.3522 ? ftl-library-inlining 99.5299+-18.2459 ? 102.9587+-14.1832 ? might be 1.0345x slower function-dot-apply 2.3519+-0.1334 2.2995+-0.0568 might be 1.0228x faster function-test 2.9131+-0.0407 2.9030+-0.0386 function-with-eval 111.6064+-4.6160 ? 113.9303+-4.9949 ? might be 1.0208x slower gcse-poly-get-less-obvious 18.7372+-1.1329 18.6489+-1.1604 gcse-poly-get 21.1558+-0.9425 ? 22.8883+-3.1909 ? might be 1.0819x slower gcse 4.4413+-0.1136 ? 4.4427+-0.1159 ? get-by-id-bimorphic-check-structure-elimination-simple 2.7832+-0.0313 2.7720+-0.0516 get-by-id-bimorphic-check-structure-elimination 6.0249+-0.0647 ? 6.0793+-0.1649 ? get-by-id-chain-from-try-block 7.0293+-0.6969 6.6544+-0.0924 might be 1.0563x faster get-by-id-check-structure-elimination 5.1640+-0.1012 5.1388+-0.1072 get-by-id-proto-or-self 17.9331+-0.8700 ? 18.3877+-1.2086 ? might be 1.0254x slower get-by-id-quadmorphic-check-structure-elimination-simple 2.9812+-0.0172 ? 2.9845+-0.0326 ? get-by-id-self-or-proto 18.4280+-0.8303 ? 19.6517+-1.9144 ? might be 1.0664x slower get-by-val-out-of-bounds 4.4323+-0.0369 ? 4.4909+-0.0949 ? might be 1.0132x slower get_callee_monomorphic 2.8590+-0.5036 2.6401+-0.2354 might be 1.0829x faster get_callee_polymorphic 3.5868+-0.1914 ? 3.6416+-0.2567 ? might be 1.0153x slower getter-no-activation 5.1193+-0.4267 ? 5.1936+-0.2838 ? might be 1.0145x slower getter-prototype 15.2028+-0.8572 14.9386+-0.3215 might be 1.0177x faster getter-richards 142.7488+-13.7955 136.1184+-6.3265 might be 1.0487x faster getter 6.1554+-1.0539 5.4212+-0.0175 might be 1.1354x faster global-var-const-infer-fire-from-opt 1.1829+-0.0979 ^ 1.0016+-0.0788 ^ definitely 1.1810x faster global-var-const-infer 0.8532+-0.1117 ? 0.9035+-0.0861 ? might be 1.0589x slower HashMap-put-get-iterate-keys 30.9323+-3.8077 29.0674+-1.1018 might be 1.0642x faster HashMap-put-get-iterate 31.5552+-1.2151 30.8794+-1.4874 might be 1.0219x faster HashMap-string-put-get-iterate 28.1022+-1.2046 27.8942+-1.3572 hoist-make-rope 12.7024+-1.4578 ? 13.0253+-1.8014 ? might be 1.0254x slower hoist-poly-check-structure-effectful-loop 5.3066+-0.4519 5.1449+-0.0399 might be 1.0314x faster hoist-poly-check-structure 3.8383+-0.2913 3.7257+-0.0297 might be 1.0302x faster imul-double-only 8.4376+-0.2067 ? 8.6118+-0.5321 ? might be 1.0206x slower imul-int-only 11.4417+-1.3243 10.7767+-0.7252 might be 1.0617x faster imul-mixed 8.7619+-0.8064 8.6637+-0.3881 might be 1.0113x faster in-four-cases 22.8675+-0.3460 22.7302+-0.2934 in-one-case-false 11.0184+-0.1029 ? 11.0877+-0.1682 ? in-one-case-true 11.0233+-0.1215 ? 11.4596+-0.6120 ? might be 1.0396x slower in-two-cases 11.3627+-0.1019 ? 11.5584+-0.4428 ? might be 1.0172x slower indexed-properties-in-objects 2.9980+-0.0667 ? 3.0192+-0.2147 ? infer-closure-const-then-mov-no-inline 3.9631+-0.1498 ? 4.5502+-0.5337 ? might be 1.1481x slower infer-closure-const-then-mov 19.7679+-0.2856 ? 