Bug 174188 - NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
Summary: NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when havin...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari Technology Preview
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-07-05 18:07 PDT by Saam Barati
Modified: 2017-07-06 23:11 PDT (History)
12 users (show)

See Also:


Attachments
patch (7.04 KB, patch)
2017-07-05 18:43 PDT, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2017-07-05 18:07:27 PDT
...
Comment 1 Saam Barati 2017-07-05 18:41:21 PDT
<rdar://problem/30581423>
Comment 2 Saam Barati 2017-07-05 18:43:59 PDT
Created attachment 314674 [details]
patch
Comment 3 Mark Lam 2017-07-05 21:27:44 PDT
Comment on attachment 314674 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=314674&action=review

r=me with question addressed.

> Tools/Scripts/run-jsc-stress-tests:862
> -    run("ftl-no-cjit-b3o1", *(FTL_OPTIONS + NO_CJIT_OPTIONS + B3O1_OPTIONS + optionalTestSpecificOptions))
> +    run("ftl-no-cjit-b3o1", "--useArrayAllocationProfiling=false", *(FTL_OPTIONS + NO_CJIT_OPTIONS + B3O1_OPTIONS + optionalTestSpecificOptions))

Does it make sense to use --useArrayAllocationProfiling=false for all ftl-no-cjit-b3o1 tests?  If not, you can just as easily add //@ runFTLNoCJITB3O1("--useArrayAllocationProfiling=false") at the top of the new test to configure that test alone to use this option.
Comment 4 JF Bastien 2017-07-05 21:29:31 PDT
Comment on attachment 314674 [details]
patch

r=me

> JSTests/stress/new-array-having-a-bad-time-double.js:12
> +Object.defineProperty(Object.prototype, "10000", {get() { return 20; }});

Ew
Comment 5 Saam Barati 2017-07-05 21:33:25 PDT
Comment on attachment 314674 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=314674&action=review

>> Tools/Scripts/run-jsc-stress-tests:862
>> +    run("ftl-no-cjit-b3o1", "--useArrayAllocationProfiling=false", *(FTL_OPTIONS + NO_CJIT_OPTIONS + B3O1_OPTIONS + optionalTestSpecificOptions))
> 
> Does it make sense to use --useArrayAllocationProfiling=false for all ftl-no-cjit-b3o1 tests?  If not, you can just as easily add //@ runFTLNoCJITB3O1("--useArrayAllocationProfiling=false") at the top of the new test to configure that test alone to use this option.

The reason I added it this way is I thought we might as well run a test type this way since it’ll make our compilers hit certain code paths more often than it would otherwise
Comment 6 WebKit Commit Bot 2017-07-05 22:01:38 PDT
Comment on attachment 314674 [details]
patch

Clearing flags on attachment: 314674

Committed r219187: <http://trac.webkit.org/changeset/219187>
Comment 7 WebKit Commit Bot 2017-07-05 22:01:39 PDT
All reviewed patches have been landed.  Closing bug.
Comment 8 Yusuke Suzuki 2017-07-06 05:32:17 PDT
(In reply to WebKit Commit Bot from comment #7)
> All reviewed patches have been landed.  Closing bug.

It seems that this causes regression.
https://arewefastyet.com/#machine=29&view=single&suite=six-speed&subtest=object-assign-es5
https://arewefastyet.com/#machine=29&view=single&suite=six-speed&subtest=object-assign-es6

But it seems a bit strange. I'll check it when I have time.
Comment 9 Saam Barati 2017-07-06 12:04:05 PDT
(In reply to Yusuke Suzuki from comment #8)
> (In reply to WebKit Commit Bot from comment #7)
> > All reviewed patches have been landed.  Closing bug.
> 
> It seems that this causes regression.
> https://arewefastyet.com/#machine=29&view=single&suite=six-
> speed&subtest=object-assign-es5
> https://arewefastyet.com/#machine=29&view=single&suite=six-
> speed&subtest=object-assign-es6
> 
> But it seems a bit strange. I'll check it when I have time.

