164356 – [DOMJIT] Add DOMJIT::Signature annotation to Document::getElementById

Bug 164356 - [DOMJIT] Add DOMJIT::Signature annotation to Document::getElementById

Summary: [DOMJIT] Add DOMJIT::Signature annotation to Document::getElementById

Status:	RESOLVED FIXED

Alias:	None

Product:	WebKit
Classification:	Unclassified
Component:	JavaScriptCore (show other bugs)
Version:	WebKit Nightly Build
Hardware:	Unspecified Unspecified

Importance:	P2 Normal
Assignee:	Yusuke Suzuki

URL:
Keywords:

Depends on:	162980
Blocks:	162544
	Show dependency tree / graph

Reported:	2016-11-02 20:12 PDT by Yusuke Suzuki
Modified:	2016-11-04 18:18 PDT (History)
CC List:	11 users (show)

See Also:

Attachments
Patch (11.89 KB, patch) 2016-11-03 01:04 PDT, Yusuke Suzuki	no flags	Details \| Formatted Diff \| Diff
Patch (12.11 KB, patch) 2016-11-03 11:39 PDT, Yusuke Suzuki	fpizlo: review+ ysuzuki: commit-queue-	Details \| Formatted Diff \| Diff
Patch for landing (12.08 KB, patch) 2016-11-04 10:56 PDT, Yusuke Suzuki	no flags	Details \| Formatted Diff \| Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Yusuke Suzuki 2016-11-02 20:12:15 PDT

...

Comment 1 Yusuke Suzuki 2016-11-02 23:43:32 PDT

Haha, it figures out that the result of getElementById will be hoisted since it does not write anything.

Comment 2 Yusuke Suzuki 2016-11-03 00:08:36 PDT

We have dromaeo test like this.

        test( "getElementById", function(){
                for ( var i = 0; i < num * 30; i++ ) {
                        ret = document.getElementById("testA" + num).nodeType;
                        ret = document.getElementById("testB" + num).nodeType;
                        ret = document.getElementById("testC" + num).nodeType;
                        ret = document.getElementById("testD" + num).nodeType;
                        ret = document.getElementById("testE" + num).nodeType;
                        ret = document.getElementById("testF" + num).nodeType;
                }
        });

After fix up phase in DFG FTL is finished the graph becomes like this.
https://gist.github.com/Constellation/21a8d938fa73ced9ca7e1b20d98bae41
Especially, per `ret = document.getElementById("testA" + num).nodeType;` line, 

