...
Created attachment 384216 [details] patch
Comment on attachment 384216 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=384216&action=review r=me > Source/JavaScriptCore/bytecode/BytecodeList.rb:537 > + seenIdentifiers: uint64_t, # Top 8 bits are the seen identifier count. Lower 56 bits are a bloom filter of seen UniquedStringImpl*. I recommend introducing a class like GetByValHistory etc. not to use uint64_t directly. > Source/JavaScriptCore/jit/JITPropertyAccess.cpp:97 > + if (m_fastGetByVals.contains(currentInstruction)) { You can count # of slowcase jumps by using `iter` (see JIT::linkAllSlowCasesForBytecodeIndex code, which iterates all slowcase jumps), and we can omit this code generation when slowcase count is 0, instead of tracking it by m_fastGetByVals.
Created attachment 384221 [details] patch for landing
Comment on attachment 384216 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=384216&action=review >> Source/JavaScriptCore/bytecode/BytecodeList.rb:537 >> + seenIdentifiers: uint64_t, # Top 8 bits are the seen identifier count. Lower 56 bits are a bloom filter of seen UniquedStringImpl*. > > I recommend introducing a class like GetByValHistory etc. not to use uint64_t directly. nice. Done >> Source/JavaScriptCore/jit/JITPropertyAccess.cpp:97 >> + if (m_fastGetByVals.contains(currentInstruction)) { > > You can count # of slowcase jumps by using `iter` (see JIT::linkAllSlowCasesForBytecodeIndex code, which iterates all slowcase jumps), and we can omit this code generation when slowcase count is 0, instead of tracking it by m_fastGetByVals. nice. Done
Comment on attachment 384221 [details] patch for landing Clearing flags on attachment: 384221 Committed r252825: <https://trac.webkit.org/changeset/252825>
All reviewed patches have been landed. Closing bug.
<rdar://problem/57448652>
32-bit build fix in: https://trac.webkit.org/changeset/252871/webkit