I'm not sure we even care about such a microbenchmark. However, there are other commits in that range. Maybe it's them? I don't see how this patch could slow that code down.
Comment 10 Yusuke Suzuki 2017-07-06 19:03:15 PDT
(In reply to Saam Barati from comment #9)
> (In reply to Yusuke Suzuki from comment #8)
> > (In reply to WebKit Commit Bot from comment #7)
> > > All reviewed patches have been landed.  Closing bug.
> > 
> > It seems that this causes regression.
> > https://arewefastyet.com/#machine=29&view=single&suite=six-
> > speed&subtest=object-assign-es5
> > https://arewefastyet.com/#machine=29&view=single&suite=six-
> > speed&subtest=object-assign-es6
> > 
> > But it seems a bit strange. I'll check it when I have time.
> 
> I'm not sure we even care about such a microbenchmark. However, there are
> other commits in that range. Maybe it's them? I don't see how this patch
> could slow that code down.

If this regression is real (I'm still suspecting b/c this change is unlikely related to this), I think we should fix it because this bench measures the time of Object.assign(). Which is super frequently used in user's code including Speedometer2.0 Redux-React.
Comment 11 Saam Barati 2017-07-06 20:39:10 PDT
(In reply to Yusuke Suzuki from comment #10)
> (In reply to Saam Barati from comment #9)
> > (In reply to Yusuke Suzuki from comment #8)
> > > (In reply to WebKit Commit Bot from comment #7)
> > > > All reviewed patches have been landed.  Closing bug.
> > > 
> > > It seems that this causes regression.
> > > https://arewefastyet.com/#machine=29&view=single&suite=six-
> > > speed&subtest=object-assign-es5
> > > https://arewefastyet.com/#machine=29&view=single&suite=six-
> > > speed&subtest=object-assign-es6
> > > 
> > > But it seems a bit strange. I'll check it when I have time.
> > 
> > I'm not sure we even care about such a microbenchmark. However, there are
> > other commits in that range. Maybe it's them? I don't see how this patch
> > could slow that code down.
> 
> If this regression is real (I'm still suspecting b/c this change is unlikely
> related to this), I think we should fix it because this bench measures the
> time of Object.assign(). Which is super frequently used in user's code
> including Speedometer2.0 Redux-React.

I'll measure this locally.
Comment 12 Yusuke Suzuki 2017-07-06 23:11:46 PDT
(In reply to Saam Barati from comment #11)
> (In reply to Yusuke Suzuki from comment #10)
> > (In reply to Saam Barati from comment #9)
> > > (In reply to Yusuke Suzuki from comment #8)
> > > > (In reply to WebKit Commit Bot from comment #7)
> > > > > All reviewed patches have been landed.  Closing bug.
> > > > 
> > > > It seems that this causes regression.
> > > > https://arewefastyet.com/#machine=29&view=single&suite=six-
> > > > speed&subtest=object-assign-es5
> > > > https://arewefastyet.com/#machine=29&view=single&suite=six-
> > > > speed&subtest=object-assign-es6
> > > > 
> > > > But it seems a bit strange. I'll check it when I have time.
> > > 
> > > I'm not sure we even care about such a microbenchmark. However, there are
> > > other commits in that range. Maybe it's them? I don't see how this patch
> > > could slow that code down.
> > 
> > If this regression is real (I'm still suspecting b/c this change is unlikely
> > related to this), I think we should fix it because this bench measures the
> > time of Object.assign(). Which is super frequently used in user's code
> > including Speedometer2.0 Redux-React.
> 
> I'll measure this locally.

It seems that performance regression is fixed. I'm still not sure what happens... (My guess is C++ compiler inlining...., but idk. If such a thing can change performance so significantly, we should check the implementation in Object.assign and we should annotate NEVER_INLINE / ALWAYS_INLINE carefully since this Object.assign() is very important function.)