  42:< 1:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261, bc#34)
  43:<!0:->	MovHint(Check:Untyped:@42, MustGen, loc7, W:SideState, ClobbersExit, bc#34)
  44:< 1:->	SetLocal(Check:Untyped:@42, loc7(P~<Object>/FlushedJSValue), W:Stack(-8), bc#34, exit: bc#41)  predicting Otherobj
  45:< 1:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391, bc#41)
  46:<!0:->	MovHint(Check:Untyped:@45, MustGen, loc12, W:SideState, ClobbersExit, bc#41)
  47:<!0:->	Check(MustGen, bc#41, ExitInvalid)
  48:< 1:->	SetLocal(Check:Untyped:@45, loc12(Q~<Object>/FlushedJSValue), W:Stack(-13), bc#41, exit: bc#48)  predicting Otherobj
  49:<!0:->	Check(MustGen, bc#48)
  50:< 1:->	GetGlobalVar(JS|UseAsOther, Otherobj, global(0x1166dc900), R:Absolute(4671260928), Exits, bc#48)  predicting Otherobj
  51:<!0:->	MovHint(Check:Untyped:@50, MustGen, loc12, W:SideState, ClobbersExit, bc#48)
  52:< 1:->	SetLocal(Check:Untyped:@50, loc12(R~<Object>/FlushedJSValue), W:Stack(-13), bc#48, exit: bc#56)  predicting Otherobj
  53:<!0:->	PureGetById(Check:Cell:@50, JS|MustGen|UseAsOther, Function, id3{getElementById}, R:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags,JSCell_typeInfoType,JSObject_butterfly,NamedProperties(3),MiscFields, W:JSCell_structureID,JSCell_typeInfoFlags,JSObject_butterfly,Watchpoint_fire,MiscFields, Exits, ClobbersExit, bc#56)  predicting Function
  54:<!0:->	MovHint(Check:Untyped:@53, MustGen, loc8, W:SideState, ClobbersExit, bc#56, ExitInvalid)
 316:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#56, exit: bc#65)
  55:< 1:->	SetLocal(Check:Untyped:@53, loc8(S~<Function>/FlushedJSValue), W:Stack(-9), bc#56, exit: bc#65)  predicting Function
  56:<!0:->	Check(MustGen, bc#65)
  57:< 1:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261, bc#65)
  58:<!0:->	MovHint(Check:Untyped:@57, MustGen, loc13, W:SideState, ClobbersExit, bc#65)
  59:< 1:->	SetLocal(Check:Untyped:@57, loc13(T~<Object>/FlushedJSValue), W:Stack(-14), bc#65, exit: bc#72)  predicting Otherobj
  60:<!0:->	Check(MustGen, bc#72)
  61:< 1:->	JSConstant(JS|PureNum|UseAsOther, Nonboolint32, Int32: 40, bc#72)
  62:<!0:->	MovHint(Check:Untyped:@61, MustGen, loc14, W:SideState, ClobbersExit, bc#72)
  63:< 1:->	SetLocal(Check:Untyped:@61, loc14(U~<Int32>/FlushedJSValue), W:Stack(-15), bc#72, exit: bc#80)  predicting Nonboolint32
  64:< 1:->	JSConstant(JS|PureNum|UseAsOther, Stringident, Strong:String (atomic) (identifier): testA, ID: 4, bc#80)
  65:<!0:->	ValueAdd(Check:Untyped:@64, Check:Untyped:@61, JS|MustGen|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, R:World, W:Heap, Exits, ClobbersExit, bc#80)
  66:<!0:->	MovHint(Check:Untyped:@65, MustGen, loc11, W:SideState, ClobbersExit, bc#80, ExitInvalid)
 317:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#80, exit: bc#85)
  67:< 1:->	SetLocal(Check:Untyped:@65, loc11(V~/FlushedJSValue), W:Stack(-12), bc#80, exit: bc#85)  predicting StringBoolint32Nonboolint32
  68:<!0:->	CheckCell(Check:Cell:@53, Check:Untyped:@50, MustGen, <0x11c9e2da0, Function>, <host function>, Exits, bc#85)
 304:<!0:->	CheckDOM(Check:Cell:@50, MustGen, Exits, bc#85)
  69:< 1:->	CallDOM(Check:Cell:@50, Check:String:@65, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#85)  predicting Otherobj
  70:<!0:->	MovHint(Check:Untyped:@69, MustGen, loc8, W:SideState, ClobbersExit, bc#85, ExitInvalid)
  71:<!0:->	Check(MustGen, bc#85, ExitInvalid)
  72:<!0:->	Check(MustGen, bc#85, ExitInvalid)
  73:<!0:->	Check(MustGen, bc#85, ExitInvalid)
  74:< 1:->	SetLocal(Check:Untyped:@69, loc8(W~<Object>/FlushedJSValue), W:Stack(-9), bc#85, exit: bc#94)  predicting Otherobj
  75:<!0:->	CheckStructure(Check:Cell:@69, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#94)
  76:<!0:->	CheckDOM(Check:Cell:@69, MustGen, Exits, bc#94)
  77:< 1:->	CallDOMGetter(Check:Cell:@69, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#94)  predicting Boolint32
  78:<!0:->	MovHint(Check:Untyped:@77, MustGen, loc9, W:SideState, ClobbersExit, bc#94)
  79:< 1:->	SetLocal(Check:Untyped:@77, loc9(X~<BoolInt32>/FlushedJSValue), W:Stack(-10), bc#94, exit: bc#103)  predicting Boolint32
 305:<!0:->	Check(Check:Int32:@77, MustGen, Exits, bc#103)
  80:<!0:->	PutClosureVar(Check:KnownCell:@42, Check:Untyped:@77, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#103)


The crazy thing is,

1. Since nodeType is now handled as CallDOMGetter, we know that it is pure
2. PureGetById does not write Heap/DOMState
3. `"testA" + num` will be converted to constant thing
4. CallDOM for getElementById said it just reads(DOM).
5. CheckCell leading CallDOM ensures the inlined getElementById node. (CallDOM node)

The important thing is, anyone does not write DOMState -> Heap!
CallDOM will be hoisted. The final code becomes like this.