19.8195+-0.2337 ? infer-closure-const-then-put-to-scope-no-inline 12.6552+-1.0413 12.2737+-0.3274 might be 1.0311x faster infer-closure-const-then-put-to-scope 22.6110+-1.3426 21.2890+-0.1778 might be 1.0621x faster infer-closure-const-then-reenter-no-inline 56.5621+-2.0710 55.4860+-2.3094 might be 1.0194x faster infer-closure-const-then-reenter 21.5719+-0.1601 ? 22.7464+-1.3237 ? might be 1.0544x slower infer-constant-global-property 3.6265+-0.0481 3.6051+-0.0669 infer-constant-property 2.7480+-0.0223 ? 2.8083+-0.1783 ? might be 1.0220x slower infer-one-time-closure-ten-vars 13.0804+-1.0464 ? 13.1890+-0.9804 ? infer-one-time-closure-two-vars 12.3414+-0.6584 ? 12.4534+-0.8376 ? infer-one-time-closure 12.7104+-1.8395 12.1052+-0.2440 might be 1.0500x faster infer-one-time-deep-closure 21.6525+-1.1454 ? 22.2657+-1.7851 ? might be 1.0283x slower inline-arguments-access 4.3542+-0.0392 ? 4.3998+-0.0937 ? might be 1.0105x slower inline-arguments-aliased-access 4.3552+-0.0714 ? 4.3741+-0.1158 ? inline-arguments-local-escape 4.5682+-0.4465 4.4708+-0.1111 might be 1.0218x faster inline-get-scoped-var 5.0644+-0.3538 4.9300+-0.2788 might be 1.0273x faster inlined-put-by-id-transition 12.0170+-0.3284 11.9289+-0.6590 int-or-other-abs-then-get-by-val 5.1598+-0.0310 ? 5.2091+-0.0684 ? int-or-other-abs-zero-then-get-by-val 18.6121+-1.3841 ? 19.2131+-0.9829 ? might be 1.0323x slower int-or-other-add-then-get-by-val 4.8753+-1.3109 4.3973+-0.0662 might be 1.1087x faster int-or-other-add 5.3907+-0.0525 5.3819+-0.0249 int-or-other-div-then-get-by-val 4.3431+-0.1028 4.3264+-0.2121 int-or-other-max-then-get-by-val 4.4886+-0.0550 4.4574+-0.0671 int-or-other-min-then-get-by-val 4.6672+-0.2261 4.5548+-0.0388 might be 1.0247x faster int-or-other-mod-then-get-by-val 3.9304+-0.0604 3.8614+-0.0485 might be 1.0179x faster int-or-other-mul-then-get-by-val 3.9126+-0.0453 ? 4.0972+-0.4102 ? might be 1.0472x slower int-or-other-neg-then-get-by-val 4.8171+-0.0412 4.8145+-0.0191 int-or-other-neg-zero-then-get-by-val 17.9616+-0.8091 ? 18.2531+-1.4310 ? might be 1.0162x slower int-or-other-sub-then-get-by-val 4.3786+-0.0159 ? 4.5620+-0.3581 ? might be 1.0419x slower int-or-other-sub 3.5532+-0.0265 ? 3.9251+-0.9120 ? might be 1.1047x slower int-overflow-local 4.6774+-0.3288 4.5876+-0.0704 might be 1.0196x faster Int16Array-alloc-long-lived 54.8415+-0.8797 ? 55.0491+-2.6556 ? Int16Array-bubble-sort-with-byteLength 22.0397+-1.7591 21.4410+-1.4199 might be 1.0279x faster Int16Array-bubble-sort 20.3900+-0.2872 ? 20.5175+-0.5569 ? Int16Array-load-int-mul 1.5341+-0.0128 1.5291+-0.0224 Int16Array-to-Int32Array-set 57.2809+-3.0517 ? 58.7389+-1.7630 ? might be 1.0255x slower Int32Array-alloc-large 23.9189+-0.6588 ? 24.0688+-1.2167 ? Int32Array-alloc-long-lived 66.9176+-0.5556 ? 67.7700+-2.1464 ? might be 1.0127x slower Int32Array-alloc 3.4580+-0.2992 ? 3.6418+-0.5279 ? might be 1.0531x slower Int32Array-Int8Array-view-alloc 7.1153+-0.9028 6.7908+-0.2978 might be 1.0478x faster int52-spill 5.2352+-0.0502 ? 