Bug 180192 - [JSC] op_in's ArrayProfile should record OutOfBounds
Summary: [JSC] op_in's ArrayProfile should record OutOfBounds
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords:
Depends on: 180190
Blocks:
  Show dependency tree / graph
 
Reported: 2017-11-30 05:56 PST by Yusuke Suzuki
Modified: 2018-05-30 09:13 PDT (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2017-11-30 05:56:14 PST 
...
Comment 1 Yusuke Suzuki 2018-01-16 20:35:47 PST 
Original issue is that  op_in's ArrayProfile does not record OutOfBounds. So it repeatedly causes OSR exit.
I think we should introduce complete IC to op_in, which is similar to get_by_val.

We would have op_in_by_val and op_in_by_id, and introduce ICs.