DFG for #B0dEnY:[0x11c9adae0->0x11c9ad680->0x11c9d21a0, DFGFunctionCall, 518 (DidTryToEnterInLoop)]:
  Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
  Argument formats: FlushedJSValue

Block #0 (bc#0): (OSR target)
  Execution count: 1.000000
  Predecessors:
  Successors: #2
  Dominated by: #0
  Dominates: #0 #1 #2 #3 #4
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Backwards dominates by: #end #0 #2 #3 #4
  Backwards dominates: #0
  Control equivalent to: #0 #2 #3 #4
  States: StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable; heap = }
  Live: 
  Values: 
  17:< 13:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261, bc#0)
  22:< 2:->	JSConstant(JS|UseAsOther, Boolint32, Int32: 0, bc#0)
  11:< 1:->	JSConstant(JS|PureNum, Boolint32, Int32: 1, bc#0)
  34:< 3:->	JSConstant(Number|UseAsOther, Int32, Int32: 1200, bc#0)
   1:< 1:->	JSConstant(JS|PureInt, Other, Undefined, bc#0)
  32:<!0:->	ExitOK(MustGen, W:SideState, bc#0)
  61:<!0:->	KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0)
   2:<!0:->	ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  41:<!0:->	KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   4:<!0:->	ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  29:<!0:->	KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   6:<!0:->	ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  55:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   8:<!0:->	ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  56:<!0:->	KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  10:<!0:->	ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  59:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  12:<!0:->	ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  63:<!0:->	KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  14:<!0:->	ZombieHint(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  74:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1)
  18:<!0:->	MovHint(Untyped:@17, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid)
  84:<!0:->	KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3)
  20:<!0:->	ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid)
  88:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#6)
  23:<!0:->	MovHint(Untyped:@22, MustGen, loc5, W:SideState, ClobbersExit, bc#6, ExitInvalid)
  92:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#9)
  27:<!0:->	ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#9, ExitInvalid)
  97:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#16)
  31:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#16, ExitInvalid)
 101:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#24, ExitInvalid)
  35:<!0:->	MovHint(Untyped:@34, MustGen, loc8, W:SideState, ClobbersExit, bc#24, ExitInvalid)
  25:<!0:->	Jump(MustGen, T:#2, W:SideState, bc#29, ExitInvalid)
  States: InvalidBranchDirection, StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc3:ConflictingFlush/@17 loc5:ConflictingFlush/@22 loc8:ConflictingFlush/@34; heap = }
  Live: @1, @11, @17, @22, @34
  Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, NonArray, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @22=>(Boolint32, Int32: 0), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391)

Block #1 (bc#33):
  Execution count: 10.000000
  Predecessors: #3
  Successors: #3
  Dominated by: #0 #1 #2 #3
  Dominates: #1
  Dominance Frontier: #3
  Iterated Dominance Frontier: #3
  Backwards dominates by: #end #1 #3 #4
  Backwards dominates: #1
  Control equivalent to: #1
  Containing loop headers: #3
  States: StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@9 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1, @9, @11, @17, @19, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197
  Values: @1=>(Other, Undefined), @9=>(Int32), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @149=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @197=>(Int32)
 111:<!0:->	ExitOK(MustGen, W:SideState, bc#33)
  87:< 1:->	Upsilon(KnownInt32:@9, ^28, W:SideState, bc#33)
   5:<!0:->	Jump(MustGen, T:#3, W:SideState, bc#33)
  States: InvalidBranchDirection, StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@9 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1, @11, @17, @19, @28, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197
  Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @28=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @149=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @197=>(Int32)