5.2972+-0.0323 ? might be 1.0118x slower Int8Array-alloc-long-lived 50.2923+-1.6038 ? 50.9793+-1.8067 ? might be 1.0137x slower Int8Array-load-with-byteLength 3.4315+-0.0510 3.4035+-0.0949 Int8Array-load 3.4404+-0.0440 ? 3.4611+-0.2085 ? integer-divide 10.7805+-0.1104 10.7127+-0.1273 integer-modulo 2.0945+-0.0786 2.0649+-0.0970 might be 1.0143x faster is-boolean-fold-tricky 4.5251+-0.1028 ? 4.5337+-0.1016 ? is-boolean-fold 2.9061+-0.0836 2.8980+-0.0533 is-function-fold-tricky-internal-function 11.9477+-0.1548 ? 13.5618+-4.2220 ? might be 1.1351x slower is-function-fold-tricky 4.5546+-0.0598 4.5352+-0.0412 is-function-fold 2.8976+-0.0357 ? 2.9491+-0.1432 ? might be 1.0178x slower is-number-fold-tricky 4.4792+-0.1068 ? 4.5688+-0.1994 ? might be 1.0200x slower is-number-fold 2.8730+-0.0256 2.8699+-0.0283 is-object-or-null-fold-functions 2.9994+-0.1870 2.9683+-0.0969 might be 1.0105x faster is-object-or-null-fold-less-tricky 4.5297+-0.0282 ? 4.5763+-0.0676 ? might be 1.0103x slower is-object-or-null-fold-tricky 6.8418+-0.3978 6.7484+-0.2114 might be 1.0139x faster is-object-or-null-fold 2.9986+-0.2188 ? 3.1139+-0.2513 ? might be 1.0385x slower is-object-or-null-trickier-function 4.6234+-0.0491 ? 4.7487+-0.1710 ? might be 1.0271x slower is-object-or-null-trickier-internal-function 12.3845+-0.0704 ? 14.0079+-3.7739 ? might be 1.1311x slower is-object-or-null-tricky-function 4.7622+-0.1761 4.7410+-0.2515 is-object-or-null-tricky-internal-function 9.2888+-0.0459 9.2769+-0.0645 is-string-fold-tricky 4.4546+-0.0784 ? 4.5093+-0.0609 ? might be 1.0123x slower is-string-fold 3.0611+-0.4330 2.9895+-0.2134 might be 1.0239x faster is-undefined-fold-tricky 3.7612+-0.0505 ? 3.9293+-0.1795 ? might be 1.0447x slower is-undefined-fold 2.8927+-0.0684 2.8832+-0.1171 large-int-captured 4.6336+-0.0355 ? 4.6602+-0.1305 ? large-int-neg 16.2665+-0.1735 ? 16.2840+-0.6176 ? large-int 15.5990+-1.0239 14.8095+-0.3566 might be 1.0533x faster load-varargs-elimination 22.7304+-0.3564 ? 23.1996+-1.0369 ? might be 1.0206x slower logical-not-weird-types 3.3803+-0.0982 3.3623+-0.0412 logical-not 4.6757+-0.0513 4.6534+-0.0422 lots-of-fields 13.5341+-1.3572 ? 14.1935+-1.0412 ? might be 1.0487x slower make-indexed-storage 3.2706+-0.4362 3.1972+-0.0690 might be 1.0230x faster make-rope-cse 4.6576+-0.4245 ? 5.0953+-0.5592 ? might be 1.0940x slower marsaglia-larger-ints 36.8950+-0.6663 ? 37.4822+-2.2354 ? might be 1.0159x slower marsaglia-osr-entry 23.3608+-1.3497 ? 24.0582+-1.9235 ? might be 1.0299x slower math-with-out-of-bounds-array-values 23.9806+-0.8705 ? 24.8044+-2.1719 ? might be 1.0344x slower max-boolean 2.7446+-0.0317 2.5962+-0.1327 might be 1.0572x faster method-on-number 17.3278+-1.0730 17.0938+-0.2285 might be 1.0137x faster min-boolean 2.7040+-0.0413 2.6005+-0.1001 might be 1.0398x faster minus-boolean-double 3.2278+-0.0645 ? 