Bug 20356 - Dynamic function/type specialisation
Summary: Dynamic function/type specialisation
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.5
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2008-08-11 21:50 PDT by Oliver Hunt
Modified: 2012-03-07 11:37 PST (History)
6 users (show)

See Also:

initial specialisation patch (101.71 KB, patch)
2008-08-11 21:56 PDT, Oliver Hunt
no flags Details | Formatted Diff | Diff
quality test case (2.18 KB, text/plain)
2008-08-12 01:34 PDT, Oliver Hunt
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2008-08-11 21:50:36 PDT
Dynamically specialising code for hot builtin functions should be a win.
Comment 1 Oliver Hunt 2008-08-11 21:56:16 PDT
Created attachment 22741 [details]
initial specialisation patch

Here's an initial version of this patch.  Current problems:
 * I'm fairly sure it's not gc-safe (it stores the JSFunction* for functions it specialises in the opcode stream, which could be gc'd, then that address could be reallocated with a different object which could in certain circumstances result in badness)
 * It's not 64bit safe -- it stores the JSFunction* in a single operand in te intstruction stream.
 * Some of the code is heonously ugly, especially the bits where functions specialise themselves.
Comment 2 Oliver Hunt 2008-08-11 22:27:21 PDT
This code will trigger a failure in commandline jsc:
g=Math.sqrt; function f(){return g(4);}; Math.sqrt=null; f(); f(); f(); gc(); for (var i = 0; i < 10000; i++) { g=new Function("", "return 3;"); if (f() == 2) { throw "Failed"; }  }

Comment 3 Oliver Hunt 2008-08-12 01:34:44 PDT
Created attachment 22743 [details]
quality test case
Comment 4 Gavin Barraclough 2012-03-07 00:06:41 PST
We do lots of function & type specialization now; this bug is archaic.