Block #2 (bc#33):
  Execution count: 1.000000
  Predecessors: #0
  Successors: #3
  Dominated by: #0 #2
  Dominates: #1 #2 #3 #4
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Backwards dominates by: #end #2 #3 #4
  Backwards dominates: #0 #2
  Control equivalent to: #0 #2 #3 #4
  States: StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@22 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1, @11, @17, @22, @34
  Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, NonArray, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @22=>(Boolint32, Int32: 0), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391)
 103:<!0:->	ExitOK(MustGen, W:SideState, bc#33)
  71:< 1:->	Upsilon(KnownInt32:@22, ^28, W:SideState, bc#33)
  50:< 10:->	GetGlobalVar(JS|UseAsOther, Otherobj, global(0x1166dc900), R:Absolute(4671260928), Exits, bc#48, exit: bc#33)  predicting Otherobj
  65:< 2:->	LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testA40), bc#80, exit: bc#33)
  89:<!0:->	CheckDOM(Check:Cell:@50, MustGen, Exits, bc#85, exit: bc#33)
  69:< 3:->	CallDOM(Cell:@50, String:@65, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#85, exit: bc#33)  predicting Otherobj
  77:< 1:->	CallDOMGetter(Check:Cell:@69, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#94, exit: bc#33)  predicting Boolint32
 105:< 1:->	LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testB40), bc#156, exit: bc#33)
 109:< 3:->	CallDOM(Cell:@50, String:Kill:@105, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#161, exit: bc#33)  predicting Otherobj
 117:< 1:->	CallDOMGetter(Check:Cell:@109, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#170, exit: bc#33)  predicting Boolint32
 145:< 1:->	LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testC40), bc#232, exit: bc#33)
 149:< 3:->	CallDOM(Cell:@50, String:Kill:@145, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#237, exit: bc#33)  predicting Otherobj
 157:< 1:->	CallDOMGetter(Check:Cell:@149, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#246, exit: bc#33)  predicting Boolint32
 185:< 1:->	LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testD40), bc#308, exit: bc#33)
 189:< 3:->	CallDOM(Cell:@50, String:Kill:@185, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#313, exit: bc#33)  predicting Otherobj
 197:< 1:->	CallDOMGetter(Check:Cell:@189, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#322, exit: bc#33)  predicting Boolint32
 164:< 1:->	LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testE40), bc#384, exit: bc#33)
 147:< 3:->	CallDOM(Cell:@50, String:Kill:@164, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#389, exit: bc#33)  predicting Otherobj
 119:< 1:->	CallDOMGetter(Check:Cell:@147, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#398, exit: bc#33)  predicting Boolint32
  47:< 1:->	LazyJSConstant(JS|UseAsOther|MayHaveNonNumberResult, StringBoolint32Nonboolint32, Lazy:NewString(testF40), bc#460, exit: bc#33)
  38:< 3:->	CallDOM(Cell:@50, String:Kill:@47, JS|PureInt, Otherobj, R:DOMState(0x0-0x7), Exits, bc#465, exit: bc#33)  predicting Otherobj
  19:< 1:->	CallDOMGetter(Check:Cell:@38, JS|UseAsOther, Boolint32, id4{nodeType}, domJIT = 0x110a1de20, Exits, bc#474, exit: bc#33)  predicting Boolint32
   3:<!0:->	Jump(MustGen, T:#3, W:SideState, bc#33)
  States: InvalidBranchDirection, StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@22 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1, @11, @17, @19, @28, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197
  Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, NonArray, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @28=>(Boolint32, Int32: 0), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Cell, TOP, TOP), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Cell, TOP, TOP), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Cell, TOP, TOP), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Cell, TOP, TOP), @149=>(Cell, TOP, TOP), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Cell, TOP, TOP), @197=>(Int32)