3.2641+-0.0829 ? might be 1.0112x slower minus-boolean 2.4434+-0.0935 2.3873+-0.0440 might be 1.0235x faster misc-strict-eq 38.0774+-0.5121 37.3997+-0.4031 might be 1.0181x faster mod-boolean-double 11.1070+-0.3055 ? 11.3152+-1.0788 ? might be 1.0187x slower mod-boolean 7.9316+-0.1393 ? 7.9428+-0.1168 ? mul-boolean-double 3.8228+-0.0689 ? 3.8649+-0.2877 ? might be 1.0110x slower mul-boolean 3.0680+-0.1703 2.9402+-0.0267 might be 1.0435x faster neg-boolean 3.2368+-0.0414 ? 3.2387+-0.0575 ? negative-zero-divide 0.3750+-0.0242 ? 0.3834+-0.0236 ? might be 1.0225x slower negative-zero-modulo 0.3824+-0.0253 0.3813+-0.0088 negative-zero-negate 0.3744+-0.0259 ? 0.3763+-0.0463 ? nested-function-parsing 50.2159+-1.1144 ? 50.8993+-2.0204 ? might be 1.0136x slower new-array-buffer-dead 116.7105+-2.8559 116.1063+-3.1561 new-array-buffer-push 7.5408+-0.9790 7.3518+-0.9982 might be 1.0257x faster new-array-dead 20.0121+-0.8094 19.5286+-0.4882 might be 1.0248x faster new-array-push 6.7928+-0.2278 ? 6.8539+-0.1919 ? no-inline-constructor 39.9347+-1.6526 39.4386+-1.2089 might be 1.0126x faster number-test 3.0702+-0.0440 ? 3.1156+-0.1849 ? might be 1.0148x slower object-closure-call 5.6977+-0.0271 5.6777+-0.0427 object-test 2.8678+-0.0523 2.8538+-0.0549 obvious-sink-pathology-taken 139.0988+-3.7345 ? 139.2595+-5.1010 ? obvious-sink-pathology 132.2765+-2.7040 129.2439+-2.7549 might be 1.0235x faster obviously-elidable-new-object 34.9643+-1.3034 ? 34.9957+-0.9712 ? plus-boolean-arith 2.6043+-0.0980 ? 2.6653+-0.3358 ? might be 1.0234x slower plus-boolean-double 3.2360+-0.0354 ? 3.2646+-0.0415 ? plus-boolean 2.4806+-0.0418 ? 2.5351+-0.1816 ? might be 1.0220x slower poly-chain-access-different-prototypes-simple 3.3256+-0.0509 ? 3.3798+-0.1394 ? might be 1.0163x slower poly-chain-access-different-prototypes 2.6581+-0.0185 ? 2.7107+-0.0950 ? might be 1.0198x slower poly-chain-access-simpler 3.3577+-0.0591 ? 3.3604+-0.0449 ? poly-chain-access 2.6465+-0.0390 ? 2.6676+-0.1464 ? poly-stricteq 63.7962+-1.8889 63.3604+-3.5010 polymorphic-array-call 1.3951+-0.0416 ? 1.4285+-0.0796 ? might be 1.0239x slower polymorphic-get-by-id 3.2019+-0.0877 ? 3.3712+-0.2237 ? might be 1.0529x slower polymorphic-put-by-id 31.9371+-3.8358 31.4132+-2.1433 might be 1.0167x faster polymorphic-structure 14.9526+-0.1551 ? 14.9618+-0.1914 ? polyvariant-monomorphic-get-by-id 8.6298+-0.1569 ? 9.4935+-1.3897 ? might be 1.1001x slower proto-getter-access 9.2038+-0.1124 9.1712+-0.1894 put-by-id-replace-and-transition 9.4959+-0.0533 ? 9.7665+-0.6999 ? might be 1.0285x slower put-by-id-slightly-polymorphic 2.8653+-0.0274 ? 2.8741+-0.0201 ? put-by-id 12.5377+-0.9608 12.4845+-0.2169 put-by-val-direct 0.4074+-0.0380 ? 0.4111+-0.0456 ? put-by-val-large-index-blank-indexing-type 12.8136+-1.1683 12.6095+-0.9656 might be 1.0162x faster put-by-val-machine-int 2.8431+-0.0847 2.7750+-0.0478 might be 1.0245x faster rare-osr-exit-on-local 14.7378+-0.2026 ? 