Bug 157938 - Math.pow with Object arguments get deoptimized
Summary: Math.pow with Object arguments get deoptimized
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-19 21:49 PDT by Joseph Pecoraro
Modified: 2016-05-19 21:49 PDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Joseph Pecoraro 2016-05-19 21:49:35 PDT
* SUMMARY
Math.pow with Object arguments get deoptimized.

It seems the DFG doesn't reason about converting Object -> numbers via valueOf() here.

* TEST
var sum = 0;
for (var i = 0; i < 1e5; ++i) {
    sum += Math.pow(2, {valueOf() { return 3 }});
}

* NOTES
$ jsc test.js -p profile.json
$ display-profiler-output profile.json 
   CodeBlock    #Instr      Source Counts         Machine Counts    #Compil  Inlines  #Exits   Last Opts                         Source                      
                         Base/DFG/FTL/FTLOSR   Base/DFG/FTL/FTLOSR          Src/Total         Get/Put/Call
valueOf#BI9kVc    8       462/10073/89433/0     462/10073/89433/0      3       0/0       0       0/0/0     function () { return 3 }
<global>#D7oSjt  267        99506/20/0/0           99506/20/0/0        4       0/0      20       1/5/1     var sum = 0; for (var i = 0; i < 1e5; ++i) { sum +

> log <global>#D7oSjt
Compilation <global>#D7oSjt-1-Baseline:
    Total count: 3283261  Max count: 99506
Compilation <global>#D7oSjt-2-DFG:
    Total count: 120  Max count: 5
    EXIT: at bc#186 due to Uncountable, 5 times
    Jettisoned due to BaselineLoopReoptimizationTrigger
Compilation <global>#D7oSjt-3-DFG:
    Total count: 240  Max count: 10
    EXIT: at bc#186 due to Uncountable, 10 times
    Jettisoned due to BaselineLoopReoptimizationTrigger
Compilation <global>#D7oSjt-4-DFG:
    Total count: 120  Max count: 5
    EXIT: at bc#186 due to Uncountable, 5 times

> d <global>#D7oSjt-2-DFG
...
      5                     99486/20/0/0                     94:< 5:loc12>	NewObject(JS|UseAsOther, Final, %DY:Object, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#99)
...
      5                     99486/20/0/0                    238:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#177, exit: bc#186)
      5                     99506/20/0/0                    233:< 1:loc14>	DoubleConstant(Double|PureInt, Bytecodedouble, Double: 4611686018427387904, 2.000000, bc#186)
      5                     99506/20/0/0                    157:< 2:loc12>	ArithPow(DoubleRep:@233<Double>, Check:Int32:@94, Double|UseAsOther, Bytecodedouble, Exits, bc#186)
      5                     99506/20/0/0                         0x510434202461: mov $0x4000000000000000, %rax
      5                     99506/20/0/0                         0x51043420246b: movq %rax, %xmm0
      5                     99506/20/0/0                         0x510434202470: jmp 0x510434202725
    !!!!!                      !!!!!                                           EXIT: due to Uncountable, 5 times