Block #3 (bc#33): (OSR target)
  Execution count: 10.000000
  Predecessors: #1 #2
  Successors: #1 #4
  Dominated by: #0 #2 #3
  Dominates: #1 #3 #4
  Dominance Frontier: #3
  Iterated Dominance Frontier: #3
  Backwards dominates by: #end #3 #4
  Backwards dominates: #0 #1 #2 #3
  Control equivalent to: #0 #2 #3 #4
  Loop header, contains: #1 #3
  Containing loop headers: #3
  States: StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1, @11, @17, @19, @28, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197
  Values: @1=>(Other, Undefined), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @28=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Cell, TOP, TOP), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Cell, TOP, TOP), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Cell, TOP, TOP), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Cell, TOP, TOP), @149=>(Cell, TOP, TOP), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Cell, TOP, TOP), @197=>(Int32)
  28:< 2:->	Phi(Int32|PureInt, Int32, W:SideState, bc#33, ExitInvalid)
 124:<!0:->	MovHint(Untyped:@28, MustGen, loc5, W:SideState, ClobbersExit, bc#33, ExitInvalid)
 132:<!0:->	ExitOK(MustGen, W:SideState, bc#33)
  39:<!0:->	LoopHint(MustGen, W:SideState, bc#33)
 135:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#34)
  43:<!0:->	MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#34, ExitInvalid)
 139:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#41)
  46:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#41, ExitInvalid)
  72:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#48)
  51:<!0:->	MovHint(Untyped:@50, MustGen, loc12, W:SideState, ClobbersExit, bc#48, ExitInvalid)
  53:<!2:->	PureGetById(Cell:@50, JS|MustGen|UseAsOther, Function, id3{getElementById}, R:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags,JSCell_typeInfoType,JSObject_butterfly,NamedProperties(3),MiscFields, W:JSCell_structureID,JSCell_typeInfoFlags,JSObject_butterfly,Watchpoint_fire,MiscFields, Exits, ClobbersExit, bc#56)  predicting Function
 154:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#56, ExitInvalid)
  54:<!0:->	MovHint(Untyped:@53, MustGen, loc8, W:SideState, ClobbersExit, bc#56, ExitInvalid)
  60:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#56, exit: bc#65)
  40:<!0:->	KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#65)
  58:<!0:->	ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#65, ExitInvalid)
 175:<!0:->	KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#72)
  62:<!0:->	ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#72, ExitInvalid)
 179:<!0:->	KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#80, ExitInvalid)
  66:<!0:->	MovHint(Untyped:@65, MustGen, loc11, W:SideState, ClobbersExit, bc#80, ExitInvalid)
  68:<!0:->	CheckCell(Check:Cell:Kill:@53, Untyped:@50, MustGen, <0x11c9e2da0, Function>, <host function>, Exits, bc#85)
 187:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#85, ExitInvalid)
  70:<!0:->	MovHint(Untyped:@69, MustGen, loc8, W:SideState, ClobbersExit, bc#85, ExitInvalid)
  75:<!0:->	CheckStructure(Cell:@69, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#94)
 194:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#94)
  78:<!0:->	ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#94, ExitInvalid)
  80:<!0:->	PutClosureVar(KnownCell:@17, Untyped:@77, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#103)
 204:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#110)
  83:<!0:->	MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#110, ExitInvalid)
 210:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#117)
  86:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#117, ExitInvalid)
 209:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#124)
  91:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#124, ExitInvalid)
 207:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#132, ExitInvalid)
  94:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#132, ExitInvalid)
 205:<!0:->	KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#141)
  98:<!0:->	ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#141, ExitInvalid)
 202:<!0:->	KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#148)
 102:<!0:->	ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#148, ExitInvalid)
 201:<!0:->	KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#156, ExitInvalid)
 106:<!0:->	ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#156, ExitInvalid)
  73:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#161, ExitInvalid)
 110:<!0:->	MovHint(Untyped:@109, MustGen, loc8, W:SideState, ClobbersExit, bc#161, ExitInvalid)
 115:<!0:->	CheckStructure(Cell:@109, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#170)
 196:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#170)
 118:<!0:->	ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#170, ExitInvalid)
 120:<!0:->	PutClosureVar(KnownCell:@17, Untyped:@117, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#179)
 193:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#186)
 123:<!0:->	MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#186, ExitInvalid)
 192:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#193)
 126:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#193, ExitInvalid)
 191:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#200)
 131:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#200, ExitInvalid)
  76:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#208, ExitInvalid)
 134:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#208, ExitInvalid)
 188:<!0:->	KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#217)
 138:<!0:->	ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#217, ExitInvalid)
  42:<!0:->	KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#224)
 142:<!0:->	ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#224, ExitInvalid)
 181:<!0:->	KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#232, ExitInvalid)
 146:<!0:->	ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#232, ExitInvalid)
 180:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#237, ExitInvalid)
 150:<!0:->	MovHint(Untyped:@149, MustGen, loc8, W:SideState, ClobbersExit, bc#237, ExitInvalid)
 155:<!0:->	CheckStructure(Cell:@149, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#246)
 177:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#246)
 158:<!0:->	ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#246, ExitInvalid)
 160:<!0:->	PutClosureVar(KnownCell:@17, Untyped:@157, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#255)
 176:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#262)
 163:<!0:->	MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#262, ExitInvalid)
 173:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#269)
 166:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#269, ExitInvalid)