15.0659+-0.3868 ? might be 1.0223x slower register-pressure-from-osr 23.7920+-5.1003 21.3421+-0.2491 might be 1.1148x faster repeat-multi-get-by-offset 24.9656+-1.2200 24.1028+-0.7089 might be 1.0358x faster setter-prototype 10.7817+-0.1752 ? 11.1064+-0.8337 ? might be 1.0301x slower setter 6.0565+-0.8871 ? 6.8486+-1.1342 ? might be 1.1308x slower simple-activation-demo 26.0940+-1.0190 25.3783+-0.2962 might be 1.0282x faster simple-getter-access 11.8910+-0.2302 11.7700+-0.1779 might be 1.0103x faster simple-poly-call-nested 8.1458+-0.3263 ? 8.2704+-0.3957 ? might be 1.0153x slower simple-poly-call 1.2955+-0.0141 ? 1.3134+-0.0322 ? might be 1.0138x slower sin-boolean 24.4286+-2.0230 23.4221+-0.9140 might be 1.0430x faster singleton-scope 62.8030+-2.5979 ? 63.1274+-1.6159 ? sink-function 11.7089+-0.1244 11.6955+-0.2529 sink-huge-activation 19.0329+-0.5494 ? 19.4456+-0.8617 ? might be 1.0217x slower sinkable-new-object-dag 71.0866+-2.4980 68.2019+-2.0508 might be 1.0423x faster sinkable-new-object-taken 51.4484+-2.4458 51.3571+-3.5181 sinkable-new-object 38.0858+-1.0264 ? 38.6293+-1.1546 ? might be 1.0143x slower slow-array-profile-convergence 2.9362+-0.0731 2.9126+-0.0565 slow-convergence 2.7041+-0.0484 ? 2.7048+-0.1141 ? slow-ternaries 22.8486+-2.8953 21.2612+-2.5604 might be 1.0747x faster sorting-benchmark 18.7098+-0.3078 ? 19.0012+-0.3065 ? might be 1.0156x slower sparse-conditional 1.2283+-0.0354 1.2170+-0.0312 splice-to-remove 15.3480+-0.9836 15.0212+-0.1531 might be 1.0218x faster string-char-code-at 16.0640+-0.3588 15.9119+-0.1668 string-concat-object 2.6526+-0.0599 ? 2.6643+-0.2980 ? string-concat-pair-object 2.4516+-0.0659 ? 2.4744+-0.0948 ? string-concat-pair-simple 11.7471+-1.0387 ? 11.8360+-1.1692 ? string-concat-simple 12.1871+-1.1766 11.8508+-0.6097 might be 1.0284x faster string-cons-repeat 8.1770+-0.6413 8.0923+-0.7036 might be 1.0105x faster string-cons-tower 7.9288+-0.0918 ? 8.2785+-0.7234 ? might be 1.0441x slower string-equality 18.7683+-0.8236 ! 22.2420+-0.8225 ! definitely 1.1851x slower string-get-by-val-big-char 7.2335+-0.1534 7.1973+-0.0584 string-get-by-val-out-of-bounds-insane 3.7736+-0.2738 3.6500+-0.1494 might be 1.0339x faster string-get-by-val-out-of-bounds 5.3210+-0.1664 5.2849+-0.1292 string-get-by-val 3.3293+-0.0623 ? 3.4613+-0.0939 ? might be 1.0396x slower string-hash 2.0920+-0.0421 ? 2.0949+-0.0723 ? string-long-ident-equality 17.5789+-1.1482 ^ 15.1092+-0.7200 ^ definitely 1.1635x faster string-out-of-bounds 14.8328+-0.1165 ? 15.1006+-0.8133 ? might be 1.0181x slower string-repeat-arith 35.2674+-3.0488 ? 35.9169+-2.9784 ? might be 1.0184x slower string-sub 71.9545+-0.9754 69.6618+-3.1504 might be 1.0329x faster string-test 2.9532+-0.0157 ? 2.9635+-0.0410 ? string-var-equality 34.5922+-0.1229 ? 36.0954+-2.0963 ? might be 1.0435x slower structure-hoist-over-transitions 2.6442+-0.0199 ? 2.6486+-0.0362 ? substring-concat-weird 42.2306+-1.1907 ? 43.1875+-1.7354 ? might be 1.0227x slower substring-concat 45.6743+-2.8498 44.6290+-1.2507 might be 1.0234x faster substring 48.4918+-0.7181 ? 48.6324+-1.1482 ? switch-char-constant 2.7871+-0.0163 ? 2.8094+-0.0204 ? switch-char 6.6656+-0.7563 ? 6.7631+-0.6714 ? might be 1.0146x slower switch-constant 8.4830+-0.4696 8.1971+-0.1585 might be 1.0349x faster switch-string-basic-big-var 18.5730+-0.3710 18.2826+-0.2487 might be 1.0159x faster switch-string-basic-big 14.8646+-0.2611 14.8239+-0.1194 switch-string-basic-var 15.6848+-1.3306 15.1412+-0.2281 might be 1.0359x faster switch-string-basic 13.9664+-0.1198 ? 14.2203+-0.6999 ? might be 1.0182x slower switch-string-big-length-tower-var 20.2944+-0.1808 ? 21.3515+-1.5724 ? might be 1.0521x slower switch-string-length-tower-var 15.9220+-1.4140 15.3934+-0.2871 might be 1.0343x faster switch-string-length-tower 13.2328+-0.0799 13.2126+-0.2027 switch-string-short 13.5974+-1.1835 13.0909+-0.1939 might be 1.0387x faster switch 12.6652+-1.0394 12.2121+-0.1400 might be 1.0371x faster tear-off-arguments-simple 3.3968+-0.0970 3.3759+-0.0793 tear-off-arguments 4.5225+-0.0491 4.4768+-0.0442 might be 1.0102x faster temporal-structure 13.0960+-0.2724 13.0232+-0.1938 to-int32-boolean 14.1315+-0.2003 ? 14.3189+-0.7914 ? might be 1.0133x slower try-catch-get-by-val-cloned-arguments 15.5108+-0.4149 ? 16.9777+-1.7747 ? might be 1.0946x slower try-catch-get-by-val-direct-arguments 7.0088+-0.0842 ? 7.6011+-1.1353 ? might be 1.0845x slower try-catch-get-by-val-scoped-arguments 8.3146+-0.3858 ? 9.2380+-0.8045 ? might be 1.1111x slower typed-array-get-set-by-val-profiling 28.6257+-1.3600 27.9119+-0.4480 might be 1.0256x faster undefined-property-access 382.6589+-4.9183 ? 386.3757+-9.3250 ? undefined-test 3.1135+-0.1345 3.1000+-0.0467 unprofiled-licm 22.9883+-0.7274 ? 23.6173+-1.3773 ? might be 1.0274x slower varargs-call 14.6163+-0.0738 ? 15.4217+-1.0139 ? might be 1.0551x slower varargs-construct-inline 27.5913+-0.8025 ? 27.9218+-0.7479 ? might be 1.0120x slower varargs-construct 22.5176+-0.1697 ? 24.2928+-1.8387 ? might be 1.0788x slower varargs-inline 9.6087+-0.1125 ? 9.6720+-0.1575 ? varargs-strict-mode 10.6362+-1.2375 10.1512+-0.3067 might be 1.0478x faster varargs 11.3409+-3.2275 10.0993+-0.1301 might be 1.1229x faster weird-inlining-const-prop 3.4196+-0.3123 3.3159+-0.1142 might be 1.0313x faster <geometric> 9.1552+-0.0421 9.1535+-0.0213 might be 1.0002x faster TipOfTree FixSTE AsmBench: bigfib.cpp 505.1322+-5.7694 502.1876+-1.6108 cray.c 432.3682+-3.3747 ? 433.1559+-5.5342 ? dry.c 491.3257+-2.3108 488.3864+-8.0730 FloatMM.c 726.2710+-3.0817 ? 734.4530+-17.0423 ? might be 1.0113x slower gcc-loops.cpp 4126.6291+-17.6764 ? 4230.4295+-250.1178 ? might be 1.0252x slower n-body.c 980.5491+-16.1848 ? 985.1325+-11.1834 ? Quicksort.c 424.9220+-6.1545 ? 425.5615+-15.7177 ? stepanov_container.cpp 3662.6952+-89.7606 ? 3778.2427+-378.2175 ? might be 1.0315x slower Towers.c 258.7342+-3.5181 ? 264.3552+-15.0237 ? might be 1.0217x slower <geometric> 795.0468+-3.2480 ? 