 170:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#276)
 171:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#276, ExitInvalid)
 169:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#284, ExitInvalid)
 174:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#284, ExitInvalid)
 167:<!0:->	KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#293)
 178:<!0:->	ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#293, ExitInvalid)
 165:<!0:->	KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#300)
 182:<!0:->	ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#300, ExitInvalid)
 162:<!0:->	KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#308, ExitInvalid)
 186:<!0:->	ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#308, ExitInvalid)
 161:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#313, ExitInvalid)
 190:<!0:->	MovHint(Untyped:@189, MustGen, loc8, W:SideState, ClobbersExit, bc#313, ExitInvalid)
 195:<!0:->	CheckStructure(Cell:@189, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#322)
  81:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#322)
 198:<!0:->	ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#322, ExitInvalid)
 200:<!0:->	PutClosureVar(KnownCell:@17, Untyped:@197, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#331)
 156:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#338)
 203:<!0:->	MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#338, ExitInvalid)
 153:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#345)
 206:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#345, ExitInvalid)
 152:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#352)
 208:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#352, ExitInvalid)
 151:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#360, ExitInvalid)
 199:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#360, ExitInvalid)
  82:<!0:->	KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#369)
 183:<!0:->	ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#369, ExitInvalid)
 148:<!0:->	KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#376)
 172:<!0:->	ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#376, ExitInvalid)
  49:<!0:->	KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#384, ExitInvalid)
 159:<!0:->	ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#384, ExitInvalid)
 141:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#389, ExitInvalid)
 143:<!0:->	MovHint(Untyped:@147, MustGen, loc8, W:SideState, ClobbersExit, bc#389, ExitInvalid)
 128:<!0:->	CheckStructure(Cell:@147, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#398)
 140:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#398)
 114:<!0:->	ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#398, ExitInvalid)
 107:<!0:->	PutClosureVar(KnownCell:@17, Untyped:@119, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#407)
 137:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#414)
  99:<!0:->	MovHint(Untyped:@17, MustGen, loc7, W:SideState, ClobbersExit, bc#414, ExitInvalid)
 136:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#421)
  95:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#421, ExitInvalid)
 133:<!0:->	KillStack(MustGen, loc12, W:SideState, ClobbersExit, bc#428)
  79:<!0:->	ZombieHint(MustGen, loc12, W:SideState, ClobbersExit, bc#428, ExitInvalid)
 130:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#436, ExitInvalid)
  67:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#436, ExitInvalid)
 129:<!0:->	KillStack(MustGen, loc13, W:SideState, ClobbersExit, bc#445)
  57:<!0:->	ZombieHint(MustGen, loc13, W:SideState, ClobbersExit, bc#445, ExitInvalid)
 127:<!0:->	KillStack(MustGen, loc14, W:SideState, ClobbersExit, bc#452)
  52:<!0:->	ZombieHint(MustGen, loc14, W:SideState, ClobbersExit, bc#452, ExitInvalid)
 125:<!0:->	KillStack(MustGen, loc11, W:SideState, ClobbersExit, bc#460, ExitInvalid)
  44:<!0:->	ZombieHint(MustGen, loc11, W:SideState, ClobbersExit, bc#460, ExitInvalid)
 122:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#465, ExitInvalid)
  36:<!0:->	MovHint(Untyped:@38, MustGen, loc8, W:SideState, ClobbersExit, bc#465, ExitInvalid)
  24:<!0:->	CheckStructure(Cell:@38, MustGen, [%D9:HTMLHeadingElement], R:JSCell_structureID, Exits, bc#474)
 121:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#474)
  15:<!0:->	ZombieHint(MustGen, loc9, W:SideState, ClobbersExit, bc#474, ExitInvalid)
  13:<!0:->	PutClosureVar(KnownCell:@17, Untyped:@19, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#483)
   9:<!3:->	ArithAdd(Int32:Kill:@28, Int32:@11, Number|MustGen|UseAsOther, Int32, Unchecked, Exits, bc#490)
  85:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#490)
   7:<!0:->	MovHint(Untyped:@9, MustGen, loc5, W:SideState, ClobbersExit, bc#490, ExitInvalid)
 116:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#492)
   0:<!0:->	ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#492, ExitInvalid)
 113:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#499)
  21:<!0:->	ZombieHint(MustGen, loc8, W:SideState, ClobbersExit, bc#499, ExitInvalid)
 112:<!0:->	KillStack(MustGen, loc8, W:SideState, ClobbersExit, bc#507, ExitInvalid)
 100:<!0:->	MovHint(Untyped:@34, MustGen, loc8, W:SideState, ClobbersExit, bc#507, ExitInvalid)
  96:< 1:->	CompareLess(Int32:@9, Int32:@34, Boolean|UseAsOther, Bool, Exits, bc#512)
  93:<!0:->	Branch(KnownBoolean:Kill:@96, MustGen, T:#1/w:10.000000, F:#4/w:1.000000, W:SideState, bc#512, ExitInvalid)
  States: TakeBoth, StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@17 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@9 loc6:DeadFlush/Undecided loc8:ConflictingFlush/@34 loc10:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1, @9, @11, @17, @19, @34, @38, @50, @65, @69, @77, @109, @117, @119, @147, @149, @157, @189, @197
  Values: @1=>(Other, Undefined), @9=>(Int32), @11=>(Boolint32, Int32: 1), @17=>(Otherobj, TOP, [%Bj:JSLexicalEnvironment], Object: 0x118fca660 with butterfly 0x0 (%Bj:JSLexicalEnvironment), ID: 2261), @19=>(Int32), @30=>(Nonboolint32, Int32: 40), @34=>(Nonboolint32, Int32: 1200), @38=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @45=>(Otherobj, TOP, TOP, Object: 0x118fd7570 with butterfly 0x118e832c8 (%CR:Window), ID: 2391), @47=>(String, TOP, [%Ck:string]), @50=>(Otherobj, TOP, TOP), @65=>(String, TOP, [%Ck:string]), @69=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @77=>(Int32), @105=>(String, TOP, [%Ck:string]), @109=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @117=>(Int32), @119=>(Int32), @145=>(String, TOP, [%Ck:string]), @147=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @149=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @157=>(Int32), @164=>(String, TOP, [%Ck:string]), @185=>(String, TOP, [%Ck:string]), @189=>(Otherobj, NonArray, [%D9:HTMLHeadingElement]), @197=>(Int32)