802.0522+-9.5987 ? might be 1.0088x slower TipOfTree FixSTE CompressionBench: huffman 62.8671+-2.6257 62.2584+-3.1723 arithmetic-simple 345.9539+-6.0398 341.9422+-4.1743 might be 1.0117x faster arithmetic-precise 283.5095+-7.2314 279.5575+-2.4010 might be 1.0141x faster arithmetic-complex-precise 291.7014+-31.8006 279.2008+-3.5982 might be 1.0448x faster arithmetic-precise-order-0 363.5805+-13.3993 ? 371.3999+-28.9261 ? might be 1.0215x slower arithmetic-precise-order-1 356.3984+-52.7854 338.3228+-2.9567 might be 1.0534x faster arithmetic-precise-order-2 382.9665+-8.9269 380.4092+-4.4952 arithmetic-simple-order-1 410.3756+-14.1061 406.3551+-3.4338 arithmetic-simple-order-2 459.4163+-3.2388 453.5747+-5.6845 might be 1.0129x faster lz-string 308.0000+-2.9654 ? 316.2663+-8.4717 ? might be 1.0268x slower <geometric> 295.7539+-5.7465 292.6945+-3.0779 might be 1.0105x faster TipOfTree FixSTE Geomean of preferred means: <scaled-result> 60.4083+-0.2145 ? 60.4297+-0.2839 ? might be 1.0004x slower
Created attachment 257429 [details] better changelog
Comment on attachment 257429 [details] better changelog View in context: https://bugs.webkit.org/attachment.cgi?id=257429&action=review r=me > Source/JavaScriptCore/dfg/DFGSafeToExecute.h:345 > + // We can't always guarantee that the MultiGetByOffset is safe to execute if it > + // contains loads from prototypes. We know that it won't load from those prototypes if > + // we watch the mutability of the properties being loaded. So, here we try to Will garbage collecting a prototype fire its watchpoints?
(In reply to comment #6) > Comment on attachment 257429 [details] > better changelog > > View in context: > https://bugs.webkit.org/attachment.cgi?id=257429&action=review > > r=me > > > Source/JavaScriptCore/dfg/DFGSafeToExecute.h:345 > > + // We can't always guarantee that the MultiGetByOffset is safe to execute if it > > + // contains loads from prototypes. We know that it won't load from those prototypes if > > + // we watch the mutability of the properties being loaded. So, here we try to > > Will garbage collecting a prototype fire its watchpoints? No, but a prerequisite to the DFG seeing a prototype is that it gets registered as a weak value. So, GC will kill the CodeBlock before anything interesting happens with watchpoints when the prototype dies. Currently the weak registration of prototypes used by MultiGetByOffset happens like this in ByteCodeParser: // 1) Emit prototype structure checks for all chains. This could sort of maybe not be // optimal, if there is some rarely executed case in the chain that requires a lot // of checks and those checks are not watchpointable. for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;) emitChecks(getByIdStatus[variantIndex].constantChecks()); The prototype that we load from will be one of the things we check. To emit the check, we emit a JSConstant, which we create using weakJSConstant.
Landed in http://trac.webkit.org/changeset/187347