Block #4 (bc#516):
  Execution count: 1.000000
  Predecessors: #3
  Successors:
  Dominated by: #0 #2 #3 #4
  Dominates: #4
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Backwards dominates by: #end #4
  Backwards dominates: #0 #1 #2 #3 #4
  Control equivalent to: #0 #2 #3 #4
  States: StructuresAreWatched
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: @1
  Values: @1=>(Other, Undefined)
 108:<!0:->	ExitOK(MustGen, W:SideState, bc#516)
  90:<!0:->	Return(Untyped:Kill:@1, MustGen, W:SideState, Exits, bc#516)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided loc16:DeadFlush/Undecided loc17:DeadFlush/Undecided; heap = }
  Live: 
  Values:

Comment 3 Yusuke Suzuki 2016-11-03 00:15:05 PDT

Saam and Filip, is that sound? I'm still carefully considering about it.
But I think it is sound.

getByIdElement cannot be changed. And it is figured out by DFG.
Only way to change it is doing something PureGetById and in that case the watchpoint is fired.
And even if the getElementById is changed, CheckCell will cause OSR and it ensures the result of inlining is correct.
And CallDOM said that getElementById is not observable and it returns the same value if  DOMState(DOM) is not changed. That is correct. If you change the tree, your node should say that DOMState(DOM) / DOMState(Tree) is changed.

Comment 4 Yusuke Suzuki 2016-11-03 01:04:22 PDT

Created attachment 293754 [details]
Patch

Performance numbers will be added tomorrow. But quick comparison between STP shows that getElementById test becomes 43x faster (250638 v.s. 5791.2)

Comment 5 Yusuke Suzuki 2016-11-03 02:54:13 PDT

Comment on attachment 293754 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=293754&action=review

> Source/WebCore/dom/NonElementParentNode.idl:31
> +    [DOMJIT=ReadDOM] Element? getElementById([RequiresExistingAtomicString] DOMString elementId);

I found this IDL was wrong. It may return null.

Comment 6 Yusuke Suzuki 2016-11-03 11:39:27 PDT

Created attachment 293782 [details]
Patch

Comment 7 Filip Pizlo 2016-11-03 11:48:06 PDT

Comment on attachment 293782 [details]
Patch

Wow, this is cool!

Comment 8 Yusuke Suzuki 2016-11-03 12:19:40 PDT

Comment on attachment 293782 [details]
Patch

Thanks!

Comment 9 Yusuke Suzuki 2016-11-03 13:26:40 PDT

Comment on attachment 293782 [details]
Patch

Before landing I'll check the crashing things. It may be unrelated, since the current ToT seems crashing with Speedometer and DOMJIT::Signature patch was not related to that (I checked it))

Comment 10 Yusuke Suzuki 2016-11-04 10:56:00 PDT

Created attachment 293901 [details]
Patch for landing

Comment 11 Yusuke Suzuki 2016-11-04 18:18:21 PDT

Committed r208412: <http://trac.webkit.org/